@tinycloud/sdk-core 3.0.0-beta.1 → 3.0.0-beta.10

package/dist/delegations/index.d.cts

@@ -1,6 +1,6 @@
-import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-G8NEKRoo.cjs';
-export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationParams, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, m as Delegation, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, w as DelegationRevocationReceipt, x as DelegationStatus, E as EncodedShareData, G as GenerateShareParams, y as ISharingService, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationPermission, T as OwnerDelegationReceipt, U as OwnerShareAction, V as OwnerShareDecryption, W as OwnerShareMatcher, X as OwnerSharePolicyRegistration, Y as OwnerSharePolicyRegistrationReceipt, Z as OwnerSharePolicyV2, _ as PortableDelegationImportReceipt, $ as ReceiveOptions, a0 as RegisterOwnerSharePolicyParams, a1 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a2 as SenderShareKeyStorage, a3 as SenderShareRecord, a4 as SenderShareRecordStorage, a5 as SenderShareRevocationScope, a6 as SenderShareStore, a7 as ShareAccess, a8 as ShareAccessError, a9 as ShareAccessV2, aa as ShareAction, ab as ShareActionSchema, ac as ShareAddressedDelegationEnvelopeV2, ad as ShareAddressedDelegationEnvelopeV2Schema, ae as ShareAddressedDelegationRequestV2, af as ShareAddressedDelegationRequestV2Schema, ag as ShareAddressedDelegationResponseV2, ah as ShareAddressedDelegationResponseV2Schema, ai as ShareAddressedRecipientMatcher, aj as ShareArtifactInput, ak as ShareArtifactResult, al as ShareArtifactV2, am as ShareCache, an as ShareCacheEntry, ao as ShareCacheKey, ap as ShareCacheMetadata, aq as ShareCapabilityLike, ar as ShareConflict, as as ShareContentMetadata, at as ShareContentSource, au as ShareDeliveryAuthorization, av as ShareDeliveryAuthorizationReceipt, aw as ShareDeliveryAuthorizationRequest, ax as ShareDetachedProof, ay as ShareEnvelopeError, az as ShareEnvelopeV2, aA as ShareExpiryBounds, aB as ShareKvContentSource, aC as ShareLink, aD as ShareLinkData, aE as ShareLinkLocation, aF as ShareListEntry, aG as ShareListResult, aH as ShareNativeAction, aI as ShareNativeInvokeEnvelopeV1, aJ as ShareNativeInvokeErrorResult, aK as ShareNativeInvokeInput, aL as ShareNativeInvokeResult, aM as ShareNativeInvokeSuccessResult, aN as ShareNativeResponse, aO as ShareNativeResponseSchema, aP as SharePolicy, aQ as SharePolicyBinding, aR as SharePolicySession, aS as SharePolicySessionV1, aT as SharePolicySessionWireV1, aU as SharePortableDelegation, aV as ShareReadInvocationV1, aW as ShareReadResult, aX as ShareRecipientClient, aY as ShareRecipientClientOptions, aZ as ShareRecipientClientOptionsSchema, a_ as ShareRecipientPolicy, a$ as ShareRecipientPolicySchema, b0 as ShareRecipientResult, b1 as ShareRecipientTarget, b2 as ShareRecipientTargetSchema, b3 as ShareResource, b4 as ShareResourceSchema, b5 as ShareSaveOptions, b6 as ShareSchema, b7 as ShareSqlContentSource, b8 as ShareWireAction, b9 as SharingService, ba as SharingServiceConfig, bb as SignedDelegation, bc as SpaceInfo, bd as SpaceOwnership, be as ValidateShareDeliveryAuthorizationExpected, bf as VerifyShareEnvelopeOptions, bg as canonicalOwnerSharePolicy, bh as computeOwnerShareRegistrationCid, bi as computeShareCid, bj as createDelegatedShareKey, bk as createPolicyEnforcementDelegation, bl as createShareArtifact, bm as createShareArtifactAsync, bn as createSharePolicy, bo as createSharingService, bp as decryptShareBytesAsync, bq as delegatePortablePolicySession, br as encodeInlineShareUrl, bs as encodeShareArtifact, bt as encodeShareUrl, bu as encryptShareBytes, bv as encryptShareBytesAsync, bw as importPortableDelegation, bx as intersectShareCapabilities, by as isV2ShareLink, bz as normalizeShareActions, bA as normalizeShareRecipientTarget, bB as normalizeShareResource, bC as parsePortableDelegation, bD as parseShareArtifact, bE as parseShareUrl, bF as restoreDelegatedShareKey, bG as serializePortableDelegation, bH as shareCapabilityAllows, bI as shareDeliveryTrustedKid, bJ as signShareEnvelope, bK as validateOwnerSharePolicyRegistration, bL as validateOwnerSharePolicyRegistrationBytes, bM as validateShareDeliveryAuthorizationBytes, bN as verifyShareCid, bO as verifyShareEnvelope } from '../recipient-types.schema-G8NEKRoo.cjs';
-export { EncryptedSenderShareHistory, EncryptedShareHistoryStorage, LegacyMigrationResult, LegacyShareReader, MemoryEncryptedShareHistoryStorage, ShareAuthorizationAdapter, ShareAuthorizationDenied, ShareAuthorizationMethod, ShareAuthorizationReady, ShareAuthorizationRequired, ShareAuthorizationResult, ShareDeliveryAdapter, ShareErrorCode, ShareErrorInfo, ShareFetchOptions, ShareHistoryView, ShareInspection, ShareMetadata, ShareNotifyResult, ShareNotifyState, SharePolicyPublishAdapter, ShareReceiveError, ShareReceiveResult, ShareRevocationAdapter, ShareRevocationResult, ShareTarget, TargetPublishAdapter, TargetPublishInput, TargetPublishOutcome, VerifyBearerEnvelopeOptions, authorizationMethodForTarget, authorizeShare, claimShare, inspectShare, isLegacyShareLink, listShares, migrateShare, notifyShare, publishPolicyShare, publishTargetShare, receiveLegacyShare, receiveShare, resumeShareAuthorization, revokeShare, showShare, toShareErrorInfo, verifyBearerEnvelope } from '@tinycloud/share-sdk';
+import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-Cz5zJzED.cjs';
+export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, f as CreateDelegationParams, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, p as Delegation, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, z as DelegationRevocationReceipt, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, G as GenerateShareParams, H as ISharingService, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, ae as ShareActionSchema, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDeliveryAuthorizationV3Receipt, ay as ShareDeliveryAuthorizationV3Request, az as ShareDetachedProof, aA as ShareEnvelopeError, aB as ShareEnvelopeV2, aC as ShareExpiryBounds, aD as ShareKvContentSource, aE as ShareLink, aF as ShareLinkData, aG as ShareLinkLocation, aH as ShareListEntry, aI as ShareListResult, aJ as ShareNativeAction, aK as ShareNativeInvokeEnvelopeV1, aL as ShareNativeInvokeErrorResult, aM as ShareNativeInvokeInput, aN as ShareNativeInvokeResult, aO as ShareNativeInvokeSuccessResult, aP as ShareNativeResponse, aQ as ShareNativeResponseSchema, aR as SharePolicy, aS as SharePolicyBinding, aT as SharePolicySession, aU as SharePolicySessionV1, aV as SharePolicySessionWireV1, aW as SharePortableDelegation, aX as ShareReadInvocationV1, aY as ShareReadResult, aZ as ShareRecipientClient, a_ as ShareRecipientClientOptions, a$ as ShareRecipientClientOptionsSchema, b0 as ShareRecipientPolicy, b1 as ShareRecipientPolicySchema, b2 as ShareRecipientResult, b3 as ShareRecipientTarget, b4 as ShareRecipientTargetSchema, b5 as ShareResource, b6 as ShareResourceSchema, b7 as ShareSaveOptions, b8 as ShareSchema, b9 as ShareSqlContentSource, ba as ShareWireAction, bb as SharingService, bc as SharingServiceConfig, bd as SignedDelegation, be as SpaceInfo, bf as SpaceOwnership, bg as VerifyShareEnvelopeOptions, bh as canonicalOwnerSharePolicy, bi as computeOwnerShareRegistrationCid, bj as computeShareCid, bk as createDelegatedShareKey, bl as createPolicyEnforcementDelegation, bm as createShareArtifact, bn as createShareArtifactAsync, bo as createSharePolicy, bp as createSharingService, bq as decryptShareBytesAsync, br as delegatePortablePolicySession, bs as encodeInlineShareUrl, bt as encodeShareArtifact, bu as encodeShareUrl, bv as encryptShareBytes, bw as encryptShareBytesAsync, bx as importPortableDelegation, by as intersectShareCapabilities, bz as isV2ShareLink, bA as normalizeShareActions, bB as normalizeShareRecipientTarget, bC as normalizeShareResource, bD as parsePortableDelegation, bE as parseShareArtifact, bF as parseShareUrl, bG as restoreDelegatedShareKey, bH as serializePortableDelegation, bI as shareCapabilityAllows, bJ as signShareEnvelope, bK as validateOwnerSharePolicyRegistration, bL as validateOwnerSharePolicyRegistrationBytes, bM as validateShareDeliveryAuthorizationV3Bytes, bN as verifyShareCid, bO as verifyShareEnvelope } from '../recipient-types.schema-Cz5zJzED.cjs';
+export { EncryptedSenderShareHistory, EncryptedShareHistoryStorage, MemoryEncryptedShareHistoryStorage, ShareAuthorizationAdapter, ShareAuthorizationDenied, ShareAuthorizationMethod, ShareAuthorizationReady, ShareAuthorizationRequired, ShareAuthorizationResult, ShareDeliveryAdapter, ShareErrorCode, ShareErrorInfo, ShareFetchOptions, ShareHistoryView, ShareInspection, ShareMetadata, ShareNotifyResult, ShareNotifyState, SharePolicyPublishAdapter, ShareReceiveError, ShareReceiveResult, ShareRevocationAdapter, ShareRevocationResult, ShareTarget, TargetPublishAdapter, TargetPublishInput, TargetPublishOutcome, authorizationMethodForTarget, authorizeShare, claimShare, inspectShare, listShares, notifyShare, publishPolicyShare, publishTargetShare, receiveShare, resumeShareAuthorization, revokeShare, showShare, toShareErrorInfo } from '@tinycloud/share-sdk';
 import { z } from 'zod';
 import { ServiceSession, InvokeFunction, FetchFunction, IKVService } from '@tinycloud/sdk-services';
 

package/dist/delegations/index.d.ts

@@ -1,6 +1,6 @@
-import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-G8NEKRoo.js';
-export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationParams, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, m as Delegation, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, w as DelegationRevocationReceipt, x as DelegationStatus, E as EncodedShareData, G as GenerateShareParams, y as ISharingService, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationPermission, T as OwnerDelegationReceipt, U as OwnerShareAction, V as OwnerShareDecryption, W as OwnerShareMatcher, X as OwnerSharePolicyRegistration, Y as OwnerSharePolicyRegistrationReceipt, Z as OwnerSharePolicyV2, _ as PortableDelegationImportReceipt, $ as ReceiveOptions, a0 as RegisterOwnerSharePolicyParams, a1 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a2 as SenderShareKeyStorage, a3 as SenderShareRecord, a4 as SenderShareRecordStorage, a5 as SenderShareRevocationScope, a6 as SenderShareStore, a7 as ShareAccess, a8 as ShareAccessError, a9 as ShareAccessV2, aa as ShareAction, ab as ShareActionSchema, ac as ShareAddressedDelegationEnvelopeV2, ad as ShareAddressedDelegationEnvelopeV2Schema, ae as ShareAddressedDelegationRequestV2, af as ShareAddressedDelegationRequestV2Schema, ag as ShareAddressedDelegationResponseV2, ah as ShareAddressedDelegationResponseV2Schema, ai as ShareAddressedRecipientMatcher, aj as ShareArtifactInput, ak as ShareArtifactResult, al as ShareArtifactV2, am as ShareCache, an as ShareCacheEntry, ao as ShareCacheKey, ap as ShareCacheMetadata, aq as ShareCapabilityLike, ar as ShareConflict, as as ShareContentMetadata, at as ShareContentSource, au as ShareDeliveryAuthorization, av as ShareDeliveryAuthorizationReceipt, aw as ShareDeliveryAuthorizationRequest, ax as ShareDetachedProof, ay as ShareEnvelopeError, az as ShareEnvelopeV2, aA as ShareExpiryBounds, aB as ShareKvContentSource, aC as ShareLink, aD as ShareLinkData, aE as ShareLinkLocation, aF as ShareListEntry, aG as ShareListResult, aH as ShareNativeAction, aI as ShareNativeInvokeEnvelopeV1, aJ as ShareNativeInvokeErrorResult, aK as ShareNativeInvokeInput, aL as ShareNativeInvokeResult, aM as ShareNativeInvokeSuccessResult, aN as ShareNativeResponse, aO as ShareNativeResponseSchema, aP as SharePolicy, aQ as SharePolicyBinding, aR as SharePolicySession, aS as SharePolicySessionV1, aT as SharePolicySessionWireV1, aU as SharePortableDelegation, aV as ShareReadInvocationV1, aW as ShareReadResult, aX as ShareRecipientClient, aY as ShareRecipientClientOptions, aZ as ShareRecipientClientOptionsSchema, a_ as ShareRecipientPolicy, a$ as ShareRecipientPolicySchema, b0 as ShareRecipientResult, b1 as ShareRecipientTarget, b2 as ShareRecipientTargetSchema, b3 as ShareResource, b4 as ShareResourceSchema, b5 as ShareSaveOptions, b6 as ShareSchema, b7 as ShareSqlContentSource, b8 as ShareWireAction, b9 as SharingService, ba as SharingServiceConfig, bb as SignedDelegation, bc as SpaceInfo, bd as SpaceOwnership, be as ValidateShareDeliveryAuthorizationExpected, bf as VerifyShareEnvelopeOptions, bg as canonicalOwnerSharePolicy, bh as computeOwnerShareRegistrationCid, bi as computeShareCid, bj as createDelegatedShareKey, bk as createPolicyEnforcementDelegation, bl as createShareArtifact, bm as createShareArtifactAsync, bn as createSharePolicy, bo as createSharingService, bp as decryptShareBytesAsync, bq as delegatePortablePolicySession, br as encodeInlineShareUrl, bs as encodeShareArtifact, bt as encodeShareUrl, bu as encryptShareBytes, bv as encryptShareBytesAsync, bw as importPortableDelegation, bx as intersectShareCapabilities, by as isV2ShareLink, bz as normalizeShareActions, bA as normalizeShareRecipientTarget, bB as normalizeShareResource, bC as parsePortableDelegation, bD as parseShareArtifact, bE as parseShareUrl, bF as restoreDelegatedShareKey, bG as serializePortableDelegation, bH as shareCapabilityAllows, bI as shareDeliveryTrustedKid, bJ as signShareEnvelope, bK as validateOwnerSharePolicyRegistration, bL as validateOwnerSharePolicyRegistrationBytes, bM as validateShareDeliveryAuthorizationBytes, bN as verifyShareCid, bO as verifyShareEnvelope } from '../recipient-types.schema-G8NEKRoo.js';
-export { EncryptedSenderShareHistory, EncryptedShareHistoryStorage, LegacyMigrationResult, LegacyShareReader, MemoryEncryptedShareHistoryStorage, ShareAuthorizationAdapter, ShareAuthorizationDenied, ShareAuthorizationMethod, ShareAuthorizationReady, ShareAuthorizationRequired, ShareAuthorizationResult, ShareDeliveryAdapter, ShareErrorCode, ShareErrorInfo, ShareFetchOptions, ShareHistoryView, ShareInspection, ShareMetadata, ShareNotifyResult, ShareNotifyState, SharePolicyPublishAdapter, ShareReceiveError, ShareReceiveResult, ShareRevocationAdapter, ShareRevocationResult, ShareTarget, TargetPublishAdapter, TargetPublishInput, TargetPublishOutcome, VerifyBearerEnvelopeOptions, authorizationMethodForTarget, authorizeShare, claimShare, inspectShare, isLegacyShareLink, listShares, migrateShare, notifyShare, publishPolicyShare, publishTargetShare, receiveLegacyShare, receiveShare, resumeShareAuthorization, revokeShare, showShare, toShareErrorInfo, verifyBearerEnvelope } from '@tinycloud/share-sdk';
+import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-Cz5zJzED.js';
+export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, f as CreateDelegationParams, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, p as Delegation, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, z as DelegationRevocationReceipt, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, G as GenerateShareParams, H as ISharingService, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, ae as ShareActionSchema, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDeliveryAuthorizationV3Receipt, ay as ShareDeliveryAuthorizationV3Request, az as ShareDetachedProof, aA as ShareEnvelopeError, aB as ShareEnvelopeV2, aC as ShareExpiryBounds, aD as ShareKvContentSource, aE as ShareLink, aF as ShareLinkData, aG as ShareLinkLocation, aH as ShareListEntry, aI as ShareListResult, aJ as ShareNativeAction, aK as ShareNativeInvokeEnvelopeV1, aL as ShareNativeInvokeErrorResult, aM as ShareNativeInvokeInput, aN as ShareNativeInvokeResult, aO as ShareNativeInvokeSuccessResult, aP as ShareNativeResponse, aQ as ShareNativeResponseSchema, aR as SharePolicy, aS as SharePolicyBinding, aT as SharePolicySession, aU as SharePolicySessionV1, aV as SharePolicySessionWireV1, aW as SharePortableDelegation, aX as ShareReadInvocationV1, aY as ShareReadResult, aZ as ShareRecipientClient, a_ as ShareRecipientClientOptions, a$ as ShareRecipientClientOptionsSchema, b0 as ShareRecipientPolicy, b1 as ShareRecipientPolicySchema, b2 as ShareRecipientResult, b3 as ShareRecipientTarget, b4 as ShareRecipientTargetSchema, b5 as ShareResource, b6 as ShareResourceSchema, b7 as ShareSaveOptions, b8 as ShareSchema, b9 as ShareSqlContentSource, ba as ShareWireAction, bb as SharingService, bc as SharingServiceConfig, bd as SignedDelegation, be as SpaceInfo, bf as SpaceOwnership, bg as VerifyShareEnvelopeOptions, bh as canonicalOwnerSharePolicy, bi as computeOwnerShareRegistrationCid, bj as computeShareCid, bk as createDelegatedShareKey, bl as createPolicyEnforcementDelegation, bm as createShareArtifact, bn as createShareArtifactAsync, bo as createSharePolicy, bp as createSharingService, bq as decryptShareBytesAsync, br as delegatePortablePolicySession, bs as encodeInlineShareUrl, bt as encodeShareArtifact, bu as encodeShareUrl, bv as encryptShareBytes, bw as encryptShareBytesAsync, bx as importPortableDelegation, by as intersectShareCapabilities, bz as isV2ShareLink, bA as normalizeShareActions, bB as normalizeShareRecipientTarget, bC as normalizeShareResource, bD as parsePortableDelegation, bE as parseShareArtifact, bF as parseShareUrl, bG as restoreDelegatedShareKey, bH as serializePortableDelegation, bI as shareCapabilityAllows, bJ as signShareEnvelope, bK as validateOwnerSharePolicyRegistration, bL as validateOwnerSharePolicyRegistrationBytes, bM as validateShareDeliveryAuthorizationV3Bytes, bN as verifyShareCid, bO as verifyShareEnvelope } from '../recipient-types.schema-Cz5zJzED.js';
+export { EncryptedSenderShareHistory, EncryptedShareHistoryStorage, MemoryEncryptedShareHistoryStorage, ShareAuthorizationAdapter, ShareAuthorizationDenied, ShareAuthorizationMethod, ShareAuthorizationReady, ShareAuthorizationRequired, ShareAuthorizationResult, ShareDeliveryAdapter, ShareErrorCode, ShareErrorInfo, ShareFetchOptions, ShareHistoryView, ShareInspection, ShareMetadata, ShareNotifyResult, ShareNotifyState, SharePolicyPublishAdapter, ShareReceiveError, ShareReceiveResult, ShareRevocationAdapter, ShareRevocationResult, ShareTarget, TargetPublishAdapter, TargetPublishInput, TargetPublishOutcome, authorizationMethodForTarget, authorizeShare, claimShare, inspectShare, listShares, notifyShare, publishPolicyShare, publishTargetShare, receiveShare, resumeShareAuthorization, revokeShare, showShare, toShareErrorInfo } from '@tinycloud/share-sdk';
 import { z } from 'zod';
 import { ServiceSession, InvokeFunction, FetchFunction, IKVService } from '@tinycloud/sdk-services';
 

package/dist/delegations/index.js

@@ -1378,13 +1378,13 @@ function canonicalizeRecapCaveats(caveats) {
     }
     if (Array.isArray(value)) return `[${value.map(canonicalize).join(",")}]`;
     if (typeof value === "object") {
-      const object = value;
-      const prototype = Object.getPrototypeOf(object);
+      const object2 = value;
+      const prototype = Object.getPrototypeOf(object2);
       if (prototype !== Object.prototype && prototype !== null) {
         throw new Error("ReCap caveats must contain only JSON values.");
       }
-      return `{${Object.keys(object).sort().map(
-        (key) => `${JSON.stringify(key)}:${canonicalize(object[key])}`
+      return `{${Object.keys(object2).sort().map(
+        (key) => `${JSON.stringify(key)}:${canonicalize(object2[key])}`
       ).join(",")}}`;
     }
     throw new Error("ReCap caveats must contain only JSON values.");
@@ -2582,7 +2582,6 @@ import { ed25519 } from "@noble/curves/ed25519";
 import { blake3 } from "@noble/hashes/blake3";
 import { sha256 as sha2562 } from "@noble/hashes/sha256";
 var ENVELOPE_SCHEMA = "xyz.tinycloud.share/envelope";
-var INLINE_PREFIX = "tc2:";
 var RAW_CID_CODEC = 85;
 var BLAKE3_256_CODE = 30;
 var DEFAULT_MAX_INLINE_BYTES = 256 * 1024;
@@ -2629,8 +2628,8 @@ function canonicalJson(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
   if (typeof value === "object") {
-    const object = value;
-    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(",")}}`;
+    const object2 = value;
+    return `{${Object.keys(object2).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object2[key])}`).join(",")}}`;
   }
   throw new ShareEnvelopeError("invalid-envelope", "unsupported JSON value");
 }
@@ -3287,25 +3286,8 @@ function parsePublishedShareLink(link, options = {}) {
   }
   const origin = normalizeOrigin(url.origin);
   if (options.trustedOrigins !== void 0 && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
-  if (url.search !== "" || url.username !== "" || url.password !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
-  if (url.pathname === "/s/inline" && url.hash.startsWith("#v=2&p=")) {
-    let payload;
-    try {
-      const bytes2 = base64UrlToBytes(url.hash.slice("#v=2&p=".length));
-      if (bytes2.length > (options.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES) * 2) throw new Error("inline payload too large");
-      const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
-      if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("inline payload shape");
-      payload = value;
-    } catch (error) {
-      throw new ShareEnvelopeError("invalid-link", error instanceof Error ? error.message : "invalid inline payload");
-    }
-    if (payload.v !== 2 || typeof payload.c !== "string" || typeof payload.cid !== "string" || payload.k !== void 0 && typeof payload.k !== "string" || Object.keys(payload).some((key3) => !["v", "c", "cid", "k"].includes(key3))) throw new ShareEnvelopeError("invalid-link", "inline payload fields are invalid");
-    const sealed = base64UrlToBytes(payload.c);
-    if (!verifyPublishedShareCid(payload.cid, sealed)) throw new ShareEnvelopeError("cid-mismatch", "inline payload CID does not match");
-    const key2 = payload.k === void 0 ? void 0 : base64UrlToBytes(payload.k);
-    if (key2 !== void 0 && key2.length !== 32) throw new ShareEnvelopeError("invalid-link", "inline payload key is invalid");
-    return { origin, cid: payload.cid, ...key2 === void 0 ? {} : { key: key2 }, sealed };
-  }
+  if (url.username !== "" || url.password !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
+  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
   const match = /^\/s\/([a-z2-7]+)$/.exec(url.pathname);
   if (match === null || !url.hash.startsWith("#k=")) throw new ShareEnvelopeError("invalid-link", "published share link is invalid");
   const key = base64UrlToBytes(url.hash.slice(3));
@@ -3325,13 +3307,10 @@ function parseShareUrl(link, options = {}) {
   } catch {
     throw new ShareEnvelopeError("invalid-link", "share link must be an absolute URL");
   }
-  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share links must not contain query parameters");
   const origin = normalizeOrigin(url.origin);
   if (options.trustedOrigins !== void 0 && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
-  if (url.pathname === "/s/inline" && url.hash.startsWith("#v=2&p=")) {
-    const published = parsePublishedShareLink(link, options);
-    return { kind: "inline", origin, cid: published.cid, key: published.key, url: `${url.origin}${url.pathname}`, protocol: "share-envelope-v2" };
-  }
+  if (url.pathname === "/viewer") throw new ShareEnvelopeError("invalid-link", "retired viewer links are not accepted");
+  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share links must not contain query parameters");
   const match = url.pathname.match(/^\/s\/(i\/)?([^/]+)$/);
   if (!match) throw new ShareEnvelopeError("invalid-link", "share link path is invalid");
   const fragmentParams = url.hash === "" ? void 0 : new URLSearchParams(url.hash.slice(1));
@@ -3354,9 +3333,10 @@ function parseShareUrl(link, options = {}) {
 }
 function isV2ShareLink(link) {
   try {
-    return new URL(link).pathname.startsWith("/s/");
+    const url = new URL(link);
+    return url.search === "" && url.pathname.startsWith("/s/");
   } catch {
-    return link.startsWith(INLINE_PREFIX);
+    return false;
   }
 }
 async function encryptShareBytes(bytes2, key) {
@@ -3896,6 +3876,11 @@ var POLICY_SESSION_FACT_KEYS = [
   "issuanceAuditDigestHex",
   "remainingRedelegationDepth"
 ];
+var POLICY_SESSION_V4_AUDIT_FACT_KEYS = [
+  "credentialIdAuditDigestHex",
+  "presentationJtiAuditDigestHex"
+];
+var LOWER_SHA256_HEX = /^[0-9a-f]{64}$/;
 var CompactHeaderSchema = z4.object({
   alg: z4.literal("EdDSA"),
   jwk: z4.object({ alg: z4.literal("EdDSA"), crv: z4.literal("Ed25519"), kty: z4.literal("OKP"), x: z4.string().min(1) }).strict(),
@@ -4037,9 +4022,13 @@ function parsePolicySessionUcan(authorization, expectedProofs) {
   if (expectedProofs !== void 0 && (parsed.payload.prf[0] !== expectedProofs[0] || parsed.payload.prf[1] !== expectedProofs[1]))
     throw new Error("policy session UCAN ordered proofs do not match");
   const factKeys = Object.keys(fact);
-  if (factKeys.length !== POLICY_SESSION_FACT_KEYS.length || factKeys.some((key) => !POLICY_SESSION_FACT_KEYS.includes(key)) || POLICY_SESSION_FACT_KEYS.some((key) => !(key in fact)))
+  const hasLegacyFactShape = factKeys.length === POLICY_SESSION_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact);
+  const hasV4AuditFactShape = factKeys.length === POLICY_SESSION_FACT_KEYS.length + POLICY_SESSION_V4_AUDIT_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key) || POLICY_SESSION_V4_AUDIT_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact) && POLICY_SESSION_V4_AUDIT_FACT_KEYS.every((key) => key in fact);
+  if (!hasLegacyFactShape && !hasV4AuditFactShape)
     throw new Error("policy session UCAN fact is incomplete");
-  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.enforcerDid || parsed.payload.aud !== fact.recipientDid)
+  if (hasV4AuditFactShape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)))
+    throw new Error("policy session UCAN v4 audit facts are invalid");
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
     throw new Error("policy session UCAN fact is invalid");
   return {
     authorization,
@@ -4216,8 +4205,8 @@ function canonicalJsonForProof(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalJsonForProof).join(",")}]`;
   if (typeof value === "object") {
-    const object = value;
-    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object[key])}`).join(",")}}`;
+    const object2 = value;
+    return `{${Object.keys(object2).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object2[key])}`).join(",")}}`;
   }
   throw new ShareAccessError("SHARE_SESSION_INVALID");
 }
@@ -4926,12 +4915,12 @@ var ShareRecipientClient = class {
     this.assertDetachedProof(request.proof);
   }
   parseSessionCapability(value) {
-    const object = this.requireObject(value, "session capability");
-    if (typeof object.spaceId !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability space is invalid");
-    if (!Array.isArray(object.actions) || object.actions.some((action) => !["read", "list", "edit"].includes(action))) throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability actions are invalid");
-    const resource = this.requireObject(object.resource, "session capability resource");
+    const object2 = this.requireObject(value, "session capability");
+    if (typeof object2.spaceId !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability space is invalid");
+    if (!Array.isArray(object2.actions) || object2.actions.some((action) => !["read", "list", "edit"].includes(action))) throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability actions are invalid");
+    const resource = this.requireObject(object2.resource, "session capability resource");
     if (resource.kind !== "exact" && resource.kind !== "prefix" || typeof resource.path !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability resource is invalid");
-    return { spaceId: object.spaceId, actions: [...new Set(object.actions)], resource: { kind: resource.kind, path: resource.path } };
+    return { spaceId: object2.spaceId, actions: [...new Set(object2.actions)], resource: { kind: resource.kind, path: resource.path } };
   }
   assertProvidedPolicySession(session, envelope) {
     const sessionExpiry = dateValue(session.expiresAt);
@@ -6584,62 +6573,21 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
   return validateOwnerSharePolicyRegistration(value, expected);
 }
 
-// src/delegations/share-delivery.ts
+// src/delegations/share-delivery-v3.ts
 import { ed25519 as ed255197 } from "@noble/curves/ed25519";
-var SHARE_DELIVERY_AUTHORIZATION_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v2\0";
-function isCanonicalHttpsOrigin(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
-  }
-  return url.protocol === "https:" && url.origin === value && url.pathname === "/" && url.search === "" && url.hash === "" && url.username === "" && url.password === "";
-}
-var AUTHORIZATION_KEYS = [
-  "type",
-  "version",
-  "jti",
-  "shareCid",
-  "shareId",
-  "registrationCid",
-  "delegationCid",
-  "enforcementDelegationCid",
-  "envelopeCid",
-  "policyCid",
-  "nodeAudience",
-  "targetOrigin",
-  "openCredentialsAudience",
-  "holder",
-  "recipientMatcher",
-  "deliveryEmail",
-  "shareUrl",
-  "returnOrigin",
-  "documentName",
-  "senderDid",
-  "senderTrust",
-  "contentSource",
-  "contentSourceDigest",
-  "shareExpiresAt",
-  "issuedAt",
-  "reportAbuseToken",
-  "actions",
-  "resource",
-  "authorityMaterialHandle",
-  "authorityMaterialDigest",
-  "requestBodyDigest",
-  "idempotencyKey",
-  "expiresAt",
-  "dataAuthority"
-];
-function assertObject2(value, keys, label) {
+import { sha256 as sha2568 } from "@noble/hashes/sha256";
+var CREDENTIAL_INVITATION_REQUEST_DOMAIN = "xyz.tinycloud.credentials/invitation-request/v1\0";
+var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v0\0";
+var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
+var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
+function exactObject(value, keys, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
   const record = value;
   if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);
   return record;
 }
-function fromB642(value) {
-  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share delivery value is not canonical base64url");
+function decodeBase64Url2(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share delivery value is not canonical base64url");
   if (typeof atob === "function") {
     const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
     return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
@@ -6647,42 +6595,45 @@ function fromB642(value) {
   if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(value, "base64url"));
   throw new Error("base64url decoding is unavailable");
 }
-function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
-  let value;
+function object(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
+  return value;
+}
+function didKeyBytes(did) {
+  if (!did.startsWith("did:key:z") || /[#/?]/.test(did.slice("did:key:".length))) throw new Error("v3 delivery admission signer is invalid");
+  const decoded = base58btc.decode(did.slice("did:key:".length));
+  if (decoded.length !== 34 || decoded[0] !== 237 || decoded[1] !== 1) throw new Error("v3 delivery admission signer is invalid");
+  return decoded.slice(2);
+}
+function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
+  let parsed;
   try {
-    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytesValue));
+    parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
   } catch {
-    throw new Error("share delivery authorization response is not valid UTF-8 JSON");
-  }
-  const root = assertObject2(value, ["authorization", "proof"], "share delivery authorization response");
-  const authorization = assertObject2(root.authorization, AUTHORIZATION_KEYS, "share delivery authorization");
-  const proof = assertObject2(root.proof, ["alg", "kid", "signature"], "share delivery authorization proof");
-  const request = expected.request;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.idempotencyKey || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
-    throw new Error("share delivery authorization is not bound to the submitted request");
-  }
-  if (typeof authorization.issuedAt !== "string" || Date.parse(authorization.issuedAt) > Date.now() + 6e4) throw new Error("share delivery authorization issuedAt is invalid");
-  if (new Date(authorization.expiresAt).toISOString() !== authorization.expiresAt) throw new Error("share delivery authorization expiresAt is non-canonical");
-  if (typeof authorization.openCredentialsAudience !== "string" || !isCanonicalHttpsOrigin(authorization.openCredentialsAudience) || authorization.openCredentialsAudience !== expected.credentialsAudience || authorization.openCredentialsAudience === authorization.nodeAudience || authorization.openCredentialsAudience === authorization.returnOrigin) {
-    throw new Error("share delivery authorization openCredentialsAudience is missing or untrusted");
-  }
-  if (proof.alg !== "EdDSA" || typeof proof.kid !== "string" || typeof proof.signature !== "string") throw new Error("share delivery authorization proof is invalid");
-  if (proof.kid !== expected.nodeProof.kid) throw new Error("share delivery authorization proof key is not trusted");
-  const encodedKid = expected.nodeProof.publicKey;
-  const publicKey = encodedKid.length === 34 && encodedKid[0] === 237 && encodedKid[1] === 1 ? encodedKid.slice(2) : encodedKid;
-  if (publicKey.length !== 32) throw new Error("share delivery authorization proof key is invalid");
-  const signatureBytes = fromB642(proof.signature);
-  const signedBytes = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_DOMAIN}${canonicalizeSignedObjectUnsigned(authorization)}`);
-  if (signatureBytes.length !== 64 || !ed255197.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
-  return { authorization, proof };
-}
-function shareDeliveryTrustedKid(publicKey) {
-  if (publicKey.length !== 32) throw new Error("share delivery node key must be a raw 32-byte Ed25519 public key");
-  const prefixed = new Uint8Array(34);
-  prefixed.set([237, 1]);
-  prefixed.set(publicKey, 2);
-  const did = `did:key:${base58btc.encode(prefixed)}`;
-  return `${did}#${did.slice("did:key:".length)}`;
+    throw new Error("v3 share delivery response is not valid UTF-8 JSON");
+  }
+  const root = exactObject(parsed, ["request", "admission"], "v3 share delivery response");
+  const request = exactObject(root.request, REQUEST_KEYS, "credential invitation request");
+  const admission = exactObject(root.admission, ADMISSION_KEYS, "delivery admission");
+  const signature = exactObject(admission.signature, ["suite", "signerDid", "value"], "delivery admission signature");
+  const envelope = object(expected.request.envelope, "v3 share envelope");
+  const policy = object(envelope.policy, "v3 share policy");
+  const requirement = object(policy.credentialRequirement, "v3 credential requirement");
+  const credentialType = object(requirement.credentialType, "v3 credential type");
+  const contentSource = object(envelope.contentSource, "v3 content source");
+  const envelopeSignature = object(envelope.signature, "v3 envelope signature");
+  const target = object(envelope.target, "v3 target");
+  const binding = object(envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
+  const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
+  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.label !== expected.request.documentName || request.shareExpiresAt !== envelope.expiry || request.audience !== expected.deliveryAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || target.nodeAudience !== binding.nodeAudience || signature.signerDid !== binding.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  const issuedAt = Date.parse(String(request.issuedAt));
+  const expiresAt = Date.parse(String(request.expiresAt));
+  if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 15 * 6e4) throw new Error("v3 share delivery authorization time is invalid");
+  const admissionSignature = decodeBase64Url2(signature.value);
+  const { signature: _signature, ...unsignedAdmission } = admission;
+  const digest4 = sha2568(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
+  if (admissionSignature.length !== 64 || !ed255197.verify(admissionSignature, digest4, didKeyBytes(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
+  return { request, admission };
 }
 
 // src/delegations/sender-share-store.ts
@@ -6805,9 +6756,6 @@ import {
   publishPolicyShare,
   claimShare,
   resumeShareAuthorization,
-  isLegacyShareLink,
-  receiveLegacyShare,
-  migrateShare,
   MemoryEncryptedShareHistoryStorage,
   EncryptedSenderShareHistory
 } from "@tinycloud/share-sdk";
@@ -6815,10 +6763,11 @@ import {
   inspectShare,
   receiveShare,
   ShareReceiveError,
-  toShareErrorInfo,
-  verifyBearerEnvelope
+  toShareErrorInfo
 } from "@tinycloud/share-sdk";
 export {
+  CREDENTIAL_INVITATION_REQUEST_DOMAIN,
+  DELIVERY_ADMISSION_DOMAIN,
   DelegationErrorCodes,
   DelegationManager,
   EncodedShareDataSchema,
@@ -6832,7 +6781,6 @@ export {
   MemorySenderShareRecordStorage,
   MemoryShareCache,
   ReceiveOptionsSchema,
-  SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
   SenderShareStore,
   ShareAccessError,
   ShareActionSchema,
@@ -6872,10 +6820,8 @@ export {
   importPortableDelegation,
   inspectShare,
   intersectShareCapabilities,
-  isLegacyShareLink,
   isV2ShareLink,
   listShares,
-  migrateShare,
   normalizeShareActions,
   normalizeShareRecipientTarget,
   normalizeShareResource,
@@ -6885,14 +6831,12 @@ export {
   parseShareUrl,
   publishPolicyShare,
   publishTargetShare,
-  receiveLegacyShare,
   receiveShare,
   restoreDelegatedShareKey,
   resumeShareAuthorization,
   revokeShare,
   serializePortableDelegation,
   shareCapabilityAllows,
-  shareDeliveryTrustedKid,
   showShare,
   signShareEnvelope,
   toShareErrorInfo,
@@ -6900,9 +6844,8 @@ export {
   validateOwnerSharePolicyRegistration,
   validateOwnerSharePolicyRegistrationBytes,
   validateReceiveOptions,
-  validateShareDeliveryAuthorizationBytes,
+  validateShareDeliveryAuthorizationV3Bytes,
   validateSharingServiceConfig,
-  verifyBearerEnvelope,
   verifyShareCid,
   verifyShareEnvelope
 };