@tinycloud/sdk-core 3.0.0-beta.8 → 3.0.0

package/dist/delegations/index.d.cts

@@ -1,6 +1,6 @@
-import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-DjmM_yJu.cjs';
-export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, f as CreateDelegationParams, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, p as Delegation, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, z as DelegationRevocationReceipt, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, G as GenerateShareParams, H as ISharingService, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a6 as SenderShareKeyStorage, a7 as SenderShareRecord, a8 as SenderShareRecordStorage, a9 as SenderShareRevocationScope, aa as SenderShareStore, ab as ShareAccess, ac as ShareAccessError, ad as ShareAccessV2, ae as ShareAction, af as ShareActionSchema, ag as ShareAddressedDelegationEnvelopeV2, ah as ShareAddressedDelegationEnvelopeV2Schema, ai as ShareAddressedDelegationRequestV2, aj as ShareAddressedDelegationRequestV2Schema, ak as ShareAddressedDelegationResponseV2, al as ShareAddressedDelegationResponseV2Schema, am as ShareAddressedRecipientMatcher, an as ShareArtifactInput, ao as ShareArtifactResult, ap as ShareArtifactV2, aq as ShareCache, ar as ShareCacheEntry, as as ShareCacheKey, at as ShareCacheMetadata, au as ShareCapabilityLike, av as ShareConflict, aw as ShareContentMetadata, ax as ShareContentSource, ay as ShareDeliveryAuthorization, az as ShareDeliveryAuthorizationReceipt, aA as ShareDeliveryAuthorizationRequest, aB as ShareDeliveryAuthorizationV3Receipt, aC as ShareDeliveryAuthorizationV3Request, aD as ShareDetachedProof, aE as ShareEnvelopeError, aF as ShareEnvelopeV2, aG as ShareExpiryBounds, aH as ShareKvContentSource, aI as ShareLink, aJ as ShareLinkData, aK as ShareLinkLocation, aL as ShareListEntry, aM as ShareListResult, aN as ShareNativeAction, aO as ShareNativeInvokeEnvelopeV1, aP as ShareNativeInvokeErrorResult, aQ as ShareNativeInvokeInput, aR as ShareNativeInvokeResult, aS as ShareNativeInvokeSuccessResult, aT as ShareNativeResponse, aU as ShareNativeResponseSchema, aV as SharePolicy, aW as SharePolicyBinding, aX as SharePolicySession, aY as SharePolicySessionV1, aZ as SharePolicySessionWireV1, a_ as SharePortableDelegation, a$ as ShareReadInvocationV1, b0 as ShareReadResult, b1 as ShareRecipientClient, b2 as ShareRecipientClientOptions, b3 as ShareRecipientClientOptionsSchema, b4 as ShareRecipientPolicy, b5 as ShareRecipientPolicySchema, b6 as ShareRecipientResult, b7 as ShareRecipientTarget, b8 as ShareRecipientTargetSchema, b9 as ShareResource, ba as ShareResourceSchema, bb as ShareSaveOptions, bc as ShareSchema, bd as ShareSqlContentSource, be as ShareWireAction, bf as SharingService, bg as SharingServiceConfig, bh as SignedDelegation, bi as SpaceInfo, bj as SpaceOwnership, bk as ValidateShareDeliveryAuthorizationExpected, bl as VerifyShareEnvelopeOptions, bm as canonicalOwnerSharePolicy, bn as computeOwnerShareRegistrationCid, bo as computeShareCid, bp as createDelegatedShareKey, bq as createPolicyEnforcementDelegation, br as createShareArtifact, bs as createShareArtifactAsync, bt as createSharePolicy, bu as createSharingService, bv as decryptShareBytesAsync, bw as delegatePortablePolicySession, bx as encodeInlineShareUrl, by as encodeShareArtifact, bz as encodeShareUrl, bA as encryptShareBytes, bB as encryptShareBytesAsync, bC as importPortableDelegation, bD as intersectShareCapabilities, bE as isV2ShareLink, bF as normalizeShareActions, bG as normalizeShareRecipientTarget, bH as normalizeShareResource, bI as parsePortableDelegation, bJ as parseShareArtifact, bK as parseShareUrl, bL as restoreDelegatedShareKey, bM as serializePortableDelegation, bN as shareCapabilityAllows, bO as shareDeliveryTrustedKid, bP as signShareEnvelope, bQ as validateOwnerSharePolicyRegistration, bR as validateOwnerSharePolicyRegistrationBytes, bS as validateShareDeliveryAuthorizationBytes, bT as validateShareDeliveryAuthorizationV3Bytes, bU as verifyShareCid, bV as verifyShareEnvelope } from '../recipient-types.schema-DjmM_yJu.cjs';
-export { EncryptedSenderShareHistory, EncryptedShareHistoryStorage, LegacyMigrationResult, LegacyShareReader, MemoryEncryptedShareHistoryStorage, ShareAuthorizationAdapter, ShareAuthorizationDenied, ShareAuthorizationMethod, ShareAuthorizationReady, ShareAuthorizationRequired, ShareAuthorizationResult, ShareDeliveryAdapter, ShareErrorCode, ShareErrorInfo, ShareFetchOptions, ShareHistoryView, ShareInspection, ShareMetadata, ShareNotifyResult, ShareNotifyState, SharePolicyPublishAdapter, ShareReceiveError, ShareReceiveResult, ShareRevocationAdapter, ShareRevocationResult, ShareTarget, TargetPublishAdapter, TargetPublishInput, TargetPublishOutcome, VerifyBearerEnvelopeOptions, authorizationMethodForTarget, authorizeShare, claimShare, inspectShare, isLegacyShareLink, listShares, migrateShare, notifyShare, publishPolicyShare, publishTargetShare, receiveLegacyShare, receiveShare, resumeShareAuthorization, revokeShare, showShare, toShareErrorInfo, verifyBearerEnvelope } from '@tinycloud/share-sdk';
+import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-D9AI8tjN.cjs';
+export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, f as CreateDelegationParams, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, p as Delegation, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, z as DelegationRevocationReceipt, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, G as GenerateShareParams, H as ISharingService, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, ae as ShareActionSchema, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aF as ShareLink, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b0 as ShareRecipientClientOptionsSchema, b1 as ShareRecipientPolicy, b2 as ShareRecipientPolicySchema, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b5 as ShareRecipientTargetSchema, b6 as ShareResource, b7 as ShareResourceSchema, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bf as SpaceInfo, bg as SpaceOwnership, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from '../recipient-types.schema-D9AI8tjN.cjs';
+export { EncryptedSenderShareHistory, EncryptedShareHistoryStorage, MemoryEncryptedShareHistoryStorage, ShareAuthorizationAdapter, ShareAuthorizationDenied, ShareAuthorizationMethod, ShareAuthorizationReady, ShareAuthorizationRequired, ShareAuthorizationResult, ShareDeliveryAdapter, ShareErrorCode, ShareErrorInfo, ShareFetchOptions, ShareHistoryView, ShareInspection, ShareMetadata, ShareNotifyResult, ShareNotifyState, SharePolicyPublishAdapter, ShareReceiveError, ShareReceiveResult, ShareRevocationAdapter, ShareRevocationResult, ShareTarget, TargetPublishAdapter, TargetPublishInput, TargetPublishOutcome, authorizationMethodForTarget, authorizeShare, claimShare, inspectShare, listShares, notifyShare, publishPolicyShare, publishTargetShare, receiveShare, resumeShareAuthorization, revokeShare, showShare, toShareErrorInfo } from '@tinycloud/share-sdk';
 import { z } from 'zod';
 import { ServiceSession, InvokeFunction, FetchFunction, IKVService } from '@tinycloud/sdk-services';
 

package/dist/delegations/index.d.ts

@@ -1,6 +1,6 @@
-import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-DjmM_yJu.js';
-export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, f as CreateDelegationParams, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, p as Delegation, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, z as DelegationRevocationReceipt, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, G as GenerateShareParams, H as ISharingService, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a6 as SenderShareKeyStorage, a7 as SenderShareRecord, a8 as SenderShareRecordStorage, a9 as SenderShareRevocationScope, aa as SenderShareStore, ab as ShareAccess, ac as ShareAccessError, ad as ShareAccessV2, ae as ShareAction, af as ShareActionSchema, ag as ShareAddressedDelegationEnvelopeV2, ah as ShareAddressedDelegationEnvelopeV2Schema, ai as ShareAddressedDelegationRequestV2, aj as ShareAddressedDelegationRequestV2Schema, ak as ShareAddressedDelegationResponseV2, al as ShareAddressedDelegationResponseV2Schema, am as ShareAddressedRecipientMatcher, an as ShareArtifactInput, ao as ShareArtifactResult, ap as ShareArtifactV2, aq as ShareCache, ar as ShareCacheEntry, as as ShareCacheKey, at as ShareCacheMetadata, au as ShareCapabilityLike, av as ShareConflict, aw as ShareContentMetadata, ax as ShareContentSource, ay as ShareDeliveryAuthorization, az as ShareDeliveryAuthorizationReceipt, aA as ShareDeliveryAuthorizationRequest, aB as ShareDeliveryAuthorizationV3Receipt, aC as ShareDeliveryAuthorizationV3Request, aD as ShareDetachedProof, aE as ShareEnvelopeError, aF as ShareEnvelopeV2, aG as ShareExpiryBounds, aH as ShareKvContentSource, aI as ShareLink, aJ as ShareLinkData, aK as ShareLinkLocation, aL as ShareListEntry, aM as ShareListResult, aN as ShareNativeAction, aO as ShareNativeInvokeEnvelopeV1, aP as ShareNativeInvokeErrorResult, aQ as ShareNativeInvokeInput, aR as ShareNativeInvokeResult, aS as ShareNativeInvokeSuccessResult, aT as ShareNativeResponse, aU as ShareNativeResponseSchema, aV as SharePolicy, aW as SharePolicyBinding, aX as SharePolicySession, aY as SharePolicySessionV1, aZ as SharePolicySessionWireV1, a_ as SharePortableDelegation, a$ as ShareReadInvocationV1, b0 as ShareReadResult, b1 as ShareRecipientClient, b2 as ShareRecipientClientOptions, b3 as ShareRecipientClientOptionsSchema, b4 as ShareRecipientPolicy, b5 as ShareRecipientPolicySchema, b6 as ShareRecipientResult, b7 as ShareRecipientTarget, b8 as ShareRecipientTargetSchema, b9 as ShareResource, ba as ShareResourceSchema, bb as ShareSaveOptions, bc as ShareSchema, bd as ShareSqlContentSource, be as ShareWireAction, bf as SharingService, bg as SharingServiceConfig, bh as SignedDelegation, bi as SpaceInfo, bj as SpaceOwnership, bk as ValidateShareDeliveryAuthorizationExpected, bl as VerifyShareEnvelopeOptions, bm as canonicalOwnerSharePolicy, bn as computeOwnerShareRegistrationCid, bo as computeShareCid, bp as createDelegatedShareKey, bq as createPolicyEnforcementDelegation, br as createShareArtifact, bs as createShareArtifactAsync, bt as createSharePolicy, bu as createSharingService, bv as decryptShareBytesAsync, bw as delegatePortablePolicySession, bx as encodeInlineShareUrl, by as encodeShareArtifact, bz as encodeShareUrl, bA as encryptShareBytes, bB as encryptShareBytesAsync, bC as importPortableDelegation, bD as intersectShareCapabilities, bE as isV2ShareLink, bF as normalizeShareActions, bG as normalizeShareRecipientTarget, bH as normalizeShareResource, bI as parsePortableDelegation, bJ as parseShareArtifact, bK as parseShareUrl, bL as restoreDelegatedShareKey, bM as serializePortableDelegation, bN as shareCapabilityAllows, bO as shareDeliveryTrustedKid, bP as signShareEnvelope, bQ as validateOwnerSharePolicyRegistration, bR as validateOwnerSharePolicyRegistrationBytes, bS as validateShareDeliveryAuthorizationBytes, bT as validateShareDeliveryAuthorizationV3Bytes, bU as verifyShareCid, bV as verifyShareEnvelope } from '../recipient-types.schema-DjmM_yJu.js';
-export { EncryptedSenderShareHistory, EncryptedShareHistoryStorage, LegacyMigrationResult, LegacyShareReader, MemoryEncryptedShareHistoryStorage, ShareAuthorizationAdapter, ShareAuthorizationDenied, ShareAuthorizationMethod, ShareAuthorizationReady, ShareAuthorizationRequired, ShareAuthorizationResult, ShareDeliveryAdapter, ShareErrorCode, ShareErrorInfo, ShareFetchOptions, ShareHistoryView, ShareInspection, ShareMetadata, ShareNotifyResult, ShareNotifyState, SharePolicyPublishAdapter, ShareReceiveError, ShareReceiveResult, ShareRevocationAdapter, ShareRevocationResult, ShareTarget, TargetPublishAdapter, TargetPublishInput, TargetPublishOutcome, VerifyBearerEnvelopeOptions, authorizationMethodForTarget, authorizeShare, claimShare, inspectShare, isLegacyShareLink, listShares, migrateShare, notifyShare, publishPolicyShare, publishTargetShare, receiveLegacyShare, receiveShare, resumeShareAuthorization, revokeShare, showShare, toShareErrorInfo, verifyBearerEnvelope } from '@tinycloud/share-sdk';
+import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-D9AI8tjN.js';
+export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, f as CreateDelegationParams, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, p as Delegation, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, z as DelegationRevocationReceipt, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, G as GenerateShareParams, H as ISharingService, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, ae as ShareActionSchema, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aF as ShareLink, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b0 as ShareRecipientClientOptionsSchema, b1 as ShareRecipientPolicy, b2 as ShareRecipientPolicySchema, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b5 as ShareRecipientTargetSchema, b6 as ShareResource, b7 as ShareResourceSchema, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bf as SpaceInfo, bg as SpaceOwnership, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from '../recipient-types.schema-D9AI8tjN.js';
+export { EncryptedSenderShareHistory, EncryptedShareHistoryStorage, MemoryEncryptedShareHistoryStorage, ShareAuthorizationAdapter, ShareAuthorizationDenied, ShareAuthorizationMethod, ShareAuthorizationReady, ShareAuthorizationRequired, ShareAuthorizationResult, ShareDeliveryAdapter, ShareErrorCode, ShareErrorInfo, ShareFetchOptions, ShareHistoryView, ShareInspection, ShareMetadata, ShareNotifyResult, ShareNotifyState, SharePolicyPublishAdapter, ShareReceiveError, ShareReceiveResult, ShareRevocationAdapter, ShareRevocationResult, ShareTarget, TargetPublishAdapter, TargetPublishInput, TargetPublishOutcome, authorizationMethodForTarget, authorizeShare, claimShare, inspectShare, listShares, notifyShare, publishPolicyShare, publishTargetShare, receiveShare, resumeShareAuthorization, revokeShare, showShare, toShareErrorInfo } from '@tinycloud/share-sdk';
 import { z } from 'zod';
 import { ServiceSession, InvokeFunction, FetchFunction, IKVService } from '@tinycloud/sdk-services';
 

package/dist/delegations/index.js

@@ -59,6 +59,7 @@ var DelegationErrorSchema = z.object({
 });
 var DelegationErrorCodes = {
   AUTH_REQUIRED: "AUTH_REQUIRED",
+  AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED",
   AUTH_EXPIRED: "AUTH_EXPIRED",
   NOT_INITIALIZED: "NOT_INITIALIZED",
   NOT_FOUND: "NOT_FOUND",
@@ -423,7 +424,7 @@ var CreateDelegationWasmResultSchema = z.object({
 // src/expiry.ts
 var EPHEMERAL_MS = 60 * 60 * 1e3;
 var SIGNED_READ_URL_MS = 5 * 60 * 1e3;
-var SESSION_MS = 7 * 24 * 60 * 60 * 1e3;
+var SESSION_MS = 30 * 24 * 60 * 60 * 1e3;
 var SHARE_MS = 7 * 24 * 60 * 60 * 1e3;
 var APP_MS = 30 * 24 * 60 * 60 * 1e3;
 var MAX_MS = 10 * 365 * 24 * 60 * 60 * 1e3;
@@ -2582,7 +2583,6 @@ import { ed25519 } from "@noble/curves/ed25519";
 import { blake3 } from "@noble/hashes/blake3";
 import { sha256 as sha2562 } from "@noble/hashes/sha256";
 var ENVELOPE_SCHEMA = "xyz.tinycloud.share/envelope";
-var INLINE_PREFIX = "tc2:";
 var RAW_CID_CODEC = 85;
 var BLAKE3_256_CODE = 30;
 var DEFAULT_MAX_INLINE_BYTES = 256 * 1024;
@@ -3287,25 +3287,8 @@ function parsePublishedShareLink(link, options = {}) {
   }
   const origin = normalizeOrigin(url.origin);
   if (options.trustedOrigins !== void 0 && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
-  if (url.search !== "" || url.username !== "" || url.password !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
-  if (url.pathname === "/s/inline" && url.hash.startsWith("#v=2&p=")) {
-    let payload;
-    try {
-      const bytes2 = base64UrlToBytes(url.hash.slice("#v=2&p=".length));
-      if (bytes2.length > (options.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES) * 2) throw new Error("inline payload too large");
-      const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
-      if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("inline payload shape");
-      payload = value;
-    } catch (error) {
-      throw new ShareEnvelopeError("invalid-link", error instanceof Error ? error.message : "invalid inline payload");
-    }
-    if (payload.v !== 2 || typeof payload.c !== "string" || typeof payload.cid !== "string" || payload.k !== void 0 && typeof payload.k !== "string" || Object.keys(payload).some((key3) => !["v", "c", "cid", "k"].includes(key3))) throw new ShareEnvelopeError("invalid-link", "inline payload fields are invalid");
-    const sealed = base64UrlToBytes(payload.c);
-    if (!verifyPublishedShareCid(payload.cid, sealed)) throw new ShareEnvelopeError("cid-mismatch", "inline payload CID does not match");
-    const key2 = payload.k === void 0 ? void 0 : base64UrlToBytes(payload.k);
-    if (key2 !== void 0 && key2.length !== 32) throw new ShareEnvelopeError("invalid-link", "inline payload key is invalid");
-    return { origin, cid: payload.cid, ...key2 === void 0 ? {} : { key: key2 }, sealed };
-  }
+  if (url.username !== "" || url.password !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
+  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
   const match = /^\/s\/([a-z2-7]+)$/.exec(url.pathname);
   if (match === null || !url.hash.startsWith("#k=")) throw new ShareEnvelopeError("invalid-link", "published share link is invalid");
   const key = base64UrlToBytes(url.hash.slice(3));
@@ -3325,13 +3308,10 @@ function parseShareUrl(link, options = {}) {
   } catch {
     throw new ShareEnvelopeError("invalid-link", "share link must be an absolute URL");
   }
-  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share links must not contain query parameters");
   const origin = normalizeOrigin(url.origin);
   if (options.trustedOrigins !== void 0 && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
-  if (url.pathname === "/s/inline" && url.hash.startsWith("#v=2&p=")) {
-    const published = parsePublishedShareLink(link, options);
-    return { kind: "inline", origin, cid: published.cid, key: published.key, url: `${url.origin}${url.pathname}`, protocol: "share-envelope-v2" };
-  }
+  if (url.pathname === "/viewer") throw new ShareEnvelopeError("invalid-link", "retired viewer links are not accepted");
+  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share links must not contain query parameters");
   const match = url.pathname.match(/^\/s\/(i\/)?([^/]+)$/);
   if (!match) throw new ShareEnvelopeError("invalid-link", "share link path is invalid");
   const fragmentParams = url.hash === "" ? void 0 : new URLSearchParams(url.hash.slice(1));
@@ -3354,9 +3334,10 @@ function parseShareUrl(link, options = {}) {
 }
 function isV2ShareLink(link) {
   try {
-    return new URL(link).pathname.startsWith("/s/");
+    const url = new URL(link);
+    return url.search === "" && url.pathname.startsWith("/s/");
   } catch {
-    return link.startsWith(INLINE_PREFIX);
+    return false;
   }
 }
 async function encryptShareBytes(bytes2, key) {
@@ -3917,6 +3898,7 @@ var CompactPayloadSchema = z4.object({
   nnc: z4.string().min(1),
   prf: z4.array(z4.string().min(1))
 }).strict();
+var MAX_POLICY_ROOT_SECONDS = 31 * 24 * 60 * 60;
 function createCompactPolicyInvocation(input) {
   const session = parsePolicySessionUcan(input.sessionAuthorization);
   if (session.cid !== input.sessionCid || session.aud !== input.recipientDid)
@@ -3948,7 +3930,7 @@ function createCompactPolicyInvocation(input) {
   const signature = ed255192.sign(signingInput, input.privateKey);
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
 }
-function createCompactPolicyDescendant(input) {
+function compactPolicyDescendantClaims(input) {
   const parent = parseCompactUcanAuthorization(input.parentAuthorization, input.parentCid);
   if (parent.payload.aud !== input.issuerDid) throw new Error("policy descendant issuer is not the parent audience");
   const parentFact = parent.payload.fct[0];
@@ -3956,23 +3938,33 @@ function createCompactPolicyDescendant(input) {
   if (!Number.isInteger(depth) || depth <= 0) throw new Error("policy descendant depth is exhausted");
   if (!compactAttenuationContains(parent.payload.att, input.attenuation))
     throw new Error("policy descendant exceeds the parent attenuation");
+  const now = Math.max(input.now ?? parent.payload.nbf + 1, parent.payload.nbf + 1);
+  const exp = Math.min(input.expiresAt ?? parent.payload.exp - 1, parent.payload.exp - 1);
+  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
+  return {
+    parentCid: parent.cid,
+    fact: { ...parentFact, remainingRedelegationDepth: depth - 1 },
+    notBefore: now,
+    expiresAt: exp,
+    nonce: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16)))
+  };
+}
+function createCompactPolicyDescendant(input) {
+  const claims = compactPolicyDescendantClaims(input);
   const principal = input.issuerDid.split("#", 1)[0];
   const didMaterial = base58btc.decode(principal.slice("did:key:".length));
   const publicKey = ed255192.getPublicKey(input.privateKey);
   if (didMaterial.length !== 34 || !equalBytes2(publicKey, didMaterial.slice(2))) throw new Error("policy descendant signer does not bind issuer DID");
-  const now = Math.max(input.now ?? Math.floor(Date.now() / 1e3), parent.payload.nbf + 1);
-  const exp = Math.min(input.expiresAt ?? now + 60, now + 60, parent.payload.exp - 1);
-  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
   const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(publicKey) }, typ: "JWT", ucv: "0.10.0" };
   const payload = {
     att: input.attenuation,
     aud: input.audienceDid,
-    exp,
-    fct: [{ ...parentFact, remainingRedelegationDepth: depth - 1 }],
+    exp: claims.expiresAt,
+    fct: [claims.fact],
     iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
-    nbf: now,
-    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
-    prf: [parent.cid]
+    nbf: claims.notBefore,
+    nnc: claims.nonce,
+    prf: [claims.parentCid]
   };
   const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
   const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
@@ -4048,7 +4040,7 @@ function parsePolicySessionUcan(authorization, expectedProofs) {
     throw new Error("policy session UCAN fact is incomplete");
   if (hasV4AuditFactShape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)))
     throw new Error("policy session UCAN v4 audit facts are invalid");
-  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > MAX_POLICY_ROOT_SECONDS || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
     throw new Error("policy session UCAN fact is invalid");
   return {
     authorization,
@@ -5269,6 +5261,13 @@ var ShareRecipientClient = class {
 };
 
 // src/delegations/SharingService.ts
+function spaceIdsEqual(left, right) {
+  const normalizeOwnerAddress = (space) => {
+    const match = /^(tinycloud:pkh:eip155:\d+:)(0x[0-9a-fA-F]{40})(:.+)$/.exec(space);
+    return match === null ? space : `${match[1]}${match[2].toLowerCase()}${match[3]}`;
+  };
+  return normalizeOwnerAddress(left) === normalizeOwnerAddress(right);
+}
 function inferShortServiceFromActionUrns(actions) {
   let short;
   for (const action of actions) {
@@ -5504,11 +5503,11 @@ var SharingService = class {
       }
       return result;
     };
-    const canSatisfyFromRegistry = this.findSuitableKeyForDelegation(
+    const canSatisfyFromRegistry = this.classifyDelegationAuthority(
       fullPath,
       actions,
       requestedExpiry
-    );
+    ) === "ok";
     if (canSatisfyFromRegistry) {
       const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);
       const childDelegationActiveError = this.retiredGraphError();
@@ -5578,49 +5577,58 @@ var SharingService = class {
     return { ok: true, data: shareLink };
   }
   /**
-   * Check if any key in the registry can satisfy the delegation request.
-   * A key can satisfy if it has a delegation that:
-   * 1. Covers the required path (exact match or parent path)
-   * 2. Has all required actions
-   * 3. Has sufficient expiry (delegation.expiry >= requestedExpiry)
-   * 4. Allows sub-delegation
+   * Report, without side effects, whether this session's registry authority
+   * can issue the child delegation {@link generate} would create for the same
+   * `path`, `actions` and `expiry` (defaults and `pathPrefix` applied the
+   * same way):
+   *
+   * - `"ok"`: an uncaveated entry covers it.
+   * - `"caveated"`: only caveated entries cover it. SharingService cannot
+   *   carry signed ReCap caveats into a child delegation.
+   * - `"not-covered"`: no entry covers it, or there is no session.
+   *
+   * It does not consult `onRootDelegationNeeded`, so a signer-backed session
+   * may still generate when this is not `"ok"`.
+   */
+  preflightGenerate(params) {
+    if (!this.session || !params.path) return "not-covered";
+    const fullPath = this.pathPrefix ? `${this.pathPrefix}/${params.path}`.replace(/\/+/g, "/") : params.path;
+    return this.classifyDelegationAuthority(
+      fullPath,
+      params.actions ?? DEFAULT_READ_ACTIONS,
+      params.expiry ?? new Date(Date.now() + DEFAULT_EXPIRY_MS)
+    );
+  }
+  /**
+   * Classify the registry's authority for a child delegation. An entry
+   * satisfies it when it is in the session space, valid, lasts at least until
+   * `requestedExpiry`, allows sub-delegation, covers `path` (exact or parent)
+   * and grants every action. Satisfying entries with caveats are unusable.
    * @internal
    */
-  findSuitableKeyForDelegation(path, actions, requestedExpiry) {
-    const allKeys = this.registry.getAllKeys();
-    for (const key of allKeys) {
-      const delegations = this.registry.getDelegationsForKey(key.id);
-      for (const delegation of delegations) {
-        if (delegation.spaceId !== this.session?.spaceId) {
+  classifyDelegationAuthority(path, actions, requestedExpiry) {
+    let coveredOnlyByCaveated = false;
+    for (const key of this.registry.getAllKeys()) {
+      for (const delegation of this.registry.getDelegationsForKey(key.id)) {
+        if (delegation.spaceId === void 0 || !spaceIdsEqual(delegation.spaceId, this.session?.spaceId ?? "")) {
           continue;
         }
-        if ((delegation.caveats?.length ?? 0) > 0) {
-          continue;
-        }
-        if (!this.registry.isDelegationValid(delegation)) {
-          continue;
-        }
-        if (delegation.expiry < requestedExpiry) {
-          continue;
-        }
-        if (delegation.allowSubDelegation === false) {
-          continue;
-        }
-        const delegationPath = delegation.path || "";
-        if (!this.pathMatches(delegationPath, path)) {
+        if (!this.registry.isDelegationValid(delegation)) continue;
+        if (delegation.expiry < requestedExpiry) continue;
+        if (delegation.allowSubDelegation === false) continue;
+        if (!this.pathMatches(delegation.path || "", path)) continue;
+        const delegationActions = delegation.actions || [];
+        if (!actions.every((action) => delegationActions.includes(action) || delegationActions.includes("*"))) {
           continue;
         }
-        const delegationActions = delegation.actions || [];
-        const hasAllActions = actions.every(
-          (action) => delegationActions.includes(action) || delegationActions.includes("*")
-        );
-        if (!hasAllActions) {
+        if ((delegation.caveats?.length ?? 0) > 0) {
+          coveredOnlyByCaveated = true;
           continue;
         }
-        return true;
+        return "ok";
       }
     }
-    return false;
+    return coveredOnlyByCaveated ? "caveated" : "not-covered";
   }
   retiredGraphError() {
     try {
@@ -5719,11 +5727,23 @@ var SharingService = class {
           const errorText = await registerRes.text();
           const registrationTextActiveError = this.retiredGraphError();
           if (registrationTextActiveError) return { ok: false, error: registrationTextActiveError };
+          const message = `Failed to register delegation with server: ${registerRes.status} ${errorText}`;
+          if (registerRes.status === 401 || registerRes.status === 403) {
+            return {
+              ok: false,
+              error: createError2(
+                DelegationErrorCodes.AUTH_UNAUTHORIZED,
+                message,
+                void 0,
+                { status: registerRes.status }
+              )
+            };
+          }
           return {
             ok: false,
             error: createError2(
               DelegationErrorCodes.CREATION_FAILED,
-              `Failed to register delegation with server: ${registerRes.status} ${errorText}`
+              message
             )
           };
         }
@@ -6593,114 +6613,13 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
   return validateOwnerSharePolicyRegistration(value, expected);
 }
 
-// src/delegations/share-delivery.ts
-import { ed25519 as ed255197 } from "@noble/curves/ed25519";
-var SHARE_DELIVERY_AUTHORIZATION_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v2\0";
-function isCanonicalHttpsOrigin(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
-  }
-  return url.protocol === "https:" && url.origin === value && url.pathname === "/" && url.search === "" && url.hash === "" && url.username === "" && url.password === "";
-}
-var AUTHORIZATION_KEYS = [
-  "type",
-  "version",
-  "jti",
-  "shareCid",
-  "shareId",
-  "registrationCid",
-  "delegationCid",
-  "enforcementDelegationCid",
-  "envelopeCid",
-  "policyCid",
-  "nodeAudience",
-  "targetOrigin",
-  "openCredentialsAudience",
-  "holder",
-  "recipientMatcher",
-  "deliveryEmail",
-  "shareUrl",
-  "returnOrigin",
-  "documentName",
-  "senderDid",
-  "senderTrust",
-  "contentSource",
-  "contentSourceDigest",
-  "shareExpiresAt",
-  "issuedAt",
-  "reportAbuseToken",
-  "actions",
-  "resource",
-  "authorityMaterialHandle",
-  "authorityMaterialDigest",
-  "requestBodyDigest",
-  "idempotencyKey",
-  "expiresAt",
-  "dataAuthority"
-];
-function assertObject2(value, keys, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
-  const record = value;
-  if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);
-  return record;
-}
-function fromB642(value) {
-  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share delivery value is not canonical base64url");
-  if (typeof atob === "function") {
-    const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
-    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
-  }
-  if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(value, "base64url"));
-  throw new Error("base64url decoding is unavailable");
-}
-function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
-  let value;
-  try {
-    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytesValue));
-  } catch {
-    throw new Error("share delivery authorization response is not valid UTF-8 JSON");
-  }
-  const root = assertObject2(value, ["authorization", "proof"], "share delivery authorization response");
-  const authorization = assertObject2(root.authorization, AUTHORIZATION_KEYS, "share delivery authorization");
-  const proof = assertObject2(root.proof, ["alg", "kid", "signature"], "share delivery authorization proof");
-  const request = expected.request;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.idempotencyKey || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
-    throw new Error("share delivery authorization is not bound to the submitted request");
-  }
-  if (typeof authorization.issuedAt !== "string" || Date.parse(authorization.issuedAt) > Date.now() + 6e4) throw new Error("share delivery authorization issuedAt is invalid");
-  if (new Date(authorization.expiresAt).toISOString() !== authorization.expiresAt) throw new Error("share delivery authorization expiresAt is non-canonical");
-  if (typeof authorization.openCredentialsAudience !== "string" || !isCanonicalHttpsOrigin(authorization.openCredentialsAudience) || authorization.openCredentialsAudience !== expected.credentialsAudience || authorization.openCredentialsAudience === authorization.nodeAudience || authorization.openCredentialsAudience === authorization.returnOrigin) {
-    throw new Error("share delivery authorization openCredentialsAudience is missing or untrusted");
-  }
-  if (proof.alg !== "EdDSA" || typeof proof.kid !== "string" || typeof proof.signature !== "string") throw new Error("share delivery authorization proof is invalid");
-  if (proof.kid !== expected.nodeProof.kid) throw new Error("share delivery authorization proof key is not trusted");
-  const encodedKid = expected.nodeProof.publicKey;
-  const publicKey = encodedKid.length === 34 && encodedKid[0] === 237 && encodedKid[1] === 1 ? encodedKid.slice(2) : encodedKid;
-  if (publicKey.length !== 32) throw new Error("share delivery authorization proof key is invalid");
-  const signatureBytes = fromB642(proof.signature);
-  const signedBytes = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_DOMAIN}${canonicalizeSignedObjectUnsigned(authorization)}`);
-  if (signatureBytes.length !== 64 || !ed255197.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
-  return { authorization, proof };
-}
-function shareDeliveryTrustedKid(publicKey) {
-  if (publicKey.length !== 32) throw new Error("share delivery node key must be a raw 32-byte Ed25519 public key");
-  const prefixed = new Uint8Array(34);
-  prefixed.set([237, 1]);
-  prefixed.set(publicKey, 2);
-  const did = `did:key:${base58btc.encode(prefixed)}`;
-  return `${did}#${did.slice("did:key:".length)}`;
-}
-
 // src/delegations/share-delivery-v3.ts
-import { ed25519 as ed255198 } from "@noble/curves/ed25519";
+import { ed25519 as ed255197 } from "@noble/curves/ed25519";
 import { sha256 as sha2568 } from "@noble/hashes/sha256";
 var CREDENTIAL_INVITATION_REQUEST_DOMAIN = "xyz.tinycloud.credentials/invitation-request/v1\0";
 var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v0\0";
-var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
-var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
+var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
+var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
 function exactObject(value, keys, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
   const record = value;
@@ -6744,15 +6663,16 @@ function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   const contentSource = object(envelope.contentSource, "v3 content source");
   const envelopeSignature = object(envelope.signature, "v3 envelope signature");
   const target = object(envelope.target, "v3 target");
-  const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
-  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.audience !== expected.credentialsAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || signature.signerDid !== target.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  const binding = object(envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
+  const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
+  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.label !== expected.request.documentName || request.shareExpiresAt !== envelope.expiry || request.audience !== expected.deliveryAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || target.nodeAudience !== binding.nodeAudience || signature.signerDid !== binding.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
   const issuedAt = Date.parse(String(request.issuedAt));
   const expiresAt = Date.parse(String(request.expiresAt));
   if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 15 * 6e4) throw new Error("v3 share delivery authorization time is invalid");
   const admissionSignature = decodeBase64Url2(signature.value);
   const { signature: _signature, ...unsignedAdmission } = admission;
   const digest4 = sha2568(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
-  if (admissionSignature.length !== 64 || !ed255198.verify(admissionSignature, digest4, didKeyBytes(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
+  if (admissionSignature.length !== 64 || !ed255197.verify(admissionSignature, digest4, didKeyBytes(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
   return { request, admission };
 }
 
@@ -6876,9 +6796,6 @@ import {
   publishPolicyShare,
   claimShare,
   resumeShareAuthorization,
-  isLegacyShareLink,
-  receiveLegacyShare,
-  migrateShare,
   MemoryEncryptedShareHistoryStorage,
   EncryptedSenderShareHistory
 } from "@tinycloud/share-sdk";
@@ -6886,8 +6803,7 @@ import {
   inspectShare,
   receiveShare,
   ShareReceiveError,
-  toShareErrorInfo,
-  verifyBearerEnvelope
+  toShareErrorInfo
 } from "@tinycloud/share-sdk";
 export {
   CREDENTIAL_INVITATION_REQUEST_DOMAIN,
@@ -6905,7 +6821,6 @@ export {
   MemorySenderShareRecordStorage,
   MemoryShareCache,
   ReceiveOptionsSchema,
-  SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
   SenderShareStore,
   ShareAccessError,
   ShareActionSchema,
@@ -6945,10 +6860,8 @@ export {
   importPortableDelegation,
   inspectShare,
   intersectShareCapabilities,
-  isLegacyShareLink,
   isV2ShareLink,
   listShares,
-  migrateShare,
   normalizeShareActions,
   normalizeShareRecipientTarget,
   normalizeShareResource,
@@ -6958,14 +6871,12 @@ export {
   parseShareUrl,
   publishPolicyShare,
   publishTargetShare,
-  receiveLegacyShare,
   receiveShare,
   restoreDelegatedShareKey,
   resumeShareAuthorization,
   revokeShare,
   serializePortableDelegation,
   shareCapabilityAllows,
-  shareDeliveryTrustedKid,
   showShare,
   signShareEnvelope,
   toShareErrorInfo,
@@ -6973,10 +6884,8 @@ export {
   validateOwnerSharePolicyRegistration,
   validateOwnerSharePolicyRegistrationBytes,
   validateReceiveOptions,
-  validateShareDeliveryAuthorizationBytes,
   validateShareDeliveryAuthorizationV3Bytes,
   validateSharingServiceConfig,
-  verifyBearerEnvelope,
   verifyShareCid,
   verifyShareEnvelope
 };