@tinycloud/sdk-core 3.6.0 → 3.7.0-beta.1

package/dist/index.d.cts

@@ -5,8 +5,8 @@ export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailbox
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { AuthorityRefusal, AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, IStorageService, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVChange, KVChangesAuthority, KVChangesOptions, KVChangesResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListPage, KVListResponse, KVPutOptions, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PinnedKey, PrefixedKVService, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedReplicationOptions, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageFullHandler, StorageFullMonitor, StorageRejectionDetails, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, appSecretScope, authorizationVerdictOf, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, isStorageFullError, networkDiscoveryKey, ok, openWrappedKey, parseCapabilityResource, parseNetworkId, parseSecretCatalogKey, parseStorageRejection, parseStorageStatus, resolveSecretListPrefix, resolveSecretPath, serviceError, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validatedCapabilityOf, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.cjs';
-import { o as Delegation, e as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, w as DelegationManager, a as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-DbCAdUKc.cjs';
-export { b as AccountDelegationRecord, c as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, d as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as CredentialInvitationRequest, j as DELIVERY_ADMISSION_DOMAIN, k as DelegateReceivedShareParams, l as DelegatedResource, m as DelegatedShareAccess, n as DelegatedShareKey, p as DelegationApiResponse, q as DelegationChain, r as DelegationChainV2, s as DelegationDirection, D as DelegationError, t as DelegationErrorCode, u as DelegationErrorCodes, v as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-DbCAdUKc.cjs';
+import { o as Delegation, e as CreateDelegationParams, G as GenerateShareParams, aG as ShareLink, bg as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, w as DelegationManager, a as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-BApcOn1t.cjs';
+export { b as AccountDelegationRecord, c as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, d as CapabilityEntry, bT as CapabilityKeyRegistry, bU as CapabilityKeyRegistryErrorCode, bV as CapabilityKeyRegistryErrorCodes, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as CredentialInvitationRequest, j as DELIVERY_ADMISSION_DOMAIN, k as DelegateReceivedShareParams, l as DelegatedResource, m as DelegatedShareAccess, n as DelegatedShareKey, p as DelegationApiResponse, q as DelegationChain, r as DelegationChainV2, s as DelegationDirection, D as DelegationError, t as DelegationErrorCode, u as DelegationErrorCodes, v as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDeliveryRefusedError, aB as ShareDetachedProof, aC as ShareEnvelopeError, aD as ShareEnvelopeV2, aE as ShareExpiryBounds, aF as ShareKvContentSource, aH as ShareLinkData, aI as ShareLinkLocation, aJ as ShareListEntry, aK as ShareListResult, aL as ShareNativeAction, aM as ShareNativeInvokeEnvelopeV1, aN as ShareNativeInvokeErrorResult, aO as ShareNativeInvokeInput, aP as ShareNativeInvokeResult, aQ as ShareNativeInvokeSuccessResult, aR as ShareNativeResponse, aS as ShareNativeResponseSchema, aT as SharePolicy, aU as SharePolicyBinding, aV as SharePolicySession, aW as SharePolicySessionV1, aX as SharePolicySessionWireV1, aY as SharePortableDelegation, aZ as ShareReadInvocationV1, a_ as ShareReadResult, a$ as ShareRecipientClient, b0 as ShareRecipientClientOptions, b2 as ShareRecipientPolicy, b4 as ShareRecipientResult, b5 as ShareRecipientTarget, b7 as ShareResource, b9 as ShareSaveOptions, ba as ShareSchema, bb as ShareSqlContentSource, bc as ShareWireAction, bd as SharingService, be as SharingServiceConfig, bf as SignedDelegation, bh as SpaceOwnership, bW as StoredDelegationChain, bi as VerifyShareEnvelopeOptions, bj as canonicalOwnerSharePolicy, bk as computeOwnerShareRegistrationCid, bl as computeShareCid, bX as createCapabilityKeyRegistry, bm as createDelegatedShareKey, bn as createPolicyEnforcementDelegation, bo as createShareArtifact, bp as createShareArtifactAsync, bq as createSharePolicy, br as createSharingService, bs as decryptShareBytesAsync, bt as delegatePortablePolicySession, bu as encodeInlineShareUrl, bv as encodeShareArtifact, bw as encodeShareUrl, bx as encryptShareBytes, by as encryptShareBytesAsync, bz as importPortableDelegation, bA as intersectShareCapabilities, bB as isV2ShareLink, bC as normalizeShareActions, bD as normalizeShareRecipientTarget, bE as normalizeShareResource, bF as parsePortableDelegation, bG as parseShareArtifact, bH as parseShareUrl, bI as restoreDelegatedShareKey, bJ as serializePortableDelegation, bK as shareCapabilityAllows, bL as shortDeliveryLinkBodyCid, bM as signShareEnvelope, bN as validateOwnerSharePolicyRegistration, bO as validateOwnerSharePolicyRegistrationBytes, bP as verifyShareCid, bQ as verifyShareDeliveryAuthorizationV3Bytes, bR as verifyShareEnvelope, bS as withoutShareLink } from './recipient-types.schema-BApcOn1t.cjs';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.cjs';
 export { SiweMessage } from 'siwe';

package/dist/index.d.ts

@@ -5,8 +5,8 @@ export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailbox
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { AuthorityRefusal, AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, IStorageService, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVChange, KVChangesAuthority, KVChangesOptions, KVChangesResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListPage, KVListResponse, KVPutOptions, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PinnedKey, PrefixedKVService, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedReplicationOptions, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageFullHandler, StorageFullMonitor, StorageRejectionDetails, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, appSecretScope, authorizationVerdictOf, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, isStorageFullError, networkDiscoveryKey, ok, openWrappedKey, parseCapabilityResource, parseNetworkId, parseSecretCatalogKey, parseStorageRejection, parseStorageStatus, resolveSecretListPrefix, resolveSecretPath, serviceError, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validatedCapabilityOf, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
-import { o as Delegation, e as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, w as DelegationManager, a as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-DbCAdUKc.js';
-export { b as AccountDelegationRecord, c as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, d as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as CredentialInvitationRequest, j as DELIVERY_ADMISSION_DOMAIN, k as DelegateReceivedShareParams, l as DelegatedResource, m as DelegatedShareAccess, n as DelegatedShareKey, p as DelegationApiResponse, q as DelegationChain, r as DelegationChainV2, s as DelegationDirection, D as DelegationError, t as DelegationErrorCode, u as DelegationErrorCodes, v as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-DbCAdUKc.js';
+import { o as Delegation, e as CreateDelegationParams, G as GenerateShareParams, aG as ShareLink, bg as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, w as DelegationManager, a as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-BApcOn1t.js';
+export { b as AccountDelegationRecord, c as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, d as CapabilityEntry, bT as CapabilityKeyRegistry, bU as CapabilityKeyRegistryErrorCode, bV as CapabilityKeyRegistryErrorCodes, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as CredentialInvitationRequest, j as DELIVERY_ADMISSION_DOMAIN, k as DelegateReceivedShareParams, l as DelegatedResource, m as DelegatedShareAccess, n as DelegatedShareKey, p as DelegationApiResponse, q as DelegationChain, r as DelegationChainV2, s as DelegationDirection, D as DelegationError, t as DelegationErrorCode, u as DelegationErrorCodes, v as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDeliveryRefusedError, aB as ShareDetachedProof, aC as ShareEnvelopeError, aD as ShareEnvelopeV2, aE as ShareExpiryBounds, aF as ShareKvContentSource, aH as ShareLinkData, aI as ShareLinkLocation, aJ as ShareListEntry, aK as ShareListResult, aL as ShareNativeAction, aM as ShareNativeInvokeEnvelopeV1, aN as ShareNativeInvokeErrorResult, aO as ShareNativeInvokeInput, aP as ShareNativeInvokeResult, aQ as ShareNativeInvokeSuccessResult, aR as ShareNativeResponse, aS as ShareNativeResponseSchema, aT as SharePolicy, aU as SharePolicyBinding, aV as SharePolicySession, aW as SharePolicySessionV1, aX as SharePolicySessionWireV1, aY as SharePortableDelegation, aZ as ShareReadInvocationV1, a_ as ShareReadResult, a$ as ShareRecipientClient, b0 as ShareRecipientClientOptions, b2 as ShareRecipientPolicy, b4 as ShareRecipientResult, b5 as ShareRecipientTarget, b7 as ShareResource, b9 as ShareSaveOptions, ba as ShareSchema, bb as ShareSqlContentSource, bc as ShareWireAction, bd as SharingService, be as SharingServiceConfig, bf as SignedDelegation, bh as SpaceOwnership, bW as StoredDelegationChain, bi as VerifyShareEnvelopeOptions, bj as canonicalOwnerSharePolicy, bk as computeOwnerShareRegistrationCid, bl as computeShareCid, bX as createCapabilityKeyRegistry, bm as createDelegatedShareKey, bn as createPolicyEnforcementDelegation, bo as createShareArtifact, bp as createShareArtifactAsync, bq as createSharePolicy, br as createSharingService, bs as decryptShareBytesAsync, bt as delegatePortablePolicySession, bu as encodeInlineShareUrl, bv as encodeShareArtifact, bw as encodeShareUrl, bx as encryptShareBytes, by as encryptShareBytesAsync, bz as importPortableDelegation, bA as intersectShareCapabilities, bB as isV2ShareLink, bC as normalizeShareActions, bD as normalizeShareRecipientTarget, bE as normalizeShareResource, bF as parsePortableDelegation, bG as parseShareArtifact, bH as parseShareUrl, bI as restoreDelegatedShareKey, bJ as serializePortableDelegation, bK as shareCapabilityAllows, bL as shortDeliveryLinkBodyCid, bM as signShareEnvelope, bN as validateOwnerSharePolicyRegistration, bO as validateOwnerSharePolicyRegistrationBytes, bP as verifyShareCid, bQ as verifyShareDeliveryAuthorizationV3Bytes, bR as verifyShareEnvelope, bS as withoutShareLink } from './recipient-types.schema-BApcOn1t.js';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.js';
 export { SiweMessage } from 'siwe';

package/dist/index.js

@@ -11777,7 +11777,7 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
 import { ed25519 as ed255199 } from "@noble/curves/ed25519";
 import { sha256 as sha25611 } from "@noble/hashes/sha256";
 var CREDENTIAL_INVITATION_REQUEST_DOMAIN = "xyz.tinycloud.credentials/invitation-request/v1\0";
-var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v0\0";
+var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v1\0";
 var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
 var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
 function exactObject2(value, keys, label) {
@@ -11816,7 +11816,7 @@ function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   const request = exactObject2(root.request, REQUEST_KEYS, "credential invitation request");
   const admission = exactObject2(root.admission, ADMISSION_KEYS, "delivery admission");
   const signature = exactObject2(admission.signature, ["suite", "signerDid", "value"], "delivery admission signature");
-  const envelope = object3(expected.request.envelope, "v3 share envelope");
+  const envelope = object3(expected.envelope, "v3 share envelope");
   const policy = object3(envelope.policy, "v3 share policy");
   const requirement = object3(policy.credentialRequirement, "v3 credential requirement");
   const credentialType = object3(requirement.credentialType, "v3 credential type");
@@ -11825,16 +11825,42 @@ function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   const target = object3(envelope.target, "v3 target");
   const binding = object3(envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
   const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
-  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.label !== expected.request.documentName || request.shareExpiresAt !== envelope.expiry || request.audience !== expected.deliveryAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || target.nodeAudience !== binding.nodeAudience || signature.signerDid !== binding.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v1" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.envelopeRef || request.label !== expected.request.documentName || request.shareExpiresAt !== envelope.expiry || request.audience !== expected.deliveryAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || target.nodeAudience !== binding.nodeAudience || signature.signerDid !== binding.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
   const issuedAt = Date.parse(String(request.issuedAt));
   const expiresAt = Date.parse(String(request.expiresAt));
   if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 15 * 6e4) throw new Error("v3 share delivery authorization time is invalid");
   const admissionSignature = decodeBase64Url3(signature.value);
   const { signature: _signature, ...unsignedAdmission } = admission;
-  const digest4 = sha25611(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
+  const digest4 = admissionDigest(unsignedAdmission);
   if (admissionSignature.length !== 64 || !ed255199.verify(admissionSignature, digest4, didKeyBytes2(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
   return { request, admission };
 }
+function admissionDigest(unsignedAdmission) {
+  return sha25611(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
+}
+async function verifyShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
+  const verified = validateShareDeliveryAuthorizationV3Bytes(bytes2, expected);
+  const { signature, ...unsignedAdmission } = verified.admission;
+  (await import("@tinycloud/share-envelope/links")).assertDidKeySignature(signature.signerDid, admissionDigest(unsignedAdmission), signature.value);
+  return verified;
+}
+async function shortDeliveryLinkBodyCid(shareUrl, trustedOrigins) {
+  const links = await import("@tinycloud/share-envelope/links");
+  const cid2 = links.shortShareLinkCid(shareUrl, { trustedOrigins: trustedOrigins ?? links.DEFAULT_SHARE_ORIGINS });
+  if (cid2 === void 0) throw new Error("share delivery requires a short share link");
+  return cid2;
+}
+async function withoutShareLink(text3, shareUrl) {
+  return (await import("@tinycloud/share-envelope/links")).redactLink(text3, shareUrl);
+}
+var ShareDeliveryRefusedError = class extends Error {
+  constructor() {
+    super("share delivery authorization refused");
+    this.code = "delivery-authorization-invalid";
+    this.status = 400;
+    this.name = "ShareDeliveryRefusedError";
+  }
+};
 
 // src/delegations/sender-share-store.ts
 var MemorySenderShareRecordStorage = class {
@@ -19657,6 +19683,7 @@ export {
   ShareAddressedDelegationRequestV2Schema,
   ShareAddressedDelegationResponseV2Schema,
   ShareConflict,
+  ShareDeliveryRefusedError,
   ShareEnvelopeError,
   ShareNativeResponseSchema,
   ShareRecipientClient,
@@ -19907,6 +19934,7 @@ export {
   serviceError6 as serviceError,
   sha256Base64Url,
   shareCapabilityAllows,
+  shortDeliveryLinkBodyCid,
   signCompactPolicyDescendant,
   signCompactUcanAuthorization,
   signCompactUcanRootAuthorization,
@@ -19945,7 +19973,6 @@ export {
   validatePolicyStatusSignedShape,
   validatePolicyStatusUnsigned,
   validatePolicyUnsigned,
-  validateShareDeliveryAuthorizationV3Bytes,
   validateUnifiedPolicyV2,
   validatedCapabilityOf,
   verifyDecryptResponse,
@@ -19960,8 +19987,10 @@ export {
   verifyPolicyRootStatusCheckpointV3,
   verifyPolicyStatus,
   verifyShareCid,
+  verifyShareDeliveryAuthorizationV3Bytes,
   verifyShareEnvelope,
   verifySignedObject,
-  verifyStorageReceipt
+  verifyStorageReceipt,
+  withoutShareLink
 };
 //# sourceMappingURL=index.js.map