@tinycloud/share-sdk 0.3.0-beta.1 → 0.3.0-beta.2

package/dist/index.cjs

@@ -4614,25 +4614,25 @@ function encodeTo(int, target, offset = 0) {
 function encodingLength(int) {
   return varint_default.encodingLength(int);
 }
-function create(code22, digest4) {
-  const size = digest4.byteLength;
+function create(code22, digest3) {
+  const size = digest3.byteLength;
   const sizeOffset = encodingLength(code22);
   const digestOffset = sizeOffset + encodingLength(size);
   const bytes3 = new Uint8Array(digestOffset + size);
   encodeTo(code22, bytes3, 0);
   encodeTo(size, bytes3, sizeOffset);
-  bytes3.set(digest4, digestOffset);
-  return new Digest(code22, size, digest4, bytes3);
+  bytes3.set(digest3, digestOffset);
+  return new Digest(code22, size, digest3, bytes3);
 }
 function decode4(multihash) {
   const bytes3 = coerce2(multihash);
   const [code22, sizeOffset] = decode3(bytes3);
   const [size, digestOffset] = decode3(bytes3.subarray(sizeOffset));
-  const digest4 = bytes3.subarray(sizeOffset + digestOffset);
-  if (digest4.byteLength !== size) {
+  const digest3 = bytes3.subarray(sizeOffset + digestOffset);
+  if (digest3.byteLength !== size) {
     throw new Error("Incorrect length");
   }
-  return new Digest(code22, size, digest4, bytes3);
+  return new Digest(code22, size, digest3, bytes3);
 }
 function equals2(a, b) {
   if (a === b) {
@@ -4650,10 +4650,10 @@ var Digest = class {
   /**
    * Creates a multihash digest.
    */
-  constructor(code22, size, digest4, bytes3) {
+  constructor(code22, size, digest3, bytes3) {
     this.code = code22;
     this.size = size;
-    this.digest = digest4;
+    this.digest = digest3;
     this.bytes = bytes3;
   }
 };
@@ -4734,8 +4734,8 @@ var CID = class _CID {
   toV1() {
     switch (this.version) {
       case 0: {
-        const { code: code22, digest: digest4 } = this.multihash;
-        const multihash = create(code22, digest4);
+        const { code: code22, digest: digest3 } = this.multihash;
+        const multihash = create(code22, digest3);
         return _CID.createV1(this.code, multihash);
       }
       case 1: {
@@ -4789,8 +4789,8 @@ var CID = class _CID {
       return new _CID(version, code22, multihash, bytes3 ?? encodeCID(version, code22, multihash.bytes));
     } else if (value[cidSymbol] === true) {
       const { version, multihash, code: code22 } = value;
-      const digest4 = decode4(multihash);
-      return _CID.create(version, code22, digest4);
+      const digest3 = decode4(multihash);
+      return _CID.create(version, code22, digest3);
     } else {
       return null;
     }
@@ -4800,11 +4800,11 @@ var CID = class _CID {
    * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
    * @param digest - (Multi)hash of the of the content.
    */
-  static create(version, code22, digest4) {
+  static create(version, code22, digest3) {
     if (typeof code22 !== "number") {
       throw new Error("String codecs are no longer supported");
     }
-    if (!(digest4.bytes instanceof Uint8Array)) {
+    if (!(digest3.bytes instanceof Uint8Array)) {
       throw new Error("Invalid digest");
     }
     switch (version) {
@@ -4812,12 +4812,12 @@ var CID = class _CID {
         if (code22 !== DAG_PB_CODE) {
           throw new Error(`Version 0 CID must use dag-pb (code: ${DAG_PB_CODE}) block encoding`);
         } else {
-          return new _CID(version, code22, digest4, digest4.bytes);
+          return new _CID(version, code22, digest3, digest3.bytes);
         }
       }
       case 1: {
-        const bytes3 = encodeCID(version, code22, digest4.bytes);
-        return new _CID(version, code22, digest4, bytes3);
+        const bytes3 = encodeCID(version, code22, digest3.bytes);
+        return new _CID(version, code22, digest3, bytes3);
       }
       default: {
         throw new Error("Invalid version");
@@ -4827,8 +4827,8 @@ var CID = class _CID {
   /**
    * Simplified version of `create` for CIDv0.
    */
-  static createV0(digest4) {
-    return _CID.create(0, DAG_PB_CODE, digest4);
+  static createV0(digest3) {
+    return _CID.create(0, DAG_PB_CODE, digest3);
   }
   /**
    * Simplified version of `create` for CIDv1.
@@ -4836,8 +4836,8 @@ var CID = class _CID {
    * @param code - Content encoding format code.
    * @param digest - Multihash of the content.
    */
-  static createV1(code22, digest4) {
-    return _CID.create(1, code22, digest4);
+  static createV1(code22, digest3) {
+    return _CID.create(1, code22, digest3);
   }
   /**
    * Decoded a CID from its binary representation. The byte array must contain
@@ -4870,8 +4870,8 @@ var CID = class _CID {
       throw new Error("Incorrect length");
     }
     const digestBytes3 = multihashBytes.subarray(specs.multihashSize - specs.digestSize);
-    const digest4 = new Digest(specs.multihashCode, specs.digestSize, digestBytes3, multihashBytes);
-    const cid2 = specs.version === 0 ? _CID.createV0(digest4) : _CID.createV1(specs.codec, digest4);
+    const digest3 = new Digest(specs.multihashCode, specs.digestSize, digestBytes3, multihashBytes);
+    const cid2 = specs.version === 0 ? _CID.createV0(digest3) : _CID.createV1(specs.codec, digest3);
     return [cid2, bytes3.subarray(specs.size)];
   }
   /**
@@ -4994,8 +4994,8 @@ var cidSymbol = /* @__PURE__ */ Symbol.for("@ipld/js-cid/CID");
 var code = 85;
 var SHA256_CODE = 18;
 async function computeCid(bytes3) {
-  const digest4 = create(SHA256_CODE, (0, import_sha2.sha256)(new Uint8Array(bytes3)));
-  return CID.create(1, code, digest4).toString();
+  const digest3 = create(SHA256_CODE, (0, import_sha2.sha256)(new Uint8Array(bytes3)));
+  return CID.create(1, code, digest3).toString();
 }
 function isCanonicalRawCid(cidString) {
   let cid2;
@@ -5979,8 +5979,8 @@ async function verifyEnvelopeV3(envelope, options) {
   if (hex(sourceDigest) !== parsed.contentSourceDigestHex) return false;
   const sortedCapabilities = [...policy.capabilityCeiling].sort((left, right) => canonicalize(left).localeCompare(canonicalize(right)));
   const capabilityCeilingHashHex = hex((0, import_sha256.sha256)(new TextEncoder().encode(`${POLICY_CAPABILITY_V1_DOMAIN}${canonicalize(sortedCapabilities)}`)));
-  const nativeProjection = sortedCapabilities.map((capability) => capability.kind === "encryption" ? { service: "tinycloud.encryption", space: capability.resource, path: capability.resource, actions: [capability.action] } : { service: "tinycloud.kv", space: capability.resource.slice(0, capability.resource.indexOf("/kv/")), path: capability.resource.split("/kv/")[1], actions: [...capability.actions], caveat: { type: "xyz.tinycloud.resource/selector", kind: capability.selector, value: capability.resource } }).sort((left, right) => canonicalize(left).localeCompare(canonicalize(right)));
-  const nativeProjectionHashHex = hex((0, import_sha256.sha256)(new TextEncoder().encode(`${NATIVE_PROJECTION_V1_DOMAIN}${canonicalize(nativeProjection)}`)));
+  const nativeProjection2 = sortedCapabilities.map((capability) => capability.kind === "encryption" ? { service: "tinycloud.encryption", space: capability.resource, path: capability.resource, actions: [capability.action] } : { service: "tinycloud.kv", space: capability.resource.slice(0, capability.resource.indexOf("/kv/")), path: capability.resource.split("/kv/")[1], actions: [...capability.actions], caveat: { type: "xyz.tinycloud.resource/selector", kind: capability.selector, value: capability.resource } }).sort((left, right) => canonicalize(left).localeCompare(canonicalize(right)));
+  const nativeProjectionHashHex = hex((0, import_sha256.sha256)(new TextEncoder().encode(`${NATIVE_PROJECTION_V1_DOMAIN}${canonicalize(nativeProjection2)}`)));
   const expectedAttenuation = Object.fromEntries(sortedCapabilities.map((capability) => capability.kind === "encryption" ? [capability.resource, { [capability.action]: [{}] }] : [capability.resource, Object.fromEntries(capability.actions.map((action) => [action, [{ kind: capability.selector, type: "xyz.tinycloud.resource/selector", value: capability.resource }]]))]));
   const kv = policy.capabilityCeiling.find((capability) => capability.kind === "kv");
   const expectedKvActions = parsed.actions.flatMap((action) => action === "read" ? ["tinycloud.kv/get", "tinycloud.kv/metadata"] : action === "list" ? ["tinycloud.kv/list"] : ["tinycloud.kv/put"]);
@@ -5993,8 +5993,8 @@ async function verifyEnvelopeV3(envelope, options) {
   const expectedBindingDigestHex = hex((0, import_sha256.sha256)(new TextEncoder().encode(canonicalize({ enforcerDid: binding.enforcerDid, nodeAudience: binding.nodeAudience }))));
   if (binding.enforcerDid !== parsed.target.nodeAudience || binding.attestationBindingDigestHex !== expectedBindingDigestHex || bindingSignature.signerDid !== binding.nodeAudience || bindingSignature.suite !== "Ed25519" || Date.parse(binding.issuedAt) > Date.now() || Date.parse(binding.expiresAt) <= Date.now() || Date.parse(binding.expiresAt) < Date.parse(parsed.expiry)) return false;
   try {
-    const digest4 = (0, import_sha256.sha256)(new TextEncoder().encode(`${ATTESTED_ENFORCER_V2_DOMAIN}${canonicalize(unsignedBinding)}`));
-    if (!import_ed255193.ed25519.verify(fromBase64Url(bindingSignature.value), digest4, ed25519PublicKeyFromDidKey(binding.nodeAudience), ED25519_VERIFY_OPTS2)) return false;
+    const digest3 = (0, import_sha256.sha256)(new TextEncoder().encode(`${ATTESTED_ENFORCER_V2_DOMAIN}${canonicalize(unsignedBinding)}`));
+    if (!import_ed255193.ed25519.verify(fromBase64Url(bindingSignature.value), digest3, ed25519PublicKeyFromDidKey(binding.nodeAudience), ED25519_VERIFY_OPTS2)) return false;
   } catch {
     return false;
   }
@@ -6777,10 +6777,31 @@ async function parseAddressedEnvelope(value) {
   return { envelope, policy: decoded, policyCid: envelope.authorizationTarget.policyCid };
 }
 
-// src/owner-policy.ts
-var import_ed255195 = require("@noble/curves/ed25519");
+// src/addressed-publish.ts
 var import_sha2562 = require("@noble/hashes/sha256");
 
+// src/authorization.ts
+async function authorizeShare(input) {
+  if (input.resumeToken !== void 0) {
+    if (input.resumeToken.length < 16 || input.resumeToken.length > 512) {
+      return { state: "denied", reason: "rejected" };
+    }
+    return input.adapter.resume({
+      envelope: input.envelope,
+      method: input.method,
+      resumeToken: input.resumeToken,
+      ...input.proof === void 0 ? {} : { proof: input.proof }
+    });
+  }
+  return input.adapter.begin({ envelope: input.envelope, method: input.method });
+}
+function authorizationMethodForTarget(target) {
+  if (target.kind === "recipientDid") return "openkey-device";
+  if (target.kind === "email") return "email-claim";
+  if (target.kind === "emailDomain") return "email-claim";
+  return void 0;
+}
+
 // ../../node_modules/multiformats/dist/src/bytes.js
 var empty2 = new Uint8Array(0);
 function equals3(aa, bb) {
@@ -7122,6 +7143,347 @@ function rfc46482({ name, prefix, bitsPerChar, alphabet }) {
   });
 }
 
+// ../../node_modules/multiformats/dist/src/bases/base58.js
+var base58btc2 = baseX2({
+  name: "base58btc",
+  prefix: "z",
+  alphabet: "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+});
+var base58flickr2 = baseX2({
+  name: "base58flickr",
+  prefix: "Z",
+  alphabet: "123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ"
+});
+
+// src/targets.ts
+function validEmail(value) {
+  return /^[^@\s]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i.test(value);
+}
+function validDomain(value) {
+  return /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))+$/i.test(value);
+}
+function validRecipientDid(value) {
+  if (value.length === 0 || value.length > 2048 || /[\u0000-\u0020\u007f]/.test(value)) return false;
+  const parts = value.split(":");
+  if (parts.length < 3 || parts[0] !== "did" || !/^[a-z0-9]+$/.test(parts[1] ?? "")) return false;
+  const identifier = parts.slice(2);
+  if (identifier.some((part) => part.length === 0)) return false;
+  if (parts[1] === "web") {
+    const host = identifier[0] ?? "";
+    if (host.length > 253 || host.split(".").some((label) => !label || label.length > 63 || !/^[A-Za-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-"))) return false;
+    return identifier.slice(1).every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  }
+  if (parts[1] === "pkh") return identifier.length >= 3 && identifier.every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  if (parts[1] === "key") {
+    try {
+      const bytes3 = base58btc2.decode(identifier.join(":"));
+      return bytes3.length === 34 && bytes3[0] === 237 && bytes3[1] === 1;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function normalizeShareTarget(target) {
+  if (target.kind === "bearer") return target;
+  if (target.kind === "recipientDid") {
+    if (!validRecipientDid(target.did)) throw new TypeError("recipient DID is invalid");
+    return { kind: target.kind, did: target.did };
+  }
+  if (target.kind === "email") {
+    if (!validEmail(target.address)) throw new TypeError("recipient email is invalid");
+    const at = target.address.lastIndexOf("@");
+    return { kind: target.kind, address: `${target.address.slice(0, at)}@${target.address.slice(at + 1).toLowerCase()}` };
+  }
+  if (!validDomain(target.domain)) throw new TypeError("recipient email domain is invalid");
+  return { kind: target.kind, domain: target.domain.toLowerCase() };
+}
+function targetAuthorizationMethod(target) {
+  return authorizationMethodForTarget(target);
+}
+async function publishTargetShare(input) {
+  const target = normalizeShareTarget(input.target);
+  if (target.kind === "bearer") return publishShare(input);
+  if (input.targetAdapter === void 0) {
+    return {
+      state: "authorization-required",
+      method: targetAuthorizationMethod(target)
+    };
+  }
+  const source = input.source instanceof Uint8Array ? input.source.slice() : await (async () => {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of input.source) {
+      if (!(chunk instanceof Uint8Array)) throw new TypeError("addressed publication source yielded invalid bytes");
+      size += chunk.byteLength;
+      if (size > (input.maxBytes ?? 100 * 1024 * 1024)) throw new TypeError("addressed publication exceeds maxBytes");
+      chunks.push(chunk.slice());
+    }
+    const bytes3 = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes3.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return bytes3;
+  })();
+  const files = input.files === void 0 || input.files.length === 0 ? [{ bytes: source }] : input.files;
+  const limit = input.maxBytes ?? SHARE_CONTENT_LIMIT;
+  let totalBytes = 0;
+  for (const file of files) {
+    totalBytes += file.bytes.byteLength;
+    if (!Number.isSafeInteger(totalBytes) || totalBytes > limit) {
+      throw new SharePublishError("max-bytes-exceeded", "addressed publication exceeds the combined byte limit");
+    }
+  }
+  return input.targetAdapter.publish({
+    source,
+    filename: input.filename,
+    ...input.files === void 0 ? {} : { files: input.files },
+    ...input.mediaType === void 0 ? {} : { mediaType: input.mediaType },
+    ...input.resourceKind === void 0 ? {} : { resourceKind: input.resourceKind },
+    ...input.actions === void 0 ? {} : { actions: input.actions },
+    target,
+    expiresAt: input.expiresAt ?? new Date((input.now?.() ?? Date.now()) + 7 * 24 * 60 * 60 * 1e3),
+    origin: input.origin,
+    ...input.inline === void 0 ? {} : { inline: input.inline },
+    upload: {
+      ...input.registryBaseUrl === void 0 ? {} : { registryBaseUrl: input.registryBaseUrl },
+      ...input.fetchFn === void 0 ? {} : { fetchFn: input.fetchFn },
+      ...input.authorizeUpload === void 0 ? {} : { authorizeUpload: input.authorizeUpload },
+      ...input.authorizationOrigin === void 0 ? {} : { authorizationOrigin: input.authorizationOrigin },
+      ...input.credentials === void 0 ? {} : { credentials: input.credentials },
+      ...input.allowInsecureRegistry === void 0 ? {} : { allowInsecureRegistry: input.allowInsecureRegistry },
+      ...input.uploadBlob === void 0 ? {} : { uploadBlob: input.uploadBlob }
+    },
+    ...input.notify === void 0 ? {} : { notify: input.notify }
+  });
+}
+
+// src/addressed-publish.ts
+var POLICY_V1_DOMAIN = "xyz.tinycloud.policy/policy/v1\0";
+var POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
+var POLICY_CAPABILITY_V1_DOMAIN2 = "xyz.tinycloud.policy/PolicyCapability/v1\0";
+var CONTENT_SOURCE_V1_DOMAIN2 = "xyz.tinycloud.policy/ContentSource/v1\0";
+var NATIVE_PROJECTION_V1_DOMAIN2 = "xyz.tinycloud.policy/NativeProjection/v1\0";
+var ENVELOPE_V3_DOMAIN = "xyz.tinycloud.share/envelope/v3\0";
+var textEncoder = new TextEncoder();
+function targetMatcher(target) {
+  if (target.kind === "recipientDid") return { kind: "recipientDid", value: target.did };
+  if (target.kind === "email") return { kind: "exactEmail", value: target.address };
+  return { kind: "emailDomain", value: target.domain };
+}
+function targetKind(target) {
+  return target.kind;
+}
+function assertSafeInput(input) {
+  if (!/^[A-Za-z0-9_-]{16,128}$/.test(input.shareId)) throw new TypeError("addressed share id is invalid");
+  if (input.filename.length === 0 || input.filename === "." || input.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(input.filename)) throw new TypeError("addressed filename is invalid");
+  if (!Number.isSafeInteger(input.byteLength) || input.byteLength < 0 || input.byteLength > SHARE_CONTENT_LIMIT) throw new TypeError("addressed content length is invalid");
+  if (input.actions.length === 0 || input.policyActions.length === 0) throw new TypeError("addressed share actions are empty");
+  if (!Number.isFinite(input.expiresAt.getTime()) || input.expiresAt.getTime() <= Date.now()) throw new TypeError("addressed share expiry must be in the future");
+  if (input.artifact === "html" && (input.resource.kind !== "prefix" || !input.actions.includes("read") || !input.actions.includes("list"))) throw new TypeError("html artifacts require a readable prefix");
+  if (input.contentSource.shareId !== input.shareId || input.contentSource.selector !== input.resource.kind) throw new TypeError("addressed content source is not bound to the share");
+}
+function hex2(bytes3) {
+  return [...bytes3].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function digestHex(value, domain) {
+  return hex2((0, import_sha2562.sha256)(textEncoder.encode(`${domain}${canonicalize(value)}`)));
+}
+function sortCanonical(values) {
+  return [...values].sort((left, right) => canonicalize(left).localeCompare(canonicalize(right)));
+}
+function base32Lower2(bytes3) {
+  const alphabet = "abcdefghijklmnopqrstuvwxyz234567";
+  let output = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of bytes3) {
+    buffer = buffer << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += alphabet[buffer >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) output += alphabet[buffer << 5 - bits & 31];
+  return output;
+}
+function rfc3339Seconds(value) {
+  return new Date(Math.floor(value.getTime() / 1e3) * 1e3).toISOString().replace(".000Z", "Z");
+}
+function nativeProjection(capabilities) {
+  return sortCanonical(capabilities.map((capability) => capability.kind === "encryption" ? { service: "tinycloud.encryption", space: capability.resource, path: capability.resource, actions: [capability.action] } : {
+    service: "tinycloud.kv",
+    space: capability.resource.slice(0, capability.resource.indexOf("/kv/")),
+    path: capability.resource.slice(capability.resource.indexOf("/kv/") + 4),
+    actions: [...capability.actions],
+    caveat: { type: "xyz.tinycloud.resource/selector", kind: capability.selector, value: capability.resource }
+  }));
+}
+async function createPolicy(options, capabilities) {
+  const fields = {
+    ownerDid: options.authority.ownerDid,
+    createdAt: rfc3339Seconds(/* @__PURE__ */ new Date()),
+    expiresAt: rfc3339Seconds(options.expiresAt),
+    contentSource: options.contentSource,
+    capabilityCeiling: [...capabilities]
+  };
+  const unsigned = options.credentialRequirement === void 0 ? { schema: "xyz.tinycloud.policy/policy/v1", ...fields } : { schema: "xyz.tinycloud.policy/policy/v2", ...fields, credentialRequirement: options.credentialRequirement };
+  const domain = options.credentialRequirement === void 0 ? POLICY_V1_DOMAIN : POLICY_V2_DOMAIN;
+  const policyDigestHex = digestHex(unsigned, domain);
+  const signature = await options.authority.sign((0, import_sha2562.sha256)(textEncoder.encode(`${domain}${canonicalize(unsigned)}`)));
+  if (signature.byteLength !== 64) throw new TypeError("policy signature must be Ed25519");
+  const policy = {
+    ...unsigned,
+    policyId: `pol_${base32Lower2(Uint8Array.from(policyDigestHex.match(/../g), (byte) => Number.parseInt(byte, 16)))}`,
+    signature: { suite: "Ed25519", signerDid: options.authority.ownerDid, value: toBase64Url(signature) }
+  };
+  return { policy, policyCid: await computeCid(textEncoder.encode(canonicalize(policy))), policyDigestHex };
+}
+function publicationResult(input) {
+  const result = {
+    protocol: "tinycloud-share",
+    version: SHARE_PUBLISH_RESULT_VERSION,
+    url: input.url,
+    link: { kind: input.options.inline === true ? "inline" : "compact", cid: input.envelopeCid },
+    metadata: {
+      protocol: "tinycloud-share",
+      version: 1,
+      shareId: input.options.shareId,
+      origin: input.options.shareOrigin,
+      target: { kind: targetKind(input.options.target), origin: input.options.nodeOrigin, nodeAudience: input.enforcerDid, spaceId: input.options.spaceId },
+      resource: { ...input.options.resource },
+      actions: [...input.options.actions],
+      expiresAt: input.expiry,
+      display: { filename: input.options.filename },
+      recipientMatcher: { ...input.matcher },
+      policyCid: input.policyCid,
+      ownerDelegationCid: input.policyRootCid,
+      enforcementDelegationCid: input.enforcementRootCid,
+      ownerDid: input.options.authority.ownerDid,
+      enforcerDid: input.enforcerDid,
+      envelopeCid: input.envelopeCid,
+      shareCid: input.envelopeCid
+    },
+    registryDeleteAfter: input.retention
+  };
+  Object.defineProperty(result, "toJSON", { enumerable: false, value: () => redactPublishedShare(result) });
+  Object.defineProperty(result, "url", { enumerable: false, value: input.url });
+  Object.defineProperty(result, "deliveryMaterial", { enumerable: false, value: input.deliveryMaterial });
+  return result;
+}
+async function publishAddressedShare(options) {
+  assertSafeInput(options);
+  const target = normalizeShareTarget(options.target);
+  if (target.kind === "bearer") throw new TypeError("addressed target is required");
+  const expiry = rfc3339Seconds(options.expiresAt);
+  const matcher = targetMatcher(target);
+  const capabilities = sortCanonical([
+    { kind: "kv", resource: options.contentSource.kvResource, selector: options.resource.kind, actions: [...options.policyActions] },
+    { kind: "encryption", resource: options.contentSource.encryptionNetwork, action: "tinycloud.encryption/decrypt" }
+  ]);
+  const created = await createPolicy(options, capabilities);
+  const contentSourceDigestHex = digestHex(options.contentSource, CONTENT_SOURCE_V1_DOMAIN2);
+  const capabilityCeilingHashHex = digestHex(capabilities, POLICY_CAPABILITY_V1_DOMAIN2);
+  const nativeProjectionHashHex = digestHex(nativeProjection(capabilities), NATIVE_PROJECTION_V1_DOMAIN2);
+  const commonRoot = {
+    ownerDid: options.authority.ownerDid,
+    policyId: created.policy.policyId,
+    policyDigestHex: created.policyDigestHex,
+    policyCid: created.policyCid,
+    contentSourceDigestHex,
+    capabilityCeilingHashHex,
+    nativeProjectionHashHex,
+    notBefore: new Date(created.policy.createdAt),
+    expiresAt: new Date(expiry),
+    nodeAudience: options.nodeAudience,
+    capabilities
+  };
+  const policyRootReceipt = await options.authority.createOwnerRoot({ ...commonRoot, role: "policy-authority", audienceDid: `did:tinycloud:policy:${created.policyDigestHex}` });
+  const enforcementRootReceipt = await options.authority.createOwnerRoot({ ...commonRoot, role: "policy-enforcement", audienceDid: options.enforcerDid });
+  const policyRoot = { cid: policyRootReceipt.cid, authorization: policyRootReceipt.delegationHeader.Authorization.replace(/^Bearer\s+/i, ""), role: "policy-authority" };
+  const enforcementRoot = { cid: enforcementRootReceipt.cid, authorization: enforcementRootReceipt.delegationHeader.Authorization.replace(/^Bearer\s+/i, ""), role: "policy-enforcement" };
+  const registration = await options.authority.registerPolicy({
+    policyCid: created.policyCid,
+    policy: created.policy,
+    policyRoot,
+    enforcementRoot,
+    contentSourceDigestHex,
+    nativeProjectionHashHex,
+    rootExpiresAt: expiry,
+    enforcerDid: options.enforcerDid,
+    expectedNodeAudience: options.nodeAudience
+  });
+  if (registration.policyCid !== created.policyCid || registration.policyRootCid !== policyRoot.cid || registration.enforcementRootCid !== enforcementRoot.cid) throw new Error("Policy/v3 registration receipt is not bound to the published roots");
+  const unsigned = {
+    version: 3,
+    shareId: options.shareId,
+    recipientMatcher: matcher,
+    ...options.deliveryEmail === void 0 ? {} : { deliveryEmail: options.deliveryEmail },
+    actions: [...options.actions],
+    resource: { ...options.resource },
+    target: { origin: options.nodeOrigin, nodeAudience: registration.attestedEnforcerBinding.enforcerDid, spaceId: options.spaceId },
+    policy: created.policy,
+    policyCid: created.policyCid,
+    policyRoot,
+    enforcementRoot,
+    attestedEnforcerBinding: registration.attestedEnforcerBinding,
+    contentSource: options.contentSource,
+    contentSourceDigestHex,
+    encryptionNetwork: options.contentSource.encryptionNetwork,
+    expiry,
+    display: { filename: options.filename },
+    encrypted: true,
+    metadata: {
+      mediaType: options.mediaType,
+      byteLength: options.byteLength,
+      filename: options.filename,
+      ...options.mediaType.startsWith("text/") ? { encoding: "utf-8" } : {},
+      ...options.artifact === void 0 ? {} : { artifact: options.artifact }
+    }
+  };
+  unsignedShareEnvelopeV3Schema.parse(unsigned);
+  const envelopeSignature = await options.authority.sign((0, import_sha2562.sha256)(textEncoder.encode(`${ENVELOPE_V3_DOMAIN}${canonicalize(unsigned)}`)));
+  if (envelopeSignature.byteLength !== 64) throw new TypeError("v3 envelope signature must be Ed25519");
+  const envelope = { ...unsigned, signature: { signerDid: options.authority.ownerDid, algorithm: "Ed25519", value: toBase64Url(envelopeSignature) } };
+  shareEnvelopeV3Schema.parse(envelope);
+  const envelopeKey = generateKey();
+  try {
+    const sealed = await seal(textEncoder.encode(canonicalize(envelope)), envelopeKey);
+    let url;
+    let retention = options.expiresAt.toISOString();
+    if (options.inline === true) url = await encodeInlineShareUrl({ origin: options.shareOrigin, ciphertext: sealed.blob, key32: envelopeKey });
+    else {
+      const uploaded = await uploadShareBlob({ source: new Uint8Array([1]), filename: options.filename, origin: options.shareOrigin, ...options.upload }, { blob: sealed.blob, cid: sealed.cid, deleteAfter: retention, contentLength: sealed.blob.byteLength });
+      retention = uploaded.deleteAfter;
+      url = encodeShareUrl({ origin: options.shareOrigin, ciphertextCid: uploaded.cid, key32: envelopeKey });
+    }
+    await options.publishBinding?.({
+      version: 3,
+      shareCid: sealed.cid,
+      shareId: options.shareId,
+      policyCid: created.policyCid,
+      policyRootCid: policyRoot.cid,
+      enforcementRootCid: enforcementRoot.cid,
+      contentSourceDigestHex
+    });
+    const deliveryMaterial = { envelope, sealedEnvelope: toBase64Url(sealed.blob), envelopeKey: toBase64Url(envelopeKey), shareCid: sealed.cid };
+    options.onDeliveryMaterial?.(deliveryMaterial);
+    return publicationResult({ options, url, envelopeCid: sealed.cid, matcher, policyCid: created.policyCid, policyRootCid: policyRoot.cid, enforcementRootCid: enforcementRoot.cid, enforcerDid: registration.attestedEnforcerBinding.enforcerDid, expiry, retention, deliveryMaterial });
+  } finally {
+    envelopeKey.fill(0);
+  }
+}
+
+// src/policy-authority.ts
+var import_ed255196 = require("@noble/curves/ed25519");
+
+// src/owner-policy.ts
+var import_ed255195 = require("@noble/curves/ed25519");
+var import_sha2563 = require("@noble/hashes/sha256");
+
 // ../../node_modules/multiformats/dist/src/bases/base32.js
 var base322 = rfc46482({
   prefix: "b",
@@ -7190,18 +7552,6 @@ var base36upper2 = baseX2({
   alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 });
 
-// ../../node_modules/multiformats/dist/src/bases/base58.js
-var base58btc2 = baseX2({
-  name: "base58btc",
-  prefix: "z",
-  alphabet: "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
-});
-var base58flickr2 = baseX2({
-  name: "base58flickr",
-  prefix: "Z",
-  alphabet: "123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ"
-});
-
 // ../../node_modules/multiformats/dist/src/vendor/varint.js
 var encode_12 = encode4;
 var MSB2 = 128;
@@ -7275,25 +7625,25 @@ function encodingLength2(int) {
 }
 
 // ../../node_modules/multiformats/dist/src/hashes/digest.js
-function create2(code3, digest4) {
-  const size = digest4.byteLength;
+function create2(code3, digest3) {
+  const size = digest3.byteLength;
   const sizeOffset = encodingLength2(code3);
   const digestOffset = sizeOffset + encodingLength2(size);
   const bytes3 = new Uint8Array(digestOffset + size);
   encodeTo2(code3, bytes3, 0);
   encodeTo2(size, bytes3, sizeOffset);
-  bytes3.set(digest4, digestOffset);
-  return new Digest2(code3, size, digest4, bytes3);
+  bytes3.set(digest3, digestOffset);
+  return new Digest2(code3, size, digest3, bytes3);
 }
 function decode8(multihash) {
   const bytes3 = coerce3(multihash);
   const [code3, sizeOffset] = decode7(bytes3);
   const [size, digestOffset] = decode7(bytes3.subarray(sizeOffset));
-  const digest4 = bytes3.subarray(sizeOffset + digestOffset);
-  if (digest4.byteLength !== size) {
+  const digest3 = bytes3.subarray(sizeOffset + digestOffset);
+  if (digest3.byteLength !== size) {
     throw new Error("Incorrect length");
   }
-  return new Digest2(code3, size, digest4, bytes3);
+  return new Digest2(code3, size, digest3, bytes3);
 }
 function equals4(a, b) {
   if (a === b) {
@@ -7311,10 +7661,10 @@ var Digest2 = class {
   /**
    * Creates a multihash digest.
    */
-  constructor(code3, size, digest4, bytes3) {
+  constructor(code3, size, digest3, bytes3) {
     this.code = code3;
     this.size = size;
-    this.digest = digest4;
+    this.digest = digest3;
     this.bytes = bytes3;
   }
 };
@@ -7397,8 +7747,8 @@ var CID2 = class _CID2 {
   toV1() {
     switch (this.version) {
       case 0: {
-        const { code: code3, digest: digest4 } = this.multihash;
-        const multihash = create2(code3, digest4);
+        const { code: code3, digest: digest3 } = this.multihash;
+        const multihash = create2(code3, digest3);
         return _CID2.createV1(this.code, multihash);
       }
       case 1: {
@@ -7452,8 +7802,8 @@ var CID2 = class _CID2 {
       return new _CID2(version, code3, multihash, bytes3 ?? encodeCID2(version, code3, multihash.bytes));
     } else if (value[cidSymbol2] === true) {
       const { version, multihash, code: code3 } = value;
-      const digest4 = decode8(multihash);
-      return _CID2.create(version, code3, digest4);
+      const digest3 = decode8(multihash);
+      return _CID2.create(version, code3, digest3);
     } else {
       return null;
     }
@@ -7463,11 +7813,11 @@ var CID2 = class _CID2 {
    * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
    * @param digest - (Multi)hash of the of the content.
    */
-  static create(version, code3, digest4) {
+  static create(version, code3, digest3) {
     if (typeof code3 !== "number") {
       throw new Error("String codecs are no longer supported");
     }
-    if (!(digest4.bytes instanceof Uint8Array)) {
+    if (!(digest3.bytes instanceof Uint8Array)) {
       throw new Error("Invalid digest");
     }
     switch (version) {
@@ -7475,12 +7825,12 @@ var CID2 = class _CID2 {
         if (code3 !== DAG_PB_CODE2) {
           throw new Error(`Version 0 CID must use dag-pb (code: ${DAG_PB_CODE2}) block encoding`);
         } else {
-          return new _CID2(version, code3, digest4, digest4.bytes);
+          return new _CID2(version, code3, digest3, digest3.bytes);
         }
       }
       case 1: {
-        const bytes3 = encodeCID2(version, code3, digest4.bytes);
-        return new _CID2(version, code3, digest4, bytes3);
+        const bytes3 = encodeCID2(version, code3, digest3.bytes);
+        return new _CID2(version, code3, digest3, bytes3);
       }
       default: {
         throw new Error("Invalid version");
@@ -7490,8 +7840,8 @@ var CID2 = class _CID2 {
   /**
    * Simplified version of `create` for CIDv0.
    */
-  static createV0(digest4) {
-    return _CID2.create(0, DAG_PB_CODE2, digest4);
+  static createV0(digest3) {
+    return _CID2.create(0, DAG_PB_CODE2, digest3);
   }
   /**
    * Simplified version of `create` for CIDv1.
@@ -7499,8 +7849,8 @@ var CID2 = class _CID2 {
    * @param code - Content encoding format code.
    * @param digest - Multihash of the content.
    */
-  static createV1(code3, digest4) {
-    return _CID2.create(1, code3, digest4);
+  static createV1(code3, digest3) {
+    return _CID2.create(1, code3, digest3);
   }
   /**
    * Decoded a CID from its binary representation. The byte array must contain
@@ -7533,8 +7883,8 @@ var CID2 = class _CID2 {
       throw new Error("Incorrect length");
     }
     const digestBytes3 = multihashBytes.subarray(specs.multihashSize - specs.digestSize);
-    const digest4 = new Digest2(specs.multihashCode, specs.digestSize, digestBytes3, multihashBytes);
-    const cid2 = specs.version === 0 ? _CID2.createV0(digest4) : _CID2.createV1(specs.codec, digest4);
+    const digest3 = new Digest2(specs.multihashCode, specs.digestSize, digestBytes3, multihashBytes);
+    const cid2 = specs.version === 0 ? _CID2.createV0(digest3) : _CID2.createV1(specs.codec, digest3);
     return [cid2, bytes3.subarray(specs.size)];
   }
   /**
@@ -7686,10 +8036,10 @@ function fromB64(value) {
   throw new Error("base64url decoding is unavailable");
 }
 function cid(bytesValue) {
-  return CID2.createV1(code2, create2(SHA256_CODE2, (0, import_sha2562.sha256)(bytesValue))).toString(base322.encoder);
+  return CID2.createV1(code2, create2(SHA256_CODE2, (0, import_sha2563.sha256)(bytesValue))).toString(base322.encoder);
 }
 function digest(bytesValue) {
-  return b64((0, import_sha2562.sha256)(bytesValue));
+  return b64((0, import_sha2563.sha256)(bytesValue));
 }
 function didKeyFromEd25519PublicKey2(publicKey) {
   if (publicKey.length !== 32) throw new Error("share key public key must be 32 bytes");
@@ -7880,368 +8230,8 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
   return validateOwnerSharePolicyRegistration(value, expected);
 }
 
-// src/authorization.ts
-async function authorizeShare(input) {
-  if (input.resumeToken !== void 0) {
-    if (input.resumeToken.length < 16 || input.resumeToken.length > 512) {
-      return { state: "denied", reason: "rejected" };
-    }
-    return input.adapter.resume({
-      envelope: input.envelope,
-      method: input.method,
-      resumeToken: input.resumeToken,
-      ...input.proof === void 0 ? {} : { proof: input.proof }
-    });
-  }
-  return input.adapter.begin({ envelope: input.envelope, method: input.method });
-}
-function authorizationMethodForTarget(target) {
-  if (target.kind === "recipientDid") return "openkey-device";
-  if (target.kind === "email") return "email-claim";
-  if (target.kind === "emailDomain") return "email-claim";
-  return void 0;
-}
-
-// src/targets.ts
-function validEmail(value) {
-  return /^[^@\s]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i.test(value);
-}
-function validDomain(value) {
-  return /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))+$/i.test(value);
-}
-function validRecipientDid(value) {
-  if (value.length === 0 || value.length > 2048 || /[\u0000-\u0020\u007f]/.test(value)) return false;
-  const parts = value.split(":");
-  if (parts.length < 3 || parts[0] !== "did" || !/^[a-z0-9]+$/.test(parts[1] ?? "")) return false;
-  const identifier = parts.slice(2);
-  if (identifier.some((part) => part.length === 0)) return false;
-  if (parts[1] === "web") {
-    const host = identifier[0] ?? "";
-    if (host.length > 253 || host.split(".").some((label) => !label || label.length > 63 || !/^[A-Za-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-"))) return false;
-    return identifier.slice(1).every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
-  }
-  if (parts[1] === "pkh") return identifier.length >= 3 && identifier.every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
-  if (parts[1] === "key") {
-    try {
-      const bytes3 = base58btc2.decode(identifier.join(":"));
-      return bytes3.length === 34 && bytes3[0] === 237 && bytes3[1] === 1;
-    } catch {
-      return false;
-    }
-  }
-  return false;
-}
-function normalizeShareTarget(target) {
-  if (target.kind === "bearer") return target;
-  if (target.kind === "recipientDid") {
-    if (!validRecipientDid(target.did)) throw new TypeError("recipient DID is invalid");
-    return { kind: target.kind, did: target.did };
-  }
-  if (target.kind === "email") {
-    if (!validEmail(target.address)) throw new TypeError("recipient email is invalid");
-    const at = target.address.lastIndexOf("@");
-    return { kind: target.kind, address: `${target.address.slice(0, at)}@${target.address.slice(at + 1).toLowerCase()}` };
-  }
-  if (!validDomain(target.domain)) throw new TypeError("recipient email domain is invalid");
-  return { kind: target.kind, domain: target.domain.toLowerCase() };
-}
-function targetAuthorizationMethod(target) {
-  return authorizationMethodForTarget(target);
-}
-async function publishTargetShare(input) {
-  const target = normalizeShareTarget(input.target);
-  if (target.kind === "bearer") return publishShare(input);
-  if (input.targetAdapter === void 0) {
-    return {
-      state: "authorization-required",
-      method: targetAuthorizationMethod(target)
-    };
-  }
-  const source = input.source instanceof Uint8Array ? input.source.slice() : await (async () => {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of input.source) {
-      if (!(chunk instanceof Uint8Array)) throw new TypeError("addressed publication source yielded invalid bytes");
-      size += chunk.byteLength;
-      if (size > (input.maxBytes ?? 100 * 1024 * 1024)) throw new TypeError("addressed publication exceeds maxBytes");
-      chunks.push(chunk.slice());
-    }
-    const bytes3 = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-      bytes3.set(chunk, offset);
-      offset += chunk.byteLength;
-    }
-    return bytes3;
-  })();
-  const files = input.files === void 0 || input.files.length === 0 ? [{ bytes: source }] : input.files;
-  const limit = input.maxBytes ?? SHARE_CONTENT_LIMIT;
-  let totalBytes = 0;
-  for (const file of files) {
-    totalBytes += file.bytes.byteLength;
-    if (!Number.isSafeInteger(totalBytes) || totalBytes > limit) {
-      throw new SharePublishError("max-bytes-exceeded", "addressed publication exceeds the combined byte limit");
-    }
-  }
-  return input.targetAdapter.publish({
-    source,
-    filename: input.filename,
-    ...input.files === void 0 ? {} : { files: input.files },
-    ...input.mediaType === void 0 ? {} : { mediaType: input.mediaType },
-    ...input.resourceKind === void 0 ? {} : { resourceKind: input.resourceKind },
-    ...input.actions === void 0 ? {} : { actions: input.actions },
-    target,
-    expiresAt: input.expiresAt ?? new Date((input.now?.() ?? Date.now()) + 7 * 24 * 60 * 60 * 1e3),
-    origin: input.origin,
-    ...input.inline === void 0 ? {} : { inline: input.inline },
-    upload: {
-      ...input.registryBaseUrl === void 0 ? {} : { registryBaseUrl: input.registryBaseUrl },
-      ...input.fetchFn === void 0 ? {} : { fetchFn: input.fetchFn },
-      ...input.authorizeUpload === void 0 ? {} : { authorizeUpload: input.authorizeUpload },
-      ...input.authorizationOrigin === void 0 ? {} : { authorizationOrigin: input.authorizationOrigin },
-      ...input.credentials === void 0 ? {} : { credentials: input.credentials },
-      ...input.allowInsecureRegistry === void 0 ? {} : { allowInsecureRegistry: input.allowInsecureRegistry },
-      ...input.uploadBlob === void 0 ? {} : { uploadBlob: input.uploadBlob }
-    },
-    ...input.notify === void 0 ? {} : { notify: input.notify }
-  });
-}
-
-// src/addressed-publish.ts
-var ENVELOPE_DOMAIN = "xyz.tinycloud.share/envelope/v2\0";
-function targetMatcher(target) {
-  if (target.kind === "recipientDid") return { kind: "recipientDid", value: target.did };
-  if (target.kind === "email") return { kind: "exactEmail", value: target.address };
-  return { kind: "emailDomain", value: target.domain };
-}
-function targetKind(target) {
-  return target.kind;
-}
-function assertSafeInput(input) {
-  if (!/^[A-Za-z0-9_-]{16,128}$/.test(input.shareId)) throw new TypeError("addressed share id is invalid");
-  if (input.filename.length === 0 || input.filename === "." || input.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(input.filename)) throw new TypeError("addressed filename is invalid");
-  if (!Number.isSafeInteger(input.byteLength) || input.byteLength < 0 || input.byteLength > SHARE_CONTENT_LIMIT) throw new TypeError("addressed content length is invalid");
-  if (input.actions.length === 0 || input.policyActions.length === 0) throw new TypeError("addressed share actions are empty");
-  const expiry = input.expiresAt.getTime();
-  if (!Number.isFinite(expiry) || expiry <= Date.now()) throw new TypeError("addressed share expiry must be in the future");
-  if (input.artifact === "html" && (input.resource.kind !== "prefix" || !input.actions.includes("read") || !input.actions.includes("list"))) throw new TypeError("html artifacts require a readable prefix");
-  if (input.contentSource.kind !== "kv") throw new TypeError("addressed policy publication requires a KV content source");
-}
-async function sha2564(value) {
-  return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", value)));
-}
-function publicationResult(input) {
-  const result = {
-    protocol: "tinycloud-share",
-    version: SHARE_PUBLISH_RESULT_VERSION,
-    url: input.url,
-    link: { kind: input.options.inline === true ? "inline" : "compact", cid: input.envelopeCid },
-    metadata: {
-      protocol: "tinycloud-share",
-      version: 1,
-      shareId: input.options.shareId,
-      origin: input.options.shareOrigin,
-      target: {
-        kind: targetKind(input.options.target),
-        origin: input.options.nodeOrigin,
-        nodeAudience: input.options.nodeAudience,
-        spaceId: input.options.spaceId
-      },
-      resource: { ...input.options.resource },
-      actions: [...input.options.actions],
-      expiresAt: input.options.expiresAt.toISOString(),
-      display: { filename: input.options.filename },
-      recipientMatcher: { ...input.matcher },
-      registrationCid: input.registration.registrationCid,
-      policyCid: input.policyCid,
-      ownerDelegationCid: input.registration.ownerDelegationCid,
-      enforcementDelegationCid: input.enforcementDelegationCid,
-      ownerDid: input.registration.ownerDid,
-      shareKeyDid: input.shareKeyDid,
-      enforcerDid: input.registration.enforcerDid,
-      envelopeCid: input.envelopeCid,
-      shareCid: input.shareCid
-    },
-    registryDeleteAfter: input.retention
-  };
-  Object.defineProperty(result, "toJSON", { enumerable: false, value: () => redactPublishedShare(result) });
-  Object.defineProperty(result, "url", { enumerable: false, value: input.url });
-  return result;
-}
-async function publishAddressedShare(options) {
-  assertSafeInput(options);
-  const target = normalizeShareTarget(options.target);
-  if (target.kind === "bearer") throw new TypeError("addressed target is required");
-  if (options.contentSource.kind !== "kv") throw new TypeError("addressed policy publication requires a KV content source");
-  const contentSource = options.contentSource;
-  const matcher = targetMatcher(target);
-  const expiresAt = options.expiresAt.toISOString();
-  const contentSourceDigest = options.contentSourceDigest ?? await sha2564(new TextEncoder().encode(canonicalize(contentSource)));
-  const shareKey = await createDelegatedShareKey({ extractable: false });
-  let envelopeKey;
-  try {
-    const permissions = [
-      {
-        service: "tinycloud.kv",
-        path: options.resource.kind === "prefix" ? `${options.resource.path.replace(/\/+$/, "")}/` : options.resource.path,
-        actions: [...options.policyActions]
-      },
-      ...options.decryption === void 0 ? [] : [{
-        service: "tinycloud.encryption",
-        path: options.decryption.networkId,
-        actions: [options.decryption.action]
-      }]
-    ];
-    const ownerDelegation = await options.authority.createOwnerDelegation({
-      delegateDid: shareKey.did,
-      spaceId: options.spaceId,
-      permissions,
-      expiresAt: options.expiresAt
-    });
-    const policy = {
-      type: "TinyCloudSharePolicy",
-      version: 2,
-      shareId: options.shareId,
-      ownerDid: options.authority.ownerDid,
-      shareKeyDid: shareKey.did,
-      recipientMatcher: matcher,
-      target: {
-        origin: options.nodeOrigin,
-        nodeAudience: options.nodeAudience,
-        enforcerDid: options.enforcerDid,
-        spaceId: options.spaceId
-      },
-      resource: { ...options.resource },
-      actions: [...options.policyActions],
-      ...options.decryption === void 0 ? {} : { decryption: options.decryption },
-      contentSource,
-      contentSourceDigest,
-      ownerDelegationCid: ownerDelegation.delegationCid,
-      expiresAt
-    };
-    const canonicalPolicy = await canonicalOwnerSharePolicy(policy);
-    const policyProof = toBase64Url(await shareKey.sign(canonicalPolicy.bytes));
-    const enforcementDelegation = await createPolicyEnforcementDelegation({
-      ownerDelegation,
-      shareKey,
-      enforcerDid: options.enforcerDid,
-      policyCid: canonicalPolicy.cid,
-      shareId: options.shareId,
-      spaceId: options.spaceId,
-      nodeAudience: options.nodeAudience,
-      path: options.resource.path,
-      actions: options.policyActions,
-      contentSourceDigest,
-      expiresAt
-    });
-    const registration = await options.authority.registerOwnerSharePolicy({
-      policy: { bytes: canonicalPolicy.bytes, cid: canonicalPolicy.cid, proof: policyProof },
-      ownerDelegation,
-      enforcementDelegation,
-      contentSourceDigest
-    });
-    const authorityMaterialDigest = await sha2564(fromBase64Url(enforcementDelegation.dagCbor));
-    const authorityTarget = {
-      origin: options.nodeOrigin,
-      nodeAudience: options.nodeAudience,
-      enforcerDid: options.enforcerDid,
-      spaceId: options.spaceId
-    };
-    const envelopeIdentity = {
-      schema: "xyz.tinycloud.share/envelope/v2",
-      version: 2,
-      shareId: options.shareId,
-      delegationCid: ownerDelegation.delegationCid,
-      policyCid: canonicalPolicy.cid,
-      target: authorityTarget,
-      resource: options.resource,
-      actions: options.policyActions,
-      ...options.decryption === void 0 ? {} : { decryption: options.decryption },
-      contentSource,
-      contentSourceDigest,
-      expiresAt
-    };
-    const envelopeCid = await computeCid(new TextEncoder().encode(canonicalize(envelopeIdentity)));
-    const shareCid = await computeCid(new TextEncoder().encode(canonicalize({ version: 2, shareId: options.shareId, policyCid: canonicalPolicy.cid, envelopeCid })));
-    const outerUnsigned = { ...envelopeIdentity, envelopeCid, shareCid };
-    const outerSignature = toBase64Url(await shareKey.sign(new TextEncoder().encode(`${ENVELOPE_DOMAIN}${canonicalize(outerUnsigned)}`)));
-    const unsigned = {
-      version: 2,
-      shareId: options.shareId,
-      recipientMatcher: matcher,
-      ...options.deliveryEmail === void 0 ? {} : { deliveryEmail: options.deliveryEmail },
-      actions: [...options.actions],
-      resource: { ...options.resource },
-      target: { origin: options.nodeOrigin, nodeAudience: options.nodeAudience, spaceId: options.spaceId },
-      delegationCid: ownerDelegation.delegationCid,
-      authorityMaterialHandle: registration.registration.registrationCid,
-      authorityMaterialDigest,
-      contentSource,
-      contentSourceDigest,
-      authorizationTarget: { kind: "policy", policyCid: canonicalPolicy.cid, policyBytes: toBase64Url(canonicalPolicy.bytes) },
-      display: { filename: options.filename },
-      expiry: expiresAt,
-      encrypted: true,
-      metadata: {
-        mediaType: options.mediaType,
-        byteLength: options.byteLength,
-        filename: options.filename,
-        ...options.mediaType.startsWith("text/") ? { encoding: "utf-8" } : {},
-        ...options.artifact === void 0 ? {} : { artifact: options.artifact }
-      },
-      ownerAuthority: {
-        registrationCid: registration.registration.registrationCid,
-        shareCid,
-        envelopeCid,
-        enforcementDelegation,
-        registrationReceipt: registration,
-        outerEnvelope: {
-          ...outerUnsigned,
-          signature: { signerDid: shareKey.did, algorithm: "Ed25519", value: outerSignature }
-        }
-      }
-    };
-    unsignedShareEnvelopeV2Schema.parse(unsigned);
-    const envelopeSignature = toBase64Url(await shareKey.sign(new TextEncoder().encode(`${ENVELOPE_DOMAIN}${canonicalize(unsigned)}`)));
-    const envelope = { ...unsigned, signature: { signerDid: shareKey.did, algorithm: "Ed25519", value: envelopeSignature } };
-    shareEnvelopeV2Schema.parse(envelope);
-    envelopeKey = generateKey();
-    const sealed = await seal(new TextEncoder().encode(canonicalize(envelope)), envelopeKey);
-    let url;
-    let retention = expiresAt;
-    if (options.inline === true) {
-      url = await encodeInlineShareUrl({ origin: options.shareOrigin, ciphertext: sealed.blob, key32: envelopeKey });
-    } else {
-      const uploaded = await uploadShareBlob({
-        source: new Uint8Array([1]),
-        filename: options.filename,
-        origin: options.shareOrigin,
-        ...options.upload
-      }, { blob: sealed.blob, cid: sealed.cid, deleteAfter: expiresAt, contentLength: sealed.blob.byteLength });
-      retention = uploaded.deleteAfter;
-      url = encodeShareUrl({ origin: options.shareOrigin, ciphertextCid: uploaded.cid, key32: envelopeKey });
-    }
-    return publicationResult({
-      options,
-      url,
-      envelopeCid: sealed.cid,
-      shareCid,
-      matcher,
-      registration: registration.registration,
-      policyCid: canonicalPolicy.cid,
-      enforcementDelegationCid: enforcementDelegation.cid,
-      shareKeyDid: shareKey.did,
-      retention
-    });
-  } finally {
-    shareKey.clear();
-    envelopeKey?.fill(0);
-  }
-}
-
 // src/policy-authority.ts
-var import_ed255196 = require("@noble/curves/ed25519");
-var ENVELOPE_DOMAIN2 = "xyz.tinycloud.share/envelope/v2\0";
+var ENVELOPE_DOMAIN = "xyz.tinycloud.share/envelope/v2\0";
 function record(value, keys, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
   const output = value;
@@ -8322,7 +8312,7 @@ async function verifyOuterEnvelope(value, envelope, policyCid, expectedEnforcerD
     const signatureBytes = fromBase64Url(requiredString(signature.value, "outer signature"));
     if (signatureBytes.length !== 64 || !import_ed255196.ed25519.verify(
       signatureBytes,
-      new TextEncoder().encode(`${ENVELOPE_DOMAIN2}${canonicalize(unsigned)}`),
+      new TextEncoder().encode(`${ENVELOPE_DOMAIN}${canonicalize(unsigned)}`),
       ed25519PublicKeyFromDidKey(envelope.signature.signerDid),
       { zip215: false }
     )) return void 0;
@@ -8387,13 +8377,13 @@ function createRegisteredPolicyAuthority(options) {
 }
 
 // src/cache.ts
-var import_sha2563 = require("@noble/hashes/sha256");
+var import_sha2564 = require("@noble/hashes/sha256");
 function cacheKey(key) {
   if (!key.cid || !key.expiresAt) throw new Error("share cache keys require CID and expiry");
   return `${key.cid}\0${key.expiresAt}`;
 }
 function digest2(bytes3) {
-  return (0, import_sha2563.sha256)(bytes3);
+  return (0, import_sha2564.sha256)(bytes3);
 }
 function equalBytes(left, right) {
   if (left.byteLength !== right.byteLength) return false;
@@ -8595,6 +8585,7 @@ function historyRecordForPublishedShare(result, now = /* @__PURE__ */ new Date()
     registeredAt: now.toISOString(),
     expiresAt: result.metadata.expiresAt,
     link: result.url,
+    ...result.deliveryMaterial === void 0 ? {} : { deliveryMaterial: result.deliveryMaterial },
     ...result.metadata.display.filename === void 0 ? {} : { filename: result.metadata.display.filename }
   };
 }
@@ -8779,11 +8770,11 @@ async function notifyShare(input) {
 }
 async function defaultIdempotencyKey(shareId, recipient) {
   const canonicalRecipient = canonicalize(recipient.trim().toLowerCase());
-  const digest4 = new Uint8Array(await crypto.subtle.digest(
+  const digest3 = new Uint8Array(await crypto.subtle.digest(
     "SHA-256",
     new TextEncoder().encode(canonicalRecipient)
   ));
-  return `tinycloud-share:${shareId}:${toBase64Url(digest4)}`;
+  return `tinycloud-share:${shareId}:${toBase64Url(digest3)}`;
 }
 
 // src/lifecycle.ts
@@ -8840,7 +8831,7 @@ async function migrateShare(input) {
 
 // src/recipient.ts
 var import_ed255198 = require("@noble/curves/ed25519");
-var import_sha2564 = require("@noble/hashes/sha256");
+var import_sha2565 = require("@noble/hashes/sha256");
 
 // src/protocol.ts
 var SHARE_V2_PROTOCOL = Object.freeze({
@@ -8931,12 +8922,6 @@ function fromBase64(value, label) {
   if (toBase64(out) !== value) throw new Error(`${label} is invalid`);
   return out;
 }
-async function digest3(value) {
-  return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalize(value)))));
-}
-async function digestText2(value) {
-  return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value))));
-}
 async function digestBytes2(value) {
   return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", value)));
 }
@@ -8946,24 +8931,9 @@ function trustedPublicKey(value) {
   }
   return value.invitationPublicKey;
 }
-async function verifyWrapped(value, key, domain, trust) {
-  const wrapper = object2(value, `${key} response`);
-  if (Object.keys(wrapper).length !== 2 || !Object.hasOwn(wrapper, key) || !Object.hasOwn(wrapper, "proof")) throw new Error(`${key} response is invalid`);
-  const artifact = object2(wrapper[key], `${key} artifact`);
-  const proof = object2(wrapper.proof, `${key} proof`);
-  if (proof.alg !== "EdDSA" || proof.kid !== trust.invitationKid) throw new Error(`${key} proof is invalid`);
-  if (!import_ed255198.ed25519.verify(bytes2(proof.signature, `${key} signature`), new TextEncoder().encode(`${domain}${canonicalize(artifact)}`), trustedPublicKey(trust))) throw new Error(`${key} proof is invalid`);
-  return artifact;
-}
 function nativeAction(action) {
   return action === "list" ? "tinycloud.kv/list" : action === "edit" ? "tinycloud.kv/put" : "tinycloud.kv/get";
 }
-function uiAction(action) {
-  return action === "tinycloud.kv/list" ? "list" : action === "tinycloud.kv/put" ? "edit" : "read";
-}
-function selectedAction(envelope) {
-  return envelope.actions.includes("list") ? "tinycloud.kv/list" : envelope.actions.includes("edit") ? "tinycloud.kv/put" : "tinycloud.kv/get";
-}
 function policyAttenuationForV3(envelope) {
   const policy = object2(envelope.policy, "v3 policy");
   if (!Array.isArray(policy.capabilityCeiling)) throw new Error("v3 policy capability ceiling is invalid");
@@ -9033,11 +9003,11 @@ function verifyV3PolicyAuthorization(input) {
   if (!legacyShape && !v4Shape || POLICY_SESSION_DIGEST_FACT_KEYS.some((key) => !LOWER_SHA256_HEX.test(fact[key])) || v4Shape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)) || compact.payload.aud !== input.holderDid || compact.payload.iss.split("#", 1)[0] !== fact.nodeAudience || fact.profile !== "policy-session-ucan/v1" || fact.ownerDid !== policy.ownerDid || fact.policyId !== policy.policyId || fact.policyCid !== input.envelope.policyCid || fact.contentSourceDigestHex !== input.envelope.contentSourceDigestHex || fact.enforcerDid !== binding.enforcerDid || fact.nodeAudience !== binding.nodeAudience || fact.recipientDid !== input.holderDid || fact.policyDelegationCid !== input.envelope.policyRoot.cid || fact.enforcementDelegationCid !== input.envelope.enforcementRoot.cid || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || compact.payload.prf.length !== 2 || compact.payload.prf[0] !== input.envelope.policyRoot.cid || compact.payload.prf[1] !== input.envelope.enforcementRoot.cid || compact.payload.nbf > now || compact.payload.exp <= now || compact.payload.exp - compact.payload.nbf > 60 || canonicalize(compact.payload.att) !== canonicalize(policyAttenuationForV3(input.envelope))) throw new Error("v3 policy delegation signed binding mismatch");
   return compact;
 }
-function hex2(value) {
+function hex3(value) {
   return [...value].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 function canonicalHashHex(value) {
-  return hex2((0, import_sha2564.sha256)(new TextEncoder().encode(canonicalize(value))));
+  return hex3((0, import_sha2565.sha256)(new TextEncoder().encode(canonicalize(value))));
 }
 async function aesGcmDecrypt(key, blob) {
   if (key.length !== 32 || blob.length < 28) throw new Error("encrypted content is malformed");
@@ -9069,25 +9039,6 @@ function parseV3InlineEncryptedEnvelope(bytes3, expected) {
   }
   return record2;
 }
-async function verifyDetachedResponse(response, trust) {
-  let value;
-  try {
-    value = await response.clone().json();
-  } catch {
-    throw new Error("share read response is invalid");
-  }
-  const record2 = object2(value, "share read response");
-  const proof = object2(record2.proof, "share read detached proof");
-  if (proof.alg !== "EdDSA" || proof.kid !== trust.invitationKid) throw new Error("share read detached proof is invalid");
-  const unsigned = { ...record2 };
-  delete unsigned.proof;
-  if (!import_ed255198.ed25519.verify(bytes2(proof.signature, "share read signature"), new TextEncoder().encode(`${SHARE_V2_PROTOCOL.readResponseDomain}${canonicalize(unsigned)}`), trustedPublicKey(trust))) throw new Error("share read detached proof is invalid");
-}
-async function post(fetchFn, origin, path, body) {
-  const response = await fetchFn(new URL(path, origin), { method: "POST", redirect: "error", headers: { accept: "application/json", "content-type": "application/json" }, body: JSON.stringify(body) });
-  if (!response.ok) throw new Error("share authority rejected the request");
-  return response.json();
-}
 var ShareRecipientClient = class {
   constructor(options) {
     this.options = options;
@@ -9118,72 +9069,12 @@ var ShareRecipientClient = class {
   v3ContentKey;
   v3ContentEnvelope;
   async beginChallenge(envelope) {
-    const authority = envelope.ownerAuthority;
-    if (authority === void 0) throw new Error("addressed owner authority is required");
-    const outer = object2(authority.outerEnvelope, "owner authority outer envelope");
-    const enforcement = object2(authority.enforcementDelegation, "owner authority enforcement delegation");
-    const target = object2(outer.target, "owner authority target");
-    const outerResource = object2(outer.resource, "owner authority resource");
-    const source = object2(outer.contentSource, "owner authority content source");
-    if (!Array.isArray(outer.actions) || outer.actions.length === 0 || outer.actions.some((value) => typeof value !== "string")) throw new Error("owner authority outer envelope actions are invalid");
-    const actions = [...outer.actions];
-    const action = selectedAction(envelope);
-    const challengeBody = { envelopeCid: authority.envelopeCid, shareCid: authority.shareCid, shareId: envelope.shareId, registrationCid: authority.registrationCid, delegationCid: envelope.delegationCid, policyCid: envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "", enforcementDelegationCid: String(enforcement.cid), enforcementDelegation: enforcement, outerEnvelope: outer, contentSource: source, contentSourceDigest: String(outer.contentSourceDigest), holderDid: this.options.holderDid, targetOrigin: String(target.origin), nodeAudience: String(target.nodeAudience), action, actions, resource: String(outerResource.path) };
-    const requestBodyDigest = await digest3(challengeBody);
-    const challenge = await verifyWrapped(await post(this.fetchFn, this.options.nodeOrigin, "/share/v2/policy/challenges", { ...challengeBody, requestBodyDigest }), "challenge", DOMAIN, this.options.trustedNode);
-    if (challenge.type !== "TinyCloudSharePolicyChallenge" || challenge.version !== 2 || challenge.challengeId.length < 16 || challenge.nonce.length < 16 || challenge.shareCid !== authority.shareCid || challenge.shareId !== envelope.shareId || challenge.registrationCid !== authority.registrationCid || challenge.envelopeCid !== authority.envelopeCid || challenge.policyCid !== challengeBody.policyCid || challenge.delegationCid !== envelope.delegationCid || challenge.enforcementDelegationCid !== enforcement.cid || canonicalize(challenge.contentSource) !== canonicalize(source) || challenge.contentSourceDigest !== challengeBody.contentSourceDigest || challenge.requestBodyDigest !== requestBodyDigest || challenge.holderDid !== this.options.holderDid || challenge.targetOrigin !== challengeBody.targetOrigin || challenge.nodeAudience !== challengeBody.nodeAudience || challenge.action !== action || canonicalize(challenge.actions) !== canonicalize(actions) || challenge.resource !== challengeBody.resource || !Number.isFinite(Date.parse(challenge.expiresAt)) || Date.parse(challenge.expiresAt) <= Date.now()) throw new Error("share authority returned an unbound challenge");
-    return challenge;
+    void envelope;
+    throw new Error("v2 Share recipient transport has been removed; use the embedded policy v3 envelope");
   }
   async establish(envelope) {
-    const authority = envelope.ownerAuthority;
-    if (authority === void 0) throw new Error("addressed owner authority is required");
-    const outer = object2(authority.outerEnvelope, "owner authority outer envelope");
-    const enforcement = object2(authority.enforcementDelegation, "owner authority enforcement delegation");
-    const target = object2(outer.target, "owner authority target");
-    const outerResource = object2(outer.resource, "owner authority resource");
-    const source = object2(outer.contentSource, "owner authority content source");
-    if (!Array.isArray(outer.actions) || outer.actions.length === 0 || outer.actions.some((value) => typeof value !== "string")) throw new Error("owner authority outer envelope actions are invalid");
-    const actions = [...outer.actions];
-    const action = selectedAction(envelope);
-    const challengeBody = { envelopeCid: authority.envelopeCid, shareCid: authority.shareCid, shareId: envelope.shareId, registrationCid: authority.registrationCid, delegationCid: envelope.delegationCid, policyCid: envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "", enforcementDelegationCid: String(enforcement.cid), enforcementDelegation: enforcement, outerEnvelope: outer, contentSource: source, contentSourceDigest: String(outer.contentSourceDigest), holderDid: this.options.holderDid, targetOrigin: String(target.origin), nodeAudience: String(target.nodeAudience), action, actions, resource: String(outerResource.path) };
-    const requestBodyDigest = await digest3(challengeBody);
-    const challenge = await verifyWrapped(await post(this.fetchFn, this.options.nodeOrigin, "/share/v2/policy/challenges", { ...challengeBody, requestBodyDigest }), "challenge", DOMAIN, this.options.trustedNode);
-    if (challenge.type !== "TinyCloudSharePolicyChallenge" || challenge.version !== 2 || challenge.challengeId === void 0 || challenge.nonce === void 0 || challenge.shareCid !== authority.shareCid || challenge.shareId !== envelope.shareId || challenge.registrationCid !== authority.registrationCid || challenge.envelopeCid !== authority.envelopeCid || challenge.policyCid !== challengeBody.policyCid || challenge.delegationCid !== envelope.delegationCid || challenge.enforcementDelegationCid !== enforcement.cid || challenge.requestBodyDigest !== requestBodyDigest || canonicalize(challenge.contentSource) !== canonicalize(source) || challenge.contentSourceDigest !== challengeBody.contentSourceDigest || challenge.holderDid !== this.options.holderDid || challenge.targetOrigin !== challengeBody.targetOrigin || challenge.nodeAudience !== challengeBody.nodeAudience || challenge.action !== action || canonicalize(challenge.actions) !== canonicalize(actions) || challenge.resource !== challengeBody.resource || !Number.isFinite(Date.parse(challenge.expiresAt)) || Date.parse(challenge.expiresAt) <= Date.now()) throw new Error("share authority returned an unbound challenge");
-    if (this.options.buildPresentation === void 0) throw new Error("share presentation builder is required");
-    const material = await this.options.buildPresentation({ challenge, envelope, policy: {} });
-    this.holderProof = material.proof;
-    this.signer = material.sign;
-    this.nativeSigner = material.sign;
-    if (this.signer === void 0) throw new Error("share holder signer is required");
-    const presentation = {
-      type: "TinyCloudSharePolicyPresentation",
-      version: 2,
-      challengeId: challenge.challengeId,
-      nonce: challenge.nonce,
-      shareCid: authority.shareCid,
-      shareId: envelope.shareId,
-      delegationCid: envelope.delegationCid,
-      policyCid: challengeBody.policyCid,
-      contentSource: source,
-      contentSourceDigest: challengeBody.contentSourceDigest,
-      holderDid: material.holderDid,
-      targetOrigin: challengeBody.targetOrigin,
-      nodeAudience: challengeBody.nodeAudience,
-      ...challenge.enforcerDid === void 0 ? {} : { enforcerDid: challenge.enforcerDid },
-      credentialDigest: material.credentialDigest ?? await digestText2(material.credential),
-      action,
-      actions,
-      resource: challengeBody.resource,
-      requestBodyDigest,
-      issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      expiresAt: challenge.expiresAt,
-      jti: toBase64Url(crypto.getRandomValues(new Uint8Array(16)))
-    };
-    const presentationProof = { alg: "EdDSA", kid: `${material.holderDid}#${material.holderDid.slice("did:key:".length)}`, signature: toBase64Url(await this.signer(new TextEncoder().encode(`${PRESENTATION_DOMAIN}${canonicalize(presentation)}`))) };
-    const session = await verifyWrapped(await post(this.fetchFn, this.options.nodeOrigin, "/share/v2/policy/session", { challengeId: challenge.challengeId, nonce: challenge.nonce, presentation, credential: material.credential, proof: presentationProof, holderBinding: material.holderBinding, readSignerDid: material.holderDid }), "session", SESSION_DOMAIN, this.options.trustedNode);
-    if (session.type !== "TinyCloudSharePolicySession" || session.version !== 2 || typeof session.sessionId !== "string" || session.shareCid !== authority.shareCid || session.shareId !== envelope.shareId || session.registrationCid !== authority.registrationCid || session.envelopeCid !== authority.envelopeCid || session.policyCid !== challengeBody.policyCid || session.delegationCid !== envelope.delegationCid || session.holderDid !== this.options.holderDid || session.targetOrigin !== challengeBody.targetOrigin || session.nodeAudience !== challengeBody.nodeAudience || session.action !== action || canonicalize(session.actions) !== canonicalize(actions) || canonicalize(session.contentSource) !== canonicalize(source) || session.contentSourceDigest !== challengeBody.contentSourceDigest || session.resource !== challengeBody.resource || typeof session.expiresAt !== "string" || !Number.isFinite(Date.parse(session.expiresAt)) || Date.parse(session.expiresAt) <= Date.now()) throw new Error("share authority returned an unbound session");
-    this.session = { sessionId: session.sessionId, expiresAt: session.expiresAt, actions: actions.map(uiAction), resource: { kind: envelope.resource.kind, path: String(session.resource) } };
-    return this.session;
+    void envelope;
+    throw new Error("v2 Share recipient transport has been removed; use the embedded policy v3 envelope");
   }
   async authorize(envelope) {
     if (this.session === void 0) await this.establish(envelope);
@@ -9211,7 +9102,7 @@ var ShareRecipientClient = class {
     } catch {
       throw new Error("v3 attested Node audience is invalid");
     }
-    const challengeResponse = await this.fetchFn(new URL("/share/v3/policy/challenges", this.options.nodeOrigin), {
+    const challengeResponse = await this.fetchFn(new URL("/policy/v3/challenges", this.options.nodeOrigin), {
       method: "POST",
       redirect: "error",
       headers: { accept: "application/json", "content-type": "application/json" },
@@ -9232,7 +9123,7 @@ var ShareRecipientClient = class {
       throw new Error(accountless ? "v4 ceremony requires a verified credential and requirement" : "v3 ceremony requires a claim");
     }
     this.options.onStage?.("policy-admission");
-    const delegationResponse = await this.fetchFn(new URL("/share/v3/policy/delegations", this.options.nodeOrigin), {
+    const delegationResponse = await this.fetchFn(new URL("/policy/v3/delegations", this.options.nodeOrigin), {
       method: "POST",
       redirect: "error",
       headers: { accept: "application/json", "content-type": "application/json" },
@@ -9263,7 +9154,7 @@ var ShareRecipientClient = class {
     const receiverPublicKey = toBase64(import_ed255198.x25519.getPublicKey(receiverPrivateKey));
     const receiverPublicKeyHash = canonicalHashHex(receiverPublicKey);
     const body = { type: "tinycloud.encryption.decrypt/v1", targetNode: this.v3NodeAudience, networkId: encrypted.networkId, alg: encrypted.alg, keyVersion: encrypted.keyVersion, encryptedSymmetricKey: encrypted.encryptedSymmetricKey, encryptedSymmetricKeyHash: encrypted.encryptedSymmetricKeyHash, receiverPublicKey, receiverPublicKeyHash };
-    const bodyHash = hex2((0, import_sha2564.sha256)(new TextEncoder().encode(canonicalize(body))));
+    const bodyHash = hex3((0, import_sha2565.sha256)(new TextEncoder().encode(canonicalize(body))));
     const session = verifyCompactUcanAuthorization(this.v3Authorization, this.session.sessionId);
     const now = Math.floor(Date.now() / 1e3);
     const invocation = await signCompactUcanAuthorization({
@@ -9283,7 +9174,7 @@ var ShareRecipientClient = class {
       if (!response.ok) throw new Error(`v3 decrypt invocation rejected (${response.status})`);
       const value = object2(await response.json(), "v3 decrypt response");
       const allowed = ["type", "targetNode", "networkId", "invocationCid", "encryptedSymmetricKeyHash", "receiverPublicKeyHash", "wrappedKey", "alg", "keyVersion", "requestHash", "nodeId", "nodeSignature"];
-      if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key)) || value.type !== "tinycloud.encryption.decrypt-result/v1" || value.targetNode !== body.targetNode || value.nodeId !== body.targetNode || value.networkId !== body.networkId || value.invocationCid !== invocation.cid || value.encryptedSymmetricKeyHash !== body.encryptedSymmetricKeyHash || value.receiverPublicKeyHash !== receiverPublicKeyHash || value.alg !== body.alg || value.keyVersion !== body.keyVersion || value.requestHash !== hex2((0, import_sha2564.sha256)(new TextEncoder().encode(`${invocation.cid}${bodyHash}`))) || typeof value.wrappedKey !== "string" || typeof value.nodeSignature !== "string") throw new Error("v3 decrypt response binding is invalid");
+      if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key)) || value.type !== "tinycloud.encryption.decrypt-result/v1" || value.targetNode !== body.targetNode || value.nodeId !== body.targetNode || value.networkId !== body.networkId || value.invocationCid !== invocation.cid || value.encryptedSymmetricKeyHash !== body.encryptedSymmetricKeyHash || value.receiverPublicKeyHash !== receiverPublicKeyHash || value.alg !== body.alg || value.keyVersion !== body.keyVersion || value.requestHash !== hex3((0, import_sha2565.sha256)(new TextEncoder().encode(`${invocation.cid}${bodyHash}`))) || typeof value.wrappedKey !== "string" || typeof value.nodeSignature !== "string") throw new Error("v3 decrypt response binding is invalid");
       const unsigned = { ...value };
       delete unsigned.nodeSignature;
       const signature = fromBase64(value.nodeSignature, "v3 decrypt response signature");
@@ -9309,47 +9200,16 @@ var ShareRecipientClient = class {
     return new TextEncoder().encode(canonicalize({ ...this.v3ContentEnvelope, ciphertext: toBase64Url(await aesGcmEncrypt(this.v3ContentKey, bytes3)), metadata: { ...this.v3ContentEnvelope.metadata ?? {}, contentType: mediaType } }));
   }
   async resumeWithProof(envelope, resumeToken, proof) {
-    const material = object2(proof, "share authorization proof");
-    const presentation = object2(material.presentation, "share presentation");
-    const presentationProof = object2(material.presentationProof, "share presentation proof");
-    const nonce = material.nonce;
-    const credential = material.credential;
-    const holderDid = material.holderDid;
-    const holderBinding = material.holderBinding;
-    if (typeof nonce !== "string" || typeof credential !== "string" || typeof holderDid !== "string" || holderDid !== this.options.holderDid || typeof holderBinding !== "object" || holderBinding === null || presentationProof.alg !== "EdDSA" || typeof presentationProof.signature !== "string") throw new Error("share authorization proof is incomplete");
-    const value = object2(await post(this.fetchFn, this.options.nodeOrigin, "/share/v2/policy/session", { challengeId: resumeToken, nonce, presentation, credential, proof: presentationProof, holderBinding, readSignerDid: holderDid }), "share policy session");
-    const session = await verifyWrapped(value, "session", SESSION_DOMAIN, this.options.trustedNode);
-    const authority = envelope.ownerAuthority;
-    if (authority === void 0 || session.type !== "TinyCloudSharePolicySession" || session.version !== 2 || typeof session.sessionId !== "string" || session.shareCid !== authority.shareCid || session.shareId !== envelope.shareId || session.registrationCid !== authority.registrationCid || session.envelopeCid !== authority.envelopeCid || session.delegationCid !== envelope.delegationCid || typeof session.resource !== "string" || typeof session.expiresAt !== "string") throw new Error("share authority returned an unbound session");
-    const policyCid = envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "";
-    const actions = [...new Set(envelope.actions.map(nativeAction))].sort();
-    if (session.policyCid !== policyCid || session.holderDid !== this.options.holderDid || session.targetOrigin !== envelope.target.origin || session.nodeAudience !== envelope.target.nodeAudience || session.action !== selectedAction(envelope) || canonicalize(session.actions) !== canonicalize(actions) || canonicalize(session.contentSource) !== canonicalize(envelope.contentSource) || session.contentSourceDigest !== envelope.contentSourceDigest || !Number.isFinite(Date.parse(session.expiresAt)) || Date.parse(session.expiresAt) <= Date.now()) throw new Error("share authority returned an unbound session");
-    this.session = { sessionId: session.sessionId, expiresAt: session.expiresAt, actions: actions.map(uiAction), resource: { kind: envelope.resource.kind, path: String(session.resource) } };
-    this.holderProof = presentationProof;
-    this.signer ??= this.options.sign;
-    return this.authorize(envelope);
+    void envelope;
+    void resumeToken;
+    void proof;
+    throw new Error("v2 Share recipient transport has been removed; use the embedded policy v3 envelope");
   }
   async nativeInvoke(request) {
     if (this.session === void 0) throw new Error("share policy session is required");
     const envelope = this.options.envelope;
     if (envelope.version === 3) return this.nativeInvokeV3(request, envelope);
-    if (envelope.ownerAuthority === void 0 || this.signer === void 0 || this.holderProof === void 0) throw new Error("share holder signer is required");
-    const authority = envelope.ownerAuthority;
-    const action = request.action === "list" ? "tinycloud.kv/list" : request.action === "put" ? "tinycloud.kv/put" : request.action === "metadata" ? "tinycloud.kv/metadata" : "tinycloud.kv/get";
-    const resource = typeof request.resource?.path === "string" ? request.resource.path : this.session.resource.path;
-    const actions = [...new Set(this.session.actions.map(nativeAction).concat(action === "tinycloud.kv/metadata" ? [action] : []))].sort();
-    const bodyBytes = request.body === void 0 ? void 0 : Uint8Array.from(request.body);
-    const bodyDigest = bodyBytes === void 0 ? void 0 : toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", bodyBytes)));
-    const outer = object2(authority.outerEnvelope, "owner authority outer envelope");
-    const enforcement = object2(authority.enforcementDelegation, "owner authority enforcement delegation");
-    const invocationBase = { type: "TinyCloudShareReadInvocation", version: 2, sessionId: this.session.sessionId, envelopeCid: authority.envelopeCid, shareCid: authority.shareCid, shareId: envelope.shareId, registrationCid: authority.registrationCid, delegationCid: envelope.delegationCid, policyCid: envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "", enforcementDelegationCid: String(enforcement.cid), contentSource: outer.contentSource, contentSourceDigest: String(outer.contentSourceDigest), holderDid: this.options.holderDid, targetOrigin: String(object2(outer.target, "owner authority target").origin), nodeAudience: String(object2(outer.target, "owner authority target").nodeAudience), action, actions, resource, ...action === "tinycloud.kv/list" ? { limit: 100 } : {}, ...bodyDigest === void 0 ? {} : { bodyDigest, ifMatch: request.ifMatch, contentType: request.contentType }, issuedAt: (/* @__PURE__ */ new Date()).toISOString(), expiresAt: new Date(Math.min(Date.now() + 6e4, Date.parse(this.session.expiresAt))).toISOString(), jti: toBase64Url(crypto.getRandomValues(new Uint8Array(16))) };
-    const requestBodyDigest = await digest3(invocationBase);
-    const invocation = { ...invocationBase, requestBodyDigest };
-    const proof = { ...this.holderProof, signature: toBase64Url(await this.signer(new TextEncoder().encode(`${INVOCATION_DOMAIN}${canonicalize(invocation)}`))) };
-    const signedRequest = { sessionId: this.session.sessionId, envelopeCid: authority.envelopeCid, shareCid: authority.shareCid, shareId: envelope.shareId, registrationCid: authority.registrationCid, delegationCid: envelope.delegationCid, policyCid: envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "", enforcementDelegationCid: String(enforcement.cid), contentSource: outer.contentSource, contentSourceDigest: String(outer.contentSourceDigest), holderDid: this.options.holderDid, nodeAudience: String(object2(outer.target, "owner authority target").nodeAudience), action, actions, resource, requestBodyDigest, invocation, proof };
-    const response = await this.fetchFn(new URL("/share/v2/invoke", this.options.nodeOrigin), { method: "POST", redirect: "error", headers: { accept: "application/vnd.tinycloud.share+json", "content-type": "application/vnd.tinycloud.share+json" }, body: JSON.stringify({ request: signedRequest, ...action === "tinycloud.kv/list" ? { limit: 100 } : {}, ...bodyBytes === void 0 ? {} : { body: toBase64Url(bodyBytes), bodyDigest, ifMatch: request.ifMatch, contentType: request.contentType } }) });
-    if (response.ok) await verifyDetachedResponse(response, this.options.trustedNode);
-    return response;
+    throw new Error("v2 Share invocation transport has been removed; use the embedded policy v3 envelope");
   }
   async nativeInvokeV3(request, envelope) {
     const signer = this.nativeSigner ?? this.signer;