@tinycloud/share-sdk 0.3.0-beta.1 → 1.0.0-beta.3

package/dist/index.js

@@ -4531,25 +4531,25 @@ function encodeTo(int, target, offset = 0) {
 function encodingLength(int) {
   return varint_default.encodingLength(int);
 }
-function create(code22, digest4) {
-  const size = digest4.byteLength;
+function create(code22, digest3) {
+  const size = digest3.byteLength;
   const sizeOffset = encodingLength(code22);
   const digestOffset = sizeOffset + encodingLength(size);
   const bytes3 = new Uint8Array(digestOffset + size);
   encodeTo(code22, bytes3, 0);
   encodeTo(size, bytes3, sizeOffset);
-  bytes3.set(digest4, digestOffset);
-  return new Digest(code22, size, digest4, bytes3);
+  bytes3.set(digest3, digestOffset);
+  return new Digest(code22, size, digest3, bytes3);
 }
 function decode4(multihash) {
   const bytes3 = coerce2(multihash);
   const [code22, sizeOffset] = decode3(bytes3);
   const [size, digestOffset] = decode3(bytes3.subarray(sizeOffset));
-  const digest4 = bytes3.subarray(sizeOffset + digestOffset);
-  if (digest4.byteLength !== size) {
+  const digest3 = bytes3.subarray(sizeOffset + digestOffset);
+  if (digest3.byteLength !== size) {
     throw new Error("Incorrect length");
   }
-  return new Digest(code22, size, digest4, bytes3);
+  return new Digest(code22, size, digest3, bytes3);
 }
 function equals2(a, b) {
   if (a === b) {
@@ -4567,10 +4567,10 @@ var Digest = class {
   /**
    * Creates a multihash digest.
    */
-  constructor(code22, size, digest4, bytes3) {
+  constructor(code22, size, digest3, bytes3) {
     this.code = code22;
     this.size = size;
-    this.digest = digest4;
+    this.digest = digest3;
     this.bytes = bytes3;
   }
 };
@@ -4651,8 +4651,8 @@ var CID = class _CID {
   toV1() {
     switch (this.version) {
       case 0: {
-        const { code: code22, digest: digest4 } = this.multihash;
-        const multihash = create(code22, digest4);
+        const { code: code22, digest: digest3 } = this.multihash;
+        const multihash = create(code22, digest3);
         return _CID.createV1(this.code, multihash);
       }
       case 1: {
@@ -4706,8 +4706,8 @@ var CID = class _CID {
       return new _CID(version, code22, multihash, bytes3 ?? encodeCID(version, code22, multihash.bytes));
     } else if (value[cidSymbol] === true) {
       const { version, multihash, code: code22 } = value;
-      const digest4 = decode4(multihash);
-      return _CID.create(version, code22, digest4);
+      const digest3 = decode4(multihash);
+      return _CID.create(version, code22, digest3);
     } else {
       return null;
     }
@@ -4717,11 +4717,11 @@ var CID = class _CID {
    * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
    * @param digest - (Multi)hash of the of the content.
    */
-  static create(version, code22, digest4) {
+  static create(version, code22, digest3) {
     if (typeof code22 !== "number") {
       throw new Error("String codecs are no longer supported");
     }
-    if (!(digest4.bytes instanceof Uint8Array)) {
+    if (!(digest3.bytes instanceof Uint8Array)) {
       throw new Error("Invalid digest");
     }
     switch (version) {
@@ -4729,12 +4729,12 @@ var CID = class _CID {
         if (code22 !== DAG_PB_CODE) {
           throw new Error(`Version 0 CID must use dag-pb (code: ${DAG_PB_CODE}) block encoding`);
         } else {
-          return new _CID(version, code22, digest4, digest4.bytes);
+          return new _CID(version, code22, digest3, digest3.bytes);
         }
       }
       case 1: {
-        const bytes3 = encodeCID(version, code22, digest4.bytes);
-        return new _CID(version, code22, digest4, bytes3);
+        const bytes3 = encodeCID(version, code22, digest3.bytes);
+        return new _CID(version, code22, digest3, bytes3);
       }
       default: {
         throw new Error("Invalid version");
@@ -4744,8 +4744,8 @@ var CID = class _CID {
   /**
    * Simplified version of `create` for CIDv0.
    */
-  static createV0(digest4) {
-    return _CID.create(0, DAG_PB_CODE, digest4);
+  static createV0(digest3) {
+    return _CID.create(0, DAG_PB_CODE, digest3);
   }
   /**
    * Simplified version of `create` for CIDv1.
@@ -4753,8 +4753,8 @@ var CID = class _CID {
    * @param code - Content encoding format code.
    * @param digest - Multihash of the content.
    */
-  static createV1(code22, digest4) {
-    return _CID.create(1, code22, digest4);
+  static createV1(code22, digest3) {
+    return _CID.create(1, code22, digest3);
   }
   /**
    * Decoded a CID from its binary representation. The byte array must contain
@@ -4787,8 +4787,8 @@ var CID = class _CID {
       throw new Error("Incorrect length");
     }
     const digestBytes3 = multihashBytes.subarray(specs.multihashSize - specs.digestSize);
-    const digest4 = new Digest(specs.multihashCode, specs.digestSize, digestBytes3, multihashBytes);
-    const cid2 = specs.version === 0 ? _CID.createV0(digest4) : _CID.createV1(specs.codec, digest4);
+    const digest3 = new Digest(specs.multihashCode, specs.digestSize, digestBytes3, multihashBytes);
+    const cid2 = specs.version === 0 ? _CID.createV0(digest3) : _CID.createV1(specs.codec, digest3);
     return [cid2, bytes3.subarray(specs.size)];
   }
   /**
@@ -4911,8 +4911,8 @@ var cidSymbol = /* @__PURE__ */ Symbol.for("@ipld/js-cid/CID");
 var code = 85;
 var SHA256_CODE = 18;
 async function computeCid(bytes3) {
-  const digest4 = create(SHA256_CODE, sha256(new Uint8Array(bytes3)));
-  return CID.create(1, code, digest4).toString();
+  const digest3 = create(SHA256_CODE, sha256(new Uint8Array(bytes3)));
+  return CID.create(1, code, digest3).toString();
 }
 function isCanonicalRawCid(cidString) {
   let cid2;
@@ -5359,7 +5359,7 @@ function validateV3Invariants(value, ctx) {
   if (value.contentSource.encryptionNetwork !== value.encryptionNetwork) {
     ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["encryptionNetwork"], message: "encryption network is not bound to the source" });
   }
-  if (value.attestedEnforcerBinding.enforcerDid !== value.target.nodeAudience || value.attestedEnforcerBinding.signature.signerDid !== value.attestedEnforcerBinding.nodeAudience || Date.parse(value.attestedEnforcerBinding.expiresAt) < Date.parse(value.expiry)) {
+  if (value.attestedEnforcerBinding.nodeAudience !== value.target.nodeAudience || value.attestedEnforcerBinding.signature.signerDid !== value.attestedEnforcerBinding.nodeAudience || Date.parse(value.attestedEnforcerBinding.expiresAt) < Date.parse(value.expiry)) {
     ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["attestedEnforcerBinding"], message: "enforcer binding does not cover the target and share lifetime" });
   }
   if (value.policy.contentSource.shareId !== value.contentSource.shareId || value.policy.contentSource.kvResource !== value.contentSource.kvResource || value.policy.contentSource.selector !== value.contentSource.selector || value.policy.contentSource.encryptionNetwork !== value.encryptionNetwork || value.policy.contentSource.encryptedSymmetricKeyDigestHex !== value.contentSource.encryptedSymmetricKeyDigestHex || value.policy.contentSource.keyVersion !== value.contentSource.keyVersion || value.policy.contentSource.mode !== value.contentSource.mode || value.policy.contentSource.initialCiphertextDigestHex !== value.contentSource.initialCiphertextDigestHex) {
@@ -5554,105 +5554,8 @@ function checkBearerDelegation(envelope, options = {}) {
   }
   return { ok: true, delegateeDid: audience };
 }
-function mintBearerDelegation(options) {
-  const { issuerPrivateKey, audienceDid, resourceUri, expiresAtSeconds } = options;
-  if (!audienceDid.startsWith("did:")) {
-    throw new TypeError(`audienceDid must be a DID, got ${audienceDid}`);
-  }
-  if (resourceUri.length === 0) {
-    throw new TypeError("resourceUri must be non-empty");
-  }
-  if (!Number.isSafeInteger(expiresAtSeconds) || expiresAtSeconds <= 0) {
-    throw new TypeError(
-      `expiresAtSeconds must be a positive integer (epoch seconds), got ${expiresAtSeconds}`
-    );
-  }
-  const issuerDid = didKeyFromEd25519PublicKey(
-    ed25519.getPublicKey(issuerPrivateKey)
-  );
-  const header = { alg: "EdDSA", typ: "JWT", ucv: "0.9.1" };
-  const payload = {
-    iss: issuerDid,
-    aud: audienceDid,
-    att: [{ with: resourceUri, can: BEARER_READ_ABILITY }],
-    prf: [],
-    exp: expiresAtSeconds
-  };
-  const signingInput = `${toBase64Url(utf8Bytes(JSON.stringify(header)))}.${toBase64Url(
-    utf8Bytes(JSON.stringify(payload))
-  )}`;
-  const signature = ed25519.sign(utf8Bytes(signingInput), issuerPrivateKey);
-  return `${signingInput}.${toBase64Url(signature)}`;
-}
 var ENVELOPE_AAD_LABEL = "tinycloud-share-envelope-v1";
-var SEALED_BLOB_VERSION = 1;
 var AAD = utf8Bytes(ENVELOPE_AAD_LABEL);
-var KEY_LENGTH = 32;
-var NONCE_LENGTH = 12;
-var TAG_LENGTH = 16;
-var HEADER_LENGTH = 1;
-function assertKey(key32) {
-  if (key32.length !== KEY_LENGTH) {
-    throw new TypeError(`key must be ${KEY_LENGTH} bytes, got ${key32.length}`);
-  }
-}
-async function importAesKey(key32, usage) {
-  assertKey(key32);
-  return globalThis.crypto.subtle.importKey(
-    "raw",
-    key32,
-    "AES-GCM",
-    false,
-    [usage]
-  );
-}
-function generateKey() {
-  return globalThis.crypto.getRandomValues(new Uint8Array(KEY_LENGTH));
-}
-async function seal(plaintextBytes, key32) {
-  const { nonce, ciphertext } = await encryptEnvelope(plaintextBytes, key32);
-  const blob = new Uint8Array(HEADER_LENGTH + nonce.length + ciphertext.length);
-  blob[0] = SEALED_BLOB_VERSION;
-  blob.set(nonce, HEADER_LENGTH);
-  blob.set(ciphertext, HEADER_LENGTH + nonce.length);
-  return { blob, cid: await computeCid(blob) };
-}
-async function open(blob, key32) {
-  if (blob.length < HEADER_LENGTH + NONCE_LENGTH + TAG_LENGTH) {
-    throw new TypeError(`sealed blob too short: ${blob.length} bytes`);
-  }
-  if (blob[0] !== SEALED_BLOB_VERSION) {
-    throw new TypeError(`unknown sealed blob version: ${blob[0]}`);
-  }
-  const nonce = blob.subarray(HEADER_LENGTH, HEADER_LENGTH + NONCE_LENGTH);
-  const ciphertext = blob.subarray(HEADER_LENGTH + NONCE_LENGTH);
-  return decryptEnvelope(nonce, ciphertext, key32);
-}
-async function encryptEnvelope(plaintextBytes, key32) {
-  const key = await importAesKey(key32, "encrypt");
-  const nonce = globalThis.crypto.getRandomValues(new Uint8Array(NONCE_LENGTH));
-  const ciphertext = new Uint8Array(
-    await globalThis.crypto.subtle.encrypt(
-      { name: "AES-GCM", iv: nonce, additionalData: AAD },
-      key,
-      plaintextBytes
-    )
-  );
-  return { nonce, ciphertext };
-}
-async function decryptEnvelope(nonce, ciphertext, key32) {
-  if (nonce.length !== NONCE_LENGTH) {
-    throw new TypeError(`nonce must be ${NONCE_LENGTH} bytes, got ${nonce.length}`);
-  }
-  const key = await importAesKey(key32, "decrypt");
-  return new Uint8Array(
-    await globalThis.crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: nonce, additionalData: AAD },
-      key,
-      ciphertext
-    )
-  );
-}
 function isPlainRecord(value) {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
@@ -5783,8 +5686,6 @@ function equal(left, right) {
   return left.length === right.length && left.every((byte, index) => byte === right[index]);
 }
 var ED25519_VERIFY_OPTS2 = { zip215: false };
-var ENVELOPE_SIGNATURE_DOMAIN = "xyz.tinycloud.share/envelope/v1\0";
-var ENVELOPE_V2_SIGNATURE_DOMAIN = "xyz.tinycloud.share/envelope/v2\0";
 var ENVELOPE_V3_SIGNATURE_DOMAIN = "xyz.tinycloud.share/envelope/v3\0";
 var POLICY_V1_SIGNATURE_DOMAIN = "xyz.tinycloud.policy/policy/v1\0";
 var POLICY_V2_SIGNATURE_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
@@ -5792,22 +5693,6 @@ var CONTENT_SOURCE_V1_DOMAIN = "xyz.tinycloud.policy/ContentSource/v1\0";
 var POLICY_CAPABILITY_V1_DOMAIN = "xyz.tinycloud.policy/PolicyCapability/v1\0";
 var NATIVE_PROJECTION_V1_DOMAIN = "xyz.tinycloud.policy/NativeProjection/v1\0";
 var ATTESTED_ENFORCER_V2_DOMAIN = "xyz.tinycloud.policy/AttestedEnforcerBinding/v2\0";
-function signingBytes(unsigned) {
-  const domain = utf8Bytes(ENVELOPE_SIGNATURE_DOMAIN);
-  const body = utf8Bytes(canonicalize(unsigned));
-  const bytes3 = new Uint8Array(domain.length + body.length);
-  bytes3.set(domain);
-  bytes3.set(body, domain.length);
-  return bytes3;
-}
-function signingBytesV2(unsigned) {
-  const domain = utf8Bytes(ENVELOPE_V2_SIGNATURE_DOMAIN);
-  const body = utf8Bytes(canonicalize(unsigned));
-  const bytes3 = new Uint8Array(domain.length + body.length);
-  bytes3.set(domain);
-  bytes3.set(body, domain.length);
-  return bytes3;
-}
 function signingBytesV3(unsigned) {
   const domain = utf8Bytes(ENVELOPE_V3_SIGNATURE_DOMAIN);
   const body = utf8Bytes(canonicalize(unsigned));
@@ -5816,53 +5701,6 @@ function signingBytesV3(unsigned) {
   bytes3.set(body, domain.length);
   return bytes3;
 }
-function signEnvelope(envelopeWithoutSig, ed25519PrivKey) {
-  const unsigned = unsignedShareEnvelopeSchema.parse(envelopeWithoutSig);
-  const publicKey = ed255193.getPublicKey(ed25519PrivKey);
-  const signature = ed255193.sign(signingBytes(unsigned), ed25519PrivKey);
-  return {
-    ...unsigned,
-    signature: {
-      signerDid: didKeyFromEd25519PublicKey(publicKey),
-      algorithm: "Ed25519",
-      value: toBase64Url(signature)
-    }
-  };
-}
-function verifyEnvelopeSignatureOnly(envelope) {
-  const parsed = shareEnvelopeSchema.parse(envelope);
-  const { signature, ...unsigned } = parsed;
-  const publicKey = ed25519PublicKeyFromDidKey(signature.signerDid);
-  return ed255193.verify(
-    fromBase64Url(signature.value),
-    signingBytes(unsigned),
-    publicKey,
-    ED25519_VERIFY_OPTS2
-  );
-}
-async function verifyEnvelope(envelope, options) {
-  const parsed = shareEnvelopeSchema.parse(envelope);
-  if (parsed.signature.signerDid !== options.expectedSignerDid) return false;
-  if (!verifyEnvelopeSignatureOnly(parsed)) return false;
-  if (parsed.authorizationTarget.kind === "policy") {
-    const policyBytes = fromBase64Url(parsed.authorizationTarget.policyBytes);
-    if (await computeCid(policyBytes) !== parsed.authorizationTarget.policyCid) {
-      return false;
-    }
-  }
-  return true;
-}
-function verifyEnvelopeV2SignatureOnly(envelope) {
-  const parsed = shareEnvelopeV2Schema.parse(envelope);
-  const { signature, ...unsigned } = parsed;
-  return ed255193.verify(fromBase64Url(signature.value), signingBytesV2(unsigned), ed25519PublicKeyFromDidKey(signature.signerDid), ED25519_VERIFY_OPTS2);
-}
-async function verifyEnvelopeV2(envelope, options) {
-  const parsed = shareEnvelopeV2Schema.parse(envelope);
-  if (parsed.signature.signerDid !== options.expectedSignerDid || !verifyEnvelopeV2SignatureOnly(parsed)) return false;
-  if (parsed.authorizationTarget.kind === "policy") return await computeCid(fromBase64Url(parsed.authorizationTarget.policyBytes)) === parsed.authorizationTarget.policyCid;
-  return true;
-}
 function verifyEnvelopeV3SignatureOnly(envelope) {
   const parsed = shareEnvelopeV3Schema.parse(envelope);
   const { signature, ...unsigned } = parsed;
@@ -5896,8 +5734,8 @@ async function verifyEnvelopeV3(envelope, options) {
   if (hex(sourceDigest) !== parsed.contentSourceDigestHex) return false;
   const sortedCapabilities = [...policy.capabilityCeiling].sort((left, right) => canonicalize(left).localeCompare(canonicalize(right)));
   const capabilityCeilingHashHex = hex(sha2562(new TextEncoder().encode(`${POLICY_CAPABILITY_V1_DOMAIN}${canonicalize(sortedCapabilities)}`)));
-  const nativeProjection = sortedCapabilities.map((capability) => capability.kind === "encryption" ? { service: "tinycloud.encryption", space: capability.resource, path: capability.resource, actions: [capability.action] } : { service: "tinycloud.kv", space: capability.resource.slice(0, capability.resource.indexOf("/kv/")), path: capability.resource.split("/kv/")[1], actions: [...capability.actions], caveat: { type: "xyz.tinycloud.resource/selector", kind: capability.selector, value: capability.resource } }).sort((left, right) => canonicalize(left).localeCompare(canonicalize(right)));
-  const nativeProjectionHashHex = hex(sha2562(new TextEncoder().encode(`${NATIVE_PROJECTION_V1_DOMAIN}${canonicalize(nativeProjection)}`)));
+  const nativeProjection2 = sortedCapabilities.map((capability) => capability.kind === "encryption" ? { service: "tinycloud.encryption", space: capability.resource, path: capability.resource, actions: [capability.action] } : { service: "tinycloud.kv", space: capability.resource.slice(0, capability.resource.indexOf("/kv/")), path: capability.resource.split("/kv/")[1], actions: [...capability.actions], caveat: { type: "xyz.tinycloud.resource/selector", kind: capability.selector, value: capability.resource } }).sort((left, right) => canonicalize(left).localeCompare(canonicalize(right)));
+  const nativeProjectionHashHex = hex(sha2562(new TextEncoder().encode(`${NATIVE_PROJECTION_V1_DOMAIN}${canonicalize(nativeProjection2)}`)));
   const expectedAttenuation = Object.fromEntries(sortedCapabilities.map((capability) => capability.kind === "encryption" ? [capability.resource, { [capability.action]: [{}] }] : [capability.resource, Object.fromEntries(capability.actions.map((action) => [action, [{ kind: capability.selector, type: "xyz.tinycloud.resource/selector", value: capability.resource }]]))]));
   const kv = policy.capabilityCeiling.find((capability) => capability.kind === "kv");
   const expectedKvActions = parsed.actions.flatMap((action) => action === "read" ? ["tinycloud.kv/get", "tinycloud.kv/metadata"] : action === "list" ? ["tinycloud.kv/list"] : ["tinycloud.kv/put"]);
@@ -5908,10 +5746,10 @@ async function verifyEnvelopeV3(envelope, options) {
   const binding = parsed.attestedEnforcerBinding;
   const { signature: bindingSignature, ...unsignedBinding } = binding;
   const expectedBindingDigestHex = hex(sha2562(new TextEncoder().encode(canonicalize({ enforcerDid: binding.enforcerDid, nodeAudience: binding.nodeAudience }))));
-  if (binding.enforcerDid !== parsed.target.nodeAudience || binding.attestationBindingDigestHex !== expectedBindingDigestHex || bindingSignature.signerDid !== binding.nodeAudience || bindingSignature.suite !== "Ed25519" || Date.parse(binding.issuedAt) > Date.now() || Date.parse(binding.expiresAt) <= Date.now() || Date.parse(binding.expiresAt) < Date.parse(parsed.expiry)) return false;
+  if (binding.nodeAudience !== parsed.target.nodeAudience || binding.attestationBindingDigestHex !== expectedBindingDigestHex || bindingSignature.signerDid !== binding.nodeAudience || bindingSignature.suite !== "Ed25519" || Date.parse(binding.issuedAt) > Date.now() || Date.parse(binding.expiresAt) <= Date.now() || Date.parse(binding.expiresAt) < Date.parse(parsed.expiry)) return false;
   try {
-    const digest4 = sha2562(new TextEncoder().encode(`${ATTESTED_ENFORCER_V2_DOMAIN}${canonicalize(unsignedBinding)}`));
-    if (!ed255193.verify(fromBase64Url(bindingSignature.value), digest4, ed25519PublicKeyFromDidKey(binding.nodeAudience), ED25519_VERIFY_OPTS2)) return false;
+    const digest3 = sha2562(new TextEncoder().encode(`${ATTESTED_ENFORCER_V2_DOMAIN}${canonicalize(unsignedBinding)}`));
+    if (!ed255193.verify(fromBase64Url(bindingSignature.value), digest3, ed25519PublicKeyFromDidKey(binding.nodeAudience), ED25519_VERIFY_OPTS2)) return false;
   } catch {
     return false;
   }
@@ -5950,7 +5788,8 @@ function base32Lower(bytes3) {
   return output;
 }
 var KEY_LENGTH2 = 32;
-var INLINE_PREFIX = "#v=2&p=";
+var INLINE_PREFIX = "#tc2=";
+var PUBLIC_INLINE_PARAMETER = "tc2";
 var MAX_INLINE_BYTES = 256 * 1024;
 function assertCanonicalCid(cidString) {
   const cid2 = CID.parse(cidString);
@@ -5959,77 +5798,30 @@ function assertCanonicalCid(cidString) {
     throw new TypeError(`not a canonical CIDv1 raw sha2-256 base32 CID: ${cidString}`);
   }
 }
-function encodeShareUrl({ origin, ciphertextCid, key32 }) {
-  if (key32.length !== KEY_LENGTH2) {
-    throw new TypeError(`key must be ${KEY_LENGTH2} bytes, got ${key32.length}`);
-  }
-  assertCanonicalCid(ciphertextCid);
-  if (!isCanonicalHttpsOrigin(origin)) {
-    throw new TypeError(`origin must be a canonical https origin, got ${origin}`);
-  }
-  return `${origin}/s/${ciphertextCid}#k=${toBase64Url(key32)}`;
-}
-function parseShareUrl(url, options = {}) {
-  const parsed = new URL(url);
-  if (parsed.protocol !== "https:") {
-    throw new TypeError(`share URL must be https, got ${parsed.protocol}`);
-  }
-  if (parsed.username !== "" || parsed.password !== "") {
-    throw new TypeError("share URL must not carry userinfo");
-  }
-  if (parsed.search !== "") {
-    throw new TypeError("share URL must not have a query string");
-  }
-  if (options.expectedOrigin !== void 0) {
-    if (!isCanonicalHttpsOrigin(options.expectedOrigin)) {
-      throw new TypeError(
-        `expectedOrigin must be a canonical https origin, got ${options.expectedOrigin}`
-      );
-    }
-    if (parsed.origin !== options.expectedOrigin) {
-      throw new TypeError(
-        `share URL origin ${parsed.origin} does not match expected ${options.expectedOrigin}`
-      );
-    }
-  }
-  const match = /^\/s\/([a-z2-7]+)$/.exec(parsed.pathname);
-  if (!match || match[1] === void 0) {
-    throw new TypeError(`not a share URL path: ${parsed.pathname}`);
-  }
-  const ciphertextCid = match[1];
-  assertCanonicalCid(ciphertextCid);
-  if (!parsed.hash.startsWith("#k=")) {
-    throw new TypeError("share URL is missing the #k= key fragment");
-  }
-  const key32 = fromBase64Url(parsed.hash.slice("#k=".length));
-  if (key32.length !== KEY_LENGTH2) {
-    throw new TypeError(`fragment key must be ${KEY_LENGTH2} bytes, got ${key32.length}`);
-  }
-  return { ciphertextCid, key32 };
-}
-async function encodeInlineShareUrl(parts) {
+async function encodePublicInlineShareUrl(parts) {
   if (!isCanonicalHttpsOrigin(parts.origin)) throw new TypeError("origin must be a canonical https origin");
-  if (parts.ciphertext.byteLength === 0 || parts.ciphertext.byteLength > MAX_INLINE_BYTES) throw new RangeError("inline ciphertext is outside the allowed size");
-  if (parts.key32 !== void 0 && parts.key32.length !== KEY_LENGTH2) throw new TypeError("inline key must be 32 bytes");
-  const ciphertextCid = await computeCid(parts.ciphertext);
-  const payload = canonicalize({
+  if (parts.plaintext.byteLength === 0 || parts.plaintext.byteLength > MAX_INLINE_BYTES) throw new RangeError("public inline envelope is outside the allowed size");
+  const ciphertextCid = await computeCid(parts.plaintext);
+  const payloadBytes = new TextEncoder().encode(canonicalize({
     v: 2,
-    c: toBase64Url(parts.ciphertext),
-    cid: ciphertextCid,
-    ...parts.key32 === void 0 ? {} : { k: toBase64Url(parts.key32) }
-  });
-  const payloadBytes = new TextEncoder().encode(payload);
+    c: toBase64Url(parts.plaintext),
+    cid: ciphertextCid
+  }));
   if (payloadBytes.byteLength > MAX_INLINE_BYTES * 2) throw new RangeError("inline URL is too large");
-  return `${parts.origin}/s/inline${INLINE_PREFIX}${toBase64Url(payloadBytes)}`;
+  return `${parts.origin}/viewer?${PUBLIC_INLINE_PARAMETER}=${toBase64Url(payloadBytes)}`;
 }
 function parseInlineShareUrl(url, options = {}) {
   const parsed = new URL(url);
-  if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "" || parsed.search !== "") throw new TypeError("inline share URL must be canonical HTTPS without query or userinfo");
+  if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") throw new TypeError("inline share URL must be canonical HTTPS without userinfo");
   if (!isCanonicalHttpsOrigin(parsed.origin) || options.expectedOrigin !== void 0 && parsed.origin !== options.expectedOrigin) throw new TypeError("inline share URL origin is not trusted");
-  if (parsed.pathname !== "/s/inline" || !parsed.hash.startsWith(INLINE_PREFIX)) throw new TypeError("not an inline v2 share URL");
+  if (parsed.pathname !== "/viewer") throw new TypeError("not a TinyCloud policy share URL");
+  const secretPayload = parsed.search === "" && parsed.hash.startsWith(INLINE_PREFIX) ? parsed.hash.slice(INLINE_PREFIX.length) : void 0;
+  const publicPayload = parsed.hash === "" && parsed.searchParams.size === 1 ? parsed.searchParams.get(PUBLIC_INLINE_PARAMETER) ?? void 0 : void 0;
+  if (secretPayload === void 0 && publicPayload === void 0) throw new TypeError("not a canonical TinyCloud policy share URL");
+  if (publicPayload !== void 0 && parsed.search !== `?${PUBLIC_INLINE_PARAMETER}=${publicPayload}`) throw new TypeError("public inline URL is not canonical");
   let payloadBytes;
   try {
-    payloadBytes = fromBase64Url(parsed.hash.slice(INLINE_PREFIX.length));
+    payloadBytes = fromBase64Url(secretPayload ?? publicPayload);
   } catch {
     throw new TypeError("inline payload is not canonical base64url");
   }
@@ -6042,37 +5834,32 @@ function parseInlineShareUrl(url, options = {}) {
   }
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new TypeError("inline payload must be an object");
   if (canonicalize(value) !== new TextDecoder("utf-8").decode(payloadBytes)) throw new TypeError("inline payload is not canonical JSON");
-  const record2 = value;
-  const keys = Object.keys(record2);
-  if (!keys.every((key) => key === "v" || key === "c" || key === "cid" || key === "k") || record2.v !== 2 || typeof record2.c !== "string" || typeof record2.cid !== "string") throw new TypeError("inline payload has invalid fields");
+  const record = value;
+  const keys = Object.keys(record);
+  if (!keys.every((key) => key === "v" || key === "c" || key === "cid" || key === "k") || record.v !== 2 || typeof record.c !== "string" || typeof record.cid !== "string" || publicPayload !== void 0 && (keys.length !== 3 || record.k !== void 0)) throw new TypeError("inline payload has invalid fields");
   let ciphertext;
   try {
-    ciphertext = fromBase64Url(record2.c);
+    ciphertext = fromBase64Url(record.c);
   } catch {
     throw new TypeError("inline ciphertext is not canonical base64url");
   }
   if (ciphertext.byteLength === 0 || ciphertext.byteLength > MAX_INLINE_BYTES) throw new TypeError("inline ciphertext is outside the allowed size");
-  assertCanonicalCid(record2.cid);
-  if (record2.k !== void 0 && typeof record2.k !== "string") throw new TypeError("inline key must be base64url");
+  assertCanonicalCid(record.cid);
+  if (record.k !== void 0 && typeof record.k !== "string") throw new TypeError("inline key must be base64url");
   let key32;
   try {
-    key32 = record2.k === void 0 ? void 0 : fromBase64Url(record2.k);
+    key32 = record.k === void 0 ? void 0 : fromBase64Url(record.k);
   } catch {
     throw new TypeError("inline key is not canonical base64url");
   }
   if (key32 !== void 0 && key32.length !== KEY_LENGTH2) throw new TypeError("inline key must be 32 bytes");
-  return { kind: "inline", ciphertextCid: record2.cid, ciphertext, ...key32 === void 0 ? {} : { key32 } };
-}
-function parseCompactOrInlineShareUrl(url, options = {}) {
-  if (new URL(url).pathname === "/s/inline") return parseInlineShareUrl(url, options);
-  return { kind: "compact", ...parseShareUrl(url, options) };
+  return { kind: "inline", ciphertextCid: record.cid, ciphertext, ...key32 === void 0 ? {} : { key32 } };
 }
 
 // src/receive.ts
 var SHARE_RESULT_VERSION = 1;
 var DEFAULT_MAX_SEALED_BLOB_BYTES = 100 * 1024 * 1024 + 29;
 var DEFAULT_MAX_CONTENT_BLOB_BYTES = DEFAULT_MAX_SEALED_BLOB_BYTES;
-var CONTENT_SEALED_OVERHEAD = 1 + 12 + 16;
 var ShareReceiveError = class extends Error {
   code;
   details;
@@ -6082,7 +5869,6 @@ var ShareReceiveError = class extends Error {
     this.code = code3;
     this.details = details;
   }
-  /** Machine output is deliberately code-only; diagnostics belong on stderr. */
   toJSON() {
     return { protocol: "tinycloud-share", version: SHARE_RESULT_VERSION, error: { code: this.code } };
   }
@@ -6091,338 +5877,79 @@ function toShareErrorInfo(error) {
   if (error instanceof ShareReceiveError) return error.toJSON();
   return { protocol: "tinycloud-share", version: SHARE_RESULT_VERSION, error: { code: "fetch-failed" } };
 }
-function boundedBytes(value, limit, code3) {
-  if (!Number.isSafeInteger(limit) || limit <= 0) throw new ShareReceiveError("fetch-failed", "share byte limit is invalid");
-  if (!(value instanceof Uint8Array)) throw new ShareReceiveError("fetch-failed", "registry returned invalid bytes");
-  if (value.byteLength > limit) throw new ShareReceiveError(code3, "share blob exceeds the configured byte limit");
-  return value;
-}
-async function readResponseBytes(response, limit, tooLargeCode) {
-  const contentLength = response.headers.get("content-length");
-  if (contentLength !== null && Number.isSafeInteger(Number(contentLength)) && Number(contentLength) > limit) {
-    throw new ShareReceiveError(tooLargeCode, "share blob exceeds the configured byte limit");
-  }
-  if (response.body === null) {
-    return boundedBytes(new Uint8Array(await response.arrayBuffer()), limit, tooLargeCode);
-  }
-  const reader = response.body.getReader();
-  const chunks = [];
-  let total = 0;
-  try {
-    for (; ; ) {
-      const part = await reader.read();
-      if (part.done) break;
-      total += part.value.byteLength;
-      if (total > limit) {
-        await reader.cancel();
-        throw new ShareReceiveError(tooLargeCode, "share blob exceeds the configured byte limit");
-      }
-      chunks.push(part.value);
-    }
-  } finally {
-    reader.releaseLock();
-  }
-  const bytes3 = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes3.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return bytes3;
-}
-function registryFetcher(options, limit, tooLargeCode = "max-bytes-exceeded", stage = "envelope") {
-  if (options.fetchBlob !== void 0) return async (input) => {
-    try {
-      options.signal?.throwIfAborted();
-      const bytes3 = await options.fetchBlob({ ...input, ...options.signal === void 0 ? {} : { signal: options.signal } });
-      options.signal?.throwIfAborted();
-      return boundedBytes(bytes3, limit, tooLargeCode);
-    } catch (error) {
-      if (options.signal?.aborted) throw options.signal.reason ?? error;
-      if (error instanceof ShareReceiveError) throw error;
-      throw new ShareReceiveError("fetch-failed", "registry unavailable", { stage });
-    }
-  };
-  if (options.registryBaseUrl === void 0) throw new ShareReceiveError("fetch-failed", "a registry fetch adapter is required");
-  const fetchFn = options.fetchFn ?? globalThis.fetch;
-  const base3 = options.registryBaseUrl.replace(/\/+$/, "");
-  return async ({ cid: cid2 }) => {
-    try {
-      options.signal?.throwIfAborted();
-      const response = await fetchFn(`${base3}/ipfs/${cid2}?format=raw`, {
-        headers: { accept: "application/vnd.ipld.raw" },
-        redirect: "error",
-        ...options.signal === void 0 ? {} : { signal: options.signal }
-      });
-      options.signal?.throwIfAborted();
-      if (!response.ok) throw new ShareReceiveError("fetch-failed", `registry returned ${response.status}`, { stage });
-      const bytes3 = await readResponseBytes(response, limit, tooLargeCode);
-      options.signal?.throwIfAborted();
-      return bytes3;
-    } catch (error) {
-      if (options.signal?.aborted) throw options.signal.reason ?? error;
-      if (error instanceof ShareReceiveError) throw error;
-      throw new ShareReceiveError("fetch-failed", "registry unavailable", { stage });
-    }
-  };
-}
 function metadataFor(envelope, origin) {
-  if (envelope.version === 2 || envelope.version === 3) {
-    const targetKind3 = envelope.recipientMatcher.kind === "recipientDid" ? "recipientDid" : envelope.recipientMatcher.kind === "exactEmail" ? "email" : envelope.recipientMatcher.kind === "emailDomain" ? "emailDomain" : "bearer";
-    return {
-      protocol: "tinycloud-share",
-      version: 1,
-      shareId: envelope.shareId,
-      origin,
-      target: { ...envelope.target, kind: targetKind3 },
-      resource: envelope.resource,
-      actions: envelope.actions,
-      expiresAt: envelope.expiry,
-      display: {
-        ...envelope.display.senderName === void 0 ? {} : { senderName: envelope.display.senderName },
-        ...envelope.display.filename === void 0 ? {} : { filename: envelope.display.filename },
-        ...envelope.display.mode === void 0 ? {} : { mode: envelope.display.mode }
-      },
-      ...envelope.version === 2 && envelope.content !== void 0 ? { content: { cid: envelope.content.cid } } : {}
-    };
-  }
+  const kind = envelope.recipientMatcher.kind === "recipientDid" ? "recipientDid" : envelope.recipientMatcher.kind === "exactEmail" ? "email" : "emailDomain";
   return {
     protocol: "tinycloud-share",
     version: 1,
     shareId: envelope.shareId,
     origin,
-    target: { ...envelope.target, kind: "bearer" },
-    resource: envelope.target.resource,
-    actions: ["read"],
+    target: { ...envelope.target, kind },
+    resource: { ...envelope.resource },
+    actions: [...envelope.actions],
     expiresAt: envelope.expiry,
     display: {
       ...envelope.display.senderName === void 0 ? {} : { senderName: envelope.display.senderName },
       ...envelope.display.filename === void 0 ? {} : { filename: envelope.display.filename },
       ...envelope.display.mode === void 0 ? {} : { mode: envelope.display.mode }
-    },
-    ...envelope.content === void 0 ? {} : { content: { cid: envelope.content.cid } }
+    }
   };
 }
-function parseEnvelope(bytes3) {
-  try {
-    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes3);
-    const value = JSON.parse(text);
-    if (canonicalize(value) !== text) throw new Error("share envelope is not canonical JSON");
-    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
-      const version = value.version;
-      if (version === 3) return shareEnvelopeV3Schema.parse(value);
-      if (version === 2) return shareEnvelopeV2Schema.parse(value);
-    }
-    return shareEnvelopeSchema.parse(value);
-  } catch {
-    throw new ShareReceiveError("envelope-invalid", "share envelope is invalid");
-  }
-}
-async function resolveShareEnvelope(link, options = {}) {
+async function resolvePolicyShare(link, options) {
+  options.signal?.throwIfAborted();
+  let url;
   let parsed;
   try {
-    parsed = parseCompactOrInlineShareUrl(link, { ...options.expectedOrigin === void 0 ? {} : { expectedOrigin: options.expectedOrigin } });
+    url = new URL(link);
+    if (url.pathname !== "/viewer" || url.hash !== "" || url.searchParams.size !== 1 || !url.searchParams.has("tc2")) throw new Error("not public Policy/v3");
+    parsed = parseInlineShareUrl(link, { ...options.expectedOrigin === void 0 ? {} : { expectedOrigin: options.expectedOrigin } });
+    if (parsed.key32 !== void 0) throw new Error("secret inline transport is retired");
   } catch {
     throw new ShareReceiveError("invalid-link", "share link format is invalid");
   }
+  const limit = options.maxSealedBlobBytes ?? DEFAULT_MAX_SEALED_BLOB_BYTES;
+  if (!Number.isSafeInteger(limit) || limit <= 0 || parsed.ciphertext.byteLength > limit) throw new ShareReceiveError("max-bytes-exceeded", "public policy envelope exceeds the configured byte limit");
+  if (await computeCid(parsed.ciphertext) !== parsed.ciphertextCid) throw new ShareReceiveError("cid-mismatch", "public envelope bytes do not match the link CID");
+  options.signal?.throwIfAborted();
+  let envelope;
   try {
-    if (parsed.key32 !== void 0) options.onKeyParsed?.(parsed.key32);
-    const url = new URL(link);
-    const sealed = parsed.kind === "inline" ? boundedBytes(parsed.ciphertext, options.maxSealedBlobBytes ?? DEFAULT_MAX_SEALED_BLOB_BYTES, "max-bytes-exceeded") : await registryFetcher(options, options.maxSealedBlobBytes ?? DEFAULT_MAX_SEALED_BLOB_BYTES)({ origin: url.origin, cid: parsed.ciphertextCid });
-    if (await computeCid(sealed) !== parsed.ciphertextCid) throw new ShareReceiveError("cid-mismatch", "registry bytes do not match the link CID");
-    let plaintext;
-    try {
-      plaintext = parsed.key32 === void 0 ? sealed : await open(sealed, parsed.key32);
-    } catch {
-      throw new ShareReceiveError("decrypt-failed", "share envelope could not be opened");
-    }
-    return { envelope: parseEnvelope(plaintext), origin: url.origin, cid: parsed.ciphertextCid, kind: parsed.kind };
-  } finally {
-    parsed.key32?.fill(0);
-  }
-}
-function actionName(value) {
-  return value === "read" ? "tinycloud.kv/get" : value === "list" ? "tinycloud.kv/list" : value === "edit" ? "tinycloud.kv/put" : value;
-}
-function resourceContains(outer, inner) {
-  if (outer.kind === "exact") return inner.kind === "exact" && outer.path === inner.path;
-  const prefix = outer.path.endsWith("/") ? outer.path : `${outer.path}/`;
-  return inner.path === outer.path || inner.path.startsWith(prefix);
-}
-function policyEvidenceMatches(envelope, evidence) {
-  const registeredActions = new Set(evidence.actions.map(actionName));
-  return evidence.policyCid === (envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "") && evidence.signerDid === envelope.signature.signerDid && evidence.registrationCid.length > 0 && evidence.shareId === envelope.shareId && canonicalize(evidence.recipientMatcher) === canonicalize(envelope.recipientMatcher) && canonicalize(evidence.target) === canonicalize(envelope.target) && resourceContains(evidence.resource, envelope.resource) && envelope.actions.every((action) => registeredActions.has(actionName(action))) && canonicalize(evidence.contentSource) === canonicalize(envelope.contentSource) && evidence.contentSourceDigest === envelope.contentSourceDigest && evidence.delegationCid === envelope.delegationCid && evidence.authorityMaterialHandle === envelope.authorityMaterialHandle && evidence.authorityMaterialDigest === envelope.authorityMaterialDigest && evidence.expiresAt === envelope.expiry && Number.isFinite(Date.parse(evidence.expiresAt)) && Date.parse(evidence.expiresAt) === Date.parse(envelope.expiry);
-}
-async function verifyV2Envelope(envelope, linkOrigin, options) {
-  if (options.expectedOrigin !== void 0 && linkOrigin !== options.expectedOrigin) {
-    throw new ShareReceiveError("origin-mismatch", "share link origin does not match the trusted origin");
-  }
-  try {
-    if (!await verifyEnvelopeV2(envelope, { expectedSignerDid: envelope.signature.signerDid })) throw new Error("signature");
+    const encoded = new TextDecoder("utf-8", { fatal: true }).decode(parsed.ciphertext);
+    const value = JSON.parse(encoded);
+    if (canonicalize(value) !== encoded) throw new Error("non-canonical envelope");
+    envelope = shareEnvelopeV3Schema.parse(value);
   } catch {
-    throw new ShareReceiveError("signature-invalid", "share signature is invalid");
-  }
-  const expiry = Date.parse(envelope.expiry);
-  if (!Number.isFinite(expiry)) throw new ShareReceiveError("envelope-invalid", "share expiry is invalid");
-  if (expiry <= (options.now?.() ?? Date.now())) throw new ShareReceiveError("expired", "share has expired", { expiresAt: envelope.expiry });
-  if (envelope.authorizationTarget.kind === "policy") {
-    if (options.trustedPolicyAuthority === void 0) throw new ShareReceiveError("envelope-invalid", "an external policy authority is required");
-    let evidence;
-    try {
-      evidence = await options.trustedPolicyAuthority.resolve({ policyCid: envelope.authorizationTarget.policyCid, envelope });
-    } catch {
-      evidence = void 0;
-    }
-    if (evidence === void 0 || !policyEvidenceMatches(envelope, evidence)) throw new ShareReceiveError("capability-invalid", "share policy authority evidence is not bound to the envelope");
-    if (options.trustedSignerDid !== void 0 && (evidence.signerDid !== options.trustedSignerDid || envelope.signature.signerDid !== options.trustedSignerDid)) {
-      throw new ShareReceiveError("signature-invalid", "share signer is not trusted");
-    }
-  } else if (envelope.authorizationTarget.kind === "recipientDid" && envelope.recipientMatcher.kind === "recipientDid" && envelope.authorizationTarget.did !== envelope.recipientMatcher.value) {
-    throw new ShareReceiveError("capability-invalid", "recipient authorization does not match the signed recipient");
-  } else {
-    if (options.trustedSignerDid === void 0 || envelope.signature.signerDid !== options.trustedSignerDid) throw new ShareReceiveError("signature-invalid", "an addressed signer trust root is required");
-  }
-}
-async function verifyV3Envelope(envelope, linkOrigin, options) {
-  if (options.expectedOrigin !== void 0 && linkOrigin !== options.expectedOrigin) {
-    throw new ShareReceiveError("origin-mismatch", "share link origin does not match the trusted origin");
+    throw new ShareReceiveError("envelope-invalid", "share envelope is invalid");
   }
   try {
     if (!await verifyEnvelopeV3(envelope, { expectedSignerDid: envelope.policy.ownerDid })) throw new Error("signature");
   } catch {
     throw new ShareReceiveError("signature-invalid", "share signature is invalid");
   }
+  options.signal?.throwIfAborted();
   const expiry = Date.parse(envelope.expiry);
   if (!Number.isFinite(expiry)) throw new ShareReceiveError("envelope-invalid", "share expiry is invalid");
   if (expiry <= (options.now?.() ?? Date.now())) throw new ShareReceiveError("expired", "share has expired", { expiresAt: envelope.expiry });
-}
-async function verifyV1PolicyEnvelope(envelope, linkOrigin, options) {
-  if (envelope.authorizationTarget.kind !== "policy") throw new ShareReceiveError("unsupported-target", "share target is not an addressed policy", { reason: "policy-target" });
-  if (envelope.target.origin !== linkOrigin || options.expectedOrigin !== void 0 && (linkOrigin !== options.expectedOrigin || envelope.target.origin !== options.expectedOrigin)) {
-    throw new ShareReceiveError("origin-mismatch", "share origin does not match the trusted origin");
-  }
-  throw new ShareReceiveError("unsupported-target", "share policy target is not supported", { reason: "policy-target" });
-}
-async function verifyBearerEnvelope(envelope, linkOrigin, options = {}) {
-  if (envelope.target.origin !== linkOrigin || options.expectedOrigin !== void 0 && (linkOrigin !== options.expectedOrigin || envelope.target.origin !== options.expectedOrigin)) {
-    throw new ShareReceiveError("origin-mismatch", "share origin does not match the trusted origin");
-  }
-  if (envelope.authorizationTarget.kind !== "bearerKey") throw new ShareReceiveError("unsupported-target", "this receive path only handles bearer shares", { reason: envelope.authorizationTarget.kind === "policy" ? "policy-target" : "recipient-did-target" });
-  if (envelope.target.resource.kind !== "exact") throw new ShareReceiveError("unsupported-target", "this receive path only handles exact resources", { reason: "prefix-resource" });
-  const expiry = Date.parse(envelope.expiry);
-  if (!Number.isFinite(expiry)) throw new ShareReceiveError("envelope-invalid", "share expiry is invalid");
-  try {
-    if (!await verifyEnvelope(envelope, { expectedSignerDid: envelope.signature.signerDid })) throw new Error("signature");
-  } catch {
-    throw new ShareReceiveError("signature-invalid", "share signature is invalid");
-  }
-  if (expiry <= (options.now?.() ?? Date.now())) throw new ShareReceiveError("expired", "share has expired", { expiresAt: envelope.expiry });
-  const capability = checkBearerDelegation(envelope, options.now === void 0 ? {} : { now: options.now });
-  if (!capability.ok) throw new ShareReceiveError("capability-invalid", "share delegation does not authorize the target");
-}
-async function verifyResolved(envelope, linkOrigin, options) {
-  await verifyBearerEnvelope(envelope, linkOrigin, options);
+  options.onResolvedAddressedEnvelope?.(envelope, parsed.ciphertextCid);
+  return { envelope, origin: url.origin, cid: parsed.ciphertextCid };
 }
 async function inspectShare(link, options = {}) {
-  const resolved = await resolveShareEnvelope(link, options);
-  if (resolved.envelope.version === 1 && resolved.envelope.authorizationTarget.kind === "policy") await verifyV1PolicyEnvelope(resolved.envelope, resolved.origin, options);
-  else if (resolved.envelope.version === 1) await verifyResolved(resolved.envelope, resolved.origin, options);
-  else if (resolved.envelope.version === 2) await verifyV2Envelope(resolved.envelope, resolved.origin, options);
-  else await verifyV3Envelope(resolved.envelope, resolved.origin, options);
-  if (resolved.envelope.version === 2 || resolved.envelope.version === 3 || resolved.envelope.authorizationTarget.kind === "policy") options.onResolvedAddressedEnvelope?.(resolved.envelope, resolved.cid);
-  return { metadata: metadataFor(resolved.envelope, resolved.origin), link: { origin: resolved.origin, cid: resolved.cid, kind: resolved.kind } };
+  const resolved = await resolvePolicyShare(link, options);
+  return { metadata: metadataFor(resolved.envelope, resolved.origin), link: { origin: resolved.origin, cid: resolved.cid, kind: "policy" } };
 }
 async function receiveShare(link, options = {}) {
-  const resolved = await resolveShareEnvelope(link, options);
-  if (resolved.envelope.version === 3) {
-    await verifyV3Envelope(resolved.envelope, resolved.origin, options);
-    options.onResolvedAddressedEnvelope?.(resolved.envelope, resolved.cid);
-    return { state: "authorization-required", method: resolved.envelope.recipientMatcher.kind === "recipientDid" ? "openkey-device" : "email-claim" };
-  }
-  if (resolved.envelope.version === 2) {
-    await verifyV2Envelope(resolved.envelope, resolved.origin, options);
-    options.onResolvedAddressedEnvelope?.(resolved.envelope, resolved.cid);
-    const method = resolved.envelope.recipientMatcher.kind === "recipientDid" ? "openkey-device" : "email-claim";
-    if (options.authorization === void 0) return { state: "authorization-required", method };
-    const result = options.authorizationResumeToken === void 0 ? await options.authorization.begin({ envelope: resolved.envelope, method }) : await options.authorization.resume({ envelope: resolved.envelope, method, resumeToken: options.authorizationResumeToken, ...options.authorizationProof === void 0 ? {} : { proof: options.authorizationProof } });
-    if (result.state === "authorization-required") return result;
-    if (result.state === "denied") throw new ShareReceiveError("authorization-denied", "share authorization was denied");
-    if (result.value === null || typeof result.value !== "object" || !(result.value.bytes instanceof Uint8Array) || result.value.proof === void 0 || options.authorization.verifyResult === void 0) {
-      throw new ShareReceiveError("content-integrity-failed", "share authorization returned an unsigned content result");
-    }
-    const authorized = result.value;
-    try {
-      if (!await options.authorization.verifyResult({ envelope: resolved.envelope, value: authorized, proof: authorized.proof })) throw new Error("node proof");
-    } catch {
-      throw new ShareReceiveError("content-integrity-failed", "node authorization proof is invalid");
-    }
-    const bytes4 = authorized.bytes.slice();
-    const maxBytes = options.maxContentBlobBytes ?? DEFAULT_MAX_CONTENT_BLOB_BYTES;
-    if (bytes4.byteLength > maxBytes) throw new ShareReceiveError("max-bytes-exceeded", "shared content exceeds the configured byte limit");
-    const digestBytes3 = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes4));
-    const bodyDigest = toBase64Url(digestBytes3);
-    if (authorized.bodyDigest !== bodyDigest) throw new ShareReceiveError("content-integrity-failed", "authorized content digest does not match");
-    if (authorized.contentSourceDigest !== resolved.envelope.contentSourceDigest) throw new ShareReceiveError("content-integrity-failed", "authorized content source does not match");
-    const binding = authorized.binding;
-    if (binding.shareId !== resolved.envelope.shareId || binding.delegationCid !== resolved.envelope.delegationCid || binding.authorityMaterialHandle !== resolved.envelope.authorityMaterialHandle || binding.authorityMaterialDigest !== resolved.envelope.authorityMaterialDigest || binding.resource.kind !== resolved.envelope.resource.kind || binding.resource.path !== resolved.envelope.resource.path || binding.action !== void 0 && !resolved.envelope.actions.some((action) => action === binding.action || `tinycloud.kv/${action}` === binding.action)) throw new ShareReceiveError("content-integrity-failed", "authorized content binding does not match");
-    if (resolved.envelope.metadata.byteLength !== void 0 && resolved.envelope.metadata.byteLength !== bytes4.byteLength) {
-      throw new ShareReceiveError("content-integrity-failed", "authorized content length does not match");
-    }
-    let text2;
-    try {
-      text2 = new TextDecoder("utf-8", { fatal: true }).decode(bytes4);
-    } catch {
-    }
-    return { metadata: metadataFor(resolved.envelope, resolved.origin), link: { origin: resolved.origin, cid: resolved.cid, kind: resolved.kind }, bytes: bytes4, ...text2 === void 0 ? {} : { text: text2 } };
-  }
-  if (resolved.envelope.authorizationTarget.kind === "policy") {
-    await verifyV1PolicyEnvelope(resolved.envelope, resolved.origin, options);
-    options.onResolvedAddressedEnvelope?.(resolved.envelope, resolved.cid);
-    return { state: "authorization-required", method: "email-claim" };
-  }
-  await verifyResolved(resolved.envelope, resolved.origin, options);
-  let bytes3 = new Uint8Array();
-  if (resolved.envelope.content !== void 0) {
-    bytes3 = await registryFetcher(
-      options,
-      (options.maxContentBlobBytes ?? DEFAULT_MAX_CONTENT_BLOB_BYTES) + CONTENT_SEALED_OVERHEAD,
-      "max-bytes-exceeded",
-      "content"
-    )({ origin: resolved.origin, cid: resolved.envelope.content.cid });
-    if (await computeCid(bytes3) !== resolved.envelope.content.cid) throw new ShareReceiveError("content-integrity-failed", "shared content CID does not match");
-    const key = fromBase64Url(resolved.envelope.content.key);
-    try {
-      bytes3 = await open(bytes3, key);
-    } catch {
-      throw new ShareReceiveError("content-integrity-failed", "shared content could not be opened");
-    } finally {
-      key.fill(0);
-    }
-    if (bytes3.byteLength > (options.maxContentBlobBytes ?? DEFAULT_MAX_CONTENT_BLOB_BYTES)) {
-      throw new ShareReceiveError("max-bytes-exceeded", "shared content exceeds the configured byte limit");
-    }
-  }
-  let text;
-  if (bytes3.byteLength !== 0) {
-    try {
-      text = new TextDecoder("utf-8", { fatal: true }).decode(bytes3);
-    } catch {
-    }
-  }
-  return { metadata: metadataFor(resolved.envelope, resolved.origin), link: { origin: resolved.origin, cid: resolved.cid, kind: resolved.kind }, bytes: bytes3, ...text === void 0 ? {} : { text } };
+  const resolved = await resolvePolicyShare(link, options);
+  return { state: "authorization-required", method: resolved.envelope.recipientMatcher.kind === "recipientDid" ? "openkey-device" : "email-claim" };
 }
 
 // src/publish.ts
-import { ed25519 as ed255194 } from "@noble/curves/ed25519";
 var SHARE_CONTENT_LIMIT = 100 * 1024 * 1024;
-var SHARE_SEALED_OVERHEAD = 1 + 12 + 16;
 var SHARE_PUBLISH_RESULT_VERSION = 1;
 var DEFAULT_SHARE_LIFETIME_MS = 7 * 24 * 60 * 60 * 1e3;
 function redactPublishedShare(result) {
   return {
     protocol: "tinycloud-share",
     version: SHARE_PUBLISH_RESULT_VERSION,
-    link: { kind: result.link.kind, cid: result.link.cid },
+    link: { ...result.link },
     metadata: {
       protocol: "tinycloud-share",
       version: 1,
@@ -6432,10 +5959,8 @@ function redactPublishedShare(result) {
       resource: { ...result.metadata.resource },
       actions: [...result.metadata.actions],
       expiresAt: result.metadata.expiresAt,
-      display: { ...result.metadata.display },
-      ...result.metadata.content === void 0 ? {} : { content: { cid: result.metadata.content.cid } }
-    },
-    registryDeleteAfter: result.registryDeleteAfter
+      display: { ...result.metadata.display }
+    }
   };
 }
 var SharePublishError = class extends Error {
@@ -6446,237 +5971,6 @@ var SharePublishError = class extends Error {
     this.code = code3;
   }
 };
-function assertSafeFilename(filename) {
-  if (filename.length === 0 || filename === "." || filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(filename)) {
-    throw new SharePublishError("invalid-argument", "filename must be one safe path segment");
-  }
-}
-function assertOrigin(origin, label) {
-  if (!isCanonicalHttpsOrigin(origin)) {
-    throw new SharePublishError("invalid-argument", `${label} must be a canonical HTTPS origin`);
-  }
-}
-async function snapshotSource(source, limit) {
-  if (!Number.isSafeInteger(limit) || limit <= 0) {
-    throw new SharePublishError("invalid-argument", "maxBytes must be a positive safe integer");
-  }
-  if (source instanceof Uint8Array) {
-    if (source.byteLength > limit) throw new SharePublishError("max-bytes-exceeded", "share content exceeds the configured byte limit");
-    return source.slice();
-  }
-  const chunks = [];
-  let total = 0;
-  try {
-    for await (const chunk of source) {
-      if (!(chunk instanceof Uint8Array)) throw new SharePublishError("invalid-argument", "share source yielded invalid bytes");
-      total += chunk.byteLength;
-      if (total > limit) throw new SharePublishError("max-bytes-exceeded", "share content exceeds the configured byte limit");
-      chunks.push(chunk);
-    }
-  } catch (error) {
-    if (error instanceof SharePublishError) throw error;
-    throw new SharePublishError("upload-failed", "share source could not be read");
-  }
-  const bytes3 = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes3.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return bytes3;
-}
-function assertTarget(target) {
-  if (target.kind !== "bearer") {
-    throw new SharePublishError("unsupported-target", "this release publishes bearer shares only");
-  }
-}
-function assertRegistryUrl(value, allowInsecure) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new SharePublishError("invalid-argument", "registry URL is invalid");
-  }
-  if (url.username || url.password || url.search || url.hash) throw new SharePublishError("invalid-argument", "registry URL must not contain credentials, query, or fragment");
-  if (!allowInsecure && url.protocol !== "https:") throw new SharePublishError("invalid-argument", "production registry uploads require HTTPS");
-  if (url.protocol !== "https:" && url.hostname !== "127.0.0.1" && url.hostname !== "localhost") throw new SharePublishError("invalid-argument", "insecure registry uploads are limited to localhost");
-  return url;
-}
-async function defaultUpload(options, input) {
-  if (options.registryBaseUrl === void 0) throw new SharePublishError("upload-auth-required", "an authenticated share registry is required");
-  const base3 = assertRegistryUrl(options.registryBaseUrl, options.allowInsecureRegistry === true).toString().replace(/\/$/, "");
-  const localInsecure = options.allowInsecureRegistry === true && (new URL(base3).hostname === "127.0.0.1" || new URL(base3).hostname === "localhost");
-  if (options.authorizeUpload === void 0 && !localInsecure) {
-    throw new SharePublishError("upload-auth-required", "share upload authorization is required");
-  }
-  let authorization;
-  if (options.authorizeUpload !== void 0) {
-    try {
-      authorization = await options.authorizeUpload(input);
-    } catch {
-      throw new SharePublishError("upload-auth-required", "share upload authorization was rejected");
-    }
-  }
-  if (authorization !== void 0 && options.authorizationOrigin !== void 0) {
-    let authorizationUrl;
-    try {
-      authorizationUrl = new URL(options.authorizationOrigin);
-    } catch {
-      throw new SharePublishError("invalid-argument", "upload authorization origin is invalid");
-    }
-    if (authorizationUrl.origin !== new URL(base3).origin) throw new SharePublishError("upload-auth-required", "upload authorization is scoped to another origin");
-  }
-  const headers = new Headers({
-    "content-type": "application/vnd.ipld.raw",
-    "if-none-match": "*",
-    "x-delete-after": input.deleteAfter
-  });
-  if (typeof authorization === "string") {
-    headers.set("x-tinycloud-upload-attestation", authorization);
-    try {
-      const attestation = JSON.parse(authorization);
-      if (attestation.retention === void 0) throw new Error("retention");
-      headers.set("x-tinycloud-retention", canonicalize(attestation.retention));
-    } catch {
-      throw new SharePublishError("upload-auth-required", "share upload authorization was rejected");
-    }
-  } else if (authorization !== void 0) {
-    new Headers(authorization).forEach((value, key) => headers.set(key, value));
-  }
-  let response;
-  try {
-    response = await (options.fetchFn ?? globalThis.fetch)(`${base3}/blobs`, {
-      method: "POST",
-      headers,
-      body: input.blob,
-      ...options.credentials === void 0 ? {} : { credentials: options.credentials },
-      redirect: "error",
-      referrerPolicy: "no-referrer"
-    });
-  } catch {
-    throw new SharePublishError("upload-failed", "share registry is unavailable");
-  }
-  if (response.status === 401 || response.status === 403) throw new SharePublishError("upload-auth-required", "share upload authorization was rejected");
-  if (!response.ok) throw new SharePublishError("upload-failed", "share registry rejected the encrypted blob");
-  let body;
-  try {
-    body = await response.json();
-  } catch {
-    throw new SharePublishError("upload-failed", "share registry returned an invalid response");
-  }
-  const record2 = typeof body === "object" && body !== null ? body : {};
-  if (record2.cid !== input.cid || typeof record2.deleteAfter !== "string") throw new SharePublishError("upload-failed", "share registry returned an unexpected CID or retention value");
-  return { cid: input.cid, deleteAfter: record2.deleteAfter };
-}
-async function uploadShareBlob(options, input) {
-  const result = await (options.uploadBlob ?? ((value) => defaultUpload(options, value)))(input);
-  if (result.cid !== input.cid || typeof result.deleteAfter !== "string") throw new SharePublishError("upload-failed", "share uploader returned an invalid result");
-  return result;
-}
-async function publishShare(options) {
-  const target = options.target ?? { kind: "bearer" };
-  assertTarget(target);
-  assertSafeFilename(options.filename);
-  assertOrigin(options.origin, "share origin");
-  if (options.mediaType !== void 0 && options.mediaType.length === 0) throw new SharePublishError("invalid-argument", "mediaType must not be empty");
-  const maxBytes = options.maxBytes ?? SHARE_CONTENT_LIMIT;
-  if (maxBytes > SHARE_CONTENT_LIMIT) throw new SharePublishError("max-bytes-exceeded", "share content exceeds the maximum 100 MiB limit");
-  const content = await snapshotSource(options.source, maxBytes);
-  if (content.byteLength === 0) throw new SharePublishError("invalid-argument", "share content is empty");
-  if (options.allowBinary !== true) {
-    try {
-      new TextDecoder("utf-8", { fatal: true }).decode(content);
-    } catch {
-      throw new SharePublishError("invalid-argument", "Markdown input must be valid UTF-8");
-    }
-  }
-  const nowMs = options.now?.() ?? Date.now();
-  const expiresAt = options.expiresAt ?? new Date(nowMs + DEFAULT_SHARE_LIFETIME_MS);
-  if (!Number.isFinite(expiresAt.getTime()) || expiresAt.getTime() <= nowMs) throw new SharePublishError("invalid-argument", "expiresAt must be a valid future time");
-  const expiry = expiresAt.toISOString();
-  const nodeAudience = options.nodeAudience ?? "did:web:node.tinycloud.xyz";
-  const spaceId = options.spaceId ?? "bearer";
-  const shareId = toBase64Url(globalThis.crypto.getRandomValues(new Uint8Array(16)));
-  const path = `shares/${shareId}/${options.filename}`;
-  const sessionPrivateKey = ed255194.utils.randomPrivateKey();
-  const senderPrivateKey = ed255194.utils.randomPrivateKey();
-  let contentKey;
-  let envelopeKey;
-  try {
-    const sessionPublicKey = ed255194.getPublicKey(sessionPrivateKey);
-    const sessionDid = didKeyFromEd25519PublicKey(sessionPublicKey);
-    const delegation = mintBearerDelegation({
-      issuerPrivateKey: senderPrivateKey,
-      audienceDid: sessionDid,
-      resourceUri: bearerResourceUri(options.origin, spaceId, path),
-      expiresAtSeconds: Math.ceil(expiresAt.getTime() / 1e3)
-    });
-    contentKey = generateKey();
-    const sealedContent = await seal(content, contentKey);
-    const unsigned = {
-      version: 1,
-      shareId,
-      delegation,
-      authorizationTarget: {
-        kind: "bearerKey",
-        sessionJwk: { kty: "OKP", crv: "Ed25519", x: toBase64Url(sessionPublicKey), d: toBase64Url(sessionPrivateKey) }
-      },
-      target: { origin: options.origin, nodeAudience, spaceId, resource: { kind: "exact", path } },
-      display: { filename: options.filename },
-      expiry,
-      content: { cid: sealedContent.cid, key: toBase64Url(contentKey) }
-    };
-    const envelope = signEnvelope(unsigned, senderPrivateKey);
-    envelopeKey = generateKey();
-    const sealedEnvelope = await seal(new TextEncoder().encode(canonicalize(envelope)), envelopeKey);
-    let inlineUrl;
-    if (options.inline === true) {
-      try {
-        inlineUrl = await encodeInlineShareUrl({ origin: options.origin, ciphertext: sealedEnvelope.blob, key32: envelopeKey });
-      } catch (error) {
-        throw new SharePublishError("inline-too-large", error instanceof Error ? error.message : "inline share is too large");
-      }
-    }
-    const contentUpload = await uploadShareBlob(options, { blob: sealedContent.blob, cid: sealedContent.cid, deleteAfter: expiry, contentLength: sealedContent.blob.byteLength });
-    let url;
-    let kind;
-    let retention = contentUpload.deleteAfter;
-    if (options.inline === true) {
-      if (inlineUrl === void 0) throw new SharePublishError("inline-too-large", "inline share is too large");
-      url = inlineUrl;
-      kind = "inline";
-    } else {
-      const envelopeUpload = await uploadShareBlob(options, { blob: sealedEnvelope.blob, cid: sealedEnvelope.cid, deleteAfter: expiry, contentLength: sealedEnvelope.blob.byteLength });
-      url = encodeShareUrl({ origin: options.origin, ciphertextCid: envelopeUpload.cid, key32: envelopeKey });
-      kind = "compact";
-      retention = envelopeUpload.deleteAfter;
-    }
-    const metadata = {
-      protocol: "tinycloud-share",
-      version: 1,
-      shareId,
-      origin: options.origin,
-      target: { kind: "bearer", origin: options.origin, nodeAudience, spaceId },
-      resource: { kind: "exact", path },
-      actions: ["read"],
-      expiresAt: expiry,
-      display: { filename: options.filename },
-      content: { cid: sealedContent.cid }
-    };
-    const result = { protocol: "tinycloud-share", version: SHARE_PUBLISH_RESULT_VERSION, link: { kind, cid: sealedEnvelope.cid }, metadata, registryDeleteAfter: retention };
-    Object.defineProperty(result, "toJSON", {
-      enumerable: false,
-      value: () => redactPublishedShare(result)
-    });
-    Object.defineProperty(result, "url", { enumerable: false, value: url });
-    return result;
-  } finally {
-    sessionPrivateKey.fill(0);
-    senderPrivateKey.fill(0);
-    contentKey?.fill(0);
-    envelopeKey?.fill(0);
-  }
-}
 
 // src/addressed.ts
 async function parseAddressedEnvelope(value) {
@@ -6694,10 +5988,31 @@ async function parseAddressedEnvelope(value) {
   return { envelope, policy: decoded, policyCid: envelope.authorizationTarget.policyCid };
 }
 
-// src/owner-policy.ts
-import { ed25519 as ed255195 } from "@noble/curves/ed25519";
+// src/addressed-publish.ts
 import { sha256 as sha2563 } from "@noble/hashes/sha256";
 
+// src/authorization.ts
+async function authorizeShare(input) {
+  if (input.resumeToken !== void 0) {
+    if (input.resumeToken.length < 16 || input.resumeToken.length > 512) {
+      return { state: "denied", reason: "rejected" };
+    }
+    return input.adapter.resume({
+      envelope: input.envelope,
+      method: input.method,
+      resumeToken: input.resumeToken,
+      ...input.proof === void 0 ? {} : { proof: input.proof }
+    });
+  }
+  return input.adapter.begin({ envelope: input.envelope, method: input.method });
+}
+function authorizationMethodForTarget(target) {
+  if (target.kind === "recipientDid") return "openkey-device";
+  if (target.kind === "email") return "email-claim";
+  if (target.kind === "emailDomain") return "email-claim";
+  return void 0;
+}
+
 // ../../node_modules/multiformats/dist/src/bytes.js
 var empty2 = new Uint8Array(0);
 function equals3(aa, bb) {
@@ -7039,9 +6354,402 @@ function rfc46482({ name, prefix, bitsPerChar, alphabet }) {
   });
 }
 
-// ../../node_modules/multiformats/dist/src/bases/base32.js
-var base322 = rfc46482({
-  prefix: "b",
+// ../../node_modules/multiformats/dist/src/bases/base58.js
+var base58btc2 = baseX2({
+  name: "base58btc",
+  prefix: "z",
+  alphabet: "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+});
+var base58flickr2 = baseX2({
+  name: "base58flickr",
+  prefix: "Z",
+  alphabet: "123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ"
+});
+
+// src/targets.ts
+function validEmail(value) {
+  return /^[^@\s]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i.test(value);
+}
+function validDomain(value) {
+  return /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))+$/i.test(value);
+}
+function validRecipientDid(value) {
+  if (value.length === 0 || value.length > 2048 || /[\u0000-\u0020\u007f]/.test(value)) return false;
+  const parts = value.split(":");
+  if (parts.length < 3 || parts[0] !== "did" || !/^[a-z0-9]+$/.test(parts[1] ?? "")) return false;
+  const identifier = parts.slice(2);
+  if (identifier.some((part) => part.length === 0)) return false;
+  if (parts[1] === "web") {
+    const host = identifier[0] ?? "";
+    if (host.length > 253 || host.split(".").some((label) => !label || label.length > 63 || !/^[A-Za-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-"))) return false;
+    return identifier.slice(1).every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  }
+  if (parts[1] === "pkh") return identifier.length >= 3 && identifier.every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  if (parts[1] === "key") {
+    try {
+      const bytes3 = base58btc2.decode(identifier.join(":"));
+      return bytes3.length === 34 && bytes3[0] === 237 && bytes3[1] === 1;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function normalizeShareTarget(target) {
+  if (target.kind === "bearer") return target;
+  if (target.kind === "recipientDid") {
+    if (!validRecipientDid(target.did)) throw new TypeError("recipient DID is invalid");
+    return { kind: target.kind, did: target.did };
+  }
+  if (target.kind === "email") {
+    if (!validEmail(target.address)) throw new TypeError("recipient email is invalid");
+    const at = target.address.lastIndexOf("@");
+    return { kind: target.kind, address: `${target.address.slice(0, at)}@${target.address.slice(at + 1).toLowerCase()}` };
+  }
+  if (!validDomain(target.domain)) throw new TypeError("recipient email domain is invalid");
+  return { kind: target.kind, domain: target.domain.toLowerCase() };
+}
+function targetAuthorizationMethod(target) {
+  return authorizationMethodForTarget(target);
+}
+async function publishTargetShare(input) {
+  const target = normalizeShareTarget(input.target);
+  if (input.targetAdapter === void 0) {
+    if (target.kind === "bearer") throw new SharePublishError("authority-required", "native bearer publication requires an authenticated TinyCloud node");
+    return {
+      state: "authorization-required",
+      method: targetAuthorizationMethod(target)
+    };
+  }
+  const source = input.source instanceof Uint8Array ? input.source.slice() : await (async () => {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of input.source) {
+      if (!(chunk instanceof Uint8Array)) throw new TypeError("share publication source yielded invalid bytes");
+      size += chunk.byteLength;
+      if (size > (input.maxBytes ?? SHARE_CONTENT_LIMIT)) throw new SharePublishError("max-bytes-exceeded", "share publication exceeds maxBytes");
+      chunks.push(chunk.slice());
+    }
+    const bytes3 = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes3.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return bytes3;
+  })();
+  if (source.byteLength === 0) throw new SharePublishError("invalid-argument", "share content is empty");
+  if (!input.filename || input.filename === "." || input.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(input.filename)) {
+    throw new SharePublishError("invalid-argument", "filename must be one safe path segment");
+  }
+  if (target.kind === "bearer" && input.allowBinary !== true) {
+    try {
+      new TextDecoder("utf-8", { fatal: true }).decode(source);
+    } catch {
+      throw new SharePublishError("invalid-argument", "Markdown input must be valid UTF-8");
+    }
+  }
+  const files = input.files === void 0 || input.files.length === 0 ? [{ bytes: source }] : input.files;
+  const limit = input.maxBytes ?? SHARE_CONTENT_LIMIT;
+  let totalBytes = 0;
+  for (const file of files) {
+    totalBytes += file.bytes.byteLength;
+    if (!Number.isSafeInteger(totalBytes) || totalBytes > limit) {
+      throw new SharePublishError("max-bytes-exceeded", "share publication exceeds the combined byte limit");
+    }
+  }
+  const nowMs = input.now?.() ?? Date.now();
+  const expiresAt = input.expiresAt ?? new Date(nowMs + DEFAULT_SHARE_LIFETIME_MS);
+  if (!Number.isFinite(expiresAt.getTime()) || expiresAt.getTime() <= nowMs) throw new SharePublishError("invalid-argument", "expiresAt must be a valid future time");
+  return input.targetAdapter.publish({
+    source,
+    filename: input.filename,
+    ...input.files === void 0 ? {} : { files: input.files },
+    ...input.mediaType === void 0 ? {} : { mediaType: input.mediaType },
+    ...input.resourceKind === void 0 ? {} : { resourceKind: input.resourceKind },
+    ...input.actions === void 0 ? {} : { actions: input.actions },
+    target,
+    expiresAt,
+    origin: input.origin,
+    ...input.notify === void 0 ? {} : { notify: input.notify }
+  });
+}
+
+// src/addressed-publish.ts
+var POLICY_V1_DOMAIN = "xyz.tinycloud.policy/policy/v1\0";
+var POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
+var POLICY_CAPABILITY_V1_DOMAIN2 = "xyz.tinycloud.policy/PolicyCapability/v1\0";
+var CONTENT_SOURCE_V1_DOMAIN2 = "xyz.tinycloud.policy/ContentSource/v1\0";
+var NATIVE_PROJECTION_V1_DOMAIN2 = "xyz.tinycloud.policy/NativeProjection/v1\0";
+var ENVELOPE_V3_DOMAIN = "xyz.tinycloud.share/envelope/v3\0";
+var textEncoder = new TextEncoder();
+function targetMatcher(target) {
+  if (target.kind === "recipientDid") return { kind: "recipientDid", value: target.did };
+  if (target.kind === "email") return { kind: "exactEmail", value: target.address };
+  return { kind: "emailDomain", value: target.domain };
+}
+function targetKind(target) {
+  return target.kind;
+}
+function assertSafeInput(input) {
+  if (!/^[A-Za-z0-9_-]{16,128}$/.test(input.shareId)) throw new TypeError("addressed share id is invalid");
+  if (input.filename.length === 0 || input.filename === "." || input.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(input.filename)) throw new TypeError("addressed filename is invalid");
+  if (!Number.isSafeInteger(input.byteLength) || input.byteLength < 0 || input.byteLength > SHARE_CONTENT_LIMIT) throw new TypeError("addressed content length is invalid");
+  if (input.actions.length === 0 || input.policyActions.length === 0) throw new TypeError("addressed share actions are empty");
+  if (!Number.isFinite(input.expiresAt.getTime()) || input.expiresAt.getTime() <= Date.now()) throw new TypeError("addressed share expiry must be in the future");
+  if (input.artifact === "html" && (input.resource.kind !== "prefix" || !input.actions.includes("read") || !input.actions.includes("list"))) throw new TypeError("html artifacts require a readable prefix");
+  if (input.contentSource.shareId !== input.shareId || input.contentSource.selector !== input.resource.kind) throw new TypeError("addressed content source is not bound to the share");
+}
+function hex2(bytes3) {
+  return [...bytes3].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function digestHex(value, domain) {
+  return hex2(sha2563(textEncoder.encode(`${domain}${canonicalize(value)}`)));
+}
+function sortCanonical(values) {
+  return [...values].sort((left, right) => canonicalize(left).localeCompare(canonicalize(right)));
+}
+function base32Lower2(bytes3) {
+  const alphabet = "abcdefghijklmnopqrstuvwxyz234567";
+  let output = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of bytes3) {
+    buffer = buffer << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += alphabet[buffer >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) output += alphabet[buffer << 5 - bits & 31];
+  return output;
+}
+function rfc3339Seconds(value) {
+  return new Date(Math.floor(value.getTime() / 1e3) * 1e3).toISOString().replace(".000Z", "Z");
+}
+function nativeProjection(capabilities) {
+  return sortCanonical(capabilities.map((capability) => capability.kind === "encryption" ? { service: "tinycloud.encryption", space: capability.resource, path: capability.resource, actions: [capability.action] } : {
+    service: "tinycloud.kv",
+    space: capability.resource.slice(0, capability.resource.indexOf("/kv/")),
+    path: capability.resource.slice(capability.resource.indexOf("/kv/") + 4),
+    actions: [...capability.actions],
+    caveat: { type: "xyz.tinycloud.resource/selector", kind: capability.selector, value: capability.resource }
+  }));
+}
+async function createPolicy(options, capabilities) {
+  const fields = {
+    ownerDid: options.authority.ownerDid,
+    createdAt: rfc3339Seconds(/* @__PURE__ */ new Date()),
+    expiresAt: rfc3339Seconds(options.expiresAt),
+    contentSource: options.contentSource,
+    capabilityCeiling: [...capabilities]
+  };
+  const unsigned = options.credentialRequirement === void 0 ? { schema: "xyz.tinycloud.policy/policy/v1", ...fields } : { schema: "xyz.tinycloud.policy/policy/v2", ...fields, credentialRequirement: options.credentialRequirement };
+  const domain = options.credentialRequirement === void 0 ? POLICY_V1_DOMAIN : POLICY_V2_DOMAIN;
+  const policyDigestHex = digestHex(unsigned, domain);
+  const signature = await options.authority.sign(sha2563(textEncoder.encode(`${domain}${canonicalize(unsigned)}`)));
+  if (signature.byteLength !== 64) throw new TypeError("policy signature must be Ed25519");
+  const policy = {
+    ...unsigned,
+    policyId: `pol_${base32Lower2(Uint8Array.from(policyDigestHex.match(/../g), (byte) => Number.parseInt(byte, 16)))}`,
+    signature: { suite: "Ed25519", signerDid: options.authority.ownerDid, value: toBase64Url(signature) }
+  };
+  return { policy, policyCid: await computeCid(textEncoder.encode(canonicalize(policy))), policyDigestHex };
+}
+function publicationResult(input) {
+  const result = {
+    protocol: "tinycloud-share",
+    version: SHARE_PUBLISH_RESULT_VERSION,
+    url: input.url,
+    link: { kind: "policy", cid: input.envelopeCid },
+    metadata: {
+      protocol: "tinycloud-share",
+      version: 1,
+      shareId: input.options.shareId,
+      origin: input.options.shareOrigin,
+      target: { kind: targetKind(input.options.target), origin: input.options.nodeOrigin, nodeAudience: input.enforcerDid, spaceId: input.options.spaceId },
+      resource: { ...input.options.resource },
+      actions: [...input.options.actions],
+      expiresAt: input.expiry,
+      display: { filename: input.options.filename },
+      recipientMatcher: { ...input.matcher },
+      policyCid: input.policyCid,
+      ownerDelegationCid: input.policyRootCid,
+      enforcementDelegationCid: input.enforcementRootCid,
+      ownerDid: input.options.authority.ownerDid,
+      enforcerDid: input.enforcerDid,
+      envelopeCid: input.envelopeCid,
+      shareCid: input.envelopeCid
+    }
+  };
+  Object.defineProperty(result, "toJSON", { enumerable: false, value: () => redactPublishedShare(result) });
+  Object.defineProperty(result, "url", { enumerable: false, value: input.url });
+  Object.defineProperty(result, "deliveryMaterial", { enumerable: false, value: input.deliveryMaterial });
+  return result;
+}
+async function publishAddressedShare(options) {
+  assertSafeInput(options);
+  const target = normalizeShareTarget(options.target);
+  if (target.kind === "bearer") throw new TypeError("addressed target is required");
+  const expiry = rfc3339Seconds(options.expiresAt);
+  const matcher = targetMatcher(target);
+  const capabilities = sortCanonical([
+    { kind: "kv", resource: options.contentSource.kvResource, selector: options.resource.kind, actions: [...options.policyActions] },
+    { kind: "encryption", resource: options.contentSource.encryptionNetwork, action: "tinycloud.encryption/decrypt" }
+  ]);
+  const created = await createPolicy(options, capabilities);
+  const contentSourceDigestHex = digestHex(options.contentSource, CONTENT_SOURCE_V1_DOMAIN2);
+  const capabilityCeilingHashHex = digestHex(capabilities, POLICY_CAPABILITY_V1_DOMAIN2);
+  const nativeProjectionHashHex = digestHex(nativeProjection(capabilities), NATIVE_PROJECTION_V1_DOMAIN2);
+  const commonRoot = {
+    ownerDid: options.authority.ownerDid,
+    policyId: created.policy.policyId,
+    policyDigestHex: created.policyDigestHex,
+    policyCid: created.policyCid,
+    contentSourceDigestHex,
+    capabilityCeilingHashHex,
+    nativeProjectionHashHex,
+    notBefore: new Date(created.policy.createdAt),
+    expiresAt: new Date(expiry),
+    nodeAudience: options.nodeAudience,
+    capabilities
+  };
+  const policyRootReceipt = await options.authority.createOwnerRoot({ ...commonRoot, role: "policy-authority", audienceDid: `did:tinycloud:policy:${created.policyDigestHex}` });
+  const enforcementRootReceipt = await options.authority.createOwnerRoot({ ...commonRoot, role: "policy-enforcement", audienceDid: options.enforcerDid });
+  const policyRoot = { cid: policyRootReceipt.cid, authorization: policyRootReceipt.delegationHeader.Authorization.replace(/^Bearer\s+/i, ""), role: "policy-authority" };
+  const enforcementRoot = { cid: enforcementRootReceipt.cid, authorization: enforcementRootReceipt.delegationHeader.Authorization.replace(/^Bearer\s+/i, ""), role: "policy-enforcement" };
+  const registration = await options.authority.registerPolicy({
+    policyCid: created.policyCid,
+    policy: created.policy,
+    policyRoot,
+    enforcementRoot,
+    contentSourceDigestHex,
+    nativeProjectionHashHex,
+    rootExpiresAt: expiry,
+    enforcerDid: options.enforcerDid,
+    expectedNodeAudience: options.nodeAudience
+  });
+  if (registration.policyCid !== created.policyCid || registration.policyRootCid !== policyRoot.cid || registration.enforcementRootCid !== enforcementRoot.cid) throw new Error("Policy/v3 registration receipt is not bound to the published roots");
+  const unsigned = {
+    version: 3,
+    shareId: options.shareId,
+    recipientMatcher: matcher,
+    ...options.deliveryEmail === void 0 ? {} : { deliveryEmail: options.deliveryEmail },
+    actions: [...options.actions],
+    resource: { ...options.resource },
+    target: { origin: options.nodeOrigin, nodeAudience: registration.attestedEnforcerBinding.enforcerDid, spaceId: options.spaceId },
+    policy: created.policy,
+    policyCid: created.policyCid,
+    policyRoot,
+    enforcementRoot,
+    attestedEnforcerBinding: registration.attestedEnforcerBinding,
+    contentSource: options.contentSource,
+    contentSourceDigestHex,
+    encryptionNetwork: options.contentSource.encryptionNetwork,
+    expiry,
+    display: { filename: options.filename },
+    encrypted: true,
+    metadata: {
+      mediaType: options.mediaType,
+      byteLength: options.byteLength,
+      filename: options.filename,
+      ...options.mediaType.startsWith("text/") ? { encoding: "utf-8" } : {},
+      ...options.artifact === void 0 ? {} : { artifact: options.artifact }
+    }
+  };
+  unsignedShareEnvelopeV3Schema.parse(unsigned);
+  const envelopeSignature = await options.authority.sign(sha2563(textEncoder.encode(`${ENVELOPE_V3_DOMAIN}${canonicalize(unsigned)}`)));
+  if (envelopeSignature.byteLength !== 64) throw new TypeError("v3 envelope signature must be Ed25519");
+  const envelope = { ...unsigned, signature: { signerDid: options.authority.ownerDid, algorithm: "Ed25519", value: toBase64Url(envelopeSignature) } };
+  shareEnvelopeV3Schema.parse(envelope);
+  const envelopeBytes = textEncoder.encode(canonicalize(envelope));
+  const envelopeCid = await computeCid(envelopeBytes);
+  const url = await encodePublicInlineShareUrl({ origin: options.shareOrigin, plaintext: envelopeBytes });
+  const deliveryMaterial = { envelope, shareCid: envelopeCid };
+  options.onDeliveryMaterial?.(deliveryMaterial);
+  return publicationResult({
+    options,
+    url,
+    envelopeCid,
+    matcher,
+    policyCid: created.policyCid,
+    policyRootCid: policyRoot.cid,
+    enforcementRootCid: enforcementRoot.cid,
+    enforcerDid: registration.attestedEnforcerBinding.enforcerDid,
+    expiry,
+    deliveryMaterial
+  });
+}
+
+// src/cache.ts
+import { sha256 as sha2564 } from "@noble/hashes/sha256";
+function cacheKey(key) {
+  if (!key.cid || !key.expiresAt) throw new Error("share cache keys require CID and expiry");
+  return `${key.cid}\0${key.expiresAt}`;
+}
+function digest(bytes3) {
+  return sha2564(bytes3);
+}
+function equalBytes(left, right) {
+  if (left.byteLength !== right.byteLength) return false;
+  return left.every((byte, index) => byte === right[index]);
+}
+var MemoryShareCache = class {
+  constructor(now = () => /* @__PURE__ */ new Date()) {
+    this.now = now;
+  }
+  entries = /* @__PURE__ */ new Map();
+  async get(key, now = /* @__PURE__ */ new Date()) {
+    const mapKey = cacheKey(key);
+    const entry = this.entries.get(mapKey);
+    if (entry === void 0) return void 0;
+    if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest(entry.bytes))) {
+      this.entries.delete(mapKey);
+      return void 0;
+    }
+    return entry.bytes.slice();
+  }
+  async getByCid(cid2, now = /* @__PURE__ */ new Date()) {
+    const entries = [...this.entries.values()].filter((entry) => entry.key.cid === cid2);
+    for (const entry of entries) {
+      if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest(entry.bytes))) {
+        this.entries.delete(cacheKey(entry.key));
+        continue;
+      }
+      return {
+        key: { ...entry.key },
+        bytes: entry.bytes.slice(),
+        digest: entry.digest.slice(),
+        metadata: { ...entry.metadata }
+      };
+    }
+    return void 0;
+  }
+  async set(key, bytes3, metadata) {
+    if (Date.parse(key.expiresAt) <= this.now().getTime()) return;
+    this.entries.set(cacheKey(key), {
+      key: { cid: key.cid, expiresAt: key.expiresAt },
+      bytes: bytes3.slice(),
+      digest: digest(bytes3),
+      metadata: { ...metadata }
+    });
+  }
+  async delete(key) {
+    this.entries.delete(cacheKey(key));
+  }
+  async clear() {
+    this.entries.clear();
+  }
+};
+
+// src/owner-policy.ts
+import { ed25519 as ed255194 } from "@noble/curves/ed25519";
+import { sha256 as sha2565 } from "@noble/hashes/sha256";
+
+// ../../node_modules/multiformats/dist/src/bases/base32.js
+var base322 = rfc46482({
+  prefix: "b",
   name: "base32",
   alphabet: "abcdefghijklmnopqrstuvwxyz234567",
   bitsPerChar: 5
@@ -7107,18 +6815,6 @@ var base36upper2 = baseX2({
   alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 });
 
-// ../../node_modules/multiformats/dist/src/bases/base58.js
-var base58btc2 = baseX2({
-  name: "base58btc",
-  prefix: "z",
-  alphabet: "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
-});
-var base58flickr2 = baseX2({
-  name: "base58flickr",
-  prefix: "Z",
-  alphabet: "123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ"
-});
-
 // ../../node_modules/multiformats/dist/src/vendor/varint.js
 var encode_12 = encode4;
 var MSB2 = 128;
@@ -7192,25 +6888,25 @@ function encodingLength2(int) {
 }
 
 // ../../node_modules/multiformats/dist/src/hashes/digest.js
-function create2(code3, digest4) {
-  const size = digest4.byteLength;
+function create2(code3, digest3) {
+  const size = digest3.byteLength;
   const sizeOffset = encodingLength2(code3);
   const digestOffset = sizeOffset + encodingLength2(size);
   const bytes3 = new Uint8Array(digestOffset + size);
   encodeTo2(code3, bytes3, 0);
   encodeTo2(size, bytes3, sizeOffset);
-  bytes3.set(digest4, digestOffset);
-  return new Digest2(code3, size, digest4, bytes3);
+  bytes3.set(digest3, digestOffset);
+  return new Digest2(code3, size, digest3, bytes3);
 }
 function decode8(multihash) {
   const bytes3 = coerce3(multihash);
   const [code3, sizeOffset] = decode7(bytes3);
   const [size, digestOffset] = decode7(bytes3.subarray(sizeOffset));
-  const digest4 = bytes3.subarray(sizeOffset + digestOffset);
-  if (digest4.byteLength !== size) {
+  const digest3 = bytes3.subarray(sizeOffset + digestOffset);
+  if (digest3.byteLength !== size) {
     throw new Error("Incorrect length");
   }
-  return new Digest2(code3, size, digest4, bytes3);
+  return new Digest2(code3, size, digest3, bytes3);
 }
 function equals4(a, b) {
   if (a === b) {
@@ -7228,10 +6924,10 @@ var Digest2 = class {
   /**
    * Creates a multihash digest.
    */
-  constructor(code3, size, digest4, bytes3) {
+  constructor(code3, size, digest3, bytes3) {
     this.code = code3;
     this.size = size;
-    this.digest = digest4;
+    this.digest = digest3;
     this.bytes = bytes3;
   }
 };
@@ -7314,8 +7010,8 @@ var CID2 = class _CID2 {
   toV1() {
     switch (this.version) {
       case 0: {
-        const { code: code3, digest: digest4 } = this.multihash;
-        const multihash = create2(code3, digest4);
+        const { code: code3, digest: digest3 } = this.multihash;
+        const multihash = create2(code3, digest3);
         return _CID2.createV1(this.code, multihash);
       }
       case 1: {
@@ -7369,8 +7065,8 @@ var CID2 = class _CID2 {
       return new _CID2(version, code3, multihash, bytes3 ?? encodeCID2(version, code3, multihash.bytes));
     } else if (value[cidSymbol2] === true) {
       const { version, multihash, code: code3 } = value;
-      const digest4 = decode8(multihash);
-      return _CID2.create(version, code3, digest4);
+      const digest3 = decode8(multihash);
+      return _CID2.create(version, code3, digest3);
     } else {
       return null;
     }
@@ -7380,11 +7076,11 @@ var CID2 = class _CID2 {
    * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
    * @param digest - (Multi)hash of the of the content.
    */
-  static create(version, code3, digest4) {
+  static create(version, code3, digest3) {
     if (typeof code3 !== "number") {
       throw new Error("String codecs are no longer supported");
     }
-    if (!(digest4.bytes instanceof Uint8Array)) {
+    if (!(digest3.bytes instanceof Uint8Array)) {
       throw new Error("Invalid digest");
     }
     switch (version) {
@@ -7392,12 +7088,12 @@ var CID2 = class _CID2 {
         if (code3 !== DAG_PB_CODE2) {
           throw new Error(`Version 0 CID must use dag-pb (code: ${DAG_PB_CODE2}) block encoding`);
         } else {
-          return new _CID2(version, code3, digest4, digest4.bytes);
+          return new _CID2(version, code3, digest3, digest3.bytes);
         }
       }
       case 1: {
-        const bytes3 = encodeCID2(version, code3, digest4.bytes);
-        return new _CID2(version, code3, digest4, bytes3);
+        const bytes3 = encodeCID2(version, code3, digest3.bytes);
+        return new _CID2(version, code3, digest3, bytes3);
       }
       default: {
         throw new Error("Invalid version");
@@ -7407,8 +7103,8 @@ var CID2 = class _CID2 {
   /**
    * Simplified version of `create` for CIDv0.
    */
-  static createV0(digest4) {
-    return _CID2.create(0, DAG_PB_CODE2, digest4);
+  static createV0(digest3) {
+    return _CID2.create(0, DAG_PB_CODE2, digest3);
   }
   /**
    * Simplified version of `create` for CIDv1.
@@ -7416,8 +7112,8 @@ var CID2 = class _CID2 {
    * @param code - Content encoding format code.
    * @param digest - Multihash of the content.
    */
-  static createV1(code3, digest4) {
-    return _CID2.create(1, code3, digest4);
+  static createV1(code3, digest3) {
+    return _CID2.create(1, code3, digest3);
   }
   /**
    * Decoded a CID from its binary representation. The byte array must contain
@@ -7450,8 +7146,8 @@ var CID2 = class _CID2 {
       throw new Error("Incorrect length");
     }
     const digestBytes3 = multihashBytes.subarray(specs.multihashSize - specs.digestSize);
-    const digest4 = new Digest2(specs.multihashCode, specs.digestSize, digestBytes3, multihashBytes);
-    const cid2 = specs.version === 0 ? _CID2.createV0(digest4) : _CID2.createV1(specs.codec, digest4);
+    const digest3 = new Digest2(specs.multihashCode, specs.digestSize, digestBytes3, multihashBytes);
+    const cid2 = specs.version === 0 ? _CID2.createV0(digest3) : _CID2.createV1(specs.codec, digest3);
     return [cid2, bytes3.subarray(specs.size)];
   }
   /**
@@ -7603,10 +7299,10 @@ function fromB64(value) {
   throw new Error("base64url decoding is unavailable");
 }
 function cid(bytesValue) {
-  return CID2.createV1(code2, create2(SHA256_CODE2, sha2563(bytesValue))).toString(base322.encoder);
+  return CID2.createV1(code2, create2(SHA256_CODE2, sha2565(bytesValue))).toString(base322.encoder);
 }
-function digest(bytesValue) {
-  return b64(sha2563(bytesValue));
+function digest2(bytesValue) {
+  return b64(sha2565(bytesValue));
 }
 function didKeyFromEd25519PublicKey2(publicKey) {
   if (publicKey.length !== 32) throw new Error("share key public key must be 32 bytes");
@@ -7649,824 +7345,152 @@ function dagCborEncode(value) {
       return;
     }
     if (Array.isArray(item)) {
-      writeHeader(4, item.length);
-      item.forEach(write);
-      return;
-    }
-    if (typeof item === "object" && item !== null) {
-      const entries = Object.entries(item).map(([key, value2]) => {
-        const keyBytes = dagCborEncode(key);
-        return { key, value: value2, keyBytes };
-      }).sort((left, right) => {
-        if (left.keyBytes.length !== right.keyBytes.length) return left.keyBytes.length - right.keyBytes.length;
-        for (let index = 0; index < left.keyBytes.length; index += 1) {
-          const leftByte = left.keyBytes[index] ?? 0;
-          const rightByte = right.keyBytes[index] ?? 0;
-          if (leftByte !== rightByte) return leftByte - rightByte;
-        }
-        return 0;
-      });
-      writeHeader(5, entries.length);
-      entries.forEach(({ key, value: value2 }) => {
-        write(key);
-        write(value2);
-      });
-      return;
-    }
-    throw new Error("Unsupported DAG-CBOR value");
-  };
-  write(value);
-  return Uint8Array.from(output);
-}
-function assertObject(value, keys, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
-  const record2 = value;
-  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) throw new Error(`${label} has unknown or missing fields`);
-  return record2;
-}
-async function createDelegatedShareKey(options) {
-  if (!globalThis.crypto?.subtle) throw new Error("WebCrypto Ed25519 is required for delegated share keys");
-  const generated = await crypto.subtle.generateKey({ name: "Ed25519" }, options.extractable, ["sign", "verify"]);
-  const privateKey = generated.privateKey;
-  const publicKey = new Uint8Array(await crypto.subtle.exportKey("raw", generated.publicKey));
-  let cleared = false;
-  const key = {
-    did: didKeyFromEd25519PublicKey2(publicKey),
-    publicKey: bytes(publicKey),
-    extractable: options.extractable,
-    cryptoKey: privateKey,
-    async sign(input) {
-      if (cleared) throw new Error("share key has been cleared");
-      return new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, privateKey, input));
-    },
-    clear() {
-      cleared = true;
-    }
-  };
-  return key;
-}
-function restoreDelegatedShareKey(input) {
-  let cleared = false;
-  return {
-    did: didKeyFromEd25519PublicKey2(input.publicKey),
-    publicKey: bytes(input.publicKey),
-    extractable: input.extractable,
-    cryptoKey: input.privateKey,
-    async sign(signBytes) {
-      if (cleared) throw new Error("share key has been cleared");
-      if (!globalThis.crypto?.subtle) throw new Error("WebCrypto Ed25519 is required for delegated share keys");
-      return new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, input.privateKey, signBytes));
-    },
-    clear() {
-      cleared = true;
-    }
-  };
-}
-async function createPolicyEnforcementDelegation(input) {
-  if (input.shareKey.did.length === 0 || input.ownerDelegation.delegationCid.length === 0) throw new Error("owner delegation and share key are required");
-  const facts = {
-    ownerDelegationCid: input.ownerDelegation.delegationCid,
-    policyCid: input.policyCid,
-    shareId: input.shareId,
-    shareKeyDid: input.shareKey.did,
-    enforcerDid: input.enforcerDid,
-    nodeAudience: input.nodeAudience,
-    spaceId: input.spaceId,
-    path: input.path,
-    actions: [...input.actions],
-    contentSourceDigest: input.contentSourceDigest,
-    expiresAt: input.expiresAt
-  };
-  const unsigned = { type: "TinyCloudSharePolicyEnforcement", version: 2, issuerDid: input.shareKey.did, audienceDid: input.enforcerDid, facts };
-  const dagCborBytes = dagCborEncode({ domain: POLICY_ENFORCEMENT_DOMAIN, unsigned });
-  const signature = b64(await input.shareKey.sign(dagCborBytes));
-  return { cid: cid(dagCborBytes), dagCbor: b64(dagCborBytes), issuerDid: input.shareKey.did, audienceDid: input.enforcerDid, facts, signature };
-}
-async function canonicalOwnerSharePolicy(policy) {
-  const text = canonicalize({ domain: POLICY_DOMAIN, policy });
-  const policyBytes = new TextEncoder().encode(text);
-  return { bytes: policyBytes, cid: cid(policyBytes), digest: digest(policyBytes) };
-}
-function computeOwnerShareRegistrationCid(registration) {
-  return cid(new TextEncoder().encode(canonicalize(registration)));
-}
-function validateOwnerSharePolicyRegistration(value, expected) {
-  if (cid(expected.policy.bytes) !== expected.policy.cid) throw new Error("submitted owner-share policy bytes do not match its CID");
-  const root = assertObject(value, ["registration", "proof"], "owner-share registration response");
-  const registration = assertObject(root.registration, ["registrationCid", "policyCid", "ownerDelegationCid", "enforcementDelegationCid", "ownerDid", "shareKeyDid", "enforcerDid", "shareId", "recipientMatcher", "target", "resource", "actions", "contentSource", "contentSourceDigest", "registeredAt", "expiresAt"], "owner-share registration");
-  const proof = assertObject(root.proof, ["alg", "kid", "signature"], "owner-share registration proof");
-  if (registration.policyCid !== expected.policy.cid || registration.ownerDelegationCid !== expected.ownerDelegation.delegationCid || registration.enforcementDelegationCid !== expected.enforcementDelegation.cid || registration.contentSourceDigest !== expected.contentSourceDigest) throw new Error("owner-share registration is not bound to the submitted chain");
-  let policyValue;
-  try {
-    policyValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(expected.policy.bytes));
-  } catch {
-    throw new Error("owner-share policy is not valid JSON");
-  }
-  const policy = policyValue.policy;
-  if (policyValue.domain !== "xyz.tinycloud.share/policy/v2\0" || policy === void 0 || Array.isArray(policy)) throw new Error("owner-share policy envelope is invalid");
-  const target = policy.target;
-  const resource = policy.resource;
-  const registrationTarget = registration.target;
-  const registrationResource = registration.resource;
-  const enforcementFacts = expected.enforcementDelegation.facts;
-  if (typeof target?.origin !== "string" || typeof target.nodeAudience !== "string" || typeof target.enforcerDid !== "string" || typeof target.spaceId !== "string" || typeof resource?.kind !== "string" || !["exact", "prefix"].includes(resource.kind) || typeof resource?.path !== "string" || !Array.isArray(policy.actions) || policy.ownerDid !== registration.ownerDid || policy.shareKeyDid !== registration.shareKeyDid || policy.shareId !== registration.shareId || canonicalize(policy.recipientMatcher) !== canonicalize(registration.recipientMatcher) || target.origin !== registrationTarget.origin || target.nodeAudience !== registrationTarget.nodeAudience || target.enforcerDid !== registration.enforcerDid || target.spaceId !== registrationTarget.spaceId || resource.kind !== registrationResource.kind || resource.path !== registrationResource.path || canonicalize(policy.actions) !== canonicalize(registration.actions) || canonicalize(policy.contentSource) !== canonicalize(registration.contentSource) || policy.expiresAt !== registration.expiresAt || policy.contentSourceDigest !== registration.contentSourceDigest || enforcementFacts.ownerDelegationCid !== registration.ownerDelegationCid || enforcementFacts.policyCid !== registration.policyCid || enforcementFacts.shareKeyDid !== registration.shareKeyDid || enforcementFacts.enforcerDid !== registration.enforcerDid || enforcementFacts.nodeAudience !== registrationTarget.nodeAudience || enforcementFacts.spaceId !== registrationTarget.spaceId || enforcementFacts.path !== registrationResource.path || canonicalize(enforcementFacts.actions) !== canonicalize(registration.actions) || enforcementFacts.expiresAt !== registration.expiresAt) throw new Error("owner-share registration is not bound to the canonical policy");
-  if (typeof registration.registrationCid !== "string" || typeof registration.expiresAt !== "string" || typeof registration.registeredAt !== "string") throw new Error("owner-share registration timestamps are invalid");
-  if (new Date(registration.expiresAt).toISOString() !== registration.expiresAt || Date.parse(registration.expiresAt) <= Date.now()) throw new Error("owner-share registration is expired or non-canonical");
-  const { registrationCid: _registrationCid, ...registrationCore } = registration;
-  if (computeOwnerShareRegistrationCid(registrationCore) !== registration.registrationCid) throw new Error("owner-share registration CID does not match its canonical core");
-  if (proof.alg !== "EdDSA" || typeof proof.kid !== "string" || typeof proof.signature !== "string") throw new Error("owner-share registration proof is invalid");
-  const proofKey = expected.nodeProof;
-  if (proofKey === void 0) throw new Error("owner-share registration proof trust material is required");
-  if (proof.kid !== proofKey.kid) throw new Error("owner-share registration proof key is not trusted");
-  const encodedKid = proofKey.publicKey;
-  if (encodedKid.length === 34 && encodedKid[0] === 237 && encodedKid[1] === 1) {
-  } else if (encodedKid.length !== 32) throw new Error("owner-share registration proof key is invalid");
-  const publicKey = encodedKid.length === 34 ? encodedKid.slice(2) : encodedKid;
-  const signatureBytes = fromB64(proof.signature);
-  const signedBytes = new TextEncoder().encode(`${OWNER_SHARE_REGISTRATION_DOMAIN}${canonicalize(registrationCore)}`);
-  if (signatureBytes.length !== 64 || !ed255195.verify(signatureBytes, signedBytes, publicKey)) throw new Error("owner-share registration proof signature is invalid");
-  return { registration, proof };
-}
-function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
-  let value;
-  try {
-    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytesValue));
-  } catch {
-    throw new Error("owner-share registration response is not valid UTF-8 JSON");
-  }
-  return validateOwnerSharePolicyRegistration(value, expected);
-}
-
-// src/authorization.ts
-async function authorizeShare(input) {
-  if (input.resumeToken !== void 0) {
-    if (input.resumeToken.length < 16 || input.resumeToken.length > 512) {
-      return { state: "denied", reason: "rejected" };
-    }
-    return input.adapter.resume({
-      envelope: input.envelope,
-      method: input.method,
-      resumeToken: input.resumeToken,
-      ...input.proof === void 0 ? {} : { proof: input.proof }
-    });
-  }
-  return input.adapter.begin({ envelope: input.envelope, method: input.method });
-}
-function authorizationMethodForTarget(target) {
-  if (target.kind === "recipientDid") return "openkey-device";
-  if (target.kind === "email") return "email-claim";
-  if (target.kind === "emailDomain") return "email-claim";
-  return void 0;
-}
-
-// src/targets.ts
-function validEmail(value) {
-  return /^[^@\s]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i.test(value);
-}
-function validDomain(value) {
-  return /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))+$/i.test(value);
-}
-function validRecipientDid(value) {
-  if (value.length === 0 || value.length > 2048 || /[\u0000-\u0020\u007f]/.test(value)) return false;
-  const parts = value.split(":");
-  if (parts.length < 3 || parts[0] !== "did" || !/^[a-z0-9]+$/.test(parts[1] ?? "")) return false;
-  const identifier = parts.slice(2);
-  if (identifier.some((part) => part.length === 0)) return false;
-  if (parts[1] === "web") {
-    const host = identifier[0] ?? "";
-    if (host.length > 253 || host.split(".").some((label) => !label || label.length > 63 || !/^[A-Za-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-"))) return false;
-    return identifier.slice(1).every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
-  }
-  if (parts[1] === "pkh") return identifier.length >= 3 && identifier.every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
-  if (parts[1] === "key") {
-    try {
-      const bytes3 = base58btc2.decode(identifier.join(":"));
-      return bytes3.length === 34 && bytes3[0] === 237 && bytes3[1] === 1;
-    } catch {
-      return false;
-    }
-  }
-  return false;
-}
-function normalizeShareTarget(target) {
-  if (target.kind === "bearer") return target;
-  if (target.kind === "recipientDid") {
-    if (!validRecipientDid(target.did)) throw new TypeError("recipient DID is invalid");
-    return { kind: target.kind, did: target.did };
-  }
-  if (target.kind === "email") {
-    if (!validEmail(target.address)) throw new TypeError("recipient email is invalid");
-    const at = target.address.lastIndexOf("@");
-    return { kind: target.kind, address: `${target.address.slice(0, at)}@${target.address.slice(at + 1).toLowerCase()}` };
-  }
-  if (!validDomain(target.domain)) throw new TypeError("recipient email domain is invalid");
-  return { kind: target.kind, domain: target.domain.toLowerCase() };
-}
-function targetAuthorizationMethod(target) {
-  return authorizationMethodForTarget(target);
-}
-async function publishTargetShare(input) {
-  const target = normalizeShareTarget(input.target);
-  if (target.kind === "bearer") return publishShare(input);
-  if (input.targetAdapter === void 0) {
-    return {
-      state: "authorization-required",
-      method: targetAuthorizationMethod(target)
-    };
-  }
-  const source = input.source instanceof Uint8Array ? input.source.slice() : await (async () => {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of input.source) {
-      if (!(chunk instanceof Uint8Array)) throw new TypeError("addressed publication source yielded invalid bytes");
-      size += chunk.byteLength;
-      if (size > (input.maxBytes ?? 100 * 1024 * 1024)) throw new TypeError("addressed publication exceeds maxBytes");
-      chunks.push(chunk.slice());
-    }
-    const bytes3 = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-      bytes3.set(chunk, offset);
-      offset += chunk.byteLength;
-    }
-    return bytes3;
-  })();
-  const files = input.files === void 0 || input.files.length === 0 ? [{ bytes: source }] : input.files;
-  const limit = input.maxBytes ?? SHARE_CONTENT_LIMIT;
-  let totalBytes = 0;
-  for (const file of files) {
-    totalBytes += file.bytes.byteLength;
-    if (!Number.isSafeInteger(totalBytes) || totalBytes > limit) {
-      throw new SharePublishError("max-bytes-exceeded", "addressed publication exceeds the combined byte limit");
-    }
-  }
-  return input.targetAdapter.publish({
-    source,
-    filename: input.filename,
-    ...input.files === void 0 ? {} : { files: input.files },
-    ...input.mediaType === void 0 ? {} : { mediaType: input.mediaType },
-    ...input.resourceKind === void 0 ? {} : { resourceKind: input.resourceKind },
-    ...input.actions === void 0 ? {} : { actions: input.actions },
-    target,
-    expiresAt: input.expiresAt ?? new Date((input.now?.() ?? Date.now()) + 7 * 24 * 60 * 60 * 1e3),
-    origin: input.origin,
-    ...input.inline === void 0 ? {} : { inline: input.inline },
-    upload: {
-      ...input.registryBaseUrl === void 0 ? {} : { registryBaseUrl: input.registryBaseUrl },
-      ...input.fetchFn === void 0 ? {} : { fetchFn: input.fetchFn },
-      ...input.authorizeUpload === void 0 ? {} : { authorizeUpload: input.authorizeUpload },
-      ...input.authorizationOrigin === void 0 ? {} : { authorizationOrigin: input.authorizationOrigin },
-      ...input.credentials === void 0 ? {} : { credentials: input.credentials },
-      ...input.allowInsecureRegistry === void 0 ? {} : { allowInsecureRegistry: input.allowInsecureRegistry },
-      ...input.uploadBlob === void 0 ? {} : { uploadBlob: input.uploadBlob }
-    },
-    ...input.notify === void 0 ? {} : { notify: input.notify }
-  });
-}
-
-// src/addressed-publish.ts
-var ENVELOPE_DOMAIN = "xyz.tinycloud.share/envelope/v2\0";
-function targetMatcher(target) {
-  if (target.kind === "recipientDid") return { kind: "recipientDid", value: target.did };
-  if (target.kind === "email") return { kind: "exactEmail", value: target.address };
-  return { kind: "emailDomain", value: target.domain };
-}
-function targetKind(target) {
-  return target.kind;
-}
-function assertSafeInput(input) {
-  if (!/^[A-Za-z0-9_-]{16,128}$/.test(input.shareId)) throw new TypeError("addressed share id is invalid");
-  if (input.filename.length === 0 || input.filename === "." || input.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(input.filename)) throw new TypeError("addressed filename is invalid");
-  if (!Number.isSafeInteger(input.byteLength) || input.byteLength < 0 || input.byteLength > SHARE_CONTENT_LIMIT) throw new TypeError("addressed content length is invalid");
-  if (input.actions.length === 0 || input.policyActions.length === 0) throw new TypeError("addressed share actions are empty");
-  const expiry = input.expiresAt.getTime();
-  if (!Number.isFinite(expiry) || expiry <= Date.now()) throw new TypeError("addressed share expiry must be in the future");
-  if (input.artifact === "html" && (input.resource.kind !== "prefix" || !input.actions.includes("read") || !input.actions.includes("list"))) throw new TypeError("html artifacts require a readable prefix");
-  if (input.contentSource.kind !== "kv") throw new TypeError("addressed policy publication requires a KV content source");
-}
-async function sha2564(value) {
-  return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", value)));
-}
-function publicationResult(input) {
-  const result = {
-    protocol: "tinycloud-share",
-    version: SHARE_PUBLISH_RESULT_VERSION,
-    url: input.url,
-    link: { kind: input.options.inline === true ? "inline" : "compact", cid: input.envelopeCid },
-    metadata: {
-      protocol: "tinycloud-share",
-      version: 1,
-      shareId: input.options.shareId,
-      origin: input.options.shareOrigin,
-      target: {
-        kind: targetKind(input.options.target),
-        origin: input.options.nodeOrigin,
-        nodeAudience: input.options.nodeAudience,
-        spaceId: input.options.spaceId
-      },
-      resource: { ...input.options.resource },
-      actions: [...input.options.actions],
-      expiresAt: input.options.expiresAt.toISOString(),
-      display: { filename: input.options.filename },
-      recipientMatcher: { ...input.matcher },
-      registrationCid: input.registration.registrationCid,
-      policyCid: input.policyCid,
-      ownerDelegationCid: input.registration.ownerDelegationCid,
-      enforcementDelegationCid: input.enforcementDelegationCid,
-      ownerDid: input.registration.ownerDid,
-      shareKeyDid: input.shareKeyDid,
-      enforcerDid: input.registration.enforcerDid,
-      envelopeCid: input.envelopeCid,
-      shareCid: input.shareCid
-    },
-    registryDeleteAfter: input.retention
-  };
-  Object.defineProperty(result, "toJSON", { enumerable: false, value: () => redactPublishedShare(result) });
-  Object.defineProperty(result, "url", { enumerable: false, value: input.url });
-  return result;
-}
-async function publishAddressedShare(options) {
-  assertSafeInput(options);
-  const target = normalizeShareTarget(options.target);
-  if (target.kind === "bearer") throw new TypeError("addressed target is required");
-  if (options.contentSource.kind !== "kv") throw new TypeError("addressed policy publication requires a KV content source");
-  const contentSource = options.contentSource;
-  const matcher = targetMatcher(target);
-  const expiresAt = options.expiresAt.toISOString();
-  const contentSourceDigest = options.contentSourceDigest ?? await sha2564(new TextEncoder().encode(canonicalize(contentSource)));
-  const shareKey = await createDelegatedShareKey({ extractable: false });
-  let envelopeKey;
-  try {
-    const permissions = [
-      {
-        service: "tinycloud.kv",
-        path: options.resource.kind === "prefix" ? `${options.resource.path.replace(/\/+$/, "")}/` : options.resource.path,
-        actions: [...options.policyActions]
-      },
-      ...options.decryption === void 0 ? [] : [{
-        service: "tinycloud.encryption",
-        path: options.decryption.networkId,
-        actions: [options.decryption.action]
-      }]
-    ];
-    const ownerDelegation = await options.authority.createOwnerDelegation({
-      delegateDid: shareKey.did,
-      spaceId: options.spaceId,
-      permissions,
-      expiresAt: options.expiresAt
-    });
-    const policy = {
-      type: "TinyCloudSharePolicy",
-      version: 2,
-      shareId: options.shareId,
-      ownerDid: options.authority.ownerDid,
-      shareKeyDid: shareKey.did,
-      recipientMatcher: matcher,
-      target: {
-        origin: options.nodeOrigin,
-        nodeAudience: options.nodeAudience,
-        enforcerDid: options.enforcerDid,
-        spaceId: options.spaceId
-      },
-      resource: { ...options.resource },
-      actions: [...options.policyActions],
-      ...options.decryption === void 0 ? {} : { decryption: options.decryption },
-      contentSource,
-      contentSourceDigest,
-      ownerDelegationCid: ownerDelegation.delegationCid,
-      expiresAt
-    };
-    const canonicalPolicy = await canonicalOwnerSharePolicy(policy);
-    const policyProof = toBase64Url(await shareKey.sign(canonicalPolicy.bytes));
-    const enforcementDelegation = await createPolicyEnforcementDelegation({
-      ownerDelegation,
-      shareKey,
-      enforcerDid: options.enforcerDid,
-      policyCid: canonicalPolicy.cid,
-      shareId: options.shareId,
-      spaceId: options.spaceId,
-      nodeAudience: options.nodeAudience,
-      path: options.resource.path,
-      actions: options.policyActions,
-      contentSourceDigest,
-      expiresAt
-    });
-    const registration = await options.authority.registerOwnerSharePolicy({
-      policy: { bytes: canonicalPolicy.bytes, cid: canonicalPolicy.cid, proof: policyProof },
-      ownerDelegation,
-      enforcementDelegation,
-      contentSourceDigest
-    });
-    const authorityMaterialDigest = await sha2564(fromBase64Url(enforcementDelegation.dagCbor));
-    const authorityTarget = {
-      origin: options.nodeOrigin,
-      nodeAudience: options.nodeAudience,
-      enforcerDid: options.enforcerDid,
-      spaceId: options.spaceId
-    };
-    const envelopeIdentity = {
-      schema: "xyz.tinycloud.share/envelope/v2",
-      version: 2,
-      shareId: options.shareId,
-      delegationCid: ownerDelegation.delegationCid,
-      policyCid: canonicalPolicy.cid,
-      target: authorityTarget,
-      resource: options.resource,
-      actions: options.policyActions,
-      ...options.decryption === void 0 ? {} : { decryption: options.decryption },
-      contentSource,
-      contentSourceDigest,
-      expiresAt
-    };
-    const envelopeCid = await computeCid(new TextEncoder().encode(canonicalize(envelopeIdentity)));
-    const shareCid = await computeCid(new TextEncoder().encode(canonicalize({ version: 2, shareId: options.shareId, policyCid: canonicalPolicy.cid, envelopeCid })));
-    const outerUnsigned = { ...envelopeIdentity, envelopeCid, shareCid };
-    const outerSignature = toBase64Url(await shareKey.sign(new TextEncoder().encode(`${ENVELOPE_DOMAIN}${canonicalize(outerUnsigned)}`)));
-    const unsigned = {
-      version: 2,
-      shareId: options.shareId,
-      recipientMatcher: matcher,
-      ...options.deliveryEmail === void 0 ? {} : { deliveryEmail: options.deliveryEmail },
-      actions: [...options.actions],
-      resource: { ...options.resource },
-      target: { origin: options.nodeOrigin, nodeAudience: options.nodeAudience, spaceId: options.spaceId },
-      delegationCid: ownerDelegation.delegationCid,
-      authorityMaterialHandle: registration.registration.registrationCid,
-      authorityMaterialDigest,
-      contentSource,
-      contentSourceDigest,
-      authorizationTarget: { kind: "policy", policyCid: canonicalPolicy.cid, policyBytes: toBase64Url(canonicalPolicy.bytes) },
-      display: { filename: options.filename },
-      expiry: expiresAt,
-      encrypted: true,
-      metadata: {
-        mediaType: options.mediaType,
-        byteLength: options.byteLength,
-        filename: options.filename,
-        ...options.mediaType.startsWith("text/") ? { encoding: "utf-8" } : {},
-        ...options.artifact === void 0 ? {} : { artifact: options.artifact }
-      },
-      ownerAuthority: {
-        registrationCid: registration.registration.registrationCid,
-        shareCid,
-        envelopeCid,
-        enforcementDelegation,
-        registrationReceipt: registration,
-        outerEnvelope: {
-          ...outerUnsigned,
-          signature: { signerDid: shareKey.did, algorithm: "Ed25519", value: outerSignature }
+      writeHeader(4, item.length);
+      item.forEach(write);
+      return;
+    }
+    if (typeof item === "object" && item !== null) {
+      const entries = Object.entries(item).map(([key, value2]) => {
+        const keyBytes = dagCborEncode(key);
+        return { key, value: value2, keyBytes };
+      }).sort((left, right) => {
+        if (left.keyBytes.length !== right.keyBytes.length) return left.keyBytes.length - right.keyBytes.length;
+        for (let index = 0; index < left.keyBytes.length; index += 1) {
+          const leftByte = left.keyBytes[index] ?? 0;
+          const rightByte = right.keyBytes[index] ?? 0;
+          if (leftByte !== rightByte) return leftByte - rightByte;
         }
-      }
-    };
-    unsignedShareEnvelopeV2Schema.parse(unsigned);
-    const envelopeSignature = toBase64Url(await shareKey.sign(new TextEncoder().encode(`${ENVELOPE_DOMAIN}${canonicalize(unsigned)}`)));
-    const envelope = { ...unsigned, signature: { signerDid: shareKey.did, algorithm: "Ed25519", value: envelopeSignature } };
-    shareEnvelopeV2Schema.parse(envelope);
-    envelopeKey = generateKey();
-    const sealed = await seal(new TextEncoder().encode(canonicalize(envelope)), envelopeKey);
-    let url;
-    let retention = expiresAt;
-    if (options.inline === true) {
-      url = await encodeInlineShareUrl({ origin: options.shareOrigin, ciphertext: sealed.blob, key32: envelopeKey });
-    } else {
-      const uploaded = await uploadShareBlob({
-        source: new Uint8Array([1]),
-        filename: options.filename,
-        origin: options.shareOrigin,
-        ...options.upload
-      }, { blob: sealed.blob, cid: sealed.cid, deleteAfter: expiresAt, contentLength: sealed.blob.byteLength });
-      retention = uploaded.deleteAfter;
-      url = encodeShareUrl({ origin: options.shareOrigin, ciphertextCid: uploaded.cid, key32: envelopeKey });
-    }
-    return publicationResult({
-      options,
-      url,
-      envelopeCid: sealed.cid,
-      shareCid,
-      matcher,
-      registration: registration.registration,
-      policyCid: canonicalPolicy.cid,
-      enforcementDelegationCid: enforcementDelegation.cid,
-      shareKeyDid: shareKey.did,
-      retention
-    });
-  } finally {
-    shareKey.clear();
-    envelopeKey?.fill(0);
-  }
+        return 0;
+      });
+      writeHeader(5, entries.length);
+      entries.forEach(({ key, value: value2 }) => {
+        write(key);
+        write(value2);
+      });
+      return;
+    }
+    throw new Error("Unsupported DAG-CBOR value");
+  };
+  write(value);
+  return Uint8Array.from(output);
 }
-
-// src/policy-authority.ts
-import { ed25519 as ed255196 } from "@noble/curves/ed25519";
-var ENVELOPE_DOMAIN2 = "xyz.tinycloud.share/envelope/v2\0";
-function record(value, keys, label) {
+function assertObject(value, keys, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
-  const output = value;
-  if (Object.keys(output).length !== keys.length || keys.some((key) => !Object.hasOwn(output, key))) throw new Error(`${label} has unknown or missing fields`);
-  return output;
-}
-function requiredString(value, label) {
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${label} is invalid`);
-  return value;
-}
-function stringArray(value, label) {
-  if (!Array.isArray(value) || value.length === 0 || !value.every((item) => typeof item === "string" && item.length > 0)) throw new Error(`${label} is invalid`);
-  return value;
+  const record = value;
+  if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);
+  return record;
 }
-function parseEnforcement(value) {
-  const delegation = record(value, ["cid", "dagCbor", "issuerDid", "audienceDid", "facts", "signature"], "policy enforcement delegation");
-  const facts = record(delegation.facts, ["ownerDelegationCid", "policyCid", "shareId", "shareKeyDid", "enforcerDid", "nodeAudience", "spaceId", "path", "actions", "contentSourceDigest", "expiresAt"], "policy enforcement facts");
-  return {
-    cid: requiredString(delegation.cid, "policy enforcement CID"),
-    dagCbor: requiredString(delegation.dagCbor, "policy enforcement bytes"),
-    issuerDid: requiredString(delegation.issuerDid, "policy enforcement issuer"),
-    audienceDid: requiredString(delegation.audienceDid, "policy enforcement audience"),
-    facts: {
-      ownerDelegationCid: requiredString(facts.ownerDelegationCid, "owner delegation CID"),
-      policyCid: requiredString(facts.policyCid, "policy CID"),
-      shareId: requiredString(facts.shareId, "share id"),
-      shareKeyDid: requiredString(facts.shareKeyDid, "share key DID"),
-      enforcerDid: requiredString(facts.enforcerDid, "enforcer DID"),
-      nodeAudience: requiredString(facts.nodeAudience, "node audience"),
-      spaceId: requiredString(facts.spaceId, "space id"),
-      path: requiredString(facts.path, "resource path"),
-      actions: stringArray(facts.actions, "policy actions"),
-      contentSourceDigest: requiredString(facts.contentSourceDigest, "content source digest"),
-      expiresAt: requiredString(facts.expiresAt, "policy expiry")
+async function createDelegatedShareKey(options) {
+  if (!globalThis.crypto?.subtle) throw new Error("WebCrypto Ed25519 is required for delegated share keys");
+  const generated = await crypto.subtle.generateKey({ name: "Ed25519" }, options.extractable, ["sign", "verify"]);
+  const privateKey = generated.privateKey;
+  const publicKey = new Uint8Array(await crypto.subtle.exportKey("raw", generated.publicKey));
+  let cleared = false;
+  const key = {
+    did: didKeyFromEd25519PublicKey2(publicKey),
+    publicKey: bytes(publicKey),
+    extractable: options.extractable,
+    cryptoKey: privateKey,
+    async sign(input) {
+      if (cleared) throw new Error("share key has been cleared");
+      return new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, privateKey, input));
     },
-    signature: requiredString(delegation.signature, "policy enforcement signature")
+    clear() {
+      cleared = true;
+    }
   };
+  return key;
 }
-async function verifyEnforcement(delegation) {
-  try {
-    const dagCbor = fromBase64Url(delegation.dagCbor);
-    if (await computeCid(dagCbor) !== delegation.cid) return false;
-    const expectedDagCbor = dagCborEncode({
-      domain: POLICY_ENFORCEMENT_DOMAIN,
-      unsigned: {
-        type: "TinyCloudSharePolicyEnforcement",
-        version: 2,
-        issuerDid: delegation.issuerDid,
-        audienceDid: delegation.audienceDid,
-        facts: delegation.facts
-      }
-    });
-    if (expectedDagCbor.length !== dagCbor.length || expectedDagCbor.some((byte, index) => byte !== dagCbor[index])) return false;
-    const signature = fromBase64Url(delegation.signature);
-    return signature.length === 64 && ed255196.verify(
-      signature,
-      dagCbor,
-      ed25519PublicKeyFromDidKey(delegation.issuerDid),
-      { zip215: false }
-    );
-  } catch {
-    return false;
-  }
-}
-async function verifyOuterEnvelope(value, envelope, policyCid, expectedEnforcerDid, expectedActions) {
-  try {
-    const hasDecryption = typeof value === "object" && value !== null && Object.hasOwn(value, "decryption");
-    const outer = record(value, ["schema", "version", "shareId", "delegationCid", "policyCid", "target", "resource", "actions", ...hasDecryption ? ["decryption"] : [], "contentSource", "contentSourceDigest", "expiresAt", "envelopeCid", "shareCid", "signature"], "outer envelope");
-    const target = record(outer.target, ["origin", "nodeAudience", "enforcerDid", "spaceId"], "outer target");
-    const signature = record(outer.signature, ["signerDid", "algorithm", "value"], "outer envelope signature");
-    const envelopeCid = requiredString(outer.envelopeCid, "outer envelope CID");
-    const shareCid = requiredString(outer.shareCid, "outer share CID");
-    const { signature: _signature, envelopeCid: _envelopeCid, shareCid: _shareCid, ...identity } = outer;
-    if (outer.schema !== "xyz.tinycloud.share/envelope/v2" || outer.version !== 2 || outer.shareId !== envelope.shareId || outer.delegationCid !== envelope.delegationCid || outer.policyCid !== policyCid || target.origin !== envelope.target.origin || target.nodeAudience !== envelope.target.nodeAudience || target.enforcerDid !== expectedEnforcerDid || target.spaceId !== envelope.target.spaceId || canonicalize(outer.resource) !== canonicalize(envelope.resource) || canonicalize(outer.actions) !== canonicalize(expectedActions) || (hasDecryption ? envelope.decryption === void 0 || canonicalize(outer.decryption) !== canonicalize(envelope.decryption) : envelope.decryption !== void 0) || canonicalize(outer.contentSource) !== canonicalize(envelope.contentSource) || outer.contentSourceDigest !== envelope.contentSourceDigest || outer.expiresAt !== envelope.expiry || signature.signerDid !== envelope.signature.signerDid || signature.algorithm !== "Ed25519") return void 0;
-    if (envelopeCid !== await computeCid(new TextEncoder().encode(canonicalize(identity)))) return void 0;
-    if (shareCid !== await computeCid(new TextEncoder().encode(canonicalize({ version: 2, shareId: envelope.shareId, policyCid, envelopeCid })))) return void 0;
-    const unsigned = { ...identity, envelopeCid, shareCid };
-    const signatureBytes = fromBase64Url(requiredString(signature.value, "outer signature"));
-    if (signatureBytes.length !== 64 || !ed255196.verify(
-      signatureBytes,
-      new TextEncoder().encode(`${ENVELOPE_DOMAIN2}${canonicalize(unsigned)}`),
-      ed25519PublicKeyFromDidKey(envelope.signature.signerDid),
-      { zip215: false }
-    )) return void 0;
-    return { envelopeCid, shareCid };
-  } catch {
-    return void 0;
-  }
-}
-function createRegisteredPolicyAuthority(options) {
-  const proofKey = options.nodeProof.publicKey.slice();
+function restoreDelegatedShareKey(input) {
+  let cleared = false;
   return {
-    async resolve({ policyCid, envelope }) {
-      try {
-        if (envelope.authorizationTarget.kind !== "policy" || envelope.authorizationTarget.policyCid !== policyCid) return void 0;
-        const ownerAuthority = envelope.ownerAuthority;
-        if (ownerAuthority?.registrationReceipt === void 0) return void 0;
-        const enforcement = parseEnforcement(ownerAuthority.enforcementDelegation);
-        if (!await verifyEnforcement(enforcement)) return void 0;
-        const policyBytes = fromBase64Url(envelope.authorizationTarget.policyBytes);
-        const ownerDelegation = {
-          delegationCid: envelope.delegationCid,
-          signedDagCbor: new Uint8Array(),
-          delegation: {
-            delegateDID: envelope.signature.signerDid,
-            spaceId: envelope.target.spaceId,
-            path: envelope.resource.path,
-            actions: envelope.actions,
-            expiry: new Date(envelope.expiry)
-          }
-        };
-        const receipt = validateOwnerSharePolicyRegistration(ownerAuthority.registrationReceipt, {
-          policy: { bytes: policyBytes, cid: policyCid, proof: "" },
-          ownerDelegation,
-          enforcementDelegation: enforcement,
-          contentSourceDigest: envelope.contentSourceDigest,
-          nodeProof: { kid: options.nodeProof.kid, publicKey: proofKey }
-        });
-        const registration = receipt.registration;
-        const outer = await verifyOuterEnvelope(ownerAuthority.outerEnvelope, envelope, policyCid, options.expectedTarget.enforcerDid, registration.actions);
-        if (outer === void 0 || ownerAuthority.registrationCid !== registration.registrationCid || ownerAuthority.envelopeCid !== outer.envelopeCid || ownerAuthority.shareCid !== outer.shareCid || envelope.authorityMaterialHandle !== registration.registrationCid || envelope.signature.signerDid !== registration.shareKeyDid || registration.target.origin !== options.expectedTarget.origin || registration.target.nodeAudience !== options.expectedTarget.nodeAudience || registration.enforcerDid !== options.expectedTarget.enforcerDid || enforcement.issuerDid !== registration.shareKeyDid || enforcement.audienceDid !== registration.enforcerDid) return void 0;
-        return {
-          policyCid: registration.policyCid,
-          signerDid: registration.shareKeyDid,
-          registrationCid: registration.registrationCid,
-          shareId: registration.shareId,
-          recipientMatcher: registration.recipientMatcher,
-          target: registration.target,
-          resource: registration.resource,
-          actions: registration.actions,
-          contentSource: registration.contentSource,
-          contentSourceDigest: registration.contentSourceDigest,
-          delegationCid: registration.ownerDelegationCid,
-          authorityMaterialHandle: registration.registrationCid,
-          authorityMaterialDigest: envelope.authorityMaterialDigest,
-          expiresAt: registration.expiresAt
-        };
-      } catch {
-        return void 0;
-      }
+    did: didKeyFromEd25519PublicKey2(input.publicKey),
+    publicKey: bytes(input.publicKey),
+    extractable: input.extractable,
+    cryptoKey: input.privateKey,
+    async sign(signBytes) {
+      if (cleared) throw new Error("share key has been cleared");
+      if (!globalThis.crypto?.subtle) throw new Error("WebCrypto Ed25519 is required for delegated share keys");
+      return new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, input.privateKey, signBytes));
+    },
+    clear() {
+      cleared = true;
     }
   };
 }
-
-// src/cache.ts
-import { sha256 as sha2565 } from "@noble/hashes/sha256";
-function cacheKey(key) {
-  if (!key.cid || !key.expiresAt) throw new Error("share cache keys require CID and expiry");
-  return `${key.cid}\0${key.expiresAt}`;
+async function createPolicyEnforcementDelegation(input) {
+  if (input.shareKey.did.length === 0 || input.ownerDelegation.delegationCid.length === 0) throw new Error("owner delegation and share key are required");
+  const facts = {
+    ownerDelegationCid: input.ownerDelegation.delegationCid,
+    policyCid: input.policyCid,
+    shareId: input.shareId,
+    shareKeyDid: input.shareKey.did,
+    enforcerDid: input.enforcerDid,
+    nodeAudience: input.nodeAudience,
+    spaceId: input.spaceId,
+    path: input.path,
+    actions: [...input.actions],
+    contentSourceDigest: input.contentSourceDigest,
+    expiresAt: input.expiresAt
+  };
+  const unsigned = { type: "TinyCloudSharePolicyEnforcement", version: 2, issuerDid: input.shareKey.did, audienceDid: input.enforcerDid, facts };
+  const dagCborBytes = dagCborEncode({ domain: POLICY_ENFORCEMENT_DOMAIN, unsigned });
+  const signature = b64(await input.shareKey.sign(dagCborBytes));
+  return { cid: cid(dagCborBytes), dagCbor: b64(dagCborBytes), issuerDid: input.shareKey.did, audienceDid: input.enforcerDid, facts, signature };
 }
-function digest2(bytes3) {
-  return sha2565(bytes3);
+async function canonicalOwnerSharePolicy(policy) {
+  const text = canonicalize({ domain: POLICY_DOMAIN, policy });
+  const policyBytes = new TextEncoder().encode(text);
+  return { bytes: policyBytes, cid: cid(policyBytes), digest: digest2(policyBytes) };
 }
-function equalBytes(left, right) {
-  if (left.byteLength !== right.byteLength) return false;
-  return left.every((byte, index) => byte === right[index]);
+function computeOwnerShareRegistrationCid(registration) {
+  return cid(new TextEncoder().encode(canonicalize(registration)));
 }
-var MemoryShareCache = class {
-  constructor(now = () => /* @__PURE__ */ new Date()) {
-    this.now = now;
-  }
-  entries = /* @__PURE__ */ new Map();
-  async get(key, now = /* @__PURE__ */ new Date()) {
-    const mapKey = cacheKey(key);
-    const entry = this.entries.get(mapKey);
-    if (entry === void 0) return void 0;
-    if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest2(entry.bytes))) {
-      this.entries.delete(mapKey);
-      return void 0;
-    }
-    return entry.bytes.slice();
-  }
-  async getByCid(cid2, now = /* @__PURE__ */ new Date()) {
-    const entries = [...this.entries.values()].filter((entry) => entry.key.cid === cid2);
-    for (const entry of entries) {
-      if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest2(entry.bytes))) {
-        this.entries.delete(cacheKey(entry.key));
-        continue;
-      }
-      return {
-        key: { ...entry.key },
-        bytes: entry.bytes.slice(),
-        digest: entry.digest.slice(),
-        metadata: { ...entry.metadata }
-      };
-    }
-    return void 0;
-  }
-  async set(key, bytes3, metadata) {
-    if (Date.parse(key.expiresAt) <= this.now().getTime()) return;
-    this.entries.set(cacheKey(key), {
-      key: { cid: key.cid, expiresAt: key.expiresAt },
-      bytes: bytes3.slice(),
-      digest: digest2(bytes3),
-      metadata: { ...metadata }
-    });
-  }
-  async delete(key) {
-    this.entries.delete(cacheKey(key));
-  }
-  async clear() {
-    this.entries.clear();
-  }
-};
-
-// src/delivery.ts
-import { ed25519 as ed255197 } from "@noble/curves/ed25519";
-var SHARE_DELIVERY_AUTHORIZATION_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v2\0";
-function isCanonicalHttpsOrigin2(value) {
-  let url;
+function validateOwnerSharePolicyRegistration(value, expected) {
+  if (cid(expected.policy.bytes) !== expected.policy.cid) throw new Error("submitted owner-share policy bytes do not match its CID");
+  const root = assertObject(value, ["registration", "proof"], "owner-share registration response");
+  const registration = assertObject(root.registration, ["registrationCid", "policyCid", "ownerDelegationCid", "enforcementDelegationCid", "ownerDid", "shareKeyDid", "enforcerDid", "shareId", "recipientMatcher", "target", "resource", "actions", "contentSource", "contentSourceDigest", "registeredAt", "expiresAt"], "owner-share registration");
+  const proof = assertObject(root.proof, ["alg", "kid", "signature"], "owner-share registration proof");
+  if (registration.policyCid !== expected.policy.cid || registration.ownerDelegationCid !== expected.ownerDelegation.delegationCid || registration.enforcementDelegationCid !== expected.enforcementDelegation.cid || registration.contentSourceDigest !== expected.contentSourceDigest) throw new Error("owner-share registration is not bound to the submitted chain");
+  let policyValue;
   try {
-    url = new URL(value);
+    policyValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(expected.policy.bytes));
   } catch {
-    return false;
-  }
-  return url.protocol === "https:" && url.origin === value && url.pathname === "/" && url.search === "" && url.hash === "" && url.username === "" && url.password === "";
-}
-var AUTHORIZATION_KEYS = [
-  "type",
-  "version",
-  "jti",
-  "shareCid",
-  "shareId",
-  "registrationCid",
-  "delegationCid",
-  "enforcementDelegationCid",
-  "envelopeCid",
-  "policyCid",
-  "nodeAudience",
-  "targetOrigin",
-  "openCredentialsAudience",
-  "holder",
-  "recipientMatcher",
-  "deliveryEmail",
-  "shareUrl",
-  "returnOrigin",
-  "documentName",
-  "senderDid",
-  "senderTrust",
-  "contentSource",
-  "contentSourceDigest",
-  "shareExpiresAt",
-  "issuedAt",
-  "reportAbuseToken",
-  "actions",
-  "resource",
-  "authorityMaterialHandle",
-  "authorityMaterialDigest",
-  "requestBodyDigest",
-  "idempotencyKey",
-  "expiresAt",
-  "dataAuthority"
-];
-function assertObject2(value, keys, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
-  const record2 = value;
-  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) throw new Error(`${label} has unknown or missing fields`);
-  return record2;
-}
-function fromB642(value) {
-  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share delivery value is not canonical base64url");
-  if (typeof atob === "function") {
-    const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
-    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+    throw new Error("owner-share policy is not valid JSON");
   }
-  if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(value, "base64url"));
-  throw new Error("base64url decoding is unavailable");
+  const policy = policyValue.policy;
+  if (policyValue.domain !== "xyz.tinycloud.share/policy/v2\0" || policy === void 0 || Array.isArray(policy)) throw new Error("owner-share policy envelope is invalid");
+  const target = policy.target;
+  const resource = policy.resource;
+  const registrationTarget = registration.target;
+  const registrationResource = registration.resource;
+  const enforcementFacts = expected.enforcementDelegation.facts;
+  if (typeof target?.origin !== "string" || typeof target.nodeAudience !== "string" || typeof target.enforcerDid !== "string" || typeof target.spaceId !== "string" || typeof resource?.kind !== "string" || !["exact", "prefix"].includes(resource.kind) || typeof resource?.path !== "string" || !Array.isArray(policy.actions) || policy.ownerDid !== registration.ownerDid || policy.shareKeyDid !== registration.shareKeyDid || policy.shareId !== registration.shareId || canonicalize(policy.recipientMatcher) !== canonicalize(registration.recipientMatcher) || target.origin !== registrationTarget.origin || target.nodeAudience !== registrationTarget.nodeAudience || target.enforcerDid !== registration.enforcerDid || target.spaceId !== registrationTarget.spaceId || resource.kind !== registrationResource.kind || resource.path !== registrationResource.path || canonicalize(policy.actions) !== canonicalize(registration.actions) || canonicalize(policy.contentSource) !== canonicalize(registration.contentSource) || policy.expiresAt !== registration.expiresAt || policy.contentSourceDigest !== registration.contentSourceDigest || enforcementFacts.ownerDelegationCid !== registration.ownerDelegationCid || enforcementFacts.policyCid !== registration.policyCid || enforcementFacts.shareKeyDid !== registration.shareKeyDid || enforcementFacts.enforcerDid !== registration.enforcerDid || enforcementFacts.nodeAudience !== registrationTarget.nodeAudience || enforcementFacts.spaceId !== registrationTarget.spaceId || enforcementFacts.path !== registrationResource.path || canonicalize(enforcementFacts.actions) !== canonicalize(registration.actions) || enforcementFacts.expiresAt !== registration.expiresAt) throw new Error("owner-share registration is not bound to the canonical policy");
+  if (typeof registration.registrationCid !== "string" || typeof registration.expiresAt !== "string" || typeof registration.registeredAt !== "string") throw new Error("owner-share registration timestamps are invalid");
+  if (new Date(registration.expiresAt).toISOString() !== registration.expiresAt || Date.parse(registration.expiresAt) <= Date.now()) throw new Error("owner-share registration is expired or non-canonical");
+  const { registrationCid: _registrationCid, ...registrationCore } = registration;
+  if (computeOwnerShareRegistrationCid(registrationCore) !== registration.registrationCid) throw new Error("owner-share registration CID does not match its canonical core");
+  if (proof.alg !== "EdDSA" || typeof proof.kid !== "string" || typeof proof.signature !== "string") throw new Error("owner-share registration proof is invalid");
+  const proofKey = expected.nodeProof;
+  if (proofKey === void 0) throw new Error("owner-share registration proof trust material is required");
+  if (proof.kid !== proofKey.kid) throw new Error("owner-share registration proof key is not trusted");
+  const encodedKid = proofKey.publicKey;
+  if (encodedKid.length === 34 && encodedKid[0] === 237 && encodedKid[1] === 1) {
+  } else if (encodedKid.length !== 32) throw new Error("owner-share registration proof key is invalid");
+  const publicKey = encodedKid.length === 34 ? encodedKid.slice(2) : encodedKid;
+  const signatureBytes = fromB64(proof.signature);
+  const signedBytes = new TextEncoder().encode(`${OWNER_SHARE_REGISTRATION_DOMAIN}${canonicalize(registrationCore)}`);
+  if (signatureBytes.length !== 64 || !ed255194.verify(signatureBytes, signedBytes, publicKey)) throw new Error("owner-share registration proof signature is invalid");
+  return { registration, proof };
 }
-function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
+function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
   let value;
   try {
     value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytesValue));
   } catch {
-    throw new Error("share delivery authorization response is not valid UTF-8 JSON");
-  }
-  const root = assertObject2(value, ["authorization", "proof"], "share delivery authorization response");
-  const authorization = assertObject2(root.authorization, AUTHORIZATION_KEYS, "share delivery authorization");
-  const proof = assertObject2(root.proof, ["alg", "kid", "signature"], "share delivery authorization proof");
-  const request = expected.request;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.idempotencyKey || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
-    throw new Error("share delivery authorization is not bound to the submitted request");
-  }
-  const now = Date.now();
-  const issuedAt = typeof authorization.issuedAt === "string" ? Date.parse(authorization.issuedAt) : Number.NaN;
-  const expiresAt = typeof authorization.expiresAt === "string" ? Date.parse(authorization.expiresAt) : Number.NaN;
-  if (!Number.isFinite(issuedAt) || issuedAt > now + 6e4 || issuedAt > expiresAt) throw new Error("share delivery authorization issuedAt is invalid");
-  if (!Number.isFinite(expiresAt) || expiresAt <= now) throw new Error("share delivery authorization is expired");
-  if (new Date(expiresAt).toISOString() !== authorization.expiresAt) throw new Error("share delivery authorization expiresAt is non-canonical");
-  if (typeof authorization.openCredentialsAudience !== "string" || !isCanonicalHttpsOrigin2(authorization.openCredentialsAudience) || authorization.openCredentialsAudience !== expected.credentialsAudience || authorization.openCredentialsAudience === authorization.nodeAudience || authorization.openCredentialsAudience === authorization.returnOrigin) {
-    throw new Error("share delivery authorization openCredentialsAudience is missing or untrusted");
-  }
-  if (proof.alg !== "EdDSA" || typeof proof.kid !== "string" || typeof proof.signature !== "string") throw new Error("share delivery authorization proof is invalid");
-  if (proof.kid !== expected.nodeProof.kid) throw new Error("share delivery authorization proof key is not trusted");
-  const encodedKid = expected.nodeProof.publicKey;
-  const publicKey = encodedKid.length === 34 && encodedKid[0] === 237 && encodedKid[1] === 1 ? encodedKid.slice(2) : encodedKid;
-  if (publicKey.length !== 32) throw new Error("share delivery authorization proof key is invalid");
-  const signatureBytes = fromB642(proof.signature);
-  const signedBytes = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_DOMAIN}${canonicalize(authorization)}`);
-  if (signatureBytes.length !== 64 || !ed255197.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
-  return { authorization, proof };
-}
-function shareDeliveryTrustedKid(publicKey) {
-  if (publicKey.length !== 32) throw new Error("share delivery node key must be a raw 32-byte Ed25519 public key");
-  const prefixed = new Uint8Array(34);
-  prefixed.set([237, 1]);
-  prefixed.set(publicKey, 2);
-  const did = `did:key:${base58btc2.encode(prefixed)}`;
-  return `${did}#${did.slice("did:key:".length)}`;
+    throw new Error("owner-share registration response is not valid UTF-8 JSON");
+  }
+  return validateOwnerSharePolicyRegistration(value, expected);
 }
 
 // src/history.ts
@@ -8512,13 +7536,14 @@ function historyRecordForPublishedShare(result, now = /* @__PURE__ */ new Date()
     registeredAt: now.toISOString(),
     expiresAt: result.metadata.expiresAt,
     link: result.url,
+    ...result.deliveryMaterial === void 0 ? {} : { deliveryMaterial: result.deliveryMaterial },
     ...result.metadata.display.filename === void 0 ? {} : { filename: result.metadata.display.filename }
   };
 }
 var MemorySenderShareRecordStorage = class {
   records = /* @__PURE__ */ new Map();
-  async put(record2) {
-    this.records.set(record2.shareId, record2);
+  async put(record) {
+    this.records.set(record.shareId, record);
   }
   async list() {
     return [...this.records.values()];
@@ -8555,7 +7580,7 @@ var SenderShareStore = class {
   async save(receipt, key) {
     const registration = receipt.registration;
     if (registration.shareKeyDid !== key.did) throw new Error("share key does not match the registered receipt");
-    const record2 = {
+    const record = {
       shareId: registration.shareId,
       registrationCid: registration.registrationCid,
       policyCid: registration.policyCid,
@@ -8572,15 +7597,15 @@ var SenderShareStore = class {
       registeredAt: registration.registeredAt,
       expiresAt: registration.expiresAt
     };
-    await this.records.put(record2);
-    await this.keys.put(record2.shareId, { cryptoKey: key.cryptoKey, publicKey: key.publicKey, extractable: key.extractable });
-    return record2;
+    await this.records.put(record);
+    await this.keys.put(record.shareId, { cryptoKey: key.cryptoKey, publicKey: key.publicKey, extractable: key.extractable });
+    return record;
   }
   /** List shares created in any session, most recent first. */
   async list(options) {
     const now = this.now().getTime();
     const records = await this.records.list();
-    return records.filter((record2) => (options?.includeRevoked ?? false) || record2.revokedAt === void 0).filter((record2) => (options?.includeExpired ?? false) || Date.parse(record2.expiresAt) > now).sort((left, right) => Date.parse(right.registeredAt) - Date.parse(left.registeredAt));
+    return records.filter((record) => (options?.includeRevoked ?? false) || record.revokedAt === void 0).filter((record) => (options?.includeExpired ?? false) || Date.parse(record.expiresAt) > now).sort((left, right) => Date.parse(right.registeredAt) - Date.parse(left.registeredAt));
   }
   async get(shareId) {
     return this.records.get(shareId);
@@ -8603,17 +7628,17 @@ var SenderShareStore = class {
    * returned CID, then call {@link markRevoked} once that succeeds.
    */
   async revocationTarget(shareId, scope) {
-    const record2 = await this.records.get(shareId);
-    if (record2 === void 0) throw new Error(`Unknown share: ${shareId}`);
-    const delegationCid = scope === "direct" ? record2.enforcementDelegationCid : record2.ownerDelegationCid;
+    const record = await this.records.get(shareId);
+    if (record === void 0) throw new Error(`Unknown share: ${shareId}`);
+    const delegationCid = scope === "direct" ? record.enforcementDelegationCid : record.ownerDelegationCid;
     if (delegationCid === void 0) throw new Error("share has no node-enforced delegation");
     return delegationCid;
   }
   /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */
   async markRevoked(shareId, revokedAt = this.now().toISOString()) {
-    const record2 = await this.records.get(shareId);
-    if (record2 === void 0) throw new Error(`Unknown share: ${shareId}`);
-    const revoked = { ...record2, revokedAt };
+    const record = await this.records.get(shareId);
+    if (record === void 0) throw new Error(`Unknown share: ${shareId}`);
+    const revoked = { ...record, revokedAt };
     await this.records.put(revoked);
     return revoked;
   }
@@ -8629,9 +7654,9 @@ var EncryptedSenderShareHistory = class {
     this.key = key;
     this.now = now;
   }
-  async put(record2) {
+  async put(record) {
     const iv = crypto.getRandomValues(new Uint8Array(12));
-    const payload = new TextEncoder().encode(JSON.stringify(record2));
+    const payload = new TextEncoder().encode(JSON.stringify(record));
     const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, this.key, payload));
     const encoded = new Uint8Array(iv.length + ciphertext.length);
     encoded.set(iv);
@@ -8664,8 +7689,8 @@ var ShareNotifyError = class extends Error {
     this.name = "ShareNotifyError";
   }
 };
-function recipientMatchesShareRecord(record2, recipient) {
-  const matcher = record2.recipientMatcher;
+function recipientMatchesShareRecord(record, recipient) {
+  const matcher = record.recipientMatcher;
   if (matcher.kind === "bearer" || matcher.kind === "recipientDid") return false;
   if (matcher.kind === "exactEmail") return matcher.value === recipient;
   const at = recipient.lastIndexOf("@");
@@ -8696,67 +7721,74 @@ async function notifyShare(input) {
 }
 async function defaultIdempotencyKey(shareId, recipient) {
   const canonicalRecipient = canonicalize(recipient.trim().toLowerCase());
-  const digest4 = new Uint8Array(await crypto.subtle.digest(
+  const digest3 = new Uint8Array(await crypto.subtle.digest(
     "SHA-256",
     new TextEncoder().encode(canonicalRecipient)
   ));
-  return `tinycloud-share:${shareId}:${toBase64Url(digest4)}`;
+  return `tinycloud-share:${shareId}:${toBase64Url(digest3)}`;
 }
 
 // src/lifecycle.ts
-function targetKind2(record2) {
-  if (record2.targetKind !== void 0) return record2.targetKind;
-  return record2.recipientMatcher.kind === "exactEmail" ? "email" : record2.recipientMatcher.kind === "emailDomain" ? "emailDomain" : record2.recipientMatcher.kind === "recipientDid" ? "recipientDid" : "bearer";
+function targetKind2(record) {
+  if (record.targetKind !== void 0) return record.targetKind;
+  return record.recipientMatcher.kind === "exactEmail" ? "email" : record.recipientMatcher.kind === "emailDomain" ? "emailDomain" : record.recipientMatcher.kind === "recipientDid" ? "recipientDid" : "bearer";
+}
+function policyNodeAudience(record) {
+  const envelope = record.deliveryMaterial?.envelope;
+  if (typeof envelope !== "object" || envelope === null || Array.isArray(envelope)) return record.target.nodeAudience;
+  const binding = envelope.attestedEnforcerBinding;
+  if (typeof binding !== "object" || binding === null || Array.isArray(binding)) return record.target.nodeAudience;
+  const nodeAudience = binding.nodeAudience;
+  return typeof nodeAudience === "string" ? nodeAudience : record.target.nodeAudience;
 }
 async function revokeShare(input) {
   const target = targetKind2(input.record);
-  if (target === "bearer") return { state: "retention-only", target, reason: "bearer-capability-cannot-be-revoked" };
   if (input.adapter === void 0) return { state: "unsupported", target, reason: "node revocation authority is required", code: "unsupported-target" };
   const scope = input.scope ?? "direct";
   const delegationCid = scope === "ancestor" ? input.record.ownerDelegationCid : input.record.enforcementDelegationCid;
   if (delegationCid === void 0) return { state: "unsupported", target, reason: "share has no node-enforced delegation receipt", code: "unsupported-target" };
-  await input.adapter.revokeDelegation({ delegationCid, scope });
+  if (target === "bearer") {
+    if (input.adapter.revokeDelegation === void 0) return { state: "unsupported", target, reason: "native delegation revocation authority is required", code: "unsupported-target" };
+    await input.adapter.revokeDelegation({ delegationCid, scope });
+  } else {
+    if (input.record.ownerDid === void 0) return { state: "unsupported", target, reason: "share has no Policy/v3 owner receipt", code: "unsupported-target" };
+    if (input.adapter.revokePolicyRoot === void 0) return { state: "unsupported", target, reason: "Policy/v3 root revocation authority is required", code: "unsupported-target" };
+    await input.adapter.revokePolicyRoot({
+      rootCid: delegationCid,
+      targetRole: scope === "ancestor" ? "policy-authority" : "policy-enforcement",
+      ownerDid: input.record.ownerDid,
+      nodeOrigin: input.record.target.origin,
+      nodeAudience: policyNodeAudience(input.record)
+    });
+  }
   const revokedAt = (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
   if (input.records !== void 0) await input.records.put({ ...input.record, revokedAt });
   return { state: "revoked", target, delegationCid, revokedAt };
 }
-function redactRecord(record2, revealLink, link) {
-  const matcher = record2.recipientMatcher;
-  const revealedLink = revealLink ? link ?? record2.link : void 0;
+function redactRecord(record, revealLink, link) {
+  const matcher = record.recipientMatcher;
+  const revealedLink = revealLink ? link ?? record.link : void 0;
   return {
-    shareId: record2.shareId,
+    shareId: record.shareId,
     target: matcher.kind === "exactEmail" ? "email" : matcher.kind === "emailDomain" ? "email-domain" : matcher.kind === "recipientDid" ? "recipient-did" : "bearer",
     ...matcher.kind === "exactEmail" ? { recipient: matcher.value } : matcher.kind === "emailDomain" ? { recipient: `*@${matcher.value}` } : matcher.kind === "recipientDid" ? { recipient: matcher.value } : {},
-    expiresAt: record2.expiresAt,
-    revoked: record2.revokedAt !== void 0,
+    expiresAt: record.expiresAt,
+    revoked: record.revokedAt !== void 0,
     ...revealedLink === void 0 ? {} : { link: revealedLink }
   };
 }
 async function listShares(storage) {
   const records = await storage.list();
-  return records.map((record2) => redactRecord(record2, false));
+  return records.map((record) => redactRecord(record, false));
 }
 async function showShare(input) {
-  const record2 = await input.storage.get(input.shareId);
-  if (record2 === void 0) throw new Error("share not found");
-  return redactRecord(record2, input.revealLink === true, input.link);
-}
-
-// src/legacy.ts
-function isLegacyShareLink(value) {
-  return value.startsWith("tc1:");
-}
-async function receiveLegacyShare(link, reader) {
-  if (!isLegacyShareLink(link)) throw new Error("legacy link must use tc1:");
-  return reader.read(link);
-}
-async function migrateShare(input) {
-  const value = await receiveLegacyShare(input.link, input.reader);
-  return { protocol: "tinycloud-share", version: 1, legacy: true, value, migrated: await input.publish(value) };
+  const record = await input.storage.get(input.shareId);
+  if (record === void 0) throw new Error("share not found");
+  return redactRecord(record, input.revealLink === true, input.link);
 }
 
 // src/recipient.ts
-import { ed25519 as ed255198, x25519 } from "@noble/curves/ed25519";
+import { ed25519 as ed255195, x25519 } from "@noble/curves/ed25519";
 import { sha256 as sha2566 } from "@noble/hashes/sha256";
 
 // src/protocol.ts
@@ -8848,12 +7880,6 @@ function fromBase64(value, label) {
   if (toBase64(out) !== value) throw new Error(`${label} is invalid`);
   return out;
 }
-async function digest3(value) {
-  return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalize(value)))));
-}
-async function digestText2(value) {
-  return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value))));
-}
 async function digestBytes2(value) {
   return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", value)));
 }
@@ -8863,24 +7889,9 @@ function trustedPublicKey(value) {
   }
   return value.invitationPublicKey;
 }
-async function verifyWrapped(value, key, domain, trust) {
-  const wrapper = object2(value, `${key} response`);
-  if (Object.keys(wrapper).length !== 2 || !Object.hasOwn(wrapper, key) || !Object.hasOwn(wrapper, "proof")) throw new Error(`${key} response is invalid`);
-  const artifact = object2(wrapper[key], `${key} artifact`);
-  const proof = object2(wrapper.proof, `${key} proof`);
-  if (proof.alg !== "EdDSA" || proof.kid !== trust.invitationKid) throw new Error(`${key} proof is invalid`);
-  if (!ed255198.verify(bytes2(proof.signature, `${key} signature`), new TextEncoder().encode(`${domain}${canonicalize(artifact)}`), trustedPublicKey(trust))) throw new Error(`${key} proof is invalid`);
-  return artifact;
-}
 function nativeAction(action) {
   return action === "list" ? "tinycloud.kv/list" : action === "edit" ? "tinycloud.kv/put" : "tinycloud.kv/get";
 }
-function uiAction(action) {
-  return action === "tinycloud.kv/list" ? "list" : action === "tinycloud.kv/put" ? "edit" : "read";
-}
-function selectedAction(envelope) {
-  return envelope.actions.includes("list") ? "tinycloud.kv/list" : envelope.actions.includes("edit") ? "tinycloud.kv/put" : "tinycloud.kv/get";
-}
 function policyAttenuationForV3(envelope) {
   const policy = object2(envelope.policy, "v3 policy");
   if (!Array.isArray(policy.capabilityCeiling)) throw new Error("v3 policy capability ceiling is invalid");
@@ -8950,11 +7961,20 @@ function verifyV3PolicyAuthorization(input) {
   if (!legacyShape && !v4Shape || POLICY_SESSION_DIGEST_FACT_KEYS.some((key) => !LOWER_SHA256_HEX.test(fact[key])) || v4Shape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)) || compact.payload.aud !== input.holderDid || compact.payload.iss.split("#", 1)[0] !== fact.nodeAudience || fact.profile !== "policy-session-ucan/v1" || fact.ownerDid !== policy.ownerDid || fact.policyId !== policy.policyId || fact.policyCid !== input.envelope.policyCid || fact.contentSourceDigestHex !== input.envelope.contentSourceDigestHex || fact.enforcerDid !== binding.enforcerDid || fact.nodeAudience !== binding.nodeAudience || fact.recipientDid !== input.holderDid || fact.policyDelegationCid !== input.envelope.policyRoot.cid || fact.enforcementDelegationCid !== input.envelope.enforcementRoot.cid || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || compact.payload.prf.length !== 2 || compact.payload.prf[0] !== input.envelope.policyRoot.cid || compact.payload.prf[1] !== input.envelope.enforcementRoot.cid || compact.payload.nbf > now || compact.payload.exp <= now || compact.payload.exp - compact.payload.nbf > 60 || canonicalize(compact.payload.att) !== canonicalize(policyAttenuationForV3(input.envelope))) throw new Error("v3 policy delegation signed binding mismatch");
   return compact;
 }
-function hex2(value) {
+function hex3(value) {
   return [...value].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
+function matchesInitialCiphertextDigest(bytes3, expected) {
+  if (typeof expected !== "string" || !LOWER_SHA256_HEX.test(expected)) return false;
+  const actual = sha2566(bytes3);
+  let mismatch = 0;
+  for (let index = 0; index < actual.length; index += 1) {
+    mismatch |= actual[index] ^ Number.parseInt(expected.slice(index * 2, index * 2 + 2), 16);
+  }
+  return mismatch === 0;
+}
 function canonicalHashHex(value) {
-  return hex2(sha2566(new TextEncoder().encode(canonicalize(value))));
+  return hex3(sha2566(new TextEncoder().encode(canonicalize(value))));
 }
 async function aesGcmDecrypt(key, blob) {
   if (key.length !== 32 || blob.length < 28) throw new Error("encrypted content is malformed");
@@ -8979,31 +7999,12 @@ function parseV3InlineEncryptedEnvelope(bytes3, expected) {
     throw new Error("encrypted content envelope is malformed");
   }
   if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("encrypted content envelope is malformed");
-  const record2 = value;
+  const record = value;
   const allowed = ["v", "networkId", "alg", "keyVersion", "encryptedSymmetricKey", "encryptedSymmetricKeyHash", "ciphertext", "metadata"];
-  if (Object.keys(record2).some((key) => !allowed.includes(key)) || record2.v !== 1 || record2.networkId !== expected.encryptionNetwork || record2.alg !== "x25519-aes256gcm/v1" || record2.keyVersion !== expected.contentSource.keyVersion || typeof record2.encryptedSymmetricKey !== "string" || typeof record2.encryptedSymmetricKeyHash !== "string" || record2.encryptedSymmetricKeyHash !== expected.contentSource.encryptedSymmetricKeyDigestHex || record2.encryptedSymmetricKeyHash !== canonicalHashHex(record2.encryptedSymmetricKey) || typeof record2.ciphertext !== "string" || record2.metadata !== void 0 && (record2.metadata === null || typeof record2.metadata !== "object" || Array.isArray(record2.metadata) || Object.values(record2.metadata).some((entry) => typeof entry !== "string"))) {
+  if (Object.keys(record).some((key) => !allowed.includes(key)) || record.v !== 1 || record.networkId !== expected.encryptionNetwork || record.alg !== "x25519-aes256gcm/v1" || record.keyVersion !== expected.contentSource.keyVersion || typeof record.encryptedSymmetricKey !== "string" || typeof record.encryptedSymmetricKeyHash !== "string" || record.encryptedSymmetricKeyHash !== expected.contentSource.encryptedSymmetricKeyDigestHex || record.encryptedSymmetricKeyHash !== canonicalHashHex(record.encryptedSymmetricKey) || typeof record.ciphertext !== "string" || record.metadata !== void 0 && (record.metadata === null || typeof record.metadata !== "object" || Array.isArray(record.metadata) || Object.values(record.metadata).some((entry) => typeof entry !== "string"))) {
     throw new Error("encrypted content envelope binding is invalid");
   }
-  return record2;
-}
-async function verifyDetachedResponse(response, trust) {
-  let value;
-  try {
-    value = await response.clone().json();
-  } catch {
-    throw new Error("share read response is invalid");
-  }
-  const record2 = object2(value, "share read response");
-  const proof = object2(record2.proof, "share read detached proof");
-  if (proof.alg !== "EdDSA" || proof.kid !== trust.invitationKid) throw new Error("share read detached proof is invalid");
-  const unsigned = { ...record2 };
-  delete unsigned.proof;
-  if (!ed255198.verify(bytes2(proof.signature, "share read signature"), new TextEncoder().encode(`${SHARE_V2_PROTOCOL.readResponseDomain}${canonicalize(unsigned)}`), trustedPublicKey(trust))) throw new Error("share read detached proof is invalid");
-}
-async function post(fetchFn, origin, path, body) {
-  const response = await fetchFn(new URL(path, origin), { method: "POST", redirect: "error", headers: { accept: "application/json", "content-type": "application/json" }, body: JSON.stringify(body) });
-  if (!response.ok) throw new Error("share authority rejected the request");
-  return response.json();
+  return record;
 }
 var ShareRecipientClient = class {
   constructor(options) {
@@ -9035,72 +8036,12 @@ var ShareRecipientClient = class {
   v3ContentKey;
   v3ContentEnvelope;
   async beginChallenge(envelope) {
-    const authority = envelope.ownerAuthority;
-    if (authority === void 0) throw new Error("addressed owner authority is required");
-    const outer = object2(authority.outerEnvelope, "owner authority outer envelope");
-    const enforcement = object2(authority.enforcementDelegation, "owner authority enforcement delegation");
-    const target = object2(outer.target, "owner authority target");
-    const outerResource = object2(outer.resource, "owner authority resource");
-    const source = object2(outer.contentSource, "owner authority content source");
-    if (!Array.isArray(outer.actions) || outer.actions.length === 0 || outer.actions.some((value) => typeof value !== "string")) throw new Error("owner authority outer envelope actions are invalid");
-    const actions = [...outer.actions];
-    const action = selectedAction(envelope);
-    const challengeBody = { envelopeCid: authority.envelopeCid, shareCid: authority.shareCid, shareId: envelope.shareId, registrationCid: authority.registrationCid, delegationCid: envelope.delegationCid, policyCid: envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "", enforcementDelegationCid: String(enforcement.cid), enforcementDelegation: enforcement, outerEnvelope: outer, contentSource: source, contentSourceDigest: String(outer.contentSourceDigest), holderDid: this.options.holderDid, targetOrigin: String(target.origin), nodeAudience: String(target.nodeAudience), action, actions, resource: String(outerResource.path) };
-    const requestBodyDigest = await digest3(challengeBody);
-    const challenge = await verifyWrapped(await post(this.fetchFn, this.options.nodeOrigin, "/share/v2/policy/challenges", { ...challengeBody, requestBodyDigest }), "challenge", DOMAIN, this.options.trustedNode);
-    if (challenge.type !== "TinyCloudSharePolicyChallenge" || challenge.version !== 2 || challenge.challengeId.length < 16 || challenge.nonce.length < 16 || challenge.shareCid !== authority.shareCid || challenge.shareId !== envelope.shareId || challenge.registrationCid !== authority.registrationCid || challenge.envelopeCid !== authority.envelopeCid || challenge.policyCid !== challengeBody.policyCid || challenge.delegationCid !== envelope.delegationCid || challenge.enforcementDelegationCid !== enforcement.cid || canonicalize(challenge.contentSource) !== canonicalize(source) || challenge.contentSourceDigest !== challengeBody.contentSourceDigest || challenge.requestBodyDigest !== requestBodyDigest || challenge.holderDid !== this.options.holderDid || challenge.targetOrigin !== challengeBody.targetOrigin || challenge.nodeAudience !== challengeBody.nodeAudience || challenge.action !== action || canonicalize(challenge.actions) !== canonicalize(actions) || challenge.resource !== challengeBody.resource || !Number.isFinite(Date.parse(challenge.expiresAt)) || Date.parse(challenge.expiresAt) <= Date.now()) throw new Error("share authority returned an unbound challenge");
-    return challenge;
+    void envelope;
+    throw new Error("v2 Share recipient transport has been removed; use the embedded policy v3 envelope");
   }
   async establish(envelope) {
-    const authority = envelope.ownerAuthority;
-    if (authority === void 0) throw new Error("addressed owner authority is required");
-    const outer = object2(authority.outerEnvelope, "owner authority outer envelope");
-    const enforcement = object2(authority.enforcementDelegation, "owner authority enforcement delegation");
-    const target = object2(outer.target, "owner authority target");
-    const outerResource = object2(outer.resource, "owner authority resource");
-    const source = object2(outer.contentSource, "owner authority content source");
-    if (!Array.isArray(outer.actions) || outer.actions.length === 0 || outer.actions.some((value) => typeof value !== "string")) throw new Error("owner authority outer envelope actions are invalid");
-    const actions = [...outer.actions];
-    const action = selectedAction(envelope);
-    const challengeBody = { envelopeCid: authority.envelopeCid, shareCid: authority.shareCid, shareId: envelope.shareId, registrationCid: authority.registrationCid, delegationCid: envelope.delegationCid, policyCid: envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "", enforcementDelegationCid: String(enforcement.cid), enforcementDelegation: enforcement, outerEnvelope: outer, contentSource: source, contentSourceDigest: String(outer.contentSourceDigest), holderDid: this.options.holderDid, targetOrigin: String(target.origin), nodeAudience: String(target.nodeAudience), action, actions, resource: String(outerResource.path) };
-    const requestBodyDigest = await digest3(challengeBody);
-    const challenge = await verifyWrapped(await post(this.fetchFn, this.options.nodeOrigin, "/share/v2/policy/challenges", { ...challengeBody, requestBodyDigest }), "challenge", DOMAIN, this.options.trustedNode);
-    if (challenge.type !== "TinyCloudSharePolicyChallenge" || challenge.version !== 2 || challenge.challengeId === void 0 || challenge.nonce === void 0 || challenge.shareCid !== authority.shareCid || challenge.shareId !== envelope.shareId || challenge.registrationCid !== authority.registrationCid || challenge.envelopeCid !== authority.envelopeCid || challenge.policyCid !== challengeBody.policyCid || challenge.delegationCid !== envelope.delegationCid || challenge.enforcementDelegationCid !== enforcement.cid || challenge.requestBodyDigest !== requestBodyDigest || canonicalize(challenge.contentSource) !== canonicalize(source) || challenge.contentSourceDigest !== challengeBody.contentSourceDigest || challenge.holderDid !== this.options.holderDid || challenge.targetOrigin !== challengeBody.targetOrigin || challenge.nodeAudience !== challengeBody.nodeAudience || challenge.action !== action || canonicalize(challenge.actions) !== canonicalize(actions) || challenge.resource !== challengeBody.resource || !Number.isFinite(Date.parse(challenge.expiresAt)) || Date.parse(challenge.expiresAt) <= Date.now()) throw new Error("share authority returned an unbound challenge");
-    if (this.options.buildPresentation === void 0) throw new Error("share presentation builder is required");
-    const material = await this.options.buildPresentation({ challenge, envelope, policy: {} });
-    this.holderProof = material.proof;
-    this.signer = material.sign;
-    this.nativeSigner = material.sign;
-    if (this.signer === void 0) throw new Error("share holder signer is required");
-    const presentation = {
-      type: "TinyCloudSharePolicyPresentation",
-      version: 2,
-      challengeId: challenge.challengeId,
-      nonce: challenge.nonce,
-      shareCid: authority.shareCid,
-      shareId: envelope.shareId,
-      delegationCid: envelope.delegationCid,
-      policyCid: challengeBody.policyCid,
-      contentSource: source,
-      contentSourceDigest: challengeBody.contentSourceDigest,
-      holderDid: material.holderDid,
-      targetOrigin: challengeBody.targetOrigin,
-      nodeAudience: challengeBody.nodeAudience,
-      ...challenge.enforcerDid === void 0 ? {} : { enforcerDid: challenge.enforcerDid },
-      credentialDigest: material.credentialDigest ?? await digestText2(material.credential),
-      action,
-      actions,
-      resource: challengeBody.resource,
-      requestBodyDigest,
-      issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      expiresAt: challenge.expiresAt,
-      jti: toBase64Url(crypto.getRandomValues(new Uint8Array(16)))
-    };
-    const presentationProof = { alg: "EdDSA", kid: `${material.holderDid}#${material.holderDid.slice("did:key:".length)}`, signature: toBase64Url(await this.signer(new TextEncoder().encode(`${PRESENTATION_DOMAIN}${canonicalize(presentation)}`))) };
-    const session = await verifyWrapped(await post(this.fetchFn, this.options.nodeOrigin, "/share/v2/policy/session", { challengeId: challenge.challengeId, nonce: challenge.nonce, presentation, credential: material.credential, proof: presentationProof, holderBinding: material.holderBinding, readSignerDid: material.holderDid }), "session", SESSION_DOMAIN, this.options.trustedNode);
-    if (session.type !== "TinyCloudSharePolicySession" || session.version !== 2 || typeof session.sessionId !== "string" || session.shareCid !== authority.shareCid || session.shareId !== envelope.shareId || session.registrationCid !== authority.registrationCid || session.envelopeCid !== authority.envelopeCid || session.policyCid !== challengeBody.policyCid || session.delegationCid !== envelope.delegationCid || session.holderDid !== this.options.holderDid || session.targetOrigin !== challengeBody.targetOrigin || session.nodeAudience !== challengeBody.nodeAudience || session.action !== action || canonicalize(session.actions) !== canonicalize(actions) || canonicalize(session.contentSource) !== canonicalize(source) || session.contentSourceDigest !== challengeBody.contentSourceDigest || session.resource !== challengeBody.resource || typeof session.expiresAt !== "string" || !Number.isFinite(Date.parse(session.expiresAt)) || Date.parse(session.expiresAt) <= Date.now()) throw new Error("share authority returned an unbound session");
-    this.session = { sessionId: session.sessionId, expiresAt: session.expiresAt, actions: actions.map(uiAction), resource: { kind: envelope.resource.kind, path: String(session.resource) } };
-    return this.session;
+    void envelope;
+    throw new Error("v2 Share recipient transport has been removed; use the embedded policy v3 envelope");
   }
   async authorize(envelope) {
     if (this.session === void 0) await this.establish(envelope);
@@ -9128,7 +8069,7 @@ var ShareRecipientClient = class {
     } catch {
       throw new Error("v3 attested Node audience is invalid");
     }
-    const challengeResponse = await this.fetchFn(new URL("/share/v3/policy/challenges", this.options.nodeOrigin), {
+    const challengeResponse = await this.fetchFn(new URL("/policy/v3/challenges", this.options.nodeOrigin), {
       method: "POST",
       redirect: "error",
       headers: { accept: "application/json", "content-type": "application/json" },
@@ -9149,7 +8090,7 @@ var ShareRecipientClient = class {
       throw new Error(accountless ? "v4 ceremony requires a verified credential and requirement" : "v3 ceremony requires a claim");
     }
     this.options.onStage?.("policy-admission");
-    const delegationResponse = await this.fetchFn(new URL("/share/v3/policy/delegations", this.options.nodeOrigin), {
+    const delegationResponse = await this.fetchFn(new URL("/policy/v3/delegations", this.options.nodeOrigin), {
       method: "POST",
       redirect: "error",
       headers: { accept: "application/json", "content-type": "application/json" },
@@ -9175,12 +8116,13 @@ var ShareRecipientClient = class {
     const envelope = this.options.envelope;
     const signer = this.nativeSigner ?? this.signer;
     if (envelope.version !== 3 || this.session === void 0 || this.v3Authorization === void 0 || this.v3NodeAudience === void 0 || signer === void 0) throw new Error("v3 policy session signer is required");
+    if (!matchesInitialCiphertextDigest(bytes3, envelope.contentSource.initialCiphertextDigestHex)) throw new Error("v3 owner KV ciphertext digest mismatch");
     const encrypted = parseV3InlineEncryptedEnvelope(bytes3, envelope);
     const receiverPrivateKey = crypto.getRandomValues(new Uint8Array(32));
     const receiverPublicKey = toBase64(x25519.getPublicKey(receiverPrivateKey));
     const receiverPublicKeyHash = canonicalHashHex(receiverPublicKey);
     const body = { type: "tinycloud.encryption.decrypt/v1", targetNode: this.v3NodeAudience, networkId: encrypted.networkId, alg: encrypted.alg, keyVersion: encrypted.keyVersion, encryptedSymmetricKey: encrypted.encryptedSymmetricKey, encryptedSymmetricKeyHash: encrypted.encryptedSymmetricKeyHash, receiverPublicKey, receiverPublicKeyHash };
-    const bodyHash = hex2(sha2566(new TextEncoder().encode(canonicalize(body))));
+    const bodyHash = hex3(sha2566(new TextEncoder().encode(canonicalize(body))));
     const session = verifyCompactUcanAuthorization(this.v3Authorization, this.session.sessionId);
     const now = Math.floor(Date.now() / 1e3);
     const invocation = await signCompactUcanAuthorization({
@@ -9200,11 +8142,11 @@ var ShareRecipientClient = class {
       if (!response.ok) throw new Error(`v3 decrypt invocation rejected (${response.status})`);
       const value = object2(await response.json(), "v3 decrypt response");
       const allowed = ["type", "targetNode", "networkId", "invocationCid", "encryptedSymmetricKeyHash", "receiverPublicKeyHash", "wrappedKey", "alg", "keyVersion", "requestHash", "nodeId", "nodeSignature"];
-      if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key)) || value.type !== "tinycloud.encryption.decrypt-result/v1" || value.targetNode !== body.targetNode || value.nodeId !== body.targetNode || value.networkId !== body.networkId || value.invocationCid !== invocation.cid || value.encryptedSymmetricKeyHash !== body.encryptedSymmetricKeyHash || value.receiverPublicKeyHash !== receiverPublicKeyHash || value.alg !== body.alg || value.keyVersion !== body.keyVersion || value.requestHash !== hex2(sha2566(new TextEncoder().encode(`${invocation.cid}${bodyHash}`))) || typeof value.wrappedKey !== "string" || typeof value.nodeSignature !== "string") throw new Error("v3 decrypt response binding is invalid");
+      if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key)) || value.type !== "tinycloud.encryption.decrypt-result/v1" || value.targetNode !== body.targetNode || value.nodeId !== body.targetNode || value.networkId !== body.networkId || value.invocationCid !== invocation.cid || value.encryptedSymmetricKeyHash !== body.encryptedSymmetricKeyHash || value.receiverPublicKeyHash !== receiverPublicKeyHash || value.alg !== body.alg || value.keyVersion !== body.keyVersion || value.requestHash !== hex3(sha2566(new TextEncoder().encode(`${invocation.cid}${bodyHash}`))) || typeof value.wrappedKey !== "string" || typeof value.nodeSignature !== "string") throw new Error("v3 decrypt response binding is invalid");
       const unsigned = { ...value };
       delete unsigned.nodeSignature;
       const signature = fromBase64(value.nodeSignature, "v3 decrypt response signature");
-      if (signature.length !== 64 || !ed255198.verify(signature, new TextEncoder().encode(canonicalize(unsigned)), ed25519PublicKeyFromDidKey(body.targetNode), { zip215: false })) throw new Error("v3 decrypt response signature is invalid");
+      if (signature.length !== 64 || !ed255195.verify(signature, new TextEncoder().encode(canonicalize(unsigned)), ed25519PublicKeyFromDidKey(body.targetNode), { zip215: false })) throw new Error("v3 decrypt response signature is invalid");
       const wrapped = fromBase64(value.wrappedKey, "v3 wrapped content key");
       if (wrapped.length < 61 || wrapped[32] !== 1) throw new Error("v3 wrapped content key is malformed");
       const shared = x25519.getSharedSecret(receiverPrivateKey, wrapped.slice(0, 32));
@@ -9226,47 +8168,16 @@ var ShareRecipientClient = class {
     return new TextEncoder().encode(canonicalize({ ...this.v3ContentEnvelope, ciphertext: toBase64Url(await aesGcmEncrypt(this.v3ContentKey, bytes3)), metadata: { ...this.v3ContentEnvelope.metadata ?? {}, contentType: mediaType } }));
   }
   async resumeWithProof(envelope, resumeToken, proof) {
-    const material = object2(proof, "share authorization proof");
-    const presentation = object2(material.presentation, "share presentation");
-    const presentationProof = object2(material.presentationProof, "share presentation proof");
-    const nonce = material.nonce;
-    const credential = material.credential;
-    const holderDid = material.holderDid;
-    const holderBinding = material.holderBinding;
-    if (typeof nonce !== "string" || typeof credential !== "string" || typeof holderDid !== "string" || holderDid !== this.options.holderDid || typeof holderBinding !== "object" || holderBinding === null || presentationProof.alg !== "EdDSA" || typeof presentationProof.signature !== "string") throw new Error("share authorization proof is incomplete");
-    const value = object2(await post(this.fetchFn, this.options.nodeOrigin, "/share/v2/policy/session", { challengeId: resumeToken, nonce, presentation, credential, proof: presentationProof, holderBinding, readSignerDid: holderDid }), "share policy session");
-    const session = await verifyWrapped(value, "session", SESSION_DOMAIN, this.options.trustedNode);
-    const authority = envelope.ownerAuthority;
-    if (authority === void 0 || session.type !== "TinyCloudSharePolicySession" || session.version !== 2 || typeof session.sessionId !== "string" || session.shareCid !== authority.shareCid || session.shareId !== envelope.shareId || session.registrationCid !== authority.registrationCid || session.envelopeCid !== authority.envelopeCid || session.delegationCid !== envelope.delegationCid || typeof session.resource !== "string" || typeof session.expiresAt !== "string") throw new Error("share authority returned an unbound session");
-    const policyCid = envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "";
-    const actions = [...new Set(envelope.actions.map(nativeAction))].sort();
-    if (session.policyCid !== policyCid || session.holderDid !== this.options.holderDid || session.targetOrigin !== envelope.target.origin || session.nodeAudience !== envelope.target.nodeAudience || session.action !== selectedAction(envelope) || canonicalize(session.actions) !== canonicalize(actions) || canonicalize(session.contentSource) !== canonicalize(envelope.contentSource) || session.contentSourceDigest !== envelope.contentSourceDigest || !Number.isFinite(Date.parse(session.expiresAt)) || Date.parse(session.expiresAt) <= Date.now()) throw new Error("share authority returned an unbound session");
-    this.session = { sessionId: session.sessionId, expiresAt: session.expiresAt, actions: actions.map(uiAction), resource: { kind: envelope.resource.kind, path: String(session.resource) } };
-    this.holderProof = presentationProof;
-    this.signer ??= this.options.sign;
-    return this.authorize(envelope);
+    void envelope;
+    void resumeToken;
+    void proof;
+    throw new Error("v2 Share recipient transport has been removed; use the embedded policy v3 envelope");
   }
   async nativeInvoke(request) {
     if (this.session === void 0) throw new Error("share policy session is required");
     const envelope = this.options.envelope;
     if (envelope.version === 3) return this.nativeInvokeV3(request, envelope);
-    if (envelope.ownerAuthority === void 0 || this.signer === void 0 || this.holderProof === void 0) throw new Error("share holder signer is required");
-    const authority = envelope.ownerAuthority;
-    const action = request.action === "list" ? "tinycloud.kv/list" : request.action === "put" ? "tinycloud.kv/put" : request.action === "metadata" ? "tinycloud.kv/metadata" : "tinycloud.kv/get";
-    const resource = typeof request.resource?.path === "string" ? request.resource.path : this.session.resource.path;
-    const actions = [...new Set(this.session.actions.map(nativeAction).concat(action === "tinycloud.kv/metadata" ? [action] : []))].sort();
-    const bodyBytes = request.body === void 0 ? void 0 : Uint8Array.from(request.body);
-    const bodyDigest = bodyBytes === void 0 ? void 0 : toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", bodyBytes)));
-    const outer = object2(authority.outerEnvelope, "owner authority outer envelope");
-    const enforcement = object2(authority.enforcementDelegation, "owner authority enforcement delegation");
-    const invocationBase = { type: "TinyCloudShareReadInvocation", version: 2, sessionId: this.session.sessionId, envelopeCid: authority.envelopeCid, shareCid: authority.shareCid, shareId: envelope.shareId, registrationCid: authority.registrationCid, delegationCid: envelope.delegationCid, policyCid: envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "", enforcementDelegationCid: String(enforcement.cid), contentSource: outer.contentSource, contentSourceDigest: String(outer.contentSourceDigest), holderDid: this.options.holderDid, targetOrigin: String(object2(outer.target, "owner authority target").origin), nodeAudience: String(object2(outer.target, "owner authority target").nodeAudience), action, actions, resource, ...action === "tinycloud.kv/list" ? { limit: 100 } : {}, ...bodyDigest === void 0 ? {} : { bodyDigest, ifMatch: request.ifMatch, contentType: request.contentType }, issuedAt: (/* @__PURE__ */ new Date()).toISOString(), expiresAt: new Date(Math.min(Date.now() + 6e4, Date.parse(this.session.expiresAt))).toISOString(), jti: toBase64Url(crypto.getRandomValues(new Uint8Array(16))) };
-    const requestBodyDigest = await digest3(invocationBase);
-    const invocation = { ...invocationBase, requestBodyDigest };
-    const proof = { ...this.holderProof, signature: toBase64Url(await this.signer(new TextEncoder().encode(`${INVOCATION_DOMAIN}${canonicalize(invocation)}`))) };
-    const signedRequest = { sessionId: this.session.sessionId, envelopeCid: authority.envelopeCid, shareCid: authority.shareCid, shareId: envelope.shareId, registrationCid: authority.registrationCid, delegationCid: envelope.delegationCid, policyCid: envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "", enforcementDelegationCid: String(enforcement.cid), contentSource: outer.contentSource, contentSourceDigest: String(outer.contentSourceDigest), holderDid: this.options.holderDid, nodeAudience: String(object2(outer.target, "owner authority target").nodeAudience), action, actions, resource, requestBodyDigest, invocation, proof };
-    const response = await this.fetchFn(new URL("/share/v2/invoke", this.options.nodeOrigin), { method: "POST", redirect: "error", headers: { accept: "application/vnd.tinycloud.share+json", "content-type": "application/vnd.tinycloud.share+json" }, body: JSON.stringify({ request: signedRequest, ...action === "tinycloud.kv/list" ? { limit: 100 } : {}, ...bodyBytes === void 0 ? {} : { body: toBase64Url(bodyBytes), bodyDigest, ifMatch: request.ifMatch, contentType: request.contentType } }) });
-    if (response.ok) await verifyDetachedResponse(response, this.options.trustedNode);
-    return response;
+    throw new Error("v2 Share invocation transport has been removed; use the embedded policy v3 envelope");
   }
   async nativeInvokeV3(request, envelope) {
     const signer = this.nativeSigner ?? this.signer;
@@ -9322,10 +8233,10 @@ function createAddressedAuthorization(input) {
         const envelopeAction = nativeAction("read");
         if (response.type !== "TinyCloudShareInvokeResponse" || response.version !== 2 || response.action !== envelopeAction || response.resource !== envelope.resource.path || typeof response.bodyDigest !== "string" || response.bodyDigest !== value.bodyDigest || response.bodyDigest !== await digestBytes2(value.bytes)) return false;
         const detached = object2(wrapper.detached, "share read detached proof");
-        if (detached.alg !== "EdDSA" || detached.kid !== input.trustedNode.invitationKid) return false;
+        if (input.trustedNode === void 0 || detached.alg !== "EdDSA" || detached.kid !== input.trustedNode.invitationKid) return false;
         const unsigned = { ...response };
         delete unsigned.proof;
-        return ed255198.verify(bytes2(detached.signature, "share read signature"), new TextEncoder().encode(`${SHARE_V2_PROTOCOL.readResponseDomain}${canonicalize(unsigned)}`), trustedPublicKey(input.trustedNode));
+        return ed255195.verify(bytes2(detached.signature, "share read signature"), new TextEncoder().encode(`${SHARE_V2_PROTOCOL.readResponseDomain}${canonicalize(unsigned)}`), trustedPublicKey(input.trustedNode));
       } catch {
         return false;
       }
@@ -9357,6 +8268,37 @@ async function claimShare(input) {
 async function resumeShareAuthorization(input) {
   return authorizeShare(input);
 }
+
+// src/native.ts
+var NATIVE_SHARE_FRAGMENT_PARAMETER = "tc1";
+function canonicalViewerUrl(viewerOrigin) {
+  const url = new URL(viewerOrigin);
+  if (url.protocol !== "https:" || url.origin !== viewerOrigin || url.pathname !== "/" || url.search || url.hash) throw new TypeError("viewer origin must be a canonical HTTPS origin");
+  url.pathname = "/viewer";
+  return url;
+}
+async function createNativeShare(sharing, input) {
+  if (!input.path || input.path.startsWith("/") || input.path.endsWith("/") || input.path.includes("..") || input.path.includes("//")) throw new TypeError("native share path must be one canonical TinyCloud KV key");
+  const generated = await sharing.generate({ path: input.path, actions: ["tinycloud.kv/get"], expiry: input.expiresAt });
+  if (generated.ok !== true) throw new Error(typeof generated.error?.message === "string" ? generated.error.message : "TinyCloud sharing service rejected delegation generation");
+  if (typeof generated.data?.token !== "string" || typeof generated.data.delegation?.cid !== "string" || !(generated.data.expiresAt instanceof Date)) throw new Error("TinyCloud sharing service returned incomplete delegation metadata");
+  const delegation = sharing.decodeLink(generated.data.token);
+  if (typeof delegation.spaceId !== "string" || delegation.spaceId.length === 0 || typeof delegation.path !== "string" || delegation.path.length === 0) throw new Error("TinyCloud sharing service returned a non-canonical delegation authority");
+  const url = canonicalViewerUrl(input.viewerOrigin);
+  url.hash = `${NATIVE_SHARE_FRAGMENT_PARAMETER}=${encodeURIComponent(generated.data.token)}`;
+  return { url: url.toString(), delegationCid: generated.data.delegation.cid, expiresAt: generated.data.expiresAt, spaceId: delegation.spaceId };
+}
+function parseNativeShareUrl(value) {
+  const url = new URL(value);
+  if (url.search || url.pathname !== "/viewer") throw new TypeError("native shares must carry tc1 only in the /viewer URL fragment");
+  const fragment = new URLSearchParams(url.hash.slice(1));
+  const token = fragment.get(NATIVE_SHARE_FRAGMENT_PARAMETER);
+  if (!token || fragment.size !== 1) throw new TypeError("missing native share fragment");
+  return token;
+}
+async function openNativeShare(sharing, link) {
+  return sharing.receive(parseNativeShareUrl(link), { autoSubdelegate: false, useSessionKey: false });
+}
 export {
   DEFAULT_MAX_CONTENT_BLOB_BYTES,
   DEFAULT_MAX_SEALED_BLOB_BYTES,
@@ -9367,12 +8309,11 @@ export {
   MemorySenderShareKeyStorage,
   MemorySenderShareRecordStorage,
   MemoryShareCache,
+  NATIVE_SHARE_FRAGMENT_PARAMETER,
   OWNER_SHARE_REGISTRATION_DOMAIN,
   SHARE_CONTENT_LIMIT,
-  SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
   SHARE_PUBLISH_RESULT_VERSION,
   SHARE_RESULT_VERSION,
-  SHARE_SEALED_OVERHEAD,
   SHARE_V2_PROTOCOL,
   SenderShareStore,
   ShareNotifyError,
@@ -9388,23 +8329,21 @@ export {
   computeOwnerShareRegistrationCid,
   createAddressedAuthorization,
   createDelegatedShareKey,
+  createNativeShare,
   createPolicyEnforcementDelegation,
-  createRegisteredPolicyAuthority,
   createShareV2HolderBindingArtifact,
   fromBase64Url,
   historyRecordForPublishedShare,
   inspectShare,
-  isLegacyShareLink,
   listShares,
-  migrateShare,
   normalizeShareTarget,
   notifyShare,
+  openNativeShare,
   parseAddressedEnvelope,
+  parseNativeShareUrl,
   publishAddressedShare,
   publishPolicyShare,
-  publishShare,
   publishTargetShare,
-  receiveLegacyShare,
   receiveShare,
   recipientMatchesShareRecord,
   redactPublishedShare,
@@ -9413,14 +8352,11 @@ export {
   restoreDelegatedShareKey,
   resumeShareAuthorization,
   revokeShare,
-  shareDeliveryTrustedKid,
   showShare,
   targetAuthorizationMethod,
   toBase64Url,
   toShareErrorInfo,
   validateOwnerSharePolicyRegistration,
-  validateOwnerSharePolicyRegistrationBytes,
-  validateShareDeliveryAuthorizationBytes,
-  verifyBearerEnvelope
+  validateOwnerSharePolicyRegistrationBytes
 };
 //# sourceMappingURL=index.js.map