@tinycloud/share-sdk 0.3.0-beta.2 → 1.0.0-beta.4

package/dist/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  CredentialInvitationError: () => CredentialInvitationError,
   DEFAULT_MAX_CONTENT_BLOB_BYTES: () => DEFAULT_MAX_CONTENT_BLOB_BYTES,
   DEFAULT_MAX_SEALED_BLOB_BYTES: () => DEFAULT_MAX_SEALED_BLOB_BYTES,
   DEFAULT_SHARE_LIFETIME_MS: () => DEFAULT_SHARE_LIFETIME_MS,
@@ -29,12 +30,11 @@ __export(index_exports, {
   MemorySenderShareKeyStorage: () => MemorySenderShareKeyStorage,
   MemorySenderShareRecordStorage: () => MemorySenderShareRecordStorage,
   MemoryShareCache: () => MemoryShareCache,
+  NATIVE_SHARE_FRAGMENT_PARAMETER: () => NATIVE_SHARE_FRAGMENT_PARAMETER,
   OWNER_SHARE_REGISTRATION_DOMAIN: () => OWNER_SHARE_REGISTRATION_DOMAIN,
   SHARE_CONTENT_LIMIT: () => SHARE_CONTENT_LIMIT,
-  SHARE_DELIVERY_AUTHORIZATION_DOMAIN: () => SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
   SHARE_PUBLISH_RESULT_VERSION: () => SHARE_PUBLISH_RESULT_VERSION,
   SHARE_RESULT_VERSION: () => SHARE_RESULT_VERSION,
-  SHARE_SEALED_OVERHEAD: () => SHARE_SEALED_OVERHEAD,
   SHARE_V2_PROTOCOL: () => SHARE_V2_PROTOCOL,
   SenderShareStore: () => SenderShareStore,
   ShareNotifyError: () => ShareNotifyError,
@@ -50,23 +50,22 @@ __export(index_exports, {
   computeOwnerShareRegistrationCid: () => computeOwnerShareRegistrationCid,
   createAddressedAuthorization: () => createAddressedAuthorization,
   createDelegatedShareKey: () => createDelegatedShareKey,
+  createNativeShare: () => createNativeShare,
   createPolicyEnforcementDelegation: () => createPolicyEnforcementDelegation,
-  createRegisteredPolicyAuthority: () => createRegisteredPolicyAuthority,
   createShareV2HolderBindingArtifact: () => createShareV2HolderBindingArtifact,
+  deliverCredentialInvitation: () => deliverCredentialInvitation,
   fromBase64Url: () => fromBase64Url,
   historyRecordForPublishedShare: () => historyRecordForPublishedShare,
   inspectShare: () => inspectShare,
-  isLegacyShareLink: () => isLegacyShareLink,
   listShares: () => listShares,
-  migrateShare: () => migrateShare,
   normalizeShareTarget: () => normalizeShareTarget,
   notifyShare: () => notifyShare,
+  openNativeShare: () => openNativeShare,
   parseAddressedEnvelope: () => parseAddressedEnvelope,
+  parseNativeShareUrl: () => parseNativeShareUrl,
   publishAddressedShare: () => publishAddressedShare,
   publishPolicyShare: () => publishPolicyShare,
-  publishShare: () => publishShare,
   publishTargetShare: () => publishTargetShare,
-  receiveLegacyShare: () => receiveLegacyShare,
   receiveShare: () => receiveShare,
   recipientMatchesShareRecord: () => recipientMatchesShareRecord,
   redactPublishedShare: () => redactPublishedShare,
@@ -75,15 +74,12 @@ __export(index_exports, {
   restoreDelegatedShareKey: () => restoreDelegatedShareKey,
   resumeShareAuthorization: () => resumeShareAuthorization,
   revokeShare: () => revokeShare,
-  shareDeliveryTrustedKid: () => shareDeliveryTrustedKid,
   showShare: () => showShare,
   targetAuthorizationMethod: () => targetAuthorizationMethod,
   toBase64Url: () => toBase64Url,
   toShareErrorInfo: () => toShareErrorInfo,
   validateOwnerSharePolicyRegistration: () => validateOwnerSharePolicyRegistration,
-  validateOwnerSharePolicyRegistrationBytes: () => validateOwnerSharePolicyRegistrationBytes,
-  validateShareDeliveryAuthorizationBytes: () => validateShareDeliveryAuthorizationBytes,
-  verifyBearerEnvelope: () => verifyBearerEnvelope
+  validateOwnerSharePolicyRegistrationBytes: () => validateOwnerSharePolicyRegistrationBytes
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -235,10 +231,10 @@ var util;
       return obj[e];
     });
   };
-  util2.objectKeys = typeof Object.keys === "function" ? (obj) => Object.keys(obj) : (object3) => {
+  util2.objectKeys = typeof Object.keys === "function" ? (obj) => Object.keys(obj) : (object4) => {
     const keys = [];
-    for (const key in object3) {
-      if (Object.prototype.hasOwnProperty.call(object3, key)) {
+    for (const key in object4) {
+      if (Object.prototype.hasOwnProperty.call(object4, key)) {
         keys.push(key);
       }
     }
@@ -5442,7 +5438,7 @@ function validateV3Invariants(value, ctx) {
   if (value.contentSource.encryptionNetwork !== value.encryptionNetwork) {
     ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["encryptionNetwork"], message: "encryption network is not bound to the source" });
   }
-  if (value.attestedEnforcerBinding.enforcerDid !== value.target.nodeAudience || value.attestedEnforcerBinding.signature.signerDid !== value.attestedEnforcerBinding.nodeAudience || Date.parse(value.attestedEnforcerBinding.expiresAt) < Date.parse(value.expiry)) {
+  if (value.attestedEnforcerBinding.nodeAudience !== value.target.nodeAudience || value.attestedEnforcerBinding.signature.signerDid !== value.attestedEnforcerBinding.nodeAudience || Date.parse(value.attestedEnforcerBinding.expiresAt) < Date.parse(value.expiry)) {
     ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["attestedEnforcerBinding"], message: "enforcer binding does not cover the target and share lifetime" });
   }
   if (value.policy.contentSource.shareId !== value.contentSource.shareId || value.policy.contentSource.kvResource !== value.contentSource.kvResource || value.policy.contentSource.selector !== value.contentSource.selector || value.policy.contentSource.encryptionNetwork !== value.encryptionNetwork || value.policy.contentSource.encryptedSymmetricKeyDigestHex !== value.contentSource.encryptedSymmetricKeyDigestHex || value.policy.contentSource.keyVersion !== value.contentSource.keyVersion || value.policy.contentSource.mode !== value.contentSource.mode || value.policy.contentSource.initialCiphertextDigestHex !== value.contentSource.initialCiphertextDigestHex) {
@@ -5637,36 +5633,6 @@ function checkBearerDelegation(envelope, options = {}) {
   }
   return { ok: true, delegateeDid: audience };
 }
-function mintBearerDelegation(options) {
-  const { issuerPrivateKey, audienceDid, resourceUri, expiresAtSeconds } = options;
-  if (!audienceDid.startsWith("did:")) {
-    throw new TypeError(`audienceDid must be a DID, got ${audienceDid}`);
-  }
-  if (resourceUri.length === 0) {
-    throw new TypeError("resourceUri must be non-empty");
-  }
-  if (!Number.isSafeInteger(expiresAtSeconds) || expiresAtSeconds <= 0) {
-    throw new TypeError(
-      `expiresAtSeconds must be a positive integer (epoch seconds), got ${expiresAtSeconds}`
-    );
-  }
-  const issuerDid = didKeyFromEd25519PublicKey(
-    import_ed25519.ed25519.getPublicKey(issuerPrivateKey)
-  );
-  const header = { alg: "EdDSA", typ: "JWT", ucv: "0.9.1" };
-  const payload = {
-    iss: issuerDid,
-    aud: audienceDid,
-    att: [{ with: resourceUri, can: BEARER_READ_ABILITY }],
-    prf: [],
-    exp: expiresAtSeconds
-  };
-  const signingInput = `${toBase64Url(utf8Bytes(JSON.stringify(header)))}.${toBase64Url(
-    utf8Bytes(JSON.stringify(payload))
-  )}`;
-  const signature = import_ed25519.ed25519.sign(utf8Bytes(signingInput), issuerPrivateKey);
-  return `${signingInput}.${toBase64Url(signature)}`;
-}
 var ENVELOPE_AAD_LABEL = "tinycloud-share-envelope-v1";
 var SEALED_BLOB_VERSION = 1;
 var AAD = utf8Bytes(ENVELOPE_AAD_LABEL);
@@ -5866,8 +5832,6 @@ function equal(left, right) {
   return left.length === right.length && left.every((byte, index) => byte === right[index]);
 }
 var ED25519_VERIFY_OPTS2 = { zip215: false };
-var ENVELOPE_SIGNATURE_DOMAIN = "xyz.tinycloud.share/envelope/v1\0";
-var ENVELOPE_V2_SIGNATURE_DOMAIN = "xyz.tinycloud.share/envelope/v2\0";
 var ENVELOPE_V3_SIGNATURE_DOMAIN = "xyz.tinycloud.share/envelope/v3\0";
 var POLICY_V1_SIGNATURE_DOMAIN = "xyz.tinycloud.policy/policy/v1\0";
 var POLICY_V2_SIGNATURE_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
@@ -5875,22 +5839,6 @@ var CONTENT_SOURCE_V1_DOMAIN = "xyz.tinycloud.policy/ContentSource/v1\0";
 var POLICY_CAPABILITY_V1_DOMAIN = "xyz.tinycloud.policy/PolicyCapability/v1\0";
 var NATIVE_PROJECTION_V1_DOMAIN = "xyz.tinycloud.policy/NativeProjection/v1\0";
 var ATTESTED_ENFORCER_V2_DOMAIN = "xyz.tinycloud.policy/AttestedEnforcerBinding/v2\0";
-function signingBytes(unsigned) {
-  const domain = utf8Bytes(ENVELOPE_SIGNATURE_DOMAIN);
-  const body = utf8Bytes(canonicalize(unsigned));
-  const bytes3 = new Uint8Array(domain.length + body.length);
-  bytes3.set(domain);
-  bytes3.set(body, domain.length);
-  return bytes3;
-}
-function signingBytesV2(unsigned) {
-  const domain = utf8Bytes(ENVELOPE_V2_SIGNATURE_DOMAIN);
-  const body = utf8Bytes(canonicalize(unsigned));
-  const bytes3 = new Uint8Array(domain.length + body.length);
-  bytes3.set(domain);
-  bytes3.set(body, domain.length);
-  return bytes3;
-}
 function signingBytesV3(unsigned) {
   const domain = utf8Bytes(ENVELOPE_V3_SIGNATURE_DOMAIN);
   const body = utf8Bytes(canonicalize(unsigned));
@@ -5899,53 +5847,6 @@ function signingBytesV3(unsigned) {
   bytes3.set(body, domain.length);
   return bytes3;
 }
-function signEnvelope(envelopeWithoutSig, ed25519PrivKey) {
-  const unsigned = unsignedShareEnvelopeSchema.parse(envelopeWithoutSig);
-  const publicKey = import_ed255193.ed25519.getPublicKey(ed25519PrivKey);
-  const signature = import_ed255193.ed25519.sign(signingBytes(unsigned), ed25519PrivKey);
-  return {
-    ...unsigned,
-    signature: {
-      signerDid: didKeyFromEd25519PublicKey(publicKey),
-      algorithm: "Ed25519",
-      value: toBase64Url(signature)
-    }
-  };
-}
-function verifyEnvelopeSignatureOnly(envelope) {
-  const parsed = shareEnvelopeSchema.parse(envelope);
-  const { signature, ...unsigned } = parsed;
-  const publicKey = ed25519PublicKeyFromDidKey(signature.signerDid);
-  return import_ed255193.ed25519.verify(
-    fromBase64Url(signature.value),
-    signingBytes(unsigned),
-    publicKey,
-    ED25519_VERIFY_OPTS2
-  );
-}
-async function verifyEnvelope(envelope, options) {
-  const parsed = shareEnvelopeSchema.parse(envelope);
-  if (parsed.signature.signerDid !== options.expectedSignerDid) return false;
-  if (!verifyEnvelopeSignatureOnly(parsed)) return false;
-  if (parsed.authorizationTarget.kind === "policy") {
-    const policyBytes = fromBase64Url(parsed.authorizationTarget.policyBytes);
-    if (await computeCid(policyBytes) !== parsed.authorizationTarget.policyCid) {
-      return false;
-    }
-  }
-  return true;
-}
-function verifyEnvelopeV2SignatureOnly(envelope) {
-  const parsed = shareEnvelopeV2Schema.parse(envelope);
-  const { signature, ...unsigned } = parsed;
-  return import_ed255193.ed25519.verify(fromBase64Url(signature.value), signingBytesV2(unsigned), ed25519PublicKeyFromDidKey(signature.signerDid), ED25519_VERIFY_OPTS2);
-}
-async function verifyEnvelopeV2(envelope, options) {
-  const parsed = shareEnvelopeV2Schema.parse(envelope);
-  if (parsed.signature.signerDid !== options.expectedSignerDid || !verifyEnvelopeV2SignatureOnly(parsed)) return false;
-  if (parsed.authorizationTarget.kind === "policy") return await computeCid(fromBase64Url(parsed.authorizationTarget.policyBytes)) === parsed.authorizationTarget.policyCid;
-  return true;
-}
 function verifyEnvelopeV3SignatureOnly(envelope) {
   const parsed = shareEnvelopeV3Schema.parse(envelope);
   const { signature, ...unsigned } = parsed;
@@ -5991,7 +5892,7 @@ async function verifyEnvelopeV3(envelope, options) {
   const binding = parsed.attestedEnforcerBinding;
   const { signature: bindingSignature, ...unsignedBinding } = binding;
   const expectedBindingDigestHex = hex((0, import_sha256.sha256)(new TextEncoder().encode(canonicalize({ enforcerDid: binding.enforcerDid, nodeAudience: binding.nodeAudience }))));
-  if (binding.enforcerDid !== parsed.target.nodeAudience || binding.attestationBindingDigestHex !== expectedBindingDigestHex || bindingSignature.signerDid !== binding.nodeAudience || bindingSignature.suite !== "Ed25519" || Date.parse(binding.issuedAt) > Date.now() || Date.parse(binding.expiresAt) <= Date.now() || Date.parse(binding.expiresAt) < Date.parse(parsed.expiry)) return false;
+  if (binding.nodeAudience !== parsed.target.nodeAudience || binding.attestationBindingDigestHex !== expectedBindingDigestHex || bindingSignature.signerDid !== binding.nodeAudience || bindingSignature.suite !== "Ed25519" || Date.parse(binding.issuedAt) > Date.now() || Date.parse(binding.expiresAt) <= Date.now() || Date.parse(binding.expiresAt) < Date.parse(parsed.expiry)) return false;
   try {
     const digest3 = (0, import_sha256.sha256)(new TextEncoder().encode(`${ATTESTED_ENFORCER_V2_DOMAIN}${canonicalize(unsignedBinding)}`));
     if (!import_ed255193.ed25519.verify(fromBase64Url(bindingSignature.value), digest3, ed25519PublicKeyFromDidKey(binding.nodeAudience), ED25519_VERIFY_OPTS2)) return false;
@@ -6033,7 +5934,6 @@ function base32Lower(bytes3) {
   return output;
 }
 var KEY_LENGTH2 = 32;
-var INLINE_PREFIX = "#v=2&p=";
 var MAX_INLINE_BYTES = 256 * 1024;
 function assertCanonicalCid(cidString) {
   const cid2 = CID.parse(cidString);
@@ -6042,120 +5942,67 @@ function assertCanonicalCid(cidString) {
     throw new TypeError(`not a canonical CIDv1 raw sha2-256 base32 CID: ${cidString}`);
   }
 }
-function encodeShareUrl({ origin, ciphertextCid, key32 }) {
-  if (key32.length !== KEY_LENGTH2) {
-    throw new TypeError(`key must be ${KEY_LENGTH2} bytes, got ${key32.length}`);
-  }
-  assertCanonicalCid(ciphertextCid);
-  if (!isCanonicalHttpsOrigin(origin)) {
-    throw new TypeError(`origin must be a canonical https origin, got ${origin}`);
-  }
-  return `${origin}/s/${ciphertextCid}#k=${toBase64Url(key32)}`;
-}
-function parseShareUrl(url, options = {}) {
-  const parsed = new URL(url);
-  if (parsed.protocol !== "https:") {
-    throw new TypeError(`share URL must be https, got ${parsed.protocol}`);
-  }
-  if (parsed.username !== "" || parsed.password !== "") {
-    throw new TypeError("share URL must not carry userinfo");
-  }
-  if (parsed.search !== "") {
-    throw new TypeError("share URL must not have a query string");
-  }
-  if (options.expectedOrigin !== void 0) {
-    if (!isCanonicalHttpsOrigin(options.expectedOrigin)) {
-      throw new TypeError(
-        `expectedOrigin must be a canonical https origin, got ${options.expectedOrigin}`
-      );
-    }
-    if (parsed.origin !== options.expectedOrigin) {
-      throw new TypeError(
-        `share URL origin ${parsed.origin} does not match expected ${options.expectedOrigin}`
-      );
-    }
-  }
-  const match = /^\/s\/([a-z2-7]+)$/.exec(parsed.pathname);
-  if (!match || match[1] === void 0) {
-    throw new TypeError(`not a share URL path: ${parsed.pathname}`);
-  }
-  const ciphertextCid = match[1];
-  assertCanonicalCid(ciphertextCid);
-  if (!parsed.hash.startsWith("#k=")) {
-    throw new TypeError("share URL is missing the #k= key fragment");
-  }
-  const key32 = fromBase64Url(parsed.hash.slice("#k=".length));
-  if (key32.length !== KEY_LENGTH2) {
-    throw new TypeError(`fragment key must be ${KEY_LENGTH2} bytes, got ${key32.length}`);
-  }
-  return { ciphertextCid, key32 };
-}
-async function encodeInlineShareUrl(parts) {
+async function encodeSealedInlineShareUrl(parts) {
   if (!isCanonicalHttpsOrigin(parts.origin)) throw new TypeError("origin must be a canonical https origin");
   if (parts.ciphertext.byteLength === 0 || parts.ciphertext.byteLength > MAX_INLINE_BYTES) throw new RangeError("inline ciphertext is outside the allowed size");
-  if (parts.key32 !== void 0 && parts.key32.length !== KEY_LENGTH2) throw new TypeError("inline key must be 32 bytes");
+  if (parts.key32.byteLength !== KEY_LENGTH2) throw new TypeError("inline key must be 32 bytes");
   const ciphertextCid = await computeCid(parts.ciphertext);
   const payload = canonicalize({
     v: 2,
     c: toBase64Url(parts.ciphertext),
     cid: ciphertextCid,
-    ...parts.key32 === void 0 ? {} : { k: toBase64Url(parts.key32) }
+    k: toBase64Url(parts.key32)
   });
   const payloadBytes = new TextEncoder().encode(payload);
   if (payloadBytes.byteLength > MAX_INLINE_BYTES * 2) throw new RangeError("inline URL is too large");
-  return `${parts.origin}/s/inline${INLINE_PREFIX}${toBase64Url(payloadBytes)}`;
+  return `${parts.origin}/s/inline#v=2&p=${toBase64Url(payloadBytes)}`;
 }
-function parseInlineShareUrl(url, options = {}) {
+async function parseSealedInlineShareUrl(url, options = {}) {
   const parsed = new URL(url);
-  if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "" || parsed.search !== "") throw new TypeError("inline share URL must be canonical HTTPS without query or userinfo");
-  if (!isCanonicalHttpsOrigin(parsed.origin) || options.expectedOrigin !== void 0 && parsed.origin !== options.expectedOrigin) throw new TypeError("inline share URL origin is not trusted");
-  if (parsed.pathname !== "/s/inline" || !parsed.hash.startsWith(INLINE_PREFIX)) throw new TypeError("not an inline v2 share URL");
+  if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") throw new TypeError("sealed inline share URL must be canonical HTTPS without userinfo");
+  if (!isCanonicalHttpsOrigin(parsed.origin) || options.expectedOrigin !== void 0 && parsed.origin !== options.expectedOrigin) throw new TypeError("sealed inline share URL origin is not trusted");
+  if (parsed.pathname !== "/s/inline" || parsed.search !== "") throw new TypeError("not a Node sealed-inline share URL");
+  if (url !== `${parsed.origin}/s/inline${parsed.hash}`) throw new TypeError("sealed inline share URL is not lexically canonical");
+  const prefix = "#v=2&p=";
+  if (!parsed.hash.startsWith(prefix)) throw new TypeError("sealed inline URL is missing its canonical fragment");
+  const encoded = parsed.hash.slice(prefix.length);
+  if (encoded.length === 0 || parsed.hash !== `${prefix}${encoded}`) throw new TypeError("sealed inline URL fragment is not canonical");
   let payloadBytes;
   try {
-    payloadBytes = fromBase64Url(parsed.hash.slice(INLINE_PREFIX.length));
+    payloadBytes = fromBase64Url(encoded);
   } catch {
-    throw new TypeError("inline payload is not canonical base64url");
+    throw new TypeError("sealed inline payload is not canonical base64url");
   }
-  if (payloadBytes.byteLength === 0 || payloadBytes.byteLength > MAX_INLINE_BYTES * 2) throw new TypeError("inline payload is too large");
+  if (payloadBytes.byteLength === 0 || payloadBytes.byteLength > MAX_INLINE_BYTES * 2) throw new TypeError("sealed inline payload is too large");
+  const payloadText = new TextDecoder("utf-8", { fatal: true }).decode(payloadBytes);
   let value;
   try {
-    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(payloadBytes));
+    value = JSON.parse(payloadText);
   } catch {
-    throw new TypeError("inline payload is not valid JSON");
+    throw new TypeError("sealed inline payload is not valid JSON");
   }
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new TypeError("inline payload must be an object");
-  if (canonicalize(value) !== new TextDecoder("utf-8").decode(payloadBytes)) throw new TypeError("inline payload is not canonical JSON");
-  const record2 = value;
-  const keys = Object.keys(record2);
-  if (!keys.every((key) => key === "v" || key === "c" || key === "cid" || key === "k") || record2.v !== 2 || typeof record2.c !== "string" || typeof record2.cid !== "string") throw new TypeError("inline payload has invalid fields");
+  if (typeof value !== "object" || value === null || Array.isArray(value) || canonicalize(value) !== payloadText) throw new TypeError("sealed inline payload is not canonical JSON");
+  const record = value;
+  if (Object.keys(record).length !== 4 || record.v !== 2 || typeof record.c !== "string" || typeof record.cid !== "string" || typeof record.k !== "string") throw new TypeError("sealed inline payload has invalid fields");
   let ciphertext;
-  try {
-    ciphertext = fromBase64Url(record2.c);
-  } catch {
-    throw new TypeError("inline ciphertext is not canonical base64url");
-  }
-  if (ciphertext.byteLength === 0 || ciphertext.byteLength > MAX_INLINE_BYTES) throw new TypeError("inline ciphertext is outside the allowed size");
-  assertCanonicalCid(record2.cid);
-  if (record2.k !== void 0 && typeof record2.k !== "string") throw new TypeError("inline key must be base64url");
   let key32;
   try {
-    key32 = record2.k === void 0 ? void 0 : fromBase64Url(record2.k);
+    ciphertext = fromBase64Url(record.c);
+    key32 = fromBase64Url(record.k);
   } catch {
-    throw new TypeError("inline key is not canonical base64url");
+    throw new TypeError("sealed inline payload has invalid base64url material");
   }
-  if (key32 !== void 0 && key32.length !== KEY_LENGTH2) throw new TypeError("inline key must be 32 bytes");
-  return { kind: "inline", ciphertextCid: record2.cid, ciphertext, ...key32 === void 0 ? {} : { key32 } };
-}
-function parseCompactOrInlineShareUrl(url, options = {}) {
-  if (new URL(url).pathname === "/s/inline") return parseInlineShareUrl(url, options);
-  return { kind: "compact", ...parseShareUrl(url, options) };
+  if (ciphertext.byteLength === 0 || ciphertext.byteLength > MAX_INLINE_BYTES) throw new TypeError("sealed inline ciphertext is outside the allowed size");
+  if (key32.byteLength !== KEY_LENGTH2) throw new TypeError("sealed inline key must be 32 bytes");
+  assertCanonicalCid(record.cid);
+  if (await computeCid(ciphertext) !== record.cid) throw new TypeError("sealed inline ciphertext does not match its CID");
+  return { kind: "inline", ciphertextCid: record.cid, ciphertext, key32 };
 }
 
 // src/receive.ts
 var SHARE_RESULT_VERSION = 1;
 var DEFAULT_MAX_SEALED_BLOB_BYTES = 100 * 1024 * 1024 + 29;
 var DEFAULT_MAX_CONTENT_BLOB_BYTES = DEFAULT_MAX_SEALED_BLOB_BYTES;
-var CONTENT_SEALED_OVERHEAD = 1 + 12 + 16;
 var ShareReceiveError = class extends Error {
   code;
   details;
@@ -6165,7 +6012,6 @@ var ShareReceiveError = class extends Error {
     this.code = code3;
     this.details = details;
   }
-  /** Machine output is deliberately code-only; diagnostics belong on stderr. */
   toJSON() {
     return { protocol: "tinycloud-share", version: SHARE_RESULT_VERSION, error: { code: this.code } };
   }
@@ -6174,338 +6020,77 @@ function toShareErrorInfo(error) {
   if (error instanceof ShareReceiveError) return error.toJSON();
   return { protocol: "tinycloud-share", version: SHARE_RESULT_VERSION, error: { code: "fetch-failed" } };
 }
-function boundedBytes(value, limit, code3) {
-  if (!Number.isSafeInteger(limit) || limit <= 0) throw new ShareReceiveError("fetch-failed", "share byte limit is invalid");
-  if (!(value instanceof Uint8Array)) throw new ShareReceiveError("fetch-failed", "registry returned invalid bytes");
-  if (value.byteLength > limit) throw new ShareReceiveError(code3, "share blob exceeds the configured byte limit");
-  return value;
-}
-async function readResponseBytes(response, limit, tooLargeCode) {
-  const contentLength = response.headers.get("content-length");
-  if (contentLength !== null && Number.isSafeInteger(Number(contentLength)) && Number(contentLength) > limit) {
-    throw new ShareReceiveError(tooLargeCode, "share blob exceeds the configured byte limit");
-  }
-  if (response.body === null) {
-    return boundedBytes(new Uint8Array(await response.arrayBuffer()), limit, tooLargeCode);
-  }
-  const reader = response.body.getReader();
-  const chunks = [];
-  let total = 0;
-  try {
-    for (; ; ) {
-      const part = await reader.read();
-      if (part.done) break;
-      total += part.value.byteLength;
-      if (total > limit) {
-        await reader.cancel();
-        throw new ShareReceiveError(tooLargeCode, "share blob exceeds the configured byte limit");
-      }
-      chunks.push(part.value);
-    }
-  } finally {
-    reader.releaseLock();
-  }
-  const bytes3 = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes3.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return bytes3;
-}
-function registryFetcher(options, limit, tooLargeCode = "max-bytes-exceeded", stage = "envelope") {
-  if (options.fetchBlob !== void 0) return async (input) => {
-    try {
-      options.signal?.throwIfAborted();
-      const bytes3 = await options.fetchBlob({ ...input, ...options.signal === void 0 ? {} : { signal: options.signal } });
-      options.signal?.throwIfAborted();
-      return boundedBytes(bytes3, limit, tooLargeCode);
-    } catch (error) {
-      if (options.signal?.aborted) throw options.signal.reason ?? error;
-      if (error instanceof ShareReceiveError) throw error;
-      throw new ShareReceiveError("fetch-failed", "registry unavailable", { stage });
-    }
-  };
-  if (options.registryBaseUrl === void 0) throw new ShareReceiveError("fetch-failed", "a registry fetch adapter is required");
-  const fetchFn = options.fetchFn ?? globalThis.fetch;
-  const base3 = options.registryBaseUrl.replace(/\/+$/, "");
-  return async ({ cid: cid2 }) => {
-    try {
-      options.signal?.throwIfAborted();
-      const response = await fetchFn(`${base3}/ipfs/${cid2}?format=raw`, {
-        headers: { accept: "application/vnd.ipld.raw" },
-        redirect: "error",
-        ...options.signal === void 0 ? {} : { signal: options.signal }
-      });
-      options.signal?.throwIfAborted();
-      if (!response.ok) throw new ShareReceiveError("fetch-failed", `registry returned ${response.status}`, { stage });
-      const bytes3 = await readResponseBytes(response, limit, tooLargeCode);
-      options.signal?.throwIfAborted();
-      return bytes3;
-    } catch (error) {
-      if (options.signal?.aborted) throw options.signal.reason ?? error;
-      if (error instanceof ShareReceiveError) throw error;
-      throw new ShareReceiveError("fetch-failed", "registry unavailable", { stage });
-    }
-  };
-}
 function metadataFor(envelope, origin) {
-  if (envelope.version === 2 || envelope.version === 3) {
-    const targetKind3 = envelope.recipientMatcher.kind === "recipientDid" ? "recipientDid" : envelope.recipientMatcher.kind === "exactEmail" ? "email" : envelope.recipientMatcher.kind === "emailDomain" ? "emailDomain" : "bearer";
-    return {
-      protocol: "tinycloud-share",
-      version: 1,
-      shareId: envelope.shareId,
-      origin,
-      target: { ...envelope.target, kind: targetKind3 },
-      resource: envelope.resource,
-      actions: envelope.actions,
-      expiresAt: envelope.expiry,
-      display: {
-        ...envelope.display.senderName === void 0 ? {} : { senderName: envelope.display.senderName },
-        ...envelope.display.filename === void 0 ? {} : { filename: envelope.display.filename },
-        ...envelope.display.mode === void 0 ? {} : { mode: envelope.display.mode }
-      },
-      ...envelope.version === 2 && envelope.content !== void 0 ? { content: { cid: envelope.content.cid } } : {}
-    };
-  }
+  const kind = envelope.recipientMatcher.kind === "recipientDid" ? "recipientDid" : envelope.recipientMatcher.kind === "exactEmail" ? "email" : "emailDomain";
   return {
     protocol: "tinycloud-share",
     version: 1,
     shareId: envelope.shareId,
     origin,
-    target: { ...envelope.target, kind: "bearer" },
-    resource: envelope.target.resource,
-    actions: ["read"],
+    target: { ...envelope.target, kind },
+    resource: { ...envelope.resource },
+    actions: [...envelope.actions],
     expiresAt: envelope.expiry,
     display: {
       ...envelope.display.senderName === void 0 ? {} : { senderName: envelope.display.senderName },
       ...envelope.display.filename === void 0 ? {} : { filename: envelope.display.filename },
       ...envelope.display.mode === void 0 ? {} : { mode: envelope.display.mode }
-    },
-    ...envelope.content === void 0 ? {} : { content: { cid: envelope.content.cid } }
+    }
   };
 }
-function parseEnvelope(bytes3) {
-  try {
-    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes3);
-    const value = JSON.parse(text);
-    if (canonicalize(value) !== text) throw new Error("share envelope is not canonical JSON");
-    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
-      const version = value.version;
-      if (version === 3) return shareEnvelopeV3Schema.parse(value);
-      if (version === 2) return shareEnvelopeV2Schema.parse(value);
-    }
-    return shareEnvelopeSchema.parse(value);
-  } catch {
-    throw new ShareReceiveError("envelope-invalid", "share envelope is invalid");
-  }
-}
-async function resolveShareEnvelope(link, options = {}) {
+async function resolvePolicyShare(link, options) {
+  options.signal?.throwIfAborted();
+  let url;
   let parsed;
   try {
-    parsed = parseCompactOrInlineShareUrl(link, { ...options.expectedOrigin === void 0 ? {} : { expectedOrigin: options.expectedOrigin } });
+    url = new URL(link);
+    parsed = await parseSealedInlineShareUrl(link, { ...options.expectedOrigin === void 0 ? {} : { expectedOrigin: options.expectedOrigin } });
   } catch {
     throw new ShareReceiveError("invalid-link", "share link format is invalid");
   }
+  const limit = options.maxSealedBlobBytes ?? DEFAULT_MAX_SEALED_BLOB_BYTES;
+  if (!Number.isSafeInteger(limit) || limit <= 0 || parsed.ciphertext.byteLength > limit) throw new ShareReceiveError("max-bytes-exceeded", "sealed policy envelope exceeds the configured byte limit");
+  if (await computeCid(parsed.ciphertext) !== parsed.ciphertextCid) throw new ShareReceiveError("cid-mismatch", "sealed envelope bytes do not match the link CID");
+  options.signal?.throwIfAborted();
+  let envelope;
   try {
-    if (parsed.key32 !== void 0) options.onKeyParsed?.(parsed.key32);
-    const url = new URL(link);
-    const sealed = parsed.kind === "inline" ? boundedBytes(parsed.ciphertext, options.maxSealedBlobBytes ?? DEFAULT_MAX_SEALED_BLOB_BYTES, "max-bytes-exceeded") : await registryFetcher(options, options.maxSealedBlobBytes ?? DEFAULT_MAX_SEALED_BLOB_BYTES)({ origin: url.origin, cid: parsed.ciphertextCid });
-    if (await computeCid(sealed) !== parsed.ciphertextCid) throw new ShareReceiveError("cid-mismatch", "registry bytes do not match the link CID");
-    let plaintext;
-    try {
-      plaintext = parsed.key32 === void 0 ? sealed : await open(sealed, parsed.key32);
-    } catch {
-      throw new ShareReceiveError("decrypt-failed", "share envelope could not be opened");
-    }
-    return { envelope: parseEnvelope(plaintext), origin: url.origin, cid: parsed.ciphertextCid, kind: parsed.kind };
-  } finally {
-    parsed.key32?.fill(0);
-  }
-}
-function actionName(value) {
-  return value === "read" ? "tinycloud.kv/get" : value === "list" ? "tinycloud.kv/list" : value === "edit" ? "tinycloud.kv/put" : value;
-}
-function resourceContains(outer, inner) {
-  if (outer.kind === "exact") return inner.kind === "exact" && outer.path === inner.path;
-  const prefix = outer.path.endsWith("/") ? outer.path : `${outer.path}/`;
-  return inner.path === outer.path || inner.path.startsWith(prefix);
-}
-function policyEvidenceMatches(envelope, evidence) {
-  const registeredActions = new Set(evidence.actions.map(actionName));
-  return evidence.policyCid === (envelope.authorizationTarget.kind === "policy" ? envelope.authorizationTarget.policyCid : "") && evidence.signerDid === envelope.signature.signerDid && evidence.registrationCid.length > 0 && evidence.shareId === envelope.shareId && canonicalize(evidence.recipientMatcher) === canonicalize(envelope.recipientMatcher) && canonicalize(evidence.target) === canonicalize(envelope.target) && resourceContains(evidence.resource, envelope.resource) && envelope.actions.every((action) => registeredActions.has(actionName(action))) && canonicalize(evidence.contentSource) === canonicalize(envelope.contentSource) && evidence.contentSourceDigest === envelope.contentSourceDigest && evidence.delegationCid === envelope.delegationCid && evidence.authorityMaterialHandle === envelope.authorityMaterialHandle && evidence.authorityMaterialDigest === envelope.authorityMaterialDigest && evidence.expiresAt === envelope.expiry && Number.isFinite(Date.parse(evidence.expiresAt)) && Date.parse(evidence.expiresAt) === Date.parse(envelope.expiry);
-}
-async function verifyV2Envelope(envelope, linkOrigin, options) {
-  if (options.expectedOrigin !== void 0 && linkOrigin !== options.expectedOrigin) {
-    throw new ShareReceiveError("origin-mismatch", "share link origin does not match the trusted origin");
-  }
-  try {
-    if (!await verifyEnvelopeV2(envelope, { expectedSignerDid: envelope.signature.signerDid })) throw new Error("signature");
+    const encoded = new TextDecoder("utf-8", { fatal: true }).decode(await open(parsed.ciphertext, parsed.key32));
+    const value = JSON.parse(encoded);
+    if (canonicalize(value) !== encoded) throw new Error("non-canonical envelope");
+    envelope = shareEnvelopeV3Schema.parse(value);
   } catch {
-    throw new ShareReceiveError("signature-invalid", "share signature is invalid");
-  }
-  const expiry = Date.parse(envelope.expiry);
-  if (!Number.isFinite(expiry)) throw new ShareReceiveError("envelope-invalid", "share expiry is invalid");
-  if (expiry <= (options.now?.() ?? Date.now())) throw new ShareReceiveError("expired", "share has expired", { expiresAt: envelope.expiry });
-  if (envelope.authorizationTarget.kind === "policy") {
-    if (options.trustedPolicyAuthority === void 0) throw new ShareReceiveError("envelope-invalid", "an external policy authority is required");
-    let evidence;
-    try {
-      evidence = await options.trustedPolicyAuthority.resolve({ policyCid: envelope.authorizationTarget.policyCid, envelope });
-    } catch {
-      evidence = void 0;
-    }
-    if (evidence === void 0 || !policyEvidenceMatches(envelope, evidence)) throw new ShareReceiveError("capability-invalid", "share policy authority evidence is not bound to the envelope");
-    if (options.trustedSignerDid !== void 0 && (evidence.signerDid !== options.trustedSignerDid || envelope.signature.signerDid !== options.trustedSignerDid)) {
-      throw new ShareReceiveError("signature-invalid", "share signer is not trusted");
-    }
-  } else if (envelope.authorizationTarget.kind === "recipientDid" && envelope.recipientMatcher.kind === "recipientDid" && envelope.authorizationTarget.did !== envelope.recipientMatcher.value) {
-    throw new ShareReceiveError("capability-invalid", "recipient authorization does not match the signed recipient");
-  } else {
-    if (options.trustedSignerDid === void 0 || envelope.signature.signerDid !== options.trustedSignerDid) throw new ShareReceiveError("signature-invalid", "an addressed signer trust root is required");
-  }
-}
-async function verifyV3Envelope(envelope, linkOrigin, options) {
-  if (options.expectedOrigin !== void 0 && linkOrigin !== options.expectedOrigin) {
-    throw new ShareReceiveError("origin-mismatch", "share link origin does not match the trusted origin");
+    throw new ShareReceiveError("envelope-invalid", "share envelope is invalid");
   }
   try {
     if (!await verifyEnvelopeV3(envelope, { expectedSignerDid: envelope.policy.ownerDid })) throw new Error("signature");
   } catch {
     throw new ShareReceiveError("signature-invalid", "share signature is invalid");
   }
+  options.signal?.throwIfAborted();
   const expiry = Date.parse(envelope.expiry);
   if (!Number.isFinite(expiry)) throw new ShareReceiveError("envelope-invalid", "share expiry is invalid");
   if (expiry <= (options.now?.() ?? Date.now())) throw new ShareReceiveError("expired", "share has expired", { expiresAt: envelope.expiry });
-}
-async function verifyV1PolicyEnvelope(envelope, linkOrigin, options) {
-  if (envelope.authorizationTarget.kind !== "policy") throw new ShareReceiveError("unsupported-target", "share target is not an addressed policy", { reason: "policy-target" });
-  if (envelope.target.origin !== linkOrigin || options.expectedOrigin !== void 0 && (linkOrigin !== options.expectedOrigin || envelope.target.origin !== options.expectedOrigin)) {
-    throw new ShareReceiveError("origin-mismatch", "share origin does not match the trusted origin");
-  }
-  throw new ShareReceiveError("unsupported-target", "share policy target is not supported", { reason: "policy-target" });
-}
-async function verifyBearerEnvelope(envelope, linkOrigin, options = {}) {
-  if (envelope.target.origin !== linkOrigin || options.expectedOrigin !== void 0 && (linkOrigin !== options.expectedOrigin || envelope.target.origin !== options.expectedOrigin)) {
-    throw new ShareReceiveError("origin-mismatch", "share origin does not match the trusted origin");
-  }
-  if (envelope.authorizationTarget.kind !== "bearerKey") throw new ShareReceiveError("unsupported-target", "this receive path only handles bearer shares", { reason: envelope.authorizationTarget.kind === "policy" ? "policy-target" : "recipient-did-target" });
-  if (envelope.target.resource.kind !== "exact") throw new ShareReceiveError("unsupported-target", "this receive path only handles exact resources", { reason: "prefix-resource" });
-  const expiry = Date.parse(envelope.expiry);
-  if (!Number.isFinite(expiry)) throw new ShareReceiveError("envelope-invalid", "share expiry is invalid");
-  try {
-    if (!await verifyEnvelope(envelope, { expectedSignerDid: envelope.signature.signerDid })) throw new Error("signature");
-  } catch {
-    throw new ShareReceiveError("signature-invalid", "share signature is invalid");
-  }
-  if (expiry <= (options.now?.() ?? Date.now())) throw new ShareReceiveError("expired", "share has expired", { expiresAt: envelope.expiry });
-  const capability = checkBearerDelegation(envelope, options.now === void 0 ? {} : { now: options.now });
-  if (!capability.ok) throw new ShareReceiveError("capability-invalid", "share delegation does not authorize the target");
-}
-async function verifyResolved(envelope, linkOrigin, options) {
-  await verifyBearerEnvelope(envelope, linkOrigin, options);
+  options.onResolvedAddressedEnvelope?.(envelope, parsed.ciphertextCid);
+  return { envelope, origin: url.origin, cid: parsed.ciphertextCid };
 }
 async function inspectShare(link, options = {}) {
-  const resolved = await resolveShareEnvelope(link, options);
-  if (resolved.envelope.version === 1 && resolved.envelope.authorizationTarget.kind === "policy") await verifyV1PolicyEnvelope(resolved.envelope, resolved.origin, options);
-  else if (resolved.envelope.version === 1) await verifyResolved(resolved.envelope, resolved.origin, options);
-  else if (resolved.envelope.version === 2) await verifyV2Envelope(resolved.envelope, resolved.origin, options);
-  else await verifyV3Envelope(resolved.envelope, resolved.origin, options);
-  if (resolved.envelope.version === 2 || resolved.envelope.version === 3 || resolved.envelope.authorizationTarget.kind === "policy") options.onResolvedAddressedEnvelope?.(resolved.envelope, resolved.cid);
-  return { metadata: metadataFor(resolved.envelope, resolved.origin), link: { origin: resolved.origin, cid: resolved.cid, kind: resolved.kind } };
+  const resolved = await resolvePolicyShare(link, options);
+  return { metadata: metadataFor(resolved.envelope, resolved.origin), link: { origin: resolved.origin, cid: resolved.cid, kind: "policy" } };
 }
 async function receiveShare(link, options = {}) {
-  const resolved = await resolveShareEnvelope(link, options);
-  if (resolved.envelope.version === 3) {
-    await verifyV3Envelope(resolved.envelope, resolved.origin, options);
-    options.onResolvedAddressedEnvelope?.(resolved.envelope, resolved.cid);
-    return { state: "authorization-required", method: resolved.envelope.recipientMatcher.kind === "recipientDid" ? "openkey-device" : "email-claim" };
-  }
-  if (resolved.envelope.version === 2) {
-    await verifyV2Envelope(resolved.envelope, resolved.origin, options);
-    options.onResolvedAddressedEnvelope?.(resolved.envelope, resolved.cid);
-    const method = resolved.envelope.recipientMatcher.kind === "recipientDid" ? "openkey-device" : "email-claim";
-    if (options.authorization === void 0) return { state: "authorization-required", method };
-    const result = options.authorizationResumeToken === void 0 ? await options.authorization.begin({ envelope: resolved.envelope, method }) : await options.authorization.resume({ envelope: resolved.envelope, method, resumeToken: options.authorizationResumeToken, ...options.authorizationProof === void 0 ? {} : { proof: options.authorizationProof } });
-    if (result.state === "authorization-required") return result;
-    if (result.state === "denied") throw new ShareReceiveError("authorization-denied", "share authorization was denied");
-    if (result.value === null || typeof result.value !== "object" || !(result.value.bytes instanceof Uint8Array) || result.value.proof === void 0 || options.authorization.verifyResult === void 0) {
-      throw new ShareReceiveError("content-integrity-failed", "share authorization returned an unsigned content result");
-    }
-    const authorized = result.value;
-    try {
-      if (!await options.authorization.verifyResult({ envelope: resolved.envelope, value: authorized, proof: authorized.proof })) throw new Error("node proof");
-    } catch {
-      throw new ShareReceiveError("content-integrity-failed", "node authorization proof is invalid");
-    }
-    const bytes4 = authorized.bytes.slice();
-    const maxBytes = options.maxContentBlobBytes ?? DEFAULT_MAX_CONTENT_BLOB_BYTES;
-    if (bytes4.byteLength > maxBytes) throw new ShareReceiveError("max-bytes-exceeded", "shared content exceeds the configured byte limit");
-    const digestBytes3 = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes4));
-    const bodyDigest = toBase64Url(digestBytes3);
-    if (authorized.bodyDigest !== bodyDigest) throw new ShareReceiveError("content-integrity-failed", "authorized content digest does not match");
-    if (authorized.contentSourceDigest !== resolved.envelope.contentSourceDigest) throw new ShareReceiveError("content-integrity-failed", "authorized content source does not match");
-    const binding = authorized.binding;
-    if (binding.shareId !== resolved.envelope.shareId || binding.delegationCid !== resolved.envelope.delegationCid || binding.authorityMaterialHandle !== resolved.envelope.authorityMaterialHandle || binding.authorityMaterialDigest !== resolved.envelope.authorityMaterialDigest || binding.resource.kind !== resolved.envelope.resource.kind || binding.resource.path !== resolved.envelope.resource.path || binding.action !== void 0 && !resolved.envelope.actions.some((action) => action === binding.action || `tinycloud.kv/${action}` === binding.action)) throw new ShareReceiveError("content-integrity-failed", "authorized content binding does not match");
-    if (resolved.envelope.metadata.byteLength !== void 0 && resolved.envelope.metadata.byteLength !== bytes4.byteLength) {
-      throw new ShareReceiveError("content-integrity-failed", "authorized content length does not match");
-    }
-    let text2;
-    try {
-      text2 = new TextDecoder("utf-8", { fatal: true }).decode(bytes4);
-    } catch {
-    }
-    return { metadata: metadataFor(resolved.envelope, resolved.origin), link: { origin: resolved.origin, cid: resolved.cid, kind: resolved.kind }, bytes: bytes4, ...text2 === void 0 ? {} : { text: text2 } };
-  }
-  if (resolved.envelope.authorizationTarget.kind === "policy") {
-    await verifyV1PolicyEnvelope(resolved.envelope, resolved.origin, options);
-    options.onResolvedAddressedEnvelope?.(resolved.envelope, resolved.cid);
-    return { state: "authorization-required", method: "email-claim" };
-  }
-  await verifyResolved(resolved.envelope, resolved.origin, options);
-  let bytes3 = new Uint8Array();
-  if (resolved.envelope.content !== void 0) {
-    bytes3 = await registryFetcher(
-      options,
-      (options.maxContentBlobBytes ?? DEFAULT_MAX_CONTENT_BLOB_BYTES) + CONTENT_SEALED_OVERHEAD,
-      "max-bytes-exceeded",
-      "content"
-    )({ origin: resolved.origin, cid: resolved.envelope.content.cid });
-    if (await computeCid(bytes3) !== resolved.envelope.content.cid) throw new ShareReceiveError("content-integrity-failed", "shared content CID does not match");
-    const key = fromBase64Url(resolved.envelope.content.key);
-    try {
-      bytes3 = await open(bytes3, key);
-    } catch {
-      throw new ShareReceiveError("content-integrity-failed", "shared content could not be opened");
-    } finally {
-      key.fill(0);
-    }
-    if (bytes3.byteLength > (options.maxContentBlobBytes ?? DEFAULT_MAX_CONTENT_BLOB_BYTES)) {
-      throw new ShareReceiveError("max-bytes-exceeded", "shared content exceeds the configured byte limit");
-    }
-  }
-  let text;
-  if (bytes3.byteLength !== 0) {
-    try {
-      text = new TextDecoder("utf-8", { fatal: true }).decode(bytes3);
-    } catch {
-    }
-  }
-  return { metadata: metadataFor(resolved.envelope, resolved.origin), link: { origin: resolved.origin, cid: resolved.cid, kind: resolved.kind }, bytes: bytes3, ...text === void 0 ? {} : { text } };
+  const resolved = await resolvePolicyShare(link, options);
+  return { state: "authorization-required", method: resolved.envelope.recipientMatcher.kind === "recipientDid" ? "openkey-device" : "email-claim" };
 }
 
 // src/publish.ts
-var import_ed255194 = require("@noble/curves/ed25519");
 var SHARE_CONTENT_LIMIT = 100 * 1024 * 1024;
-var SHARE_SEALED_OVERHEAD = 1 + 12 + 16;
 var SHARE_PUBLISH_RESULT_VERSION = 1;
 var DEFAULT_SHARE_LIFETIME_MS = 7 * 24 * 60 * 60 * 1e3;
 function redactPublishedShare(result) {
   return {
     protocol: "tinycloud-share",
     version: SHARE_PUBLISH_RESULT_VERSION,
-    link: { kind: result.link.kind, cid: result.link.cid },
+    link: { ...result.link },
     metadata: {
       protocol: "tinycloud-share",
       version: 1,
@@ -6515,10 +6100,8 @@ function redactPublishedShare(result) {
       resource: { ...result.metadata.resource },
       actions: [...result.metadata.actions],
       expiresAt: result.metadata.expiresAt,
-      display: { ...result.metadata.display },
-      ...result.metadata.content === void 0 ? {} : { content: { cid: result.metadata.content.cid } }
-    },
-    registryDeleteAfter: result.registryDeleteAfter
+      display: { ...result.metadata.display }
+    }
   };
 }
 var SharePublishError = class extends Error {
@@ -6529,237 +6112,6 @@ var SharePublishError = class extends Error {
     this.code = code3;
   }
 };
-function assertSafeFilename(filename) {
-  if (filename.length === 0 || filename === "." || filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(filename)) {
-    throw new SharePublishError("invalid-argument", "filename must be one safe path segment");
-  }
-}
-function assertOrigin(origin, label) {
-  if (!isCanonicalHttpsOrigin(origin)) {
-    throw new SharePublishError("invalid-argument", `${label} must be a canonical HTTPS origin`);
-  }
-}
-async function snapshotSource(source, limit) {
-  if (!Number.isSafeInteger(limit) || limit <= 0) {
-    throw new SharePublishError("invalid-argument", "maxBytes must be a positive safe integer");
-  }
-  if (source instanceof Uint8Array) {
-    if (source.byteLength > limit) throw new SharePublishError("max-bytes-exceeded", "share content exceeds the configured byte limit");
-    return source.slice();
-  }
-  const chunks = [];
-  let total = 0;
-  try {
-    for await (const chunk of source) {
-      if (!(chunk instanceof Uint8Array)) throw new SharePublishError("invalid-argument", "share source yielded invalid bytes");
-      total += chunk.byteLength;
-      if (total > limit) throw new SharePublishError("max-bytes-exceeded", "share content exceeds the configured byte limit");
-      chunks.push(chunk);
-    }
-  } catch (error) {
-    if (error instanceof SharePublishError) throw error;
-    throw new SharePublishError("upload-failed", "share source could not be read");
-  }
-  const bytes3 = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes3.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return bytes3;
-}
-function assertTarget(target) {
-  if (target.kind !== "bearer") {
-    throw new SharePublishError("unsupported-target", "this release publishes bearer shares only");
-  }
-}
-function assertRegistryUrl(value, allowInsecure) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new SharePublishError("invalid-argument", "registry URL is invalid");
-  }
-  if (url.username || url.password || url.search || url.hash) throw new SharePublishError("invalid-argument", "registry URL must not contain credentials, query, or fragment");
-  if (!allowInsecure && url.protocol !== "https:") throw new SharePublishError("invalid-argument", "production registry uploads require HTTPS");
-  if (url.protocol !== "https:" && url.hostname !== "127.0.0.1" && url.hostname !== "localhost") throw new SharePublishError("invalid-argument", "insecure registry uploads are limited to localhost");
-  return url;
-}
-async function defaultUpload(options, input) {
-  if (options.registryBaseUrl === void 0) throw new SharePublishError("upload-auth-required", "an authenticated share registry is required");
-  const base3 = assertRegistryUrl(options.registryBaseUrl, options.allowInsecureRegistry === true).toString().replace(/\/$/, "");
-  const localInsecure = options.allowInsecureRegistry === true && (new URL(base3).hostname === "127.0.0.1" || new URL(base3).hostname === "localhost");
-  if (options.authorizeUpload === void 0 && !localInsecure) {
-    throw new SharePublishError("upload-auth-required", "share upload authorization is required");
-  }
-  let authorization;
-  if (options.authorizeUpload !== void 0) {
-    try {
-      authorization = await options.authorizeUpload(input);
-    } catch {
-      throw new SharePublishError("upload-auth-required", "share upload authorization was rejected");
-    }
-  }
-  if (authorization !== void 0 && options.authorizationOrigin !== void 0) {
-    let authorizationUrl;
-    try {
-      authorizationUrl = new URL(options.authorizationOrigin);
-    } catch {
-      throw new SharePublishError("invalid-argument", "upload authorization origin is invalid");
-    }
-    if (authorizationUrl.origin !== new URL(base3).origin) throw new SharePublishError("upload-auth-required", "upload authorization is scoped to another origin");
-  }
-  const headers = new Headers({
-    "content-type": "application/vnd.ipld.raw",
-    "if-none-match": "*",
-    "x-delete-after": input.deleteAfter
-  });
-  if (typeof authorization === "string") {
-    headers.set("x-tinycloud-upload-attestation", authorization);
-    try {
-      const attestation = JSON.parse(authorization);
-      if (attestation.retention === void 0) throw new Error("retention");
-      headers.set("x-tinycloud-retention", canonicalize(attestation.retention));
-    } catch {
-      throw new SharePublishError("upload-auth-required", "share upload authorization was rejected");
-    }
-  } else if (authorization !== void 0) {
-    new Headers(authorization).forEach((value, key) => headers.set(key, value));
-  }
-  let response;
-  try {
-    response = await (options.fetchFn ?? globalThis.fetch)(`${base3}/blobs`, {
-      method: "POST",
-      headers,
-      body: input.blob,
-      ...options.credentials === void 0 ? {} : { credentials: options.credentials },
-      redirect: "error",
-      referrerPolicy: "no-referrer"
-    });
-  } catch {
-    throw new SharePublishError("upload-failed", "share registry is unavailable");
-  }
-  if (response.status === 401 || response.status === 403) throw new SharePublishError("upload-auth-required", "share upload authorization was rejected");
-  if (!response.ok) throw new SharePublishError("upload-failed", "share registry rejected the encrypted blob");
-  let body;
-  try {
-    body = await response.json();
-  } catch {
-    throw new SharePublishError("upload-failed", "share registry returned an invalid response");
-  }
-  const record2 = typeof body === "object" && body !== null ? body : {};
-  if (record2.cid !== input.cid || typeof record2.deleteAfter !== "string") throw new SharePublishError("upload-failed", "share registry returned an unexpected CID or retention value");
-  return { cid: input.cid, deleteAfter: record2.deleteAfter };
-}
-async function uploadShareBlob(options, input) {
-  const result = await (options.uploadBlob ?? ((value) => defaultUpload(options, value)))(input);
-  if (result.cid !== input.cid || typeof result.deleteAfter !== "string") throw new SharePublishError("upload-failed", "share uploader returned an invalid result");
-  return result;
-}
-async function publishShare(options) {
-  const target = options.target ?? { kind: "bearer" };
-  assertTarget(target);
-  assertSafeFilename(options.filename);
-  assertOrigin(options.origin, "share origin");
-  if (options.mediaType !== void 0 && options.mediaType.length === 0) throw new SharePublishError("invalid-argument", "mediaType must not be empty");
-  const maxBytes = options.maxBytes ?? SHARE_CONTENT_LIMIT;
-  if (maxBytes > SHARE_CONTENT_LIMIT) throw new SharePublishError("max-bytes-exceeded", "share content exceeds the maximum 100 MiB limit");
-  const content = await snapshotSource(options.source, maxBytes);
-  if (content.byteLength === 0) throw new SharePublishError("invalid-argument", "share content is empty");
-  if (options.allowBinary !== true) {
-    try {
-      new TextDecoder("utf-8", { fatal: true }).decode(content);
-    } catch {
-      throw new SharePublishError("invalid-argument", "Markdown input must be valid UTF-8");
-    }
-  }
-  const nowMs = options.now?.() ?? Date.now();
-  const expiresAt = options.expiresAt ?? new Date(nowMs + DEFAULT_SHARE_LIFETIME_MS);
-  if (!Number.isFinite(expiresAt.getTime()) || expiresAt.getTime() <= nowMs) throw new SharePublishError("invalid-argument", "expiresAt must be a valid future time");
-  const expiry = expiresAt.toISOString();
-  const nodeAudience = options.nodeAudience ?? "did:web:node.tinycloud.xyz";
-  const spaceId = options.spaceId ?? "bearer";
-  const shareId = toBase64Url(globalThis.crypto.getRandomValues(new Uint8Array(16)));
-  const path = `shares/${shareId}/${options.filename}`;
-  const sessionPrivateKey = import_ed255194.ed25519.utils.randomPrivateKey();
-  const senderPrivateKey = import_ed255194.ed25519.utils.randomPrivateKey();
-  let contentKey;
-  let envelopeKey;
-  try {
-    const sessionPublicKey = import_ed255194.ed25519.getPublicKey(sessionPrivateKey);
-    const sessionDid = didKeyFromEd25519PublicKey(sessionPublicKey);
-    const delegation = mintBearerDelegation({
-      issuerPrivateKey: senderPrivateKey,
-      audienceDid: sessionDid,
-      resourceUri: bearerResourceUri(options.origin, spaceId, path),
-      expiresAtSeconds: Math.ceil(expiresAt.getTime() / 1e3)
-    });
-    contentKey = generateKey();
-    const sealedContent = await seal(content, contentKey);
-    const unsigned = {
-      version: 1,
-      shareId,
-      delegation,
-      authorizationTarget: {
-        kind: "bearerKey",
-        sessionJwk: { kty: "OKP", crv: "Ed25519", x: toBase64Url(sessionPublicKey), d: toBase64Url(sessionPrivateKey) }
-      },
-      target: { origin: options.origin, nodeAudience, spaceId, resource: { kind: "exact", path } },
-      display: { filename: options.filename },
-      expiry,
-      content: { cid: sealedContent.cid, key: toBase64Url(contentKey) }
-    };
-    const envelope = signEnvelope(unsigned, senderPrivateKey);
-    envelopeKey = generateKey();
-    const sealedEnvelope = await seal(new TextEncoder().encode(canonicalize(envelope)), envelopeKey);
-    let inlineUrl;
-    if (options.inline === true) {
-      try {
-        inlineUrl = await encodeInlineShareUrl({ origin: options.origin, ciphertext: sealedEnvelope.blob, key32: envelopeKey });
-      } catch (error) {
-        throw new SharePublishError("inline-too-large", error instanceof Error ? error.message : "inline share is too large");
-      }
-    }
-    const contentUpload = await uploadShareBlob(options, { blob: sealedContent.blob, cid: sealedContent.cid, deleteAfter: expiry, contentLength: sealedContent.blob.byteLength });
-    let url;
-    let kind;
-    let retention = contentUpload.deleteAfter;
-    if (options.inline === true) {
-      if (inlineUrl === void 0) throw new SharePublishError("inline-too-large", "inline share is too large");
-      url = inlineUrl;
-      kind = "inline";
-    } else {
-      const envelopeUpload = await uploadShareBlob(options, { blob: sealedEnvelope.blob, cid: sealedEnvelope.cid, deleteAfter: expiry, contentLength: sealedEnvelope.blob.byteLength });
-      url = encodeShareUrl({ origin: options.origin, ciphertextCid: envelopeUpload.cid, key32: envelopeKey });
-      kind = "compact";
-      retention = envelopeUpload.deleteAfter;
-    }
-    const metadata = {
-      protocol: "tinycloud-share",
-      version: 1,
-      shareId,
-      origin: options.origin,
-      target: { kind: "bearer", origin: options.origin, nodeAudience, spaceId },
-      resource: { kind: "exact", path },
-      actions: ["read"],
-      expiresAt: expiry,
-      display: { filename: options.filename },
-      content: { cid: sealedContent.cid }
-    };
-    const result = { protocol: "tinycloud-share", version: SHARE_PUBLISH_RESULT_VERSION, link: { kind, cid: sealedEnvelope.cid }, metadata, registryDeleteAfter: retention };
-    Object.defineProperty(result, "toJSON", {
-      enumerable: false,
-      value: () => redactPublishedShare(result)
-    });
-    Object.defineProperty(result, "url", { enumerable: false, value: url });
-    return result;
-  } finally {
-    sessionPrivateKey.fill(0);
-    senderPrivateKey.fill(0);
-    contentKey?.fill(0);
-    envelopeKey?.fill(0);
-  }
-}
 
 // src/addressed.ts
 async function parseAddressedEnvelope(value) {
@@ -7203,8 +6555,8 @@ function targetAuthorizationMethod(target) {
 }
 async function publishTargetShare(input) {
   const target = normalizeShareTarget(input.target);
-  if (target.kind === "bearer") return publishShare(input);
   if (input.targetAdapter === void 0) {
+    if (target.kind === "bearer") throw new SharePublishError("authority-required", "native bearer publication requires an authenticated TinyCloud node");
     return {
       state: "authorization-required",
       method: targetAuthorizationMethod(target)
@@ -7214,9 +6566,9 @@ async function publishTargetShare(input) {
     const chunks = [];
     let size = 0;
     for await (const chunk of input.source) {
-      if (!(chunk instanceof Uint8Array)) throw new TypeError("addressed publication source yielded invalid bytes");
+      if (!(chunk instanceof Uint8Array)) throw new TypeError("share publication source yielded invalid bytes");
       size += chunk.byteLength;
-      if (size > (input.maxBytes ?? 100 * 1024 * 1024)) throw new TypeError("addressed publication exceeds maxBytes");
+      if (size > (input.maxBytes ?? SHARE_CONTENT_LIMIT)) throw new SharePublishError("max-bytes-exceeded", "share publication exceeds maxBytes");
       chunks.push(chunk.slice());
     }
     const bytes3 = new Uint8Array(size);
@@ -7227,15 +6579,29 @@ async function publishTargetShare(input) {
     }
     return bytes3;
   })();
+  if (source.byteLength === 0) throw new SharePublishError("invalid-argument", "share content is empty");
+  if (!input.filename || input.filename === "." || input.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(input.filename)) {
+    throw new SharePublishError("invalid-argument", "filename must be one safe path segment");
+  }
+  if (target.kind === "bearer" && input.allowBinary !== true) {
+    try {
+      new TextDecoder("utf-8", { fatal: true }).decode(source);
+    } catch {
+      throw new SharePublishError("invalid-argument", "Markdown input must be valid UTF-8");
+    }
+  }
   const files = input.files === void 0 || input.files.length === 0 ? [{ bytes: source }] : input.files;
   const limit = input.maxBytes ?? SHARE_CONTENT_LIMIT;
   let totalBytes = 0;
   for (const file of files) {
     totalBytes += file.bytes.byteLength;
     if (!Number.isSafeInteger(totalBytes) || totalBytes > limit) {
-      throw new SharePublishError("max-bytes-exceeded", "addressed publication exceeds the combined byte limit");
+      throw new SharePublishError("max-bytes-exceeded", "share publication exceeds the combined byte limit");
     }
   }
+  const nowMs = input.now?.() ?? Date.now();
+  const expiresAt = input.expiresAt ?? new Date(nowMs + DEFAULT_SHARE_LIFETIME_MS);
+  if (!Number.isFinite(expiresAt.getTime()) || expiresAt.getTime() <= nowMs) throw new SharePublishError("invalid-argument", "expiresAt must be a valid future time");
   return input.targetAdapter.publish({
     source,
     filename: input.filename,
@@ -7244,18 +6610,8 @@ async function publishTargetShare(input) {
     ...input.resourceKind === void 0 ? {} : { resourceKind: input.resourceKind },
     ...input.actions === void 0 ? {} : { actions: input.actions },
     target,
-    expiresAt: input.expiresAt ?? new Date((input.now?.() ?? Date.now()) + 7 * 24 * 60 * 60 * 1e3),
+    expiresAt,
     origin: input.origin,
-    ...input.inline === void 0 ? {} : { inline: input.inline },
-    upload: {
-      ...input.registryBaseUrl === void 0 ? {} : { registryBaseUrl: input.registryBaseUrl },
-      ...input.fetchFn === void 0 ? {} : { fetchFn: input.fetchFn },
-      ...input.authorizeUpload === void 0 ? {} : { authorizeUpload: input.authorizeUpload },
-      ...input.authorizationOrigin === void 0 ? {} : { authorizationOrigin: input.authorizationOrigin },
-      ...input.credentials === void 0 ? {} : { credentials: input.credentials },
-      ...input.allowInsecureRegistry === void 0 ? {} : { allowInsecureRegistry: input.allowInsecureRegistry },
-      ...input.uploadBlob === void 0 ? {} : { uploadBlob: input.uploadBlob }
-    },
     ...input.notify === void 0 ? {} : { notify: input.notify }
   });
 }
@@ -7347,7 +6703,7 @@ function publicationResult(input) {
     protocol: "tinycloud-share",
     version: SHARE_PUBLISH_RESULT_VERSION,
     url: input.url,
-    link: { kind: input.options.inline === true ? "inline" : "compact", cid: input.envelopeCid },
+    link: { kind: "policy", cid: input.envelopeCid },
     metadata: {
       protocol: "tinycloud-share",
       version: 1,
@@ -7366,8 +6722,7 @@ function publicationResult(input) {
       enforcerDid: input.enforcerDid,
       envelopeCid: input.envelopeCid,
       shareCid: input.envelopeCid
-    },
-    registryDeleteAfter: input.retention
+    }
   };
   Object.defineProperty(result, "toJSON", { enumerable: false, value: () => redactPublishedShare(result) });
   Object.defineProperty(result, "url", { enumerable: false, value: input.url });
@@ -7449,40 +6804,100 @@ async function publishAddressedShare(options) {
   if (envelopeSignature.byteLength !== 64) throw new TypeError("v3 envelope signature must be Ed25519");
   const envelope = { ...unsigned, signature: { signerDid: options.authority.ownerDid, algorithm: "Ed25519", value: toBase64Url(envelopeSignature) } };
   shareEnvelopeV3Schema.parse(envelope);
-  const envelopeKey = generateKey();
-  try {
-    const sealed = await seal(textEncoder.encode(canonicalize(envelope)), envelopeKey);
-    let url;
-    let retention = options.expiresAt.toISOString();
-    if (options.inline === true) url = await encodeInlineShareUrl({ origin: options.shareOrigin, ciphertext: sealed.blob, key32: envelopeKey });
-    else {
-      const uploaded = await uploadShareBlob({ source: new Uint8Array([1]), filename: options.filename, origin: options.shareOrigin, ...options.upload }, { blob: sealed.blob, cid: sealed.cid, deleteAfter: retention, contentLength: sealed.blob.byteLength });
-      retention = uploaded.deleteAfter;
-      url = encodeShareUrl({ origin: options.shareOrigin, ciphertextCid: uploaded.cid, key32: envelopeKey });
-    }
-    await options.publishBinding?.({
-      version: 3,
-      shareCid: sealed.cid,
-      shareId: options.shareId,
-      policyCid: created.policyCid,
-      policyRootCid: policyRoot.cid,
-      enforcementRootCid: enforcementRoot.cid,
-      contentSourceDigestHex
-    });
-    const deliveryMaterial = { envelope, sealedEnvelope: toBase64Url(sealed.blob), envelopeKey: toBase64Url(envelopeKey), shareCid: sealed.cid };
-    options.onDeliveryMaterial?.(deliveryMaterial);
-    return publicationResult({ options, url, envelopeCid: sealed.cid, matcher, policyCid: created.policyCid, policyRootCid: policyRoot.cid, enforcementRootCid: enforcementRoot.cid, enforcerDid: registration.attestedEnforcerBinding.enforcerDid, expiry, retention, deliveryMaterial });
-  } finally {
-    envelopeKey.fill(0);
-  }
+  const envelopeBytes = textEncoder.encode(canonicalize(envelope));
+  const envelopeKeyBytes = generateKey();
+  const sealed = await seal(envelopeBytes, envelopeKeyBytes);
+  const envelopeKey = toBase64Url(envelopeKeyBytes);
+  const url = await encodeSealedInlineShareUrl({
+    origin: options.shareOrigin,
+    ciphertext: sealed.blob,
+    key32: envelopeKeyBytes
+  });
+  const deliveryMaterial = {
+    envelope,
+    shareCid: sealed.cid,
+    sealedEnvelope: toBase64Url(sealed.blob),
+    envelopeKey
+  };
+  options.onDeliveryMaterial?.(deliveryMaterial);
+  return publicationResult({
+    options,
+    url,
+    envelopeCid: sealed.cid,
+    matcher,
+    policyCid: created.policyCid,
+    policyRootCid: policyRoot.cid,
+    enforcementRootCid: enforcementRoot.cid,
+    enforcerDid: registration.attestedEnforcerBinding.enforcerDid,
+    expiry,
+    deliveryMaterial
+  });
 }
 
-// src/policy-authority.ts
-var import_ed255196 = require("@noble/curves/ed25519");
+// src/cache.ts
+var import_sha2563 = require("@noble/hashes/sha256");
+function cacheKey(key) {
+  if (!key.cid || !key.expiresAt) throw new Error("share cache keys require CID and expiry");
+  return `${key.cid}\0${key.expiresAt}`;
+}
+function digest(bytes3) {
+  return (0, import_sha2563.sha256)(bytes3);
+}
+function equalBytes(left, right) {
+  if (left.byteLength !== right.byteLength) return false;
+  return left.every((byte, index) => byte === right[index]);
+}
+var MemoryShareCache = class {
+  constructor(now = () => /* @__PURE__ */ new Date()) {
+    this.now = now;
+  }
+  entries = /* @__PURE__ */ new Map();
+  async get(key, now = /* @__PURE__ */ new Date()) {
+    const mapKey = cacheKey(key);
+    const entry = this.entries.get(mapKey);
+    if (entry === void 0) return void 0;
+    if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest(entry.bytes))) {
+      this.entries.delete(mapKey);
+      return void 0;
+    }
+    return entry.bytes.slice();
+  }
+  async getByCid(cid2, now = /* @__PURE__ */ new Date()) {
+    const entries = [...this.entries.values()].filter((entry) => entry.key.cid === cid2);
+    for (const entry of entries) {
+      if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest(entry.bytes))) {
+        this.entries.delete(cacheKey(entry.key));
+        continue;
+      }
+      return {
+        key: { ...entry.key },
+        bytes: entry.bytes.slice(),
+        digest: entry.digest.slice(),
+        metadata: { ...entry.metadata }
+      };
+    }
+    return void 0;
+  }
+  async set(key, bytes3, metadata) {
+    if (Date.parse(key.expiresAt) <= this.now().getTime()) return;
+    this.entries.set(cacheKey(key), {
+      key: { cid: key.cid, expiresAt: key.expiresAt },
+      bytes: bytes3.slice(),
+      digest: digest(bytes3),
+      metadata: { ...metadata }
+    });
+  }
+  async delete(key) {
+    this.entries.delete(cacheKey(key));
+  }
+  async clear() {
+    this.entries.clear();
+  }
+};
 
 // src/owner-policy.ts
-var import_ed255195 = require("@noble/curves/ed25519");
-var import_sha2563 = require("@noble/hashes/sha256");
+var import_ed255194 = require("@noble/curves/ed25519");
+var import_sha2564 = require("@noble/hashes/sha256");
 
 // ../../node_modules/multiformats/dist/src/bases/base32.js
 var base322 = rfc46482({
@@ -8036,10 +7451,10 @@ function fromB64(value) {
   throw new Error("base64url decoding is unavailable");
 }
 function cid(bytesValue) {
-  return CID2.createV1(code2, create2(SHA256_CODE2, (0, import_sha2563.sha256)(bytesValue))).toString(base322.encoder);
+  return CID2.createV1(code2, create2(SHA256_CODE2, (0, import_sha2564.sha256)(bytesValue))).toString(base322.encoder);
 }
-function digest(bytesValue) {
-  return b64((0, import_sha2563.sha256)(bytesValue));
+function digest2(bytesValue) {
+  return b64((0, import_sha2564.sha256)(bytesValue));
 }
 function didKeyFromEd25519PublicKey2(publicKey) {
   if (publicKey.length !== 32) throw new Error("share key public key must be 32 bytes");
@@ -8113,9 +7528,9 @@ function dagCborEncode(value) {
 }
 function assertObject(value, keys, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
-  const record2 = value;
-  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) throw new Error(`${label} has unknown or missing fields`);
-  return record2;
+  const record = value;
+  if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);
+  return record;
 }
 async function createDelegatedShareKey(options) {
   if (!globalThis.crypto?.subtle) throw new Error("WebCrypto Ed25519 is required for delegated share keys");
@@ -8178,7 +7593,7 @@ async function createPolicyEnforcementDelegation(input) {
 async function canonicalOwnerSharePolicy(policy) {
   const text = canonicalize({ domain: POLICY_DOMAIN, policy });
   const policyBytes = new TextEncoder().encode(text);
-  return { bytes: policyBytes, cid: cid(policyBytes), digest: digest(policyBytes) };
+  return { bytes: policyBytes, cid: cid(policyBytes), digest: digest2(policyBytes) };
 }
 function computeOwnerShareRegistrationCid(registration) {
   return cid(new TextEncoder().encode(canonicalize(registration)));
@@ -8217,7 +7632,7 @@ function validateOwnerSharePolicyRegistration(value, expected) {
   const publicKey = encodedKid.length === 34 ? encodedKid.slice(2) : encodedKid;
   const signatureBytes = fromB64(proof.signature);
   const signedBytes = new TextEncoder().encode(`${OWNER_SHARE_REGISTRATION_DOMAIN}${canonicalize(registrationCore)}`);
-  if (signatureBytes.length !== 64 || !import_ed255195.ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error("owner-share registration proof signature is invalid");
+  if (signatureBytes.length !== 64 || !import_ed255194.ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error("owner-share registration proof signature is invalid");
   return { registration, proof };
 }
 function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
@@ -8230,318 +7645,6 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
   return validateOwnerSharePolicyRegistration(value, expected);
 }
 
-// src/policy-authority.ts
-var ENVELOPE_DOMAIN = "xyz.tinycloud.share/envelope/v2\0";
-function record(value, keys, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
-  const output = value;
-  if (Object.keys(output).length !== keys.length || keys.some((key) => !Object.hasOwn(output, key))) throw new Error(`${label} has unknown or missing fields`);
-  return output;
-}
-function requiredString(value, label) {
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${label} is invalid`);
-  return value;
-}
-function stringArray(value, label) {
-  if (!Array.isArray(value) || value.length === 0 || !value.every((item) => typeof item === "string" && item.length > 0)) throw new Error(`${label} is invalid`);
-  return value;
-}
-function parseEnforcement(value) {
-  const delegation = record(value, ["cid", "dagCbor", "issuerDid", "audienceDid", "facts", "signature"], "policy enforcement delegation");
-  const facts = record(delegation.facts, ["ownerDelegationCid", "policyCid", "shareId", "shareKeyDid", "enforcerDid", "nodeAudience", "spaceId", "path", "actions", "contentSourceDigest", "expiresAt"], "policy enforcement facts");
-  return {
-    cid: requiredString(delegation.cid, "policy enforcement CID"),
-    dagCbor: requiredString(delegation.dagCbor, "policy enforcement bytes"),
-    issuerDid: requiredString(delegation.issuerDid, "policy enforcement issuer"),
-    audienceDid: requiredString(delegation.audienceDid, "policy enforcement audience"),
-    facts: {
-      ownerDelegationCid: requiredString(facts.ownerDelegationCid, "owner delegation CID"),
-      policyCid: requiredString(facts.policyCid, "policy CID"),
-      shareId: requiredString(facts.shareId, "share id"),
-      shareKeyDid: requiredString(facts.shareKeyDid, "share key DID"),
-      enforcerDid: requiredString(facts.enforcerDid, "enforcer DID"),
-      nodeAudience: requiredString(facts.nodeAudience, "node audience"),
-      spaceId: requiredString(facts.spaceId, "space id"),
-      path: requiredString(facts.path, "resource path"),
-      actions: stringArray(facts.actions, "policy actions"),
-      contentSourceDigest: requiredString(facts.contentSourceDigest, "content source digest"),
-      expiresAt: requiredString(facts.expiresAt, "policy expiry")
-    },
-    signature: requiredString(delegation.signature, "policy enforcement signature")
-  };
-}
-async function verifyEnforcement(delegation) {
-  try {
-    const dagCbor = fromBase64Url(delegation.dagCbor);
-    if (await computeCid(dagCbor) !== delegation.cid) return false;
-    const expectedDagCbor = dagCborEncode({
-      domain: POLICY_ENFORCEMENT_DOMAIN,
-      unsigned: {
-        type: "TinyCloudSharePolicyEnforcement",
-        version: 2,
-        issuerDid: delegation.issuerDid,
-        audienceDid: delegation.audienceDid,
-        facts: delegation.facts
-      }
-    });
-    if (expectedDagCbor.length !== dagCbor.length || expectedDagCbor.some((byte, index) => byte !== dagCbor[index])) return false;
-    const signature = fromBase64Url(delegation.signature);
-    return signature.length === 64 && import_ed255196.ed25519.verify(
-      signature,
-      dagCbor,
-      ed25519PublicKeyFromDidKey(delegation.issuerDid),
-      { zip215: false }
-    );
-  } catch {
-    return false;
-  }
-}
-async function verifyOuterEnvelope(value, envelope, policyCid, expectedEnforcerDid, expectedActions) {
-  try {
-    const hasDecryption = typeof value === "object" && value !== null && Object.hasOwn(value, "decryption");
-    const outer = record(value, ["schema", "version", "shareId", "delegationCid", "policyCid", "target", "resource", "actions", ...hasDecryption ? ["decryption"] : [], "contentSource", "contentSourceDigest", "expiresAt", "envelopeCid", "shareCid", "signature"], "outer envelope");
-    const target = record(outer.target, ["origin", "nodeAudience", "enforcerDid", "spaceId"], "outer target");
-    const signature = record(outer.signature, ["signerDid", "algorithm", "value"], "outer envelope signature");
-    const envelopeCid = requiredString(outer.envelopeCid, "outer envelope CID");
-    const shareCid = requiredString(outer.shareCid, "outer share CID");
-    const { signature: _signature, envelopeCid: _envelopeCid, shareCid: _shareCid, ...identity } = outer;
-    if (outer.schema !== "xyz.tinycloud.share/envelope/v2" || outer.version !== 2 || outer.shareId !== envelope.shareId || outer.delegationCid !== envelope.delegationCid || outer.policyCid !== policyCid || target.origin !== envelope.target.origin || target.nodeAudience !== envelope.target.nodeAudience || target.enforcerDid !== expectedEnforcerDid || target.spaceId !== envelope.target.spaceId || canonicalize(outer.resource) !== canonicalize(envelope.resource) || canonicalize(outer.actions) !== canonicalize(expectedActions) || (hasDecryption ? envelope.decryption === void 0 || canonicalize(outer.decryption) !== canonicalize(envelope.decryption) : envelope.decryption !== void 0) || canonicalize(outer.contentSource) !== canonicalize(envelope.contentSource) || outer.contentSourceDigest !== envelope.contentSourceDigest || outer.expiresAt !== envelope.expiry || signature.signerDid !== envelope.signature.signerDid || signature.algorithm !== "Ed25519") return void 0;
-    if (envelopeCid !== await computeCid(new TextEncoder().encode(canonicalize(identity)))) return void 0;
-    if (shareCid !== await computeCid(new TextEncoder().encode(canonicalize({ version: 2, shareId: envelope.shareId, policyCid, envelopeCid })))) return void 0;
-    const unsigned = { ...identity, envelopeCid, shareCid };
-    const signatureBytes = fromBase64Url(requiredString(signature.value, "outer signature"));
-    if (signatureBytes.length !== 64 || !import_ed255196.ed25519.verify(
-      signatureBytes,
-      new TextEncoder().encode(`${ENVELOPE_DOMAIN}${canonicalize(unsigned)}`),
-      ed25519PublicKeyFromDidKey(envelope.signature.signerDid),
-      { zip215: false }
-    )) return void 0;
-    return { envelopeCid, shareCid };
-  } catch {
-    return void 0;
-  }
-}
-function createRegisteredPolicyAuthority(options) {
-  const proofKey = options.nodeProof.publicKey.slice();
-  return {
-    async resolve({ policyCid, envelope }) {
-      try {
-        if (envelope.authorizationTarget.kind !== "policy" || envelope.authorizationTarget.policyCid !== policyCid) return void 0;
-        const ownerAuthority = envelope.ownerAuthority;
-        if (ownerAuthority?.registrationReceipt === void 0) return void 0;
-        const enforcement = parseEnforcement(ownerAuthority.enforcementDelegation);
-        if (!await verifyEnforcement(enforcement)) return void 0;
-        const policyBytes = fromBase64Url(envelope.authorizationTarget.policyBytes);
-        const ownerDelegation = {
-          delegationCid: envelope.delegationCid,
-          signedDagCbor: new Uint8Array(),
-          delegation: {
-            delegateDID: envelope.signature.signerDid,
-            spaceId: envelope.target.spaceId,
-            path: envelope.resource.path,
-            actions: envelope.actions,
-            expiry: new Date(envelope.expiry)
-          }
-        };
-        const receipt = validateOwnerSharePolicyRegistration(ownerAuthority.registrationReceipt, {
-          policy: { bytes: policyBytes, cid: policyCid, proof: "" },
-          ownerDelegation,
-          enforcementDelegation: enforcement,
-          contentSourceDigest: envelope.contentSourceDigest,
-          nodeProof: { kid: options.nodeProof.kid, publicKey: proofKey }
-        });
-        const registration = receipt.registration;
-        const outer = await verifyOuterEnvelope(ownerAuthority.outerEnvelope, envelope, policyCid, options.expectedTarget.enforcerDid, registration.actions);
-        if (outer === void 0 || ownerAuthority.registrationCid !== registration.registrationCid || ownerAuthority.envelopeCid !== outer.envelopeCid || ownerAuthority.shareCid !== outer.shareCid || envelope.authorityMaterialHandle !== registration.registrationCid || envelope.signature.signerDid !== registration.shareKeyDid || registration.target.origin !== options.expectedTarget.origin || registration.target.nodeAudience !== options.expectedTarget.nodeAudience || registration.enforcerDid !== options.expectedTarget.enforcerDid || enforcement.issuerDid !== registration.shareKeyDid || enforcement.audienceDid !== registration.enforcerDid) return void 0;
-        return {
-          policyCid: registration.policyCid,
-          signerDid: registration.shareKeyDid,
-          registrationCid: registration.registrationCid,
-          shareId: registration.shareId,
-          recipientMatcher: registration.recipientMatcher,
-          target: registration.target,
-          resource: registration.resource,
-          actions: registration.actions,
-          contentSource: registration.contentSource,
-          contentSourceDigest: registration.contentSourceDigest,
-          delegationCid: registration.ownerDelegationCid,
-          authorityMaterialHandle: registration.registrationCid,
-          authorityMaterialDigest: envelope.authorityMaterialDigest,
-          expiresAt: registration.expiresAt
-        };
-      } catch {
-        return void 0;
-      }
-    }
-  };
-}
-
-// src/cache.ts
-var import_sha2564 = require("@noble/hashes/sha256");
-function cacheKey(key) {
-  if (!key.cid || !key.expiresAt) throw new Error("share cache keys require CID and expiry");
-  return `${key.cid}\0${key.expiresAt}`;
-}
-function digest2(bytes3) {
-  return (0, import_sha2564.sha256)(bytes3);
-}
-function equalBytes(left, right) {
-  if (left.byteLength !== right.byteLength) return false;
-  return left.every((byte, index) => byte === right[index]);
-}
-var MemoryShareCache = class {
-  constructor(now = () => /* @__PURE__ */ new Date()) {
-    this.now = now;
-  }
-  entries = /* @__PURE__ */ new Map();
-  async get(key, now = /* @__PURE__ */ new Date()) {
-    const mapKey = cacheKey(key);
-    const entry = this.entries.get(mapKey);
-    if (entry === void 0) return void 0;
-    if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest2(entry.bytes))) {
-      this.entries.delete(mapKey);
-      return void 0;
-    }
-    return entry.bytes.slice();
-  }
-  async getByCid(cid2, now = /* @__PURE__ */ new Date()) {
-    const entries = [...this.entries.values()].filter((entry) => entry.key.cid === cid2);
-    for (const entry of entries) {
-      if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest2(entry.bytes))) {
-        this.entries.delete(cacheKey(entry.key));
-        continue;
-      }
-      return {
-        key: { ...entry.key },
-        bytes: entry.bytes.slice(),
-        digest: entry.digest.slice(),
-        metadata: { ...entry.metadata }
-      };
-    }
-    return void 0;
-  }
-  async set(key, bytes3, metadata) {
-    if (Date.parse(key.expiresAt) <= this.now().getTime()) return;
-    this.entries.set(cacheKey(key), {
-      key: { cid: key.cid, expiresAt: key.expiresAt },
-      bytes: bytes3.slice(),
-      digest: digest2(bytes3),
-      metadata: { ...metadata }
-    });
-  }
-  async delete(key) {
-    this.entries.delete(cacheKey(key));
-  }
-  async clear() {
-    this.entries.clear();
-  }
-};
-
-// src/delivery.ts
-var import_ed255197 = require("@noble/curves/ed25519");
-var SHARE_DELIVERY_AUTHORIZATION_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v2\0";
-function isCanonicalHttpsOrigin2(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
-  }
-  return url.protocol === "https:" && url.origin === value && url.pathname === "/" && url.search === "" && url.hash === "" && url.username === "" && url.password === "";
-}
-var AUTHORIZATION_KEYS = [
-  "type",
-  "version",
-  "jti",
-  "shareCid",
-  "shareId",
-  "registrationCid",
-  "delegationCid",
-  "enforcementDelegationCid",
-  "envelopeCid",
-  "policyCid",
-  "nodeAudience",
-  "targetOrigin",
-  "openCredentialsAudience",
-  "holder",
-  "recipientMatcher",
-  "deliveryEmail",
-  "shareUrl",
-  "returnOrigin",
-  "documentName",
-  "senderDid",
-  "senderTrust",
-  "contentSource",
-  "contentSourceDigest",
-  "shareExpiresAt",
-  "issuedAt",
-  "reportAbuseToken",
-  "actions",
-  "resource",
-  "authorityMaterialHandle",
-  "authorityMaterialDigest",
-  "requestBodyDigest",
-  "idempotencyKey",
-  "expiresAt",
-  "dataAuthority"
-];
-function assertObject2(value, keys, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
-  const record2 = value;
-  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) throw new Error(`${label} has unknown or missing fields`);
-  return record2;
-}
-function fromB642(value) {
-  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share delivery value is not canonical base64url");
-  if (typeof atob === "function") {
-    const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
-    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
-  }
-  if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(value, "base64url"));
-  throw new Error("base64url decoding is unavailable");
-}
-function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
-  let value;
-  try {
-    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytesValue));
-  } catch {
-    throw new Error("share delivery authorization response is not valid UTF-8 JSON");
-  }
-  const root = assertObject2(value, ["authorization", "proof"], "share delivery authorization response");
-  const authorization = assertObject2(root.authorization, AUTHORIZATION_KEYS, "share delivery authorization");
-  const proof = assertObject2(root.proof, ["alg", "kid", "signature"], "share delivery authorization proof");
-  const request = expected.request;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.idempotencyKey || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
-    throw new Error("share delivery authorization is not bound to the submitted request");
-  }
-  const now = Date.now();
-  const issuedAt = typeof authorization.issuedAt === "string" ? Date.parse(authorization.issuedAt) : Number.NaN;
-  const expiresAt = typeof authorization.expiresAt === "string" ? Date.parse(authorization.expiresAt) : Number.NaN;
-  if (!Number.isFinite(issuedAt) || issuedAt > now + 6e4 || issuedAt > expiresAt) throw new Error("share delivery authorization issuedAt is invalid");
-  if (!Number.isFinite(expiresAt) || expiresAt <= now) throw new Error("share delivery authorization is expired");
-  if (new Date(expiresAt).toISOString() !== authorization.expiresAt) throw new Error("share delivery authorization expiresAt is non-canonical");
-  if (typeof authorization.openCredentialsAudience !== "string" || !isCanonicalHttpsOrigin2(authorization.openCredentialsAudience) || authorization.openCredentialsAudience !== expected.credentialsAudience || authorization.openCredentialsAudience === authorization.nodeAudience || authorization.openCredentialsAudience === authorization.returnOrigin) {
-    throw new Error("share delivery authorization openCredentialsAudience is missing or untrusted");
-  }
-  if (proof.alg !== "EdDSA" || typeof proof.kid !== "string" || typeof proof.signature !== "string") throw new Error("share delivery authorization proof is invalid");
-  if (proof.kid !== expected.nodeProof.kid) throw new Error("share delivery authorization proof key is not trusted");
-  const encodedKid = expected.nodeProof.publicKey;
-  const publicKey = encodedKid.length === 34 && encodedKid[0] === 237 && encodedKid[1] === 1 ? encodedKid.slice(2) : encodedKid;
-  if (publicKey.length !== 32) throw new Error("share delivery authorization proof key is invalid");
-  const signatureBytes = fromB642(proof.signature);
-  const signedBytes = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_DOMAIN}${canonicalize(authorization)}`);
-  if (signatureBytes.length !== 64 || !import_ed255197.ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
-  return { authorization, proof };
-}
-function shareDeliveryTrustedKid(publicKey) {
-  if (publicKey.length !== 32) throw new Error("share delivery node key must be a raw 32-byte Ed25519 public key");
-  const prefixed = new Uint8Array(34);
-  prefixed.set([237, 1]);
-  prefixed.set(publicKey, 2);
-  const did = `did:key:${base58btc2.encode(prefixed)}`;
-  return `${did}#${did.slice("did:key:".length)}`;
-}
-
 // src/history.ts
 var MemoryEncryptedShareHistoryStorage = class {
   values = [];
@@ -8591,8 +7694,8 @@ function historyRecordForPublishedShare(result, now = /* @__PURE__ */ new Date()
 }
 var MemorySenderShareRecordStorage = class {
   records = /* @__PURE__ */ new Map();
-  async put(record2) {
-    this.records.set(record2.shareId, record2);
+  async put(record) {
+    this.records.set(record.shareId, record);
   }
   async list() {
     return [...this.records.values()];
@@ -8629,7 +7732,7 @@ var SenderShareStore = class {
   async save(receipt, key) {
     const registration = receipt.registration;
     if (registration.shareKeyDid !== key.did) throw new Error("share key does not match the registered receipt");
-    const record2 = {
+    const record = {
       shareId: registration.shareId,
       registrationCid: registration.registrationCid,
       policyCid: registration.policyCid,
@@ -8646,15 +7749,15 @@ var SenderShareStore = class {
       registeredAt: registration.registeredAt,
       expiresAt: registration.expiresAt
     };
-    await this.records.put(record2);
-    await this.keys.put(record2.shareId, { cryptoKey: key.cryptoKey, publicKey: key.publicKey, extractable: key.extractable });
-    return record2;
+    await this.records.put(record);
+    await this.keys.put(record.shareId, { cryptoKey: key.cryptoKey, publicKey: key.publicKey, extractable: key.extractable });
+    return record;
   }
   /** List shares created in any session, most recent first. */
   async list(options) {
     const now = this.now().getTime();
     const records = await this.records.list();
-    return records.filter((record2) => (options?.includeRevoked ?? false) || record2.revokedAt === void 0).filter((record2) => (options?.includeExpired ?? false) || Date.parse(record2.expiresAt) > now).sort((left, right) => Date.parse(right.registeredAt) - Date.parse(left.registeredAt));
+    return records.filter((record) => (options?.includeRevoked ?? false) || record.revokedAt === void 0).filter((record) => (options?.includeExpired ?? false) || Date.parse(record.expiresAt) > now).sort((left, right) => Date.parse(right.registeredAt) - Date.parse(left.registeredAt));
   }
   async get(shareId) {
     return this.records.get(shareId);
@@ -8677,17 +7780,17 @@ var SenderShareStore = class {
    * returned CID, then call {@link markRevoked} once that succeeds.
    */
   async revocationTarget(shareId, scope) {
-    const record2 = await this.records.get(shareId);
-    if (record2 === void 0) throw new Error(`Unknown share: ${shareId}`);
-    const delegationCid = scope === "direct" ? record2.enforcementDelegationCid : record2.ownerDelegationCid;
+    const record = await this.records.get(shareId);
+    if (record === void 0) throw new Error(`Unknown share: ${shareId}`);
+    const delegationCid = scope === "direct" ? record.enforcementDelegationCid : record.ownerDelegationCid;
     if (delegationCid === void 0) throw new Error("share has no node-enforced delegation");
     return delegationCid;
   }
   /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */
   async markRevoked(shareId, revokedAt = this.now().toISOString()) {
-    const record2 = await this.records.get(shareId);
-    if (record2 === void 0) throw new Error(`Unknown share: ${shareId}`);
-    const revoked = { ...record2, revokedAt };
+    const record = await this.records.get(shareId);
+    if (record === void 0) throw new Error(`Unknown share: ${shareId}`);
+    const revoked = { ...record, revokedAt };
     await this.records.put(revoked);
     return revoked;
   }
@@ -8703,9 +7806,9 @@ var EncryptedSenderShareHistory = class {
     this.key = key;
     this.now = now;
   }
-  async put(record2) {
+  async put(record) {
     const iv = crypto.getRandomValues(new Uint8Array(12));
-    const payload = new TextEncoder().encode(JSON.stringify(record2));
+    const payload = new TextEncoder().encode(JSON.stringify(record));
     const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, this.key, payload));
     const encoded = new Uint8Array(iv.length + ciphertext.length);
     encoded.set(iv);
@@ -8738,8 +7841,8 @@ var ShareNotifyError = class extends Error {
     this.name = "ShareNotifyError";
   }
 };
-function recipientMatchesShareRecord(record2, recipient) {
-  const matcher = record2.recipientMatcher;
+function recipientMatchesShareRecord(record, recipient) {
+  const matcher = record.recipientMatcher;
   if (matcher.kind === "bearer" || matcher.kind === "recipientDid") return false;
   if (matcher.kind === "exactEmail") return matcher.value === recipient;
   const at = recipient.lastIndexOf("@");
@@ -8777,60 +7880,180 @@ async function defaultIdempotencyKey(shareId, recipient) {
   return `tinycloud-share:${shareId}:${toBase64Url(digest3)}`;
 }
 
+// src/credential-invitation.ts
+var CredentialInvitationError = class extends Error {
+  constructor(code3, message) {
+    super(message);
+    this.code = code3;
+    this.name = "CredentialInvitationError";
+  }
+};
+function canonicalOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new CredentialInvitationError(
+      "invalid-origin",
+      "credential invitation origin is invalid"
+    );
+  }
+  if (url.origin !== value || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.protocol !== "https:")
+    throw new CredentialInvitationError(
+      "invalid-origin",
+      "credential invitation origin is invalid"
+    );
+  return url.origin;
+}
+function object2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function validateReceipt(receipt, shareUrl) {
+  if (!object2(receipt) || !object2(receipt.request) || !object2(receipt.admission) || !object2(receipt.proof)) {
+    throw new CredentialInvitationError(
+      "invalid-receipt",
+      "credential invitation receipt is invalid"
+    );
+  }
+  if (receipt.request.returnLink !== shareUrl) {
+    throw new CredentialInvitationError(
+      "invalid-receipt",
+      "credential invitation is not bound to the share link"
+    );
+  }
+  let link;
+  try {
+    link = new URL(shareUrl);
+  } catch {
+    throw new CredentialInvitationError(
+      "invalid-receipt",
+      "credential invitation share link is invalid"
+    );
+  }
+  if (link.search !== "" || link.pathname !== "/s/inline") {
+    throw new CredentialInvitationError(
+      "invalid-receipt",
+      "credential invitation share link must be sealed inline"
+    );
+  }
+  try {
+    await parseSealedInlineShareUrl(shareUrl);
+  } catch {
+    throw new CredentialInvitationError(
+      "invalid-receipt",
+      "credential invitation share link is invalid"
+    );
+  }
+}
+async function deliverCredentialInvitation(input) {
+  const credentialsOrigin = canonicalOrigin(input.credentialsOrigin);
+  await validateReceipt(input.receipt, input.shareUrl);
+  const fetchFn = input.fetchFn ?? globalThis.fetch;
+  let response;
+  try {
+    response = await fetchFn(`${credentialsOrigin}/v1/credential-invitations`, {
+      method: "POST",
+      credentials: "omit",
+      redirect: "error",
+      referrerPolicy: "no-referrer",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(input.receipt),
+      ...input.signal === void 0 ? {} : { signal: input.signal }
+    });
+  } catch {
+    throw new CredentialInvitationError(
+      "transport",
+      "credential invitation delivery is unavailable"
+    );
+  }
+  if (response.status !== 202) {
+    throw new CredentialInvitationError(
+      "rejected",
+      "credential invitation delivery was not accepted"
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new CredentialInvitationError(
+      "invalid-response",
+      "credential invitation response is invalid"
+    );
+  }
+  if (!object2(body) || Object.keys(body).length !== 1 || body.status !== "accepted") {
+    throw new CredentialInvitationError(
+      "invalid-response",
+      "credential invitation response is invalid"
+    );
+  }
+  return { status: "accepted" };
+}
+
 // src/lifecycle.ts
-function targetKind2(record2) {
-  if (record2.targetKind !== void 0) return record2.targetKind;
-  return record2.recipientMatcher.kind === "exactEmail" ? "email" : record2.recipientMatcher.kind === "emailDomain" ? "emailDomain" : record2.recipientMatcher.kind === "recipientDid" ? "recipientDid" : "bearer";
+function targetKind2(record) {
+  if (record.targetKind !== void 0) return record.targetKind;
+  return record.recipientMatcher.kind === "exactEmail" ? "email" : record.recipientMatcher.kind === "emailDomain" ? "emailDomain" : record.recipientMatcher.kind === "recipientDid" ? "recipientDid" : "bearer";
+}
+function policyNodeAudience(record) {
+  const envelope = record.deliveryMaterial?.envelope;
+  if (typeof envelope !== "object" || envelope === null || Array.isArray(envelope)) return record.target.nodeAudience;
+  const binding = envelope.attestedEnforcerBinding;
+  if (typeof binding !== "object" || binding === null || Array.isArray(binding)) return record.target.nodeAudience;
+  const nodeAudience = binding.nodeAudience;
+  return typeof nodeAudience === "string" ? nodeAudience : record.target.nodeAudience;
 }
 async function revokeShare(input) {
   const target = targetKind2(input.record);
-  if (target === "bearer") return { state: "retention-only", target, reason: "bearer-capability-cannot-be-revoked" };
   if (input.adapter === void 0) return { state: "unsupported", target, reason: "node revocation authority is required", code: "unsupported-target" };
   const scope = input.scope ?? "direct";
   const delegationCid = scope === "ancestor" ? input.record.ownerDelegationCid : input.record.enforcementDelegationCid;
   if (delegationCid === void 0) return { state: "unsupported", target, reason: "share has no node-enforced delegation receipt", code: "unsupported-target" };
-  await input.adapter.revokeDelegation({ delegationCid, scope });
+  if (target === "bearer") {
+    if (input.adapter.revokeDelegation === void 0) return { state: "unsupported", target, reason: "native delegation revocation authority is required", code: "unsupported-target" };
+    await input.adapter.revokeDelegation({ delegationCid, scope });
+  } else {
+    if (input.record.ownerDid === void 0) return { state: "unsupported", target, reason: "share has no Policy/v3 owner receipt", code: "unsupported-target" };
+    if (input.adapter.revokePolicyRoot === void 0) return { state: "unsupported", target, reason: "Policy/v3 root revocation authority is required", code: "unsupported-target" };
+    await input.adapter.revokePolicyRoot({
+      rootCid: delegationCid,
+      targetRole: scope === "ancestor" ? "policy-authority" : "policy-enforcement",
+      ownerDid: input.record.ownerDid,
+      nodeOrigin: input.record.target.origin,
+      nodeAudience: policyNodeAudience(input.record)
+    });
+  }
   const revokedAt = (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
   if (input.records !== void 0) await input.records.put({ ...input.record, revokedAt });
   return { state: "revoked", target, delegationCid, revokedAt };
 }
-function redactRecord(record2, revealLink, link) {
-  const matcher = record2.recipientMatcher;
-  const revealedLink = revealLink ? link ?? record2.link : void 0;
+function redactRecord(record, revealLink, link) {
+  const matcher = record.recipientMatcher;
+  const revealedLink = revealLink ? link ?? record.link : void 0;
   return {
-    shareId: record2.shareId,
+    shareId: record.shareId,
     target: matcher.kind === "exactEmail" ? "email" : matcher.kind === "emailDomain" ? "email-domain" : matcher.kind === "recipientDid" ? "recipient-did" : "bearer",
     ...matcher.kind === "exactEmail" ? { recipient: matcher.value } : matcher.kind === "emailDomain" ? { recipient: `*@${matcher.value}` } : matcher.kind === "recipientDid" ? { recipient: matcher.value } : {},
-    expiresAt: record2.expiresAt,
-    revoked: record2.revokedAt !== void 0,
+    expiresAt: record.expiresAt,
+    revoked: record.revokedAt !== void 0,
     ...revealedLink === void 0 ? {} : { link: revealedLink }
   };
 }
 async function listShares(storage) {
   const records = await storage.list();
-  return records.map((record2) => redactRecord(record2, false));
+  return records.map((record) => redactRecord(record, false));
 }
 async function showShare(input) {
-  const record2 = await input.storage.get(input.shareId);
-  if (record2 === void 0) throw new Error("share not found");
-  return redactRecord(record2, input.revealLink === true, input.link);
-}
-
-// src/legacy.ts
-function isLegacyShareLink(value) {
-  return value.startsWith("tc1:");
-}
-async function receiveLegacyShare(link, reader) {
-  if (!isLegacyShareLink(link)) throw new Error("legacy link must use tc1:");
-  return reader.read(link);
-}
-async function migrateShare(input) {
-  const value = await receiveLegacyShare(input.link, input.reader);
-  return { protocol: "tinycloud-share", version: 1, legacy: true, value, migrated: await input.publish(value) };
+  const record = await input.storage.get(input.shareId);
+  if (record === void 0) throw new Error("share not found");
+  return redactRecord(record, input.revealLink === true, input.link);
 }
 
 // src/recipient.ts
-var import_ed255198 = require("@noble/curves/ed25519");
+var import_ed255195 = require("@noble/curves/ed25519");
 var import_sha2565 = require("@noble/hashes/sha256");
 
 // src/protocol.ts
@@ -8876,7 +8099,7 @@ var DOMAIN = SHARE_V2_PROTOCOL.challengeDomain;
 var PRESENTATION_DOMAIN = SHARE_V2_PROTOCOL.sessionDomain;
 var SESSION_DOMAIN = SHARE_V2_PROTOCOL.sessionDomain;
 var INVOCATION_DOMAIN = SHARE_V2_PROTOCOL.invocationDomain;
-function object2(value, label) {
+function object3(value, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
   return value;
 }
@@ -8935,11 +8158,11 @@ function nativeAction(action) {
   return action === "list" ? "tinycloud.kv/list" : action === "edit" ? "tinycloud.kv/put" : "tinycloud.kv/get";
 }
 function policyAttenuationForV3(envelope) {
-  const policy = object2(envelope.policy, "v3 policy");
+  const policy = object3(envelope.policy, "v3 policy");
   if (!Array.isArray(policy.capabilityCeiling)) throw new Error("v3 policy capability ceiling is invalid");
   const attenuation = {};
   for (const raw of policy.capabilityCeiling) {
-    const capability = object2(raw, "v3 policy capability");
+    const capability = object3(raw, "v3 policy capability");
     if (typeof capability.resource !== "string" || attenuation[capability.resource] !== void 0) throw new Error("v3 policy capability is invalid");
     if (capability.kind === "encryption") {
       if (capability.action !== "tinycloud.encryption/decrypt") throw new Error("v3 policy capability is invalid");
@@ -8997,8 +8220,8 @@ function verifyV3PolicyAuthorization(input) {
   const factKeys = Object.keys(fact);
   const legacyShape = factKeys.length === POLICY_SESSION_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact);
   const v4Shape = factKeys.length === POLICY_SESSION_FACT_KEYS.length + POLICY_SESSION_V4_AUDIT_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key) || POLICY_SESSION_V4_AUDIT_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact) && POLICY_SESSION_V4_AUDIT_FACT_KEYS.every((key) => key in fact);
-  const binding = object2(input.envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
-  const policy = object2(input.envelope.policy, "v3 policy");
+  const binding = object3(input.envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
+  const policy = object3(input.envelope.policy, "v3 policy");
   const now = Math.floor(Date.now() / 1e3);
   if (!legacyShape && !v4Shape || POLICY_SESSION_DIGEST_FACT_KEYS.some((key) => !LOWER_SHA256_HEX.test(fact[key])) || v4Shape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)) || compact.payload.aud !== input.holderDid || compact.payload.iss.split("#", 1)[0] !== fact.nodeAudience || fact.profile !== "policy-session-ucan/v1" || fact.ownerDid !== policy.ownerDid || fact.policyId !== policy.policyId || fact.policyCid !== input.envelope.policyCid || fact.contentSourceDigestHex !== input.envelope.contentSourceDigestHex || fact.enforcerDid !== binding.enforcerDid || fact.nodeAudience !== binding.nodeAudience || fact.recipientDid !== input.holderDid || fact.policyDelegationCid !== input.envelope.policyRoot.cid || fact.enforcementDelegationCid !== input.envelope.enforcementRoot.cid || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || compact.payload.prf.length !== 2 || compact.payload.prf[0] !== input.envelope.policyRoot.cid || compact.payload.prf[1] !== input.envelope.enforcementRoot.cid || compact.payload.nbf > now || compact.payload.exp <= now || compact.payload.exp - compact.payload.nbf > 60 || canonicalize(compact.payload.att) !== canonicalize(policyAttenuationForV3(input.envelope))) throw new Error("v3 policy delegation signed binding mismatch");
   return compact;
@@ -9006,6 +8229,15 @@ function verifyV3PolicyAuthorization(input) {
 function hex3(value) {
   return [...value].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
+function matchesInitialCiphertextDigest(bytes3, expected) {
+  if (typeof expected !== "string" || !LOWER_SHA256_HEX.test(expected)) return false;
+  const actual = (0, import_sha2565.sha256)(bytes3);
+  let mismatch = 0;
+  for (let index = 0; index < actual.length; index += 1) {
+    mismatch |= actual[index] ^ Number.parseInt(expected.slice(index * 2, index * 2 + 2), 16);
+  }
+  return mismatch === 0;
+}
 function canonicalHashHex(value) {
   return hex3((0, import_sha2565.sha256)(new TextEncoder().encode(canonicalize(value))));
 }
@@ -9032,12 +8264,12 @@ function parseV3InlineEncryptedEnvelope(bytes3, expected) {
     throw new Error("encrypted content envelope is malformed");
   }
   if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("encrypted content envelope is malformed");
-  const record2 = value;
+  const record = value;
   const allowed = ["v", "networkId", "alg", "keyVersion", "encryptedSymmetricKey", "encryptedSymmetricKeyHash", "ciphertext", "metadata"];
-  if (Object.keys(record2).some((key) => !allowed.includes(key)) || record2.v !== 1 || record2.networkId !== expected.encryptionNetwork || record2.alg !== "x25519-aes256gcm/v1" || record2.keyVersion !== expected.contentSource.keyVersion || typeof record2.encryptedSymmetricKey !== "string" || typeof record2.encryptedSymmetricKeyHash !== "string" || record2.encryptedSymmetricKeyHash !== expected.contentSource.encryptedSymmetricKeyDigestHex || record2.encryptedSymmetricKeyHash !== canonicalHashHex(record2.encryptedSymmetricKey) || typeof record2.ciphertext !== "string" || record2.metadata !== void 0 && (record2.metadata === null || typeof record2.metadata !== "object" || Array.isArray(record2.metadata) || Object.values(record2.metadata).some((entry) => typeof entry !== "string"))) {
+  if (Object.keys(record).some((key) => !allowed.includes(key)) || record.v !== 1 || record.networkId !== expected.encryptionNetwork || record.alg !== "x25519-aes256gcm/v1" || record.keyVersion !== expected.contentSource.keyVersion || typeof record.encryptedSymmetricKey !== "string" || typeof record.encryptedSymmetricKeyHash !== "string" || record.encryptedSymmetricKeyHash !== expected.contentSource.encryptedSymmetricKeyDigestHex || record.encryptedSymmetricKeyHash !== canonicalHashHex(record.encryptedSymmetricKey) || typeof record.ciphertext !== "string" || record.metadata !== void 0 && (record.metadata === null || typeof record.metadata !== "object" || Array.isArray(record.metadata) || Object.values(record.metadata).some((entry) => typeof entry !== "string"))) {
     throw new Error("encrypted content envelope binding is invalid");
   }
-  return record2;
+  return record;
 }
 var ShareRecipientClient = class {
   constructor(options) {
@@ -9080,7 +8312,7 @@ var ShareRecipientClient = class {
     if (this.session === void 0) await this.establish(envelope);
     const response = await this.nativeInvoke({ action: "get", resource: envelope.resource });
     if (!response.ok) throw new Error("share recipient read was rejected");
-    const value = object2(await response.json(), "share read response");
+    const value = object3(await response.json(), "share read response");
     const expectedAction = nativeAction("read");
     if (value.type !== "TinyCloudShareInvokeResponse" || value.version !== 2 || value.action !== expectedAction || value.resource !== envelope.resource.path || typeof value.content !== "string" || typeof value.bodyDigest !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.bodyDigest) || !Object.hasOwn(value, "proof")) throw new Error("share read response is invalid");
     const content = fromBase64Url(value.content);
@@ -9095,7 +8327,7 @@ var ShareRecipientClient = class {
   }
   async establishV3(envelope) {
     if (this.options.buildPresentation === void 0) throw new Error("share presentation builder is required");
-    const attestedEnforcer = object2(envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
+    const attestedEnforcer = object3(envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
     if (attestedEnforcer.enforcerDid !== envelope.target.nodeAudience || typeof attestedEnforcer.nodeAudience !== "string") throw new Error("v3 attested enforcer binding mismatch");
     try {
       ed25519PublicKeyFromDidKey(attestedEnforcer.nodeAudience);
@@ -9110,7 +8342,7 @@ var ShareRecipientClient = class {
       ...this.options.signal === void 0 ? {} : { signal: this.options.signal }
     });
     if (!challengeResponse.ok) throw new Error(`v3 policy challenge rejected (${challengeResponse.status})`);
-    const challenge = object2(await challengeResponse.json(), "v3 policy challenge");
+    const challenge = object3(await challengeResponse.json(), "v3 policy challenge");
     if (typeof challenge.challengeId !== "string" || typeof challenge.nonce !== "string" || challenge.policyCid !== envelope.policyCid || challenge.recipientDid !== this.options.holderDid || challenge.nodeAudience !== attestedEnforcer.nodeAudience || challenge.enforcerDid !== void 0 && challenge.enforcerDid !== attestedEnforcer.enforcerDid || typeof challenge.expiresAt !== "string" || !Number.isFinite(Date.parse(challenge.expiresAt)) || Date.parse(challenge.expiresAt) <= Date.now()) throw new Error("v3 policy challenge binding mismatch");
     const material = await this.options.buildPresentation({
       challenge,
@@ -9131,7 +8363,7 @@ var ShareRecipientClient = class {
       ...this.options.signal === void 0 ? {} : { signal: this.options.signal }
     });
     if (!delegationResponse.ok) throw new Error(`v3 policy delegation rejected (${delegationResponse.status})`);
-    const delegation = object2(await delegationResponse.json(), "v3 policy delegation");
+    const delegation = object3(await delegationResponse.json(), "v3 policy delegation");
     if (delegation.admitted !== true || typeof delegation.sessionCid !== "string" || typeof delegation.authorization !== "string") throw new Error("v3 policy delegation response is not admitted");
     const compact = verifyV3PolicyAuthorization({ authorization: delegation.authorization, cid: delegation.sessionCid, envelope, holderDid: this.options.holderDid });
     const fact = compact.payload.fct[0];
@@ -9149,9 +8381,10 @@ var ShareRecipientClient = class {
     const envelope = this.options.envelope;
     const signer = this.nativeSigner ?? this.signer;
     if (envelope.version !== 3 || this.session === void 0 || this.v3Authorization === void 0 || this.v3NodeAudience === void 0 || signer === void 0) throw new Error("v3 policy session signer is required");
+    if (!matchesInitialCiphertextDigest(bytes3, envelope.contentSource.initialCiphertextDigestHex)) throw new Error("v3 owner KV ciphertext digest mismatch");
     const encrypted = parseV3InlineEncryptedEnvelope(bytes3, envelope);
     const receiverPrivateKey = crypto.getRandomValues(new Uint8Array(32));
-    const receiverPublicKey = toBase64(import_ed255198.x25519.getPublicKey(receiverPrivateKey));
+    const receiverPublicKey = toBase64(import_ed255195.x25519.getPublicKey(receiverPrivateKey));
     const receiverPublicKeyHash = canonicalHashHex(receiverPublicKey);
     const body = { type: "tinycloud.encryption.decrypt/v1", targetNode: this.v3NodeAudience, networkId: encrypted.networkId, alg: encrypted.alg, keyVersion: encrypted.keyVersion, encryptedSymmetricKey: encrypted.encryptedSymmetricKey, encryptedSymmetricKeyHash: encrypted.encryptedSymmetricKeyHash, receiverPublicKey, receiverPublicKeyHash };
     const bodyHash = hex3((0, import_sha2565.sha256)(new TextEncoder().encode(canonicalize(body))));
@@ -9172,16 +8405,16 @@ var ShareRecipientClient = class {
       this.options.onStage?.("decryption");
       const response = await this.fetchFn(new URL("/invoke", this.options.nodeOrigin), { method: "POST", redirect: "error", headers: { accept: "application/json", "content-type": "application/json", Authorization: invocation.authorization }, body: JSON.stringify(body), ...this.options.signal === void 0 ? {} : { signal: this.options.signal } });
       if (!response.ok) throw new Error(`v3 decrypt invocation rejected (${response.status})`);
-      const value = object2(await response.json(), "v3 decrypt response");
+      const value = object3(await response.json(), "v3 decrypt response");
       const allowed = ["type", "targetNode", "networkId", "invocationCid", "encryptedSymmetricKeyHash", "receiverPublicKeyHash", "wrappedKey", "alg", "keyVersion", "requestHash", "nodeId", "nodeSignature"];
       if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key)) || value.type !== "tinycloud.encryption.decrypt-result/v1" || value.targetNode !== body.targetNode || value.nodeId !== body.targetNode || value.networkId !== body.networkId || value.invocationCid !== invocation.cid || value.encryptedSymmetricKeyHash !== body.encryptedSymmetricKeyHash || value.receiverPublicKeyHash !== receiverPublicKeyHash || value.alg !== body.alg || value.keyVersion !== body.keyVersion || value.requestHash !== hex3((0, import_sha2565.sha256)(new TextEncoder().encode(`${invocation.cid}${bodyHash}`))) || typeof value.wrappedKey !== "string" || typeof value.nodeSignature !== "string") throw new Error("v3 decrypt response binding is invalid");
       const unsigned = { ...value };
       delete unsigned.nodeSignature;
       const signature = fromBase64(value.nodeSignature, "v3 decrypt response signature");
-      if (signature.length !== 64 || !import_ed255198.ed25519.verify(signature, new TextEncoder().encode(canonicalize(unsigned)), ed25519PublicKeyFromDidKey(body.targetNode), { zip215: false })) throw new Error("v3 decrypt response signature is invalid");
+      if (signature.length !== 64 || !import_ed255195.ed25519.verify(signature, new TextEncoder().encode(canonicalize(unsigned)), ed25519PublicKeyFromDidKey(body.targetNode), { zip215: false })) throw new Error("v3 decrypt response signature is invalid");
       const wrapped = fromBase64(value.wrappedKey, "v3 wrapped content key");
       if (wrapped.length < 61 || wrapped[32] !== 1) throw new Error("v3 wrapped content key is malformed");
-      const shared = import_ed255198.x25519.getSharedSecret(receiverPrivateKey, wrapped.slice(0, 32));
+      const shared = import_ed255195.x25519.getSharedSecret(receiverPrivateKey, wrapped.slice(0, 32));
       const symmetricKey = await aesGcmDecrypt(shared, wrapped.slice(33));
       shared.fill(0);
       if (symmetricKey.length !== 32) throw new Error("v3 content key is malformed");
@@ -9260,15 +8493,15 @@ function createAddressedAuthorization(input) {
     },
     async verifyResult({ envelope, value, proof }) {
       try {
-        const wrapper = object2(proof, "share read proof");
-        const response = object2(wrapper.response, "share read response proof");
+        const wrapper = object3(proof, "share read proof");
+        const response = object3(wrapper.response, "share read response proof");
         const envelopeAction = nativeAction("read");
         if (response.type !== "TinyCloudShareInvokeResponse" || response.version !== 2 || response.action !== envelopeAction || response.resource !== envelope.resource.path || typeof response.bodyDigest !== "string" || response.bodyDigest !== value.bodyDigest || response.bodyDigest !== await digestBytes2(value.bytes)) return false;
-        const detached = object2(wrapper.detached, "share read detached proof");
-        if (detached.alg !== "EdDSA" || detached.kid !== input.trustedNode.invitationKid) return false;
+        const detached = object3(wrapper.detached, "share read detached proof");
+        if (input.trustedNode === void 0 || detached.alg !== "EdDSA" || detached.kid !== input.trustedNode.invitationKid) return false;
         const unsigned = { ...response };
         delete unsigned.proof;
-        return import_ed255198.ed25519.verify(bytes2(detached.signature, "share read signature"), new TextEncoder().encode(`${SHARE_V2_PROTOCOL.readResponseDomain}${canonicalize(unsigned)}`), trustedPublicKey(input.trustedNode));
+        return import_ed255195.ed25519.verify(bytes2(detached.signature, "share read signature"), new TextEncoder().encode(`${SHARE_V2_PROTOCOL.readResponseDomain}${canonicalize(unsigned)}`), trustedPublicKey(input.trustedNode));
       } catch {
         return false;
       }
@@ -9300,8 +8533,40 @@ async function claimShare(input) {
 async function resumeShareAuthorization(input) {
   return authorizeShare(input);
 }
+
+// src/native.ts
+var NATIVE_SHARE_FRAGMENT_PARAMETER = "tc1";
+function canonicalViewerUrl(viewerOrigin) {
+  const url = new URL(viewerOrigin);
+  if (url.protocol !== "https:" || url.origin !== viewerOrigin || url.pathname !== "/" || url.search || url.hash) throw new TypeError("viewer origin must be a canonical HTTPS origin");
+  url.pathname = "/viewer";
+  return url;
+}
+async function createNativeShare(sharing, input) {
+  if (!input.path || input.path.startsWith("/") || input.path.endsWith("/") || input.path.includes("..") || input.path.includes("//")) throw new TypeError("native share path must be one canonical TinyCloud KV key");
+  const generated = await sharing.generate({ path: input.path, actions: ["tinycloud.kv/get"], expiry: input.expiresAt });
+  if (generated.ok !== true) throw new Error(typeof generated.error?.message === "string" ? generated.error.message : "TinyCloud sharing service rejected delegation generation");
+  if (typeof generated.data?.token !== "string" || typeof generated.data.delegation?.cid !== "string" || !(generated.data.expiresAt instanceof Date)) throw new Error("TinyCloud sharing service returned incomplete delegation metadata");
+  const delegation = sharing.decodeLink(generated.data.token);
+  if (typeof delegation.spaceId !== "string" || delegation.spaceId.length === 0 || typeof delegation.path !== "string" || delegation.path.length === 0) throw new Error("TinyCloud sharing service returned a non-canonical delegation authority");
+  const url = canonicalViewerUrl(input.viewerOrigin);
+  url.hash = `${NATIVE_SHARE_FRAGMENT_PARAMETER}=${encodeURIComponent(generated.data.token)}`;
+  return { url: url.toString(), delegationCid: generated.data.delegation.cid, expiresAt: generated.data.expiresAt, spaceId: delegation.spaceId };
+}
+function parseNativeShareUrl(value) {
+  const url = new URL(value);
+  if (url.search || url.pathname !== "/viewer") throw new TypeError("native shares must carry tc1 only in the /viewer URL fragment");
+  const fragment = new URLSearchParams(url.hash.slice(1));
+  const token = fragment.get(NATIVE_SHARE_FRAGMENT_PARAMETER);
+  if (!token || fragment.size !== 1) throw new TypeError("missing native share fragment");
+  return token;
+}
+async function openNativeShare(sharing, link) {
+  return sharing.receive(parseNativeShareUrl(link), { autoSubdelegate: false, useSessionKey: false });
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  CredentialInvitationError,
   DEFAULT_MAX_CONTENT_BLOB_BYTES,
   DEFAULT_MAX_SEALED_BLOB_BYTES,
   DEFAULT_SHARE_LIFETIME_MS,
@@ -9311,12 +8576,11 @@ async function resumeShareAuthorization(input) {
   MemorySenderShareKeyStorage,
   MemorySenderShareRecordStorage,
   MemoryShareCache,
+  NATIVE_SHARE_FRAGMENT_PARAMETER,
   OWNER_SHARE_REGISTRATION_DOMAIN,
   SHARE_CONTENT_LIMIT,
-  SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
   SHARE_PUBLISH_RESULT_VERSION,
   SHARE_RESULT_VERSION,
-  SHARE_SEALED_OVERHEAD,
   SHARE_V2_PROTOCOL,
   SenderShareStore,
   ShareNotifyError,
@@ -9332,23 +8596,22 @@ async function resumeShareAuthorization(input) {
   computeOwnerShareRegistrationCid,
   createAddressedAuthorization,
   createDelegatedShareKey,
+  createNativeShare,
   createPolicyEnforcementDelegation,
-  createRegisteredPolicyAuthority,
   createShareV2HolderBindingArtifact,
+  deliverCredentialInvitation,
   fromBase64Url,
   historyRecordForPublishedShare,
   inspectShare,
-  isLegacyShareLink,
   listShares,
-  migrateShare,
   normalizeShareTarget,
   notifyShare,
+  openNativeShare,
   parseAddressedEnvelope,
+  parseNativeShareUrl,
   publishAddressedShare,
   publishPolicyShare,
-  publishShare,
   publishTargetShare,
-  receiveLegacyShare,
   receiveShare,
   recipientMatchesShareRecord,
   redactPublishedShare,
@@ -9357,14 +8620,11 @@ async function resumeShareAuthorization(input) {
   restoreDelegatedShareKey,
   resumeShareAuthorization,
   revokeShare,
-  shareDeliveryTrustedKid,
   showShare,
   targetAuthorizationMethod,
   toBase64Url,
   toShareErrorInfo,
   validateOwnerSharePolicyRegistration,
-  validateOwnerSharePolicyRegistrationBytes,
-  validateShareDeliveryAuthorizationBytes,
-  verifyBearerEnvelope
+  validateOwnerSharePolicyRegistrationBytes
 });
 //# sourceMappingURL=index.cjs.map