@tinycloud/share-sdk 1.0.0 → 1.1.0-beta.1

package/dist/index.d.cts

@@ -707,6 +707,8 @@ interface SenderShareRecord {
     readonly filename?: string;
     /** Policy/v3 delivery material. The containing history record must remain encrypted at rest. */
     readonly deliveryMaterial?: PublishedShareDeliveryMaterial;
+    /** Canonical mailboxes whose invitation delivery was confirmed; history is encrypted at rest. */
+    readonly deliveredRecipients?: readonly string[];
 }
 /** Create the durable encrypted-history shape from canonical publication receipts. */
 declare function historyRecordForPublishedShare(result: PublishedShare, now?: Date): SenderShareRecord;
@@ -720,6 +722,9 @@ declare function historyRecordForPublishedShare(result: PublishedShare, now?: Da
 type SenderShareRevocationScope = "direct" | "ancestor";
 interface SenderShareRecordStorage {
     put(record: SenderShareRecord): Promise<void>;
+    /** Atomically transform the latest record, if present. Implementations that
+     * provide this must serialize the read and write with every other writer. */
+    update?(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
     list(): Promise<readonly SenderShareRecord[]>;
     get(shareId: string): Promise<SenderShareRecord | undefined>;
     delete(shareId: string): Promise<void>;
@@ -737,7 +742,10 @@ interface SenderShareKeyStorage {
 /** In-memory reference implementation. Real deployments back these with IndexedDB so the non-extractable `CryptoKey` survives a reload via structured clone. */
 declare class MemorySenderShareRecordStorage implements SenderShareRecordStorage {
     private readonly records;
+    private operation;
+    private serialize;
     put(record: SenderShareRecord): Promise<void>;
+    update(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
     list(): Promise<readonly SenderShareRecord[]>;
     get(shareId: string): Promise<SenderShareRecord | undefined>;
     delete(shareId: string): Promise<void>;
@@ -809,6 +817,7 @@ interface ShareNotifyResult {
     readonly idempotencyKey: string;
     readonly attempts: number;
     readonly retryable?: boolean;
+    readonly reason?: "delivery-window-expired";
 }
 interface ShareNotifyInput {
     readonly shareId: string;
@@ -822,8 +831,9 @@ interface ShareDeliveryAdapter {
     deliver(input: ShareNotifyInput): Promise<"delivered" | "already-delivered">;
 }
 declare class ShareNotifyError extends Error {
+    readonly reason?: "delivery-window-expired" | undefined;
     readonly code: "delivery-failed";
-    constructor(message?: string);
+    constructor(message?: string, reason?: "delivery-window-expired" | undefined);
 }
 /**
  * Match a delivery address against the recipient constraint recorded when the
@@ -831,6 +841,8 @@ declare class ShareNotifyError extends Error {
  * the only form the credential issuer accepts.
  */
 declare function recipientMatchesShareRecord(record: SenderShareRecord, recipient: string): boolean;
+/** The sender can authorize a fresh invitation only until this persisted deadline. */
+declare function shareDeliveryWindowExpiresAt(record: SenderShareRecord): number;
 /**
  * Delivery is deliberately separate from publication. A failed notification
  * never causes a second envelope or link to be minted.
@@ -843,6 +855,8 @@ declare function notifyShare(input: {
     readonly idempotencyKey?: string;
     readonly maxAttempts?: number;
     readonly signal?: AbortSignal;
+    /** Check the persisted delivery window locally before calling the adapter. */
+    readonly checkDeliveryWindow?: boolean;
 }): Promise<ShareNotifyResult>;
 
 /** The signed, app-neutral receipt accepted by OpenCredentials' invitation endpoint. */
@@ -1133,4 +1147,4 @@ declare function parseNativeShareUrl(value: string): string;
 /** Receive through the public SDK without creating another transport protocol. */
 declare function openNativeShare(sharing: NativeSharingService, link: string): Promise<unknown>;
 
-export { type AddressedOwnerRootInput, type AddressedOwnerRootReceipt, type AddressedPolicyRegistrationInput, type AddressedPolicyRegistrationReceipt, type AddressedPublishAuthority, type AddressedSharePublishOptions, type AddressedShareRequest, type CreateOwnerDelegationParams, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DEFAULT_SHARE_LIFETIME_MS, type DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, MAX_CONTENT_BYTES, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, OWNER_SHARE_REGISTRATION_DOMAIN, type OwnerDelegationPermission, type OwnerDelegationReceipt, type OwnerShareAction, type OwnerShareDecryption, type OwnerShareMatcher, type OwnerSharePolicyRegistration, type OwnerSharePolicyRegistrationReceipt, type OwnerSharePolicyV2, type ParsedAddressedEnvelope, type PreparedAddressedShare, type PublishedShare, type PublishedShareDeliveryMaterial, type PublishedShareMetadata, type RegisterOwnerSharePolicyParams, SHARE_CONTENT_LIMIT, SHARE_PUBLISH_RESULT_VERSION, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, type ShareAuthorizationAdapter, type ShareAuthorizationDenied, type ShareAuthorizationMethod, type ShareAuthorizationReady, type ShareAuthorizationRequired, type ShareAuthorizationResult, type ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, SharePublishError, type SharePublishErrorCode, type SharePublishOptions, type SharePublishTarget, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, type ShareTarget, type SignedDelegation, type TargetPublishAdapter, type TargetPublishInput, type TargetPublishOutcome, addressedCredentialRequirement, authorizationMethodForTarget, authorizeShare, canonicalOwnerSharePolicy, canonicalShareFilename, claimShare, computeOwnerShareRegistrationCid, createAddressedAuthorization, createDelegatedShareKey, createNativeShare, createPolicyEnforcementDelegation, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, historyRecordForPublishedShare, inspectShare, listShares, normalizeShareTarget, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, prepareAddressedShare, publishAddressedShare, publishPolicyShare, publishTargetShare, receiveShare, recipientMatchesShareRecord, redactPublishedShare, restoreDelegatedShareKey, resumeShareAuthorization, revokeShare, showShare, targetAuthorizationMethod, toShareErrorInfo, validateOwnerSharePolicyRegistration, validateOwnerSharePolicyRegistrationBytes };
+export { type AddressedOwnerRootInput, type AddressedOwnerRootReceipt, type AddressedPolicyRegistrationInput, type AddressedPolicyRegistrationReceipt, type AddressedPublishAuthority, type AddressedSharePublishOptions, type AddressedShareRequest, type CreateOwnerDelegationParams, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DEFAULT_SHARE_LIFETIME_MS, type DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, MAX_CONTENT_BYTES, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, OWNER_SHARE_REGISTRATION_DOMAIN, type OwnerDelegationPermission, type OwnerDelegationReceipt, type OwnerShareAction, type OwnerShareDecryption, type OwnerShareMatcher, type OwnerSharePolicyRegistration, type OwnerSharePolicyRegistrationReceipt, type OwnerSharePolicyV2, type ParsedAddressedEnvelope, type PreparedAddressedShare, type PublishedShare, type PublishedShareDeliveryMaterial, type PublishedShareMetadata, type RegisterOwnerSharePolicyParams, SHARE_CONTENT_LIMIT, SHARE_PUBLISH_RESULT_VERSION, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, type ShareAuthorizationAdapter, type ShareAuthorizationDenied, type ShareAuthorizationMethod, type ShareAuthorizationReady, type ShareAuthorizationRequired, type ShareAuthorizationResult, type ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, SharePublishError, type SharePublishErrorCode, type SharePublishOptions, type SharePublishTarget, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, type ShareTarget, type SignedDelegation, type TargetPublishAdapter, type TargetPublishInput, type TargetPublishOutcome, addressedCredentialRequirement, authorizationMethodForTarget, authorizeShare, canonicalOwnerSharePolicy, canonicalShareFilename, claimShare, computeOwnerShareRegistrationCid, createAddressedAuthorization, createDelegatedShareKey, createNativeShare, createPolicyEnforcementDelegation, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, historyRecordForPublishedShare, inspectShare, listShares, normalizeShareTarget, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, prepareAddressedShare, publishAddressedShare, publishPolicyShare, publishTargetShare, receiveShare, recipientMatchesShareRecord, redactPublishedShare, restoreDelegatedShareKey, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, targetAuthorizationMethod, toShareErrorInfo, validateOwnerSharePolicyRegistration, validateOwnerSharePolicyRegistrationBytes };

package/dist/index.d.ts

@@ -707,6 +707,8 @@ interface SenderShareRecord {
     readonly filename?: string;
     /** Policy/v3 delivery material. The containing history record must remain encrypted at rest. */
     readonly deliveryMaterial?: PublishedShareDeliveryMaterial;
+    /** Canonical mailboxes whose invitation delivery was confirmed; history is encrypted at rest. */
+    readonly deliveredRecipients?: readonly string[];
 }
 /** Create the durable encrypted-history shape from canonical publication receipts. */
 declare function historyRecordForPublishedShare(result: PublishedShare, now?: Date): SenderShareRecord;
@@ -720,6 +722,9 @@ declare function historyRecordForPublishedShare(result: PublishedShare, now?: Da
 type SenderShareRevocationScope = "direct" | "ancestor";
 interface SenderShareRecordStorage {
     put(record: SenderShareRecord): Promise<void>;
+    /** Atomically transform the latest record, if present. Implementations that
+     * provide this must serialize the read and write with every other writer. */
+    update?(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
     list(): Promise<readonly SenderShareRecord[]>;
     get(shareId: string): Promise<SenderShareRecord | undefined>;
     delete(shareId: string): Promise<void>;
@@ -737,7 +742,10 @@ interface SenderShareKeyStorage {
 /** In-memory reference implementation. Real deployments back these with IndexedDB so the non-extractable `CryptoKey` survives a reload via structured clone. */
 declare class MemorySenderShareRecordStorage implements SenderShareRecordStorage {
     private readonly records;
+    private operation;
+    private serialize;
     put(record: SenderShareRecord): Promise<void>;
+    update(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
     list(): Promise<readonly SenderShareRecord[]>;
     get(shareId: string): Promise<SenderShareRecord | undefined>;
     delete(shareId: string): Promise<void>;
@@ -809,6 +817,7 @@ interface ShareNotifyResult {
     readonly idempotencyKey: string;
     readonly attempts: number;
     readonly retryable?: boolean;
+    readonly reason?: "delivery-window-expired";
 }
 interface ShareNotifyInput {
     readonly shareId: string;
@@ -822,8 +831,9 @@ interface ShareDeliveryAdapter {
     deliver(input: ShareNotifyInput): Promise<"delivered" | "already-delivered">;
 }
 declare class ShareNotifyError extends Error {
+    readonly reason?: "delivery-window-expired" | undefined;
     readonly code: "delivery-failed";
-    constructor(message?: string);
+    constructor(message?: string, reason?: "delivery-window-expired" | undefined);
 }
 /**
  * Match a delivery address against the recipient constraint recorded when the
@@ -831,6 +841,8 @@ declare class ShareNotifyError extends Error {
  * the only form the credential issuer accepts.
  */
 declare function recipientMatchesShareRecord(record: SenderShareRecord, recipient: string): boolean;
+/** The sender can authorize a fresh invitation only until this persisted deadline. */
+declare function shareDeliveryWindowExpiresAt(record: SenderShareRecord): number;
 /**
  * Delivery is deliberately separate from publication. A failed notification
  * never causes a second envelope or link to be minted.
@@ -843,6 +855,8 @@ declare function notifyShare(input: {
     readonly idempotencyKey?: string;
     readonly maxAttempts?: number;
     readonly signal?: AbortSignal;
+    /** Check the persisted delivery window locally before calling the adapter. */
+    readonly checkDeliveryWindow?: boolean;
 }): Promise<ShareNotifyResult>;
 
 /** The signed, app-neutral receipt accepted by OpenCredentials' invitation endpoint. */
@@ -1133,4 +1147,4 @@ declare function parseNativeShareUrl(value: string): string;
 /** Receive through the public SDK without creating another transport protocol. */
 declare function openNativeShare(sharing: NativeSharingService, link: string): Promise<unknown>;
 
-export { type AddressedOwnerRootInput, type AddressedOwnerRootReceipt, type AddressedPolicyRegistrationInput, type AddressedPolicyRegistrationReceipt, type AddressedPublishAuthority, type AddressedSharePublishOptions, type AddressedShareRequest, type CreateOwnerDelegationParams, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DEFAULT_SHARE_LIFETIME_MS, type DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, MAX_CONTENT_BYTES, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, OWNER_SHARE_REGISTRATION_DOMAIN, type OwnerDelegationPermission, type OwnerDelegationReceipt, type OwnerShareAction, type OwnerShareDecryption, type OwnerShareMatcher, type OwnerSharePolicyRegistration, type OwnerSharePolicyRegistrationReceipt, type OwnerSharePolicyV2, type ParsedAddressedEnvelope, type PreparedAddressedShare, type PublishedShare, type PublishedShareDeliveryMaterial, type PublishedShareMetadata, type RegisterOwnerSharePolicyParams, SHARE_CONTENT_LIMIT, SHARE_PUBLISH_RESULT_VERSION, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, type ShareAuthorizationAdapter, type ShareAuthorizationDenied, type ShareAuthorizationMethod, type ShareAuthorizationReady, type ShareAuthorizationRequired, type ShareAuthorizationResult, type ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, SharePublishError, type SharePublishErrorCode, type SharePublishOptions, type SharePublishTarget, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, type ShareTarget, type SignedDelegation, type TargetPublishAdapter, type TargetPublishInput, type TargetPublishOutcome, addressedCredentialRequirement, authorizationMethodForTarget, authorizeShare, canonicalOwnerSharePolicy, canonicalShareFilename, claimShare, computeOwnerShareRegistrationCid, createAddressedAuthorization, createDelegatedShareKey, createNativeShare, createPolicyEnforcementDelegation, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, historyRecordForPublishedShare, inspectShare, listShares, normalizeShareTarget, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, prepareAddressedShare, publishAddressedShare, publishPolicyShare, publishTargetShare, receiveShare, recipientMatchesShareRecord, redactPublishedShare, restoreDelegatedShareKey, resumeShareAuthorization, revokeShare, showShare, targetAuthorizationMethod, toShareErrorInfo, validateOwnerSharePolicyRegistration, validateOwnerSharePolicyRegistrationBytes };
+export { type AddressedOwnerRootInput, type AddressedOwnerRootReceipt, type AddressedPolicyRegistrationInput, type AddressedPolicyRegistrationReceipt, type AddressedPublishAuthority, type AddressedSharePublishOptions, type AddressedShareRequest, type CreateOwnerDelegationParams, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DEFAULT_SHARE_LIFETIME_MS, type DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, MAX_CONTENT_BYTES, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, OWNER_SHARE_REGISTRATION_DOMAIN, type OwnerDelegationPermission, type OwnerDelegationReceipt, type OwnerShareAction, type OwnerShareDecryption, type OwnerShareMatcher, type OwnerSharePolicyRegistration, type OwnerSharePolicyRegistrationReceipt, type OwnerSharePolicyV2, type ParsedAddressedEnvelope, type PreparedAddressedShare, type PublishedShare, type PublishedShareDeliveryMaterial, type PublishedShareMetadata, type RegisterOwnerSharePolicyParams, SHARE_CONTENT_LIMIT, SHARE_PUBLISH_RESULT_VERSION, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, type ShareAuthorizationAdapter, type ShareAuthorizationDenied, type ShareAuthorizationMethod, type ShareAuthorizationReady, type ShareAuthorizationRequired, type ShareAuthorizationResult, type ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, SharePublishError, type SharePublishErrorCode, type SharePublishOptions, type SharePublishTarget, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, type ShareTarget, type SignedDelegation, type TargetPublishAdapter, type TargetPublishInput, type TargetPublishOutcome, addressedCredentialRequirement, authorizationMethodForTarget, authorizeShare, canonicalOwnerSharePolicy, canonicalShareFilename, claimShare, computeOwnerShareRegistrationCid, createAddressedAuthorization, createDelegatedShareKey, createNativeShare, createPolicyEnforcementDelegation, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, historyRecordForPublishedShare, inspectShare, listShares, normalizeShareTarget, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, prepareAddressedShare, publishAddressedShare, publishPolicyShare, publishTargetShare, receiveShare, recipientMatchesShareRecord, redactPublishedShare, restoreDelegatedShareKey, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, targetAuthorizationMethod, toShareErrorInfo, validateOwnerSharePolicyRegistration, validateOwnerSharePolicyRegistrationBytes };

package/dist/index.js

@@ -5197,11 +5197,15 @@ var contentMetadataSchema = external_exports.object({
   /** Encrypted presentation discriminator. The fixed entry point is index.html. */
   artifact: external_exports.literal("html").optional()
 }).strict();
+var deliveryEmailSchema = external_exports.string().email();
+function isEnvelopeDeliveryEmail(value) {
+  return deliveryEmailSchema.safeParse(value).success;
+}
 var unsignedShareEnvelopeV2BaseSchema = external_exports.object({
   version: external_exports.literal(2),
   shareId: external_exports.string().min(1),
   recipientMatcher: recipientMatcherSchema,
-  deliveryEmail: external_exports.string().email().optional(),
+  deliveryEmail: deliveryEmailSchema.optional(),
   actions: external_exports.array(shareActionSchema).min(1).max(3),
   resource: resourceSelectorSchema,
   target: v2TargetSchema,
@@ -5341,7 +5345,7 @@ var unsignedShareEnvelopeV3BaseSchema = external_exports.object({
   version: external_exports.literal(3),
   shareId: external_exports.string().min(1),
   recipientMatcher: recipientMatcherSchema,
-  deliveryEmail: external_exports.string().email().optional(),
+  deliveryEmail: deliveryEmailSchema.optional(),
   actions: external_exports.array(shareActionSchema).min(1).max(3),
   resource: resourceSelectorSchema,
   target: v3TargetSchema,
@@ -6714,6 +6718,7 @@ function prepareAddressedShare(request) {
   }
   if (request.actions.length === 0 || request.policyActions.length === 0) throw new TypeError("addressed share actions are empty");
   if (request.policyActions.some((action) => !OWNER_SHARE_ACTIONS.has(action))) throw new TypeError("addressed share action is not supported");
+  if (request.deliveryEmail !== void 0 && !isEnvelopeDeliveryEmail(request.deliveryEmail)) throw new TypeError("delivery email is not a valid envelope address");
   const target = normalizeShareTarget(request.target);
   if (target.kind === "bearer") throw new TypeError("addressed target is required");
   if (target.kind === "recipientDid") return { target };
@@ -7695,8 +7700,25 @@ function historyRecordForPublishedShare(result, now = /* @__PURE__ */ new Date()
 }
 var MemorySenderShareRecordStorage = class {
   records = /* @__PURE__ */ new Map();
+  operation = Promise.resolve();
+  serialize(action) {
+    const next = this.operation.then(action, action);
+    this.operation = next.then(() => void 0, () => void 0);
+    return next;
+  }
   async put(record) {
-    this.records.set(record.shareId, record);
+    return this.serialize(async () => {
+      this.records.set(record.shareId, record);
+    });
+  }
+  async update(shareId, change) {
+    return this.serialize(async () => {
+      const current = this.records.get(shareId);
+      if (current === void 0) return void 0;
+      const updated = await change(current);
+      this.records.set(shareId, updated);
+      return updated;
+    });
   }
   async list() {
     return [...this.records.values()];
@@ -7705,7 +7727,9 @@ var MemorySenderShareRecordStorage = class {
     return this.records.get(shareId);
   }
   async delete(shareId) {
-    this.records.delete(shareId);
+    return this.serialize(async () => {
+      this.records.delete(shareId);
+    });
   }
 };
 var MemorySenderShareKeyStorage = class {
@@ -7789,6 +7813,11 @@ var SenderShareStore = class {
   }
   /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */
   async markRevoked(shareId, revokedAt = this.now().toISOString()) {
+    if (this.records.update !== void 0) {
+      const updated = await this.records.update(shareId, (record2) => ({ ...record2, revokedAt }));
+      if (updated === void 0) throw new Error(`Unknown share: ${shareId}`);
+      return updated;
+    }
     const record = await this.records.get(shareId);
     if (record === void 0) throw new Error(`Unknown share: ${shareId}`);
     const revoked = { ...record, revokedAt };
@@ -7836,11 +7865,12 @@ var EncryptedSenderShareHistory = class {
 
 // src/notify.ts
 var ShareNotifyError = class extends Error {
-  code = "delivery-failed";
-  constructor(message = "share delivery did not complete") {
+  constructor(message = "share delivery did not complete", reason) {
     super(message);
+    this.reason = reason;
     this.name = "ShareNotifyError";
   }
+  code = "delivery-failed";
 };
 function recipientMatchesShareRecord(record, recipient) {
   const matcher = record.recipientMatcher;
@@ -7850,6 +7880,11 @@ function recipientMatchesShareRecord(record, recipient) {
   if (matcher.kind === "emailDomain") return mailbox.domain === matcher.value;
   return false;
 }
+function shareDeliveryWindowExpiresAt(record) {
+  const expiresAt = Math.min(Date.parse(record.expiresAt), Date.parse(record.registeredAt) + 5 * 60 * 1e3);
+  if (!Number.isFinite(expiresAt)) throw new ShareNotifyError("share delivery history has invalid timestamps");
+  return expiresAt;
+}
 async function notifyShare(input) {
   const mailbox = canonicalMailbox(input.recipient);
   if (!input.shareId || mailbox === void 0) throw new ShareNotifyError("recipient is invalid");
@@ -7860,6 +7895,19 @@ async function notifyShare(input) {
   const idempotencyKey = input.idempotencyKey ?? await defaultIdempotencyKey(input.shareId, recipient);
   const attemptsLimit = input.maxAttempts ?? 3;
   if (!Number.isSafeInteger(attemptsLimit) || attemptsLimit < 1 || attemptsLimit > 8) throw new ShareNotifyError("maxAttempts is invalid");
+  if (input.signal?.aborted) throw new ShareNotifyError("share delivery was cancelled");
+  if (input.checkDeliveryWindow && input.record !== void 0 && shareDeliveryWindowExpiresAt(input.record) <= Date.now()) {
+    return {
+      protocol: "tinycloud-share",
+      version: 1,
+      shareId: input.shareId,
+      state: "partial-failure",
+      idempotencyKey,
+      attempts: 1,
+      retryable: false,
+      reason: "delivery-window-expired"
+    };
+  }
   let attempts = 0;
   let lastError;
   while (attempts < attemptsLimit) {
@@ -7867,8 +7915,27 @@ async function notifyShare(input) {
     attempts += 1;
     try {
       const state = await input.adapter.deliver({ shareId: input.shareId, recipient, idempotencyKey, ...input.record === void 0 ? {} : { record: input.record }, ...input.signal === void 0 ? {} : { signal: input.signal } });
-      return { protocol: "tinycloud-share", version: 1, shareId: input.shareId, state, idempotencyKey, attempts };
+      return {
+        protocol: "tinycloud-share",
+        version: 1,
+        shareId: input.shareId,
+        state: state === "delivered" && input.record?.deliveredRecipients?.includes(recipient) ? "already-delivered" : state,
+        idempotencyKey,
+        attempts
+      };
     } catch (error) {
+      if (error instanceof ShareNotifyError && error.reason === "delivery-window-expired") {
+        return {
+          protocol: "tinycloud-share",
+          version: 1,
+          shareId: input.shareId,
+          state: "partial-failure",
+          idempotencyKey,
+          attempts,
+          retryable: false,
+          reason: "delivery-window-expired"
+        };
+      }
       lastError = error;
     }
   }
@@ -8031,7 +8098,11 @@ async function revokeShare(input) {
     });
   }
   const revokedAt = (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
-  if (input.records !== void 0) await input.records.put({ ...input.record, revokedAt });
+  if (input.records?.update !== void 0) {
+    await input.records.update(input.record.shareId, (record) => ({ ...record, revokedAt }));
+  } else if (input.records !== void 0) {
+    await input.records.put({ ...input.record, revokedAt });
+  }
   return { state: "revoked", target, delegationCid, revokedAt };
 }
 function redactRecord(record, revealLink, link) {
@@ -8657,6 +8728,7 @@ export {
   restoreDelegatedShareKey,
   resumeShareAuthorization,
   revokeShare,
+  shareDeliveryWindowExpiresAt,
   showShare,
   targetAuthorizationMethod,
   toBase64Url,