@tinycloud/share-sdk 1.0.1-beta.0 → 1.1.0-beta.2

package/dist/index.d.cts

@@ -707,6 +707,8 @@ interface SenderShareRecord {
     readonly filename?: string;
     /** Policy/v3 delivery material. The containing history record must remain encrypted at rest. */
     readonly deliveryMaterial?: PublishedShareDeliveryMaterial;
+    /** Canonical mailboxes whose invitation delivery was confirmed; history is encrypted at rest. */
+    readonly deliveredRecipients?: readonly string[];
 }
 /** Create the durable encrypted-history shape from canonical publication receipts. */
 declare function historyRecordForPublishedShare(result: PublishedShare, now?: Date): SenderShareRecord;
@@ -720,6 +722,9 @@ declare function historyRecordForPublishedShare(result: PublishedShare, now?: Da
 type SenderShareRevocationScope = "direct" | "ancestor";
 interface SenderShareRecordStorage {
     put(record: SenderShareRecord): Promise<void>;
+    /** Atomically transform the latest record, if present. Implementations that
+     * provide this must serialize the read and write with every other writer. */
+    update?(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
     list(): Promise<readonly SenderShareRecord[]>;
     get(shareId: string): Promise<SenderShareRecord | undefined>;
     delete(shareId: string): Promise<void>;
@@ -737,7 +742,10 @@ interface SenderShareKeyStorage {
 /** In-memory reference implementation. Real deployments back these with IndexedDB so the non-extractable `CryptoKey` survives a reload via structured clone. */
 declare class MemorySenderShareRecordStorage implements SenderShareRecordStorage {
     private readonly records;
+    private operation;
+    private serialize;
     put(record: SenderShareRecord): Promise<void>;
+    update(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
     list(): Promise<readonly SenderShareRecord[]>;
     get(shareId: string): Promise<SenderShareRecord | undefined>;
     delete(shareId: string): Promise<void>;
@@ -809,6 +817,7 @@ interface ShareNotifyResult {
     readonly idempotencyKey: string;
     readonly attempts: number;
     readonly retryable?: boolean;
+    readonly reason?: "delivery-window-expired";
 }
 interface ShareNotifyInput {
     readonly shareId: string;
@@ -822,8 +831,9 @@ interface ShareDeliveryAdapter {
     deliver(input: ShareNotifyInput): Promise<"delivered" | "already-delivered">;
 }
 declare class ShareNotifyError extends Error {
+    readonly reason?: "delivery-window-expired" | undefined;
     readonly code: "delivery-failed";
-    constructor(message?: string);
+    constructor(message?: string, reason?: "delivery-window-expired" | undefined);
 }
 /**
  * Match a delivery address against the recipient constraint recorded when the
@@ -831,6 +841,8 @@ declare class ShareNotifyError extends Error {
  * the only form the credential issuer accepts.
  */
 declare function recipientMatchesShareRecord(record: SenderShareRecord, recipient: string): boolean;
+/** The sender can authorize a fresh invitation only until this persisted deadline. */
+declare function shareDeliveryWindowExpiresAt(record: SenderShareRecord): number;
 /**
  * Delivery is deliberately separate from publication. A failed notification
  * never causes a second envelope or link to be minted.
@@ -843,6 +855,8 @@ declare function notifyShare(input: {
     readonly idempotencyKey?: string;
     readonly maxAttempts?: number;
     readonly signal?: AbortSignal;
+    /** Check the persisted delivery window locally before calling the adapter. */
+    readonly checkDeliveryWindow?: boolean;
 }): Promise<ShareNotifyResult>;
 
 /** The signed, app-neutral receipt accepted by OpenCredentials' invitation endpoint. */
@@ -1133,4 +1147,4 @@ declare function parseNativeShareUrl(value: string): string;
 /** Receive through the public SDK without creating another transport protocol. */
 declare function openNativeShare(sharing: NativeSharingService, link: string): Promise<unknown>;
 
-export { type AddressedOwnerRootInput, type AddressedOwnerRootReceipt, type AddressedPolicyRegistrationInput, type AddressedPolicyRegistrationReceipt, type AddressedPublishAuthority, type AddressedSharePublishOptions, type AddressedShareRequest, type CreateOwnerDelegationParams, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DEFAULT_SHARE_LIFETIME_MS, type DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, MAX_CONTENT_BYTES, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, OWNER_SHARE_REGISTRATION_DOMAIN, type OwnerDelegationPermission, type OwnerDelegationReceipt, type OwnerShareAction, type OwnerShareDecryption, type OwnerShareMatcher, type OwnerSharePolicyRegistration, type OwnerSharePolicyRegistrationReceipt, type OwnerSharePolicyV2, type ParsedAddressedEnvelope, type PreparedAddressedShare, type PublishedShare, type PublishedShareDeliveryMaterial, type PublishedShareMetadata, type RegisterOwnerSharePolicyParams, SHARE_CONTENT_LIMIT, SHARE_PUBLISH_RESULT_VERSION, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, type ShareAuthorizationAdapter, type ShareAuthorizationDenied, type ShareAuthorizationMethod, type ShareAuthorizationReady, type ShareAuthorizationRequired, type ShareAuthorizationResult, type ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, SharePublishError, type SharePublishErrorCode, type SharePublishOptions, type SharePublishTarget, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, type ShareTarget, type SignedDelegation, type TargetPublishAdapter, type TargetPublishInput, type TargetPublishOutcome, addressedCredentialRequirement, authorizationMethodForTarget, authorizeShare, canonicalOwnerSharePolicy, canonicalShareFilename, claimShare, computeOwnerShareRegistrationCid, createAddressedAuthorization, createDelegatedShareKey, createNativeShare, createPolicyEnforcementDelegation, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, historyRecordForPublishedShare, inspectShare, listShares, normalizeShareTarget, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, prepareAddressedShare, publishAddressedShare, publishPolicyShare, publishTargetShare, receiveShare, recipientMatchesShareRecord, redactPublishedShare, restoreDelegatedShareKey, resumeShareAuthorization, revokeShare, showShare, targetAuthorizationMethod, toShareErrorInfo, validateOwnerSharePolicyRegistration, validateOwnerSharePolicyRegistrationBytes };
+export { type AddressedOwnerRootInput, type AddressedOwnerRootReceipt, type AddressedPolicyRegistrationInput, type AddressedPolicyRegistrationReceipt, type AddressedPublishAuthority, type AddressedSharePublishOptions, type AddressedShareRequest, type CreateOwnerDelegationParams, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DEFAULT_SHARE_LIFETIME_MS, type DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, MAX_CONTENT_BYTES, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, OWNER_SHARE_REGISTRATION_DOMAIN, type OwnerDelegationPermission, type OwnerDelegationReceipt, type OwnerShareAction, type OwnerShareDecryption, type OwnerShareMatcher, type OwnerSharePolicyRegistration, type OwnerSharePolicyRegistrationReceipt, type OwnerSharePolicyV2, type ParsedAddressedEnvelope, type PreparedAddressedShare, type PublishedShare, type PublishedShareDeliveryMaterial, type PublishedShareMetadata, type RegisterOwnerSharePolicyParams, SHARE_CONTENT_LIMIT, SHARE_PUBLISH_RESULT_VERSION, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, type ShareAuthorizationAdapter, type ShareAuthorizationDenied, type ShareAuthorizationMethod, type ShareAuthorizationReady, type ShareAuthorizationRequired, type ShareAuthorizationResult, type ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, SharePublishError, type SharePublishErrorCode, type SharePublishOptions, type SharePublishTarget, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, type ShareTarget, type SignedDelegation, type TargetPublishAdapter, type TargetPublishInput, type TargetPublishOutcome, addressedCredentialRequirement, authorizationMethodForTarget, authorizeShare, canonicalOwnerSharePolicy, canonicalShareFilename, claimShare, computeOwnerShareRegistrationCid, createAddressedAuthorization, createDelegatedShareKey, createNativeShare, createPolicyEnforcementDelegation, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, historyRecordForPublishedShare, inspectShare, listShares, normalizeShareTarget, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, prepareAddressedShare, publishAddressedShare, publishPolicyShare, publishTargetShare, receiveShare, recipientMatchesShareRecord, redactPublishedShare, restoreDelegatedShareKey, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, targetAuthorizationMethod, toShareErrorInfo, validateOwnerSharePolicyRegistration, validateOwnerSharePolicyRegistrationBytes };

package/dist/index.d.ts

@@ -707,6 +707,8 @@ interface SenderShareRecord {
     readonly filename?: string;
     /** Policy/v3 delivery material. The containing history record must remain encrypted at rest. */
     readonly deliveryMaterial?: PublishedShareDeliveryMaterial;
+    /** Canonical mailboxes whose invitation delivery was confirmed; history is encrypted at rest. */
+    readonly deliveredRecipients?: readonly string[];
 }
 /** Create the durable encrypted-history shape from canonical publication receipts. */
 declare function historyRecordForPublishedShare(result: PublishedShare, now?: Date): SenderShareRecord;
@@ -720,6 +722,9 @@ declare function historyRecordForPublishedShare(result: PublishedShare, now?: Da
 type SenderShareRevocationScope = "direct" | "ancestor";
 interface SenderShareRecordStorage {
     put(record: SenderShareRecord): Promise<void>;
+    /** Atomically transform the latest record, if present. Implementations that
+     * provide this must serialize the read and write with every other writer. */
+    update?(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
     list(): Promise<readonly SenderShareRecord[]>;
     get(shareId: string): Promise<SenderShareRecord | undefined>;
     delete(shareId: string): Promise<void>;
@@ -737,7 +742,10 @@ interface SenderShareKeyStorage {
 /** In-memory reference implementation. Real deployments back these with IndexedDB so the non-extractable `CryptoKey` survives a reload via structured clone. */
 declare class MemorySenderShareRecordStorage implements SenderShareRecordStorage {
     private readonly records;
+    private operation;
+    private serialize;
     put(record: SenderShareRecord): Promise<void>;
+    update(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
     list(): Promise<readonly SenderShareRecord[]>;
     get(shareId: string): Promise<SenderShareRecord | undefined>;
     delete(shareId: string): Promise<void>;
@@ -809,6 +817,7 @@ interface ShareNotifyResult {
     readonly idempotencyKey: string;
     readonly attempts: number;
     readonly retryable?: boolean;
+    readonly reason?: "delivery-window-expired";
 }
 interface ShareNotifyInput {
     readonly shareId: string;
@@ -822,8 +831,9 @@ interface ShareDeliveryAdapter {
     deliver(input: ShareNotifyInput): Promise<"delivered" | "already-delivered">;
 }
 declare class ShareNotifyError extends Error {
+    readonly reason?: "delivery-window-expired" | undefined;
     readonly code: "delivery-failed";
-    constructor(message?: string);
+    constructor(message?: string, reason?: "delivery-window-expired" | undefined);
 }
 /**
  * Match a delivery address against the recipient constraint recorded when the
@@ -831,6 +841,8 @@ declare class ShareNotifyError extends Error {
  * the only form the credential issuer accepts.
  */
 declare function recipientMatchesShareRecord(record: SenderShareRecord, recipient: string): boolean;
+/** The sender can authorize a fresh invitation only until this persisted deadline. */
+declare function shareDeliveryWindowExpiresAt(record: SenderShareRecord): number;
 /**
  * Delivery is deliberately separate from publication. A failed notification
  * never causes a second envelope or link to be minted.
@@ -843,6 +855,8 @@ declare function notifyShare(input: {
     readonly idempotencyKey?: string;
     readonly maxAttempts?: number;
     readonly signal?: AbortSignal;
+    /** Check the persisted delivery window locally before calling the adapter. */
+    readonly checkDeliveryWindow?: boolean;
 }): Promise<ShareNotifyResult>;
 
 /** The signed, app-neutral receipt accepted by OpenCredentials' invitation endpoint. */
@@ -1133,4 +1147,4 @@ declare function parseNativeShareUrl(value: string): string;
 /** Receive through the public SDK without creating another transport protocol. */
 declare function openNativeShare(sharing: NativeSharingService, link: string): Promise<unknown>;
 
-export { type AddressedOwnerRootInput, type AddressedOwnerRootReceipt, type AddressedPolicyRegistrationInput, type AddressedPolicyRegistrationReceipt, type AddressedPublishAuthority, type AddressedSharePublishOptions, type AddressedShareRequest, type CreateOwnerDelegationParams, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DEFAULT_SHARE_LIFETIME_MS, type DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, MAX_CONTENT_BYTES, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, OWNER_SHARE_REGISTRATION_DOMAIN, type OwnerDelegationPermission, type OwnerDelegationReceipt, type OwnerShareAction, type OwnerShareDecryption, type OwnerShareMatcher, type OwnerSharePolicyRegistration, type OwnerSharePolicyRegistrationReceipt, type OwnerSharePolicyV2, type ParsedAddressedEnvelope, type PreparedAddressedShare, type PublishedShare, type PublishedShareDeliveryMaterial, type PublishedShareMetadata, type RegisterOwnerSharePolicyParams, SHARE_CONTENT_LIMIT, SHARE_PUBLISH_RESULT_VERSION, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, type ShareAuthorizationAdapter, type ShareAuthorizationDenied, type ShareAuthorizationMethod, type ShareAuthorizationReady, type ShareAuthorizationRequired, type ShareAuthorizationResult, type ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, SharePublishError, type SharePublishErrorCode, type SharePublishOptions, type SharePublishTarget, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, type ShareTarget, type SignedDelegation, type TargetPublishAdapter, type TargetPublishInput, type TargetPublishOutcome, addressedCredentialRequirement, authorizationMethodForTarget, authorizeShare, canonicalOwnerSharePolicy, canonicalShareFilename, claimShare, computeOwnerShareRegistrationCid, createAddressedAuthorization, createDelegatedShareKey, createNativeShare, createPolicyEnforcementDelegation, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, historyRecordForPublishedShare, inspectShare, listShares, normalizeShareTarget, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, prepareAddressedShare, publishAddressedShare, publishPolicyShare, publishTargetShare, receiveShare, recipientMatchesShareRecord, redactPublishedShare, restoreDelegatedShareKey, resumeShareAuthorization, revokeShare, showShare, targetAuthorizationMethod, toShareErrorInfo, validateOwnerSharePolicyRegistration, validateOwnerSharePolicyRegistrationBytes };
+export { type AddressedOwnerRootInput, type AddressedOwnerRootReceipt, type AddressedPolicyRegistrationInput, type AddressedPolicyRegistrationReceipt, type AddressedPublishAuthority, type AddressedSharePublishOptions, type AddressedShareRequest, type CreateOwnerDelegationParams, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DEFAULT_SHARE_LIFETIME_MS, type DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, MAX_CONTENT_BYTES, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, OWNER_SHARE_REGISTRATION_DOMAIN, type OwnerDelegationPermission, type OwnerDelegationReceipt, type OwnerShareAction, type OwnerShareDecryption, type OwnerShareMatcher, type OwnerSharePolicyRegistration, type OwnerSharePolicyRegistrationReceipt, type OwnerSharePolicyV2, type ParsedAddressedEnvelope, type PreparedAddressedShare, type PublishedShare, type PublishedShareDeliveryMaterial, type PublishedShareMetadata, type RegisterOwnerSharePolicyParams, SHARE_CONTENT_LIMIT, SHARE_PUBLISH_RESULT_VERSION, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, type ShareAuthorizationAdapter, type ShareAuthorizationDenied, type ShareAuthorizationMethod, type ShareAuthorizationReady, type ShareAuthorizationRequired, type ShareAuthorizationResult, type ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, SharePublishError, type SharePublishErrorCode, type SharePublishOptions, type SharePublishTarget, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, type ShareTarget, type SignedDelegation, type TargetPublishAdapter, type TargetPublishInput, type TargetPublishOutcome, addressedCredentialRequirement, authorizationMethodForTarget, authorizeShare, canonicalOwnerSharePolicy, canonicalShareFilename, claimShare, computeOwnerShareRegistrationCid, createAddressedAuthorization, createDelegatedShareKey, createNativeShare, createPolicyEnforcementDelegation, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, historyRecordForPublishedShare, inspectShare, listShares, normalizeShareTarget, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, prepareAddressedShare, publishAddressedShare, publishPolicyShare, publishTargetShare, receiveShare, recipientMatchesShareRecord, redactPublishedShare, restoreDelegatedShareKey, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, targetAuthorizationMethod, toShareErrorInfo, validateOwnerSharePolicyRegistration, validateOwnerSharePolicyRegistrationBytes };

package/dist/index.js

@@ -7700,8 +7700,25 @@ function historyRecordForPublishedShare(result, now = /* @__PURE__ */ new Date()
 }
 var MemorySenderShareRecordStorage = class {
   records = /* @__PURE__ */ new Map();
+  operation = Promise.resolve();
+  serialize(action) {
+    const next = this.operation.then(action, action);
+    this.operation = next.then(() => void 0, () => void 0);
+    return next;
+  }
   async put(record) {
-    this.records.set(record.shareId, record);
+    return this.serialize(async () => {
+      this.records.set(record.shareId, record);
+    });
+  }
+  async update(shareId, change) {
+    return this.serialize(async () => {
+      const current = this.records.get(shareId);
+      if (current === void 0) return void 0;
+      const updated = await change(current);
+      this.records.set(shareId, updated);
+      return updated;
+    });
   }
   async list() {
     return [...this.records.values()];
@@ -7710,7 +7727,9 @@ var MemorySenderShareRecordStorage = class {
     return this.records.get(shareId);
   }
   async delete(shareId) {
-    this.records.delete(shareId);
+    return this.serialize(async () => {
+      this.records.delete(shareId);
+    });
   }
 };
 var MemorySenderShareKeyStorage = class {
@@ -7794,6 +7813,11 @@ var SenderShareStore = class {
   }
   /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */
   async markRevoked(shareId, revokedAt = this.now().toISOString()) {
+    if (this.records.update !== void 0) {
+      const updated = await this.records.update(shareId, (record2) => ({ ...record2, revokedAt }));
+      if (updated === void 0) throw new Error(`Unknown share: ${shareId}`);
+      return updated;
+    }
     const record = await this.records.get(shareId);
     if (record === void 0) throw new Error(`Unknown share: ${shareId}`);
     const revoked = { ...record, revokedAt };
@@ -7841,11 +7865,12 @@ var EncryptedSenderShareHistory = class {
 
 // src/notify.ts
 var ShareNotifyError = class extends Error {
-  code = "delivery-failed";
-  constructor(message = "share delivery did not complete") {
+  constructor(message = "share delivery did not complete", reason) {
     super(message);
+    this.reason = reason;
     this.name = "ShareNotifyError";
   }
+  code = "delivery-failed";
 };
 function recipientMatchesShareRecord(record, recipient) {
   const matcher = record.recipientMatcher;
@@ -7855,6 +7880,11 @@ function recipientMatchesShareRecord(record, recipient) {
   if (matcher.kind === "emailDomain") return mailbox.domain === matcher.value;
   return false;
 }
+function shareDeliveryWindowExpiresAt(record) {
+  const expiresAt = Math.min(Date.parse(record.expiresAt), Date.parse(record.registeredAt) + 5 * 60 * 1e3);
+  if (!Number.isFinite(expiresAt)) throw new ShareNotifyError("share delivery history has invalid timestamps");
+  return expiresAt;
+}
 async function notifyShare(input) {
   const mailbox = canonicalMailbox(input.recipient);
   if (!input.shareId || mailbox === void 0) throw new ShareNotifyError("recipient is invalid");
@@ -7865,19 +7895,59 @@ async function notifyShare(input) {
   const idempotencyKey = input.idempotencyKey ?? await defaultIdempotencyKey(input.shareId, recipient);
   const attemptsLimit = input.maxAttempts ?? 3;
   if (!Number.isSafeInteger(attemptsLimit) || attemptsLimit < 1 || attemptsLimit > 8) throw new ShareNotifyError("maxAttempts is invalid");
+  if (input.signal?.aborted) throw new ShareNotifyError("share delivery was cancelled");
+  if (input.checkDeliveryWindow && input.record !== void 0 && shareDeliveryWindowExpiresAt(input.record) <= Date.now()) {
+    return {
+      protocol: "tinycloud-share",
+      version: 1,
+      shareId: input.shareId,
+      state: "partial-failure",
+      idempotencyKey,
+      attempts: 1,
+      retryable: false,
+      reason: "delivery-window-expired"
+    };
+  }
   let attempts = 0;
-  let lastError;
   while (attempts < attemptsLimit) {
     if (input.signal?.aborted) throw new ShareNotifyError("share delivery was cancelled");
     attempts += 1;
     try {
       const state = await input.adapter.deliver({ shareId: input.shareId, recipient, idempotencyKey, ...input.record === void 0 ? {} : { record: input.record }, ...input.signal === void 0 ? {} : { signal: input.signal } });
-      return { protocol: "tinycloud-share", version: 1, shareId: input.shareId, state, idempotencyKey, attempts };
+      return {
+        protocol: "tinycloud-share",
+        version: 1,
+        shareId: input.shareId,
+        state: state === "delivered" && input.record?.deliveredRecipients?.includes(recipient) ? "already-delivered" : state,
+        idempotencyKey,
+        attempts
+      };
     } catch (error) {
-      lastError = error;
+      if (error instanceof ShareNotifyError && error.reason === "delivery-window-expired") {
+        return {
+          protocol: "tinycloud-share",
+          version: 1,
+          shareId: input.shareId,
+          state: "partial-failure",
+          idempotencyKey,
+          attempts,
+          retryable: false,
+          reason: "delivery-window-expired"
+        };
+      }
+      if (error !== null && typeof error === "object" && "status" in error && (error.status === 401 || error.status === 403)) {
+        return {
+          protocol: "tinycloud-share",
+          version: 1,
+          shareId: input.shareId,
+          state: "partial-failure",
+          idempotencyKey,
+          attempts,
+          retryable: false
+        };
+      }
     }
   }
-  void lastError;
   return { protocol: "tinycloud-share", version: 1, shareId: input.shareId, state: "partial-failure", idempotencyKey, attempts, retryable: true };
 }
 async function defaultIdempotencyKey(shareId, recipient) {
@@ -8036,7 +8106,11 @@ async function revokeShare(input) {
     });
   }
   const revokedAt = (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
-  if (input.records !== void 0) await input.records.put({ ...input.record, revokedAt });
+  if (input.records?.update !== void 0) {
+    await input.records.update(input.record.shareId, (record) => ({ ...record, revokedAt }));
+  } else if (input.records !== void 0) {
+    await input.records.put({ ...input.record, revokedAt });
+  }
   return { state: "revoked", target, delegationCid, revokedAt };
 }
 function redactRecord(record, revealLink, link) {
@@ -8299,6 +8373,10 @@ function parseV3InlineEncryptedEnvelope(bytes3, expected) {
   }
   return record;
 }
+async function recipientHttpError(response, context) {
+  const body = (await response.text().catch(() => "")).trim().slice(0, 512);
+  return Object.assign(new Error(`${context} (${response.status})${body ? `: ${body}` : ""}`), { status: response.status });
+}
 var ShareRecipientClient = class {
   constructor(options) {
     this.options = options;
@@ -8372,7 +8450,7 @@ var ShareRecipientClient = class {
       body: JSON.stringify({ policyCid: envelope.policyCid, recipientDid: this.options.holderDid, requestedCapabilities: envelope.policy.capabilityCeiling }),
       ...this.options.signal === void 0 ? {} : { signal: this.options.signal }
     });
-    if (!challengeResponse.ok) throw new Error(`v3 policy challenge rejected (${challengeResponse.status})`);
+    if (!challengeResponse.ok) throw await recipientHttpError(challengeResponse, "v3 policy challenge rejected");
     const challenge = object3(await challengeResponse.json(), "v3 policy challenge");
     if (typeof challenge.challengeId !== "string" || typeof challenge.nonce !== "string" || challenge.policyCid !== envelope.policyCid || challenge.recipientDid !== this.options.holderDid || challenge.nodeAudience !== attestedEnforcer.nodeAudience || challenge.enforcerDid !== void 0 && challenge.enforcerDid !== attestedEnforcer.enforcerDid || typeof challenge.expiresAt !== "string" || !Number.isFinite(Date.parse(challenge.expiresAt)) || Date.parse(challenge.expiresAt) <= Date.now()) throw new Error("v3 policy challenge binding mismatch");
     const material = await this.options.buildPresentation({
@@ -8397,14 +8475,14 @@ var ShareRecipientClient = class {
     const requestedExpiresAt = requestedSessionExpiry(envelope.expiry);
     let delegationResponse = await mint(requestedExpiresAt === void 0 ? mintBody : { ...mintBody, requestedExpiresAt });
     if (requestedExpiresAt !== void 0 && delegationResponse.status === 422) delegationResponse = await mint(mintBody);
-    if (!delegationResponse.ok) throw new Error(`v3 policy delegation rejected (${delegationResponse.status})`);
+    if (!delegationResponse.ok) throw await recipientHttpError(delegationResponse, "v3 policy delegation rejected");
     const delegation = object3(await delegationResponse.json(), "v3 policy delegation");
     if (delegation.admitted !== true || typeof delegation.sessionCid !== "string" || typeof delegation.authorization !== "string") throw new Error("v3 policy delegation response is not admitted");
     const compact = verifyV3PolicyAuthorization({ authorization: delegation.authorization, cid: delegation.sessionCid, envelope, holderDid: this.options.holderDid });
     const fact = compact.payload.fct[0];
     this.options.onStage?.("delegation-import");
     const imported = await this.fetchFn(new URL("/delegate", this.options.nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: delegation.authorization }, ...this.options.signal === void 0 ? {} : { signal: this.options.signal } });
-    if (!imported.ok) throw new Error(`ordinary delegation import rejected (${imported.status})`);
+    if (!imported.ok) throw await recipientHttpError(imported, "ordinary delegation import rejected");
     this.signer = material.sign;
     this.v3Authorization = delegation.authorization;
     this.v3NodeAudience = fact.nodeAudience;
@@ -8439,7 +8517,7 @@ var ShareRecipientClient = class {
     try {
       this.options.onStage?.("decryption");
       const response = await this.fetchFn(new URL("/invoke", this.options.nodeOrigin), { method: "POST", redirect: "error", headers: { accept: "application/json", "content-type": "application/json", Authorization: invocation.authorization }, body: JSON.stringify(body), ...this.options.signal === void 0 ? {} : { signal: this.options.signal } });
-      if (!response.ok) throw new Error(`v3 decrypt invocation rejected (${response.status})`);
+      if (!response.ok) throw await recipientHttpError(response, "v3 decrypt invocation rejected");
       const value = object3(await response.json(), "v3 decrypt response");
       const allowed = ["type", "targetNode", "networkId", "invocationCid", "encryptedSymmetricKeyHash", "receiverPublicKeyHash", "wrappedKey", "alg", "keyVersion", "requestHash", "nodeId", "nodeSignature"];
       if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key)) || value.type !== "tinycloud.encryption.decrypt-result/v1" || value.targetNode !== body.targetNode || value.nodeId !== body.targetNode || value.networkId !== body.networkId || value.invocationCid !== invocation.cid || value.encryptedSymmetricKeyHash !== body.encryptedSymmetricKeyHash || value.receiverPublicKeyHash !== receiverPublicKeyHash || value.alg !== body.alg || value.keyVersion !== body.keyVersion || value.requestHash !== hex3(sha2566(new TextEncoder().encode(`${invocation.cid}${bodyHash}`))) || typeof value.wrappedKey !== "string" || typeof value.nodeSignature !== "string") throw new Error("v3 decrypt response binding is invalid");
@@ -8662,6 +8740,7 @@ export {
   restoreDelegatedShareKey,
   resumeShareAuthorization,
   revokeShare,
+  shareDeliveryWindowExpiresAt,
   showShare,
   targetAuthorizationMethod,
   toBase64Url,