@tinycloud/share-sdk 1.3.0-beta.0 → 1.4.0-beta.0

package/dist/{history-ZJFHV-IU.d.cts → history-Bg25JIsi.d.cts}

@@ -1,4 +1,4 @@
-import { O as OwnerShareAction, a as OwnerShareMatcher, P as PublishedShareDeliveryMaterial, S as SignedDelegation, b as OwnerSharePolicyRegistrationReceipt, D as DelegatedShareKey, c as PublishedShare } from './owner-policy-CRFeEC98.cjs';
+import { O as OwnerShareAction, a as OwnerShareMatcher, P as PublishedShareDeliveryMaterial, S as SignedDelegation, b as OwnerSharePolicyRegistrationReceipt, D as DelegatedShareKey, c as PublishedShare } from './owner-policy-aPmXIR3e.cjs';
 
 interface EncryptedShareHistoryStorage {
     put(value: Uint8Array): Promise<void>;

package/dist/{history-q0ALXTv7.d.ts → history-kwJxrZgq.d.ts}

@@ -1,4 +1,4 @@
-import { O as OwnerShareAction, a as OwnerShareMatcher, P as PublishedShareDeliveryMaterial, S as SignedDelegation, b as OwnerSharePolicyRegistrationReceipt, D as DelegatedShareKey, c as PublishedShare } from './owner-policy-CRFeEC98.js';
+import { O as OwnerShareAction, a as OwnerShareMatcher, P as PublishedShareDeliveryMaterial, S as SignedDelegation, b as OwnerSharePolicyRegistrationReceipt, D as DelegatedShareKey, c as PublishedShare } from './owner-policy-aPmXIR3e.js';
 
 interface EncryptedShareHistoryStorage {
     put(value: Uint8Array): Promise<void>;

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,11 +17,21 @@ var __copyProps = (to, from3, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  ADDRESSED_SHARE_TOO_LARGE_MESSAGE: () => ADDRESSED_SHARE_TOO_LARGE_MESSAGE,
+  AddressedShareOverLimitError: () => AddressedShareOverLimitError,
   ArtifactPinError: () => ArtifactPinError,
   CredentialInvitationError: () => CredentialInvitationError,
   DEFAULT_MAX_CONTENT_BLOB_BYTES: () => DEFAULT_MAX_CONTENT_BLOB_BYTES,
@@ -43,7 +55,9 @@ __export(src_exports, {
   ShareReceiveError: () => ShareReceiveError,
   ShareRecipientClient: () => ShareRecipientClient,
   addressedCredentialRequirement: () => addressedCredentialRequirement,
+  addressedShareBodyUpperBound: () => addressedShareBodyUpperBound,
   artifactBindingView: () => artifactBindingView,
+  assertAddressedShareFits: () => assertAddressedShareFits,
   assertArtifactBinding: () => assertArtifactBinding,
   authorizationMethodForTarget: () => authorizationMethodForTarget,
   authorizeShare: () => authorizeShare,
@@ -5022,7 +5036,8 @@ function isCanonicalRawCid(cidString) {
   } catch {
     return false;
   }
-  return cid2.version === 1 && cid2.code === code && cid2.multihash.code === SHA256_CODE && cid2.toString() === cidString;
+  return cid2.version === 1 && cid2.code === code && cid2.multihash.code === SHA256_CODE && // `toString` of a parsed CID gives back the string it was parsed from; a fresh CID is encoded again.
+  CID.createV1(cid2.code, cid2.multihash).toString() === cidString;
 }
 var base64 = rfc4648({
   prefix: "m",
@@ -5684,7 +5699,6 @@ var SEALED_BLOB_VERSION = 1;
 var AAD = utf8Bytes(ENVELOPE_AAD_LABEL);
 var KEY_LENGTH = 32;
 var NONCE_LENGTH = 12;
-var TAG_LENGTH = 16;
 var HEADER_LENGTH = 1;
 function assertKey(key32) {
   if (key32.length !== KEY_LENGTH) {
@@ -5712,17 +5726,6 @@ async function seal(plaintextBytes, key32) {
   blob.set(ciphertext, HEADER_LENGTH + nonce.length);
   return { blob, cid: await computeCid(blob) };
 }
-async function open(blob, key32) {
-  if (blob.length < HEADER_LENGTH + NONCE_LENGTH + TAG_LENGTH) {
-    throw new TypeError(`sealed blob too short: ${blob.length} bytes`);
-  }
-  if (blob[0] !== SEALED_BLOB_VERSION) {
-    throw new TypeError(`unknown sealed blob version: ${blob[0]}`);
-  }
-  const nonce = blob.subarray(HEADER_LENGTH, HEADER_LENGTH + NONCE_LENGTH);
-  const ciphertext = blob.subarray(HEADER_LENGTH + NONCE_LENGTH);
-  return decryptEnvelope(nonce, ciphertext, key32);
-}
 async function encryptEnvelope(plaintextBytes, key32) {
   const key = await importAesKey(key32, "encrypt");
   const nonce = globalThis.crypto.getRandomValues(new Uint8Array(NONCE_LENGTH));
@@ -5735,19 +5738,6 @@ async function encryptEnvelope(plaintextBytes, key32) {
   );
   return { nonce, ciphertext };
 }
-async function decryptEnvelope(nonce, ciphertext, key32) {
-  if (nonce.length !== NONCE_LENGTH) {
-    throw new TypeError(`nonce must be ${NONCE_LENGTH} bytes, got ${nonce.length}`);
-  }
-  const key = await importAesKey(key32, "decrypt");
-  return new Uint8Array(
-    await globalThis.crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: nonce, additionalData: AAD },
-      key,
-      ciphertext
-    )
-  );
-}
 function isPlainRecord(value) {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
@@ -5994,71 +5984,6 @@ function base32Lower(bytes3) {
   if (bits > 0) output += alphabet[buffer << 5 - bits & 31];
   return output;
 }
-var KEY_LENGTH2 = 32;
-var MAX_INLINE_BYTES = 256 * 1024;
-function assertCanonicalCid(cidString) {
-  const cid2 = CID.parse(cidString);
-  if (cid2.version !== 1 || cid2.code !== code || cid2.multihash.code !== 18 || // sha2-256 (0x12) only, at the link layer too
-  cid2.toString() !== cidString) {
-    throw new TypeError(`not a canonical CIDv1 raw sha2-256 base32 CID: ${cidString}`);
-  }
-}
-async function encodeSealedInlineShareUrl(parts) {
-  if (!isCanonicalHttpsOrigin(parts.origin)) throw new TypeError("origin must be a canonical https origin");
-  if (parts.ciphertext.byteLength === 0 || parts.ciphertext.byteLength > MAX_INLINE_BYTES) throw new RangeError("inline ciphertext is outside the allowed size");
-  if (parts.key32.byteLength !== KEY_LENGTH2) throw new TypeError("inline key must be 32 bytes");
-  const ciphertextCid = await computeCid(parts.ciphertext);
-  const payload = canonicalize({
-    v: 2,
-    c: toBase64Url(parts.ciphertext),
-    cid: ciphertextCid,
-    k: toBase64Url(parts.key32)
-  });
-  const payloadBytes = new TextEncoder().encode(payload);
-  if (payloadBytes.byteLength > MAX_INLINE_BYTES * 2) throw new RangeError("inline URL is too large");
-  return `${parts.origin}/s/inline#v=2&p=${toBase64Url(payloadBytes)}`;
-}
-async function parseSealedInlineShareUrl(url, options = {}) {
-  const parsed = new URL(url);
-  if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") throw new TypeError("sealed inline share URL must be canonical HTTPS without userinfo");
-  if (!isCanonicalHttpsOrigin(parsed.origin) || options.expectedOrigin !== void 0 && parsed.origin !== options.expectedOrigin) throw new TypeError("sealed inline share URL origin is not trusted");
-  if (parsed.pathname !== "/s/inline" || parsed.search !== "") throw new TypeError("not a Node sealed-inline share URL");
-  if (url !== `${parsed.origin}/s/inline${parsed.hash}`) throw new TypeError("sealed inline share URL is not lexically canonical");
-  const prefix = "#v=2&p=";
-  if (!parsed.hash.startsWith(prefix)) throw new TypeError("sealed inline URL is missing its canonical fragment");
-  const encoded = parsed.hash.slice(prefix.length);
-  if (encoded.length === 0 || parsed.hash !== `${prefix}${encoded}`) throw new TypeError("sealed inline URL fragment is not canonical");
-  let payloadBytes;
-  try {
-    payloadBytes = fromBase64Url(encoded);
-  } catch {
-    throw new TypeError("sealed inline payload is not canonical base64url");
-  }
-  if (payloadBytes.byteLength === 0 || payloadBytes.byteLength > MAX_INLINE_BYTES * 2) throw new TypeError("sealed inline payload is too large");
-  const payloadText = new TextDecoder("utf-8", { fatal: true }).decode(payloadBytes);
-  let value;
-  try {
-    value = JSON.parse(payloadText);
-  } catch {
-    throw new TypeError("sealed inline payload is not valid JSON");
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value) || canonicalize(value) !== payloadText) throw new TypeError("sealed inline payload is not canonical JSON");
-  const record = value;
-  if (Object.keys(record).length !== 4 || record.v !== 2 || typeof record.c !== "string" || typeof record.cid !== "string" || typeof record.k !== "string") throw new TypeError("sealed inline payload has invalid fields");
-  let ciphertext;
-  let key32;
-  try {
-    ciphertext = fromBase64Url(record.c);
-    key32 = fromBase64Url(record.k);
-  } catch {
-    throw new TypeError("sealed inline payload has invalid base64url material");
-  }
-  if (ciphertext.byteLength === 0 || ciphertext.byteLength > MAX_INLINE_BYTES) throw new TypeError("sealed inline ciphertext is outside the allowed size");
-  if (key32.byteLength !== KEY_LENGTH2) throw new TypeError("sealed inline key must be 32 bytes");
-  assertCanonicalCid(record.cid);
-  if (await computeCid(ciphertext) !== record.cid) throw new TypeError("sealed inline ciphertext does not match its CID");
-  return { kind: "inline", ciphertextCid: record.cid, ciphertext, key32 };
-}
 
 // src/artifact-core.ts
 var ARTIFACT_ROOT = "artifacts";
@@ -6178,26 +6103,80 @@ function metadataFor(envelope, origin) {
     ...envelope.artifactPin === void 0 ? {} : { artifact: { id: envelope.artifactPin.artifactId, version: envelope.artifactPin.version } }
   };
 }
+function receiveErrorFor(error) {
+  switch (error.code) {
+    case "origin_not_trusted":
+      return new ShareReceiveError("origin-mismatch", "share link origin is not trusted");
+    case "body_over_cap":
+    case "response_too_large":
+      return new ShareReceiveError("max-bytes-exceeded", "sealed policy envelope exceeds the size limit");
+    case "body_hash_mismatch":
+    case "link_cid_mismatch":
+      return new ShareReceiveError("cid-mismatch", "sealed envelope bytes do not match the link CID");
+    case "body_open_failed":
+      return new ShareReceiveError("decrypt-failed", "share envelope could not be opened");
+    case "gone":
+    case "expired":
+      return new ShareReceiveError("expired", "share link has expired, was deleted, or never existed");
+    case "bad_signature":
+    case "issuer_binding_mismatch":
+      return new ShareReceiveError("signature-invalid", "share link signature is invalid");
+    case "service_refused":
+    case "service_unavailable":
+    case "invalid_response":
+      return new ShareReceiveError("fetch-failed", "share link could not be fetched");
+    case "not_a_url":
+    case "not_https":
+    case "userinfo":
+    case "not_canonical":
+    case "query_present":
+    case "removed_version":
+    case "path_grammar":
+    case "fragment_grammar":
+    case "key_noncanonical":
+    case "cid_grammar":
+    case "record_encoding":
+    case "record_json":
+    case "record_not_canonical":
+    case "type_path_mismatch":
+    case "full_non_share":
+      return new ShareReceiveError("invalid-link", "share link format is invalid");
+    default:
+      return new ShareReceiveError("envelope-invalid", "share envelope is invalid");
+  }
+}
 async function resolvePolicyShare(link, options) {
   options.signal?.throwIfAborted();
   let url;
-  let parsed;
   try {
     url = new URL(link);
-    parsed = await parseSealedInlineShareUrl(link, { ...options.expectedOrigin === void 0 ? {} : { expectedOrigin: options.expectedOrigin } });
   } catch {
     throw new ShareReceiveError("invalid-link", "share link format is invalid");
   }
+  const links = await import("@tinycloud/share-envelope/links");
+  let resolved;
+  try {
+    resolved = await links.resolveLink(link, {
+      trustedOrigins: [options.expectedOrigin ?? url.origin],
+      apiOrigin: options.apiOrigin ?? links.DEFAULT_LINKS_API_ORIGIN,
+      ...options.fetch === void 0 ? {} : { fetch: options.fetch },
+      ...options.signal === void 0 ? {} : { signal: options.signal },
+      now: options.now?.() ?? Date.now()
+    });
+  } catch (error) {
+    options.signal?.throwIfAborted();
+    throw error instanceof links.LinkError ? receiveErrorFor(error) : error;
+  }
+  if (resolved.type !== "share") throw new ShareReceiveError("invalid-link", "share link is not a share");
   const limit = options.maxSealedBlobBytes ?? DEFAULT_MAX_SEALED_BLOB_BYTES;
-  if (!Number.isSafeInteger(limit) || limit <= 0 || parsed.ciphertext.byteLength > limit) throw new ShareReceiveError("max-bytes-exceeded", "sealed policy envelope exceeds the configured byte limit");
-  if (await computeCid(parsed.ciphertext) !== parsed.ciphertextCid) throw new ShareReceiveError("cid-mismatch", "sealed envelope bytes do not match the link CID");
+  if (!Number.isSafeInteger(limit) || limit <= 0 || resolved.body.byteLength > limit) throw new ShareReceiveError("max-bytes-exceeded", "sealed policy envelope exceeds the configured byte limit");
+  const cid2 = resolved.header.bodyCid;
   options.signal?.throwIfAborted();
   let envelope;
   try {
-    const encoded = new TextDecoder("utf-8", { fatal: true }).decode(await open(parsed.ciphertext, parsed.key32));
-    const value = JSON.parse(encoded);
-    if (canonicalize(value) !== encoded) throw new Error("non-canonical envelope");
-    envelope = shareEnvelopeV3Schema.parse(value);
+    const encoded = new TextDecoder("utf-8", { fatal: true }).decode(resolved.plaintext);
+    if (canonicalize(resolved.value) !== encoded) throw new Error("non-canonical envelope");
+    envelope = shareEnvelopeV3Schema.parse(resolved.value);
   } catch {
     throw new ShareReceiveError("envelope-invalid", "share envelope is invalid");
   }
@@ -6216,8 +6195,8 @@ async function resolvePolicyShare(link, options) {
   const expiry = Date.parse(envelope.expiry);
   if (!Number.isFinite(expiry)) throw new ShareReceiveError("envelope-invalid", "share expiry is invalid");
   if (expiry <= (options.now?.() ?? Date.now())) throw new ShareReceiveError("expired", "share has expired", { expiresAt: envelope.expiry });
-  options.onResolvedAddressedEnvelope?.(envelope, parsed.ciphertextCid);
-  return { envelope, origin: url.origin, cid: parsed.ciphertextCid };
+  options.onResolvedAddressedEnvelope?.(envelope, cid2);
+  return { envelope, origin: url.origin, cid: cid2 };
 }
 async function inspectShare(link, options = {}) {
   const resolved = await resolvePolicyShare(link, options);
@@ -6846,6 +6825,53 @@ async function createPolicy(options, capabilities) {
   };
   return { policy, policyCid: await computeCid(textEncoder.encode(canonicalize(policy))), policyDigestHex };
 }
+function addressedPlan(options) {
+  const capabilities = sortCanonical([
+    { kind: "kv", resource: options.contentSource.kvResource, selector: options.resource.kind, actions: [...options.policyActions] },
+    { kind: "encryption", resource: options.contentSource.encryptionNetwork, action: "tinycloud.encryption/decrypt" }
+  ]);
+  return {
+    expiry: rfc3339Seconds(options.expiresAt),
+    capabilities,
+    contentSourceDigestHex: digestHex(options.contentSource, CONTENT_SOURCE_V1_DOMAIN2),
+    capabilityCeilingHashHex: digestHex(capabilities, POLICY_CAPABILITY_V1_DOMAIN2),
+    nativeProjectionHashHex: digestHex(nativeProjection(capabilities), NATIVE_PROJECTION_V1_DOMAIN2)
+  };
+}
+function unsignedAddressedEnvelope(input) {
+  const { options } = input;
+  return {
+    version: 3,
+    shareId: options.shareId,
+    recipientMatcher: input.matcher,
+    ...options.deliveryEmail === void 0 ? {} : { deliveryEmail: options.deliveryEmail },
+    actions: [...options.actions],
+    resource: { ...options.resource },
+    target: { origin: options.nodeOrigin, nodeAudience: input.attestedEnforcerBinding.enforcerDid, spaceId: options.spaceId },
+    policy: input.policy,
+    policyCid: input.policyCid,
+    policyRoot: input.policyRoot,
+    enforcementRoot: input.enforcementRoot,
+    attestedEnforcerBinding: input.attestedEnforcerBinding,
+    contentSource: options.contentSource,
+    contentSourceDigestHex: input.contentSourceDigestHex,
+    encryptionNetwork: options.contentSource.encryptionNetwork,
+    expiry: input.expiry,
+    display: { filename: options.filename },
+    encrypted: true,
+    metadata: {
+      mediaType: options.mediaType,
+      byteLength: options.byteLength,
+      filename: options.filename,
+      ...options.mediaType.startsWith("text/") ? { encoding: "utf-8" } : {},
+      ...options.artifact === void 0 ? {} : { artifact: options.artifact }
+    },
+    ...options.artifactPin === void 0 ? {} : { artifactPin: options.artifactPin }
+  };
+}
+function signedAddressedEnvelope(unsigned, signerDid, signature) {
+  return { ...unsigned, signature: { signerDid, algorithm: "Ed25519", value: toBase64Url(signature) } };
+}
 function publicationResult(input) {
   const result = {
     protocol: "tinycloud-share",
@@ -6940,16 +6966,10 @@ async function publishAddressedShare(input) {
   });
   const options = { ...input, filename: canonicalShareFilename(input.filename) };
   if (target.kind !== "recipientDid") assertMailboxCommitment(options.credentialRequirement, target);
-  const expiry = rfc3339Seconds(options.expiresAt);
   const matcher = targetMatcher(target);
-  const capabilities = sortCanonical([
-    { kind: "kv", resource: options.contentSource.kvResource, selector: options.resource.kind, actions: [...options.policyActions] },
-    { kind: "encryption", resource: options.contentSource.encryptionNetwork, action: "tinycloud.encryption/decrypt" }
-  ]);
+  const { expiry, capabilities, contentSourceDigestHex, capabilityCeilingHashHex, nativeProjectionHashHex } = addressedPlan(options);
+  await assertSealedBodyFits({ ...options, matcher, ownerDid: options.authority.ownerDid });
   const created = await createPolicy(options, capabilities);
-  const contentSourceDigestHex = digestHex(options.contentSource, CONTENT_SOURCE_V1_DOMAIN2);
-  const capabilityCeilingHashHex = digestHex(capabilities, POLICY_CAPABILITY_V1_DOMAIN2);
-  const nativeProjectionHashHex = digestHex(nativeProjection(capabilities), NATIVE_PROJECTION_V1_DOMAIN2);
   const commonRoot = {
     ownerDid: options.authority.ownerDid,
     policyId: created.policy.policyId,
@@ -6979,48 +6999,39 @@ async function publishAddressedShare(input) {
     expectedNodeAudience: options.nodeAudience
   });
   if (registration.policyCid !== created.policyCid || registration.policyRootCid !== policyRoot.cid || registration.enforcementRootCid !== enforcementRoot.cid) throw new Error("Policy/v3 registration receipt is not bound to the published roots");
-  const unsigned = {
-    version: 3,
-    shareId: options.shareId,
-    recipientMatcher: matcher,
-    ...options.deliveryEmail === void 0 ? {} : { deliveryEmail: options.deliveryEmail },
-    actions: [...options.actions],
-    resource: { ...options.resource },
-    target: { origin: options.nodeOrigin, nodeAudience: registration.attestedEnforcerBinding.enforcerDid, spaceId: options.spaceId },
+  const unsigned = unsignedAddressedEnvelope({
+    options,
+    matcher,
     policy: created.policy,
     policyCid: created.policyCid,
     policyRoot,
     enforcementRoot,
     attestedEnforcerBinding: registration.attestedEnforcerBinding,
-    contentSource: options.contentSource,
     contentSourceDigestHex,
-    encryptionNetwork: options.contentSource.encryptionNetwork,
-    expiry,
-    display: { filename: options.filename },
-    encrypted: true,
-    metadata: {
-      mediaType: options.mediaType,
-      byteLength: options.byteLength,
-      filename: options.filename,
-      ...options.mediaType.startsWith("text/") ? { encoding: "utf-8" } : {},
-      ...options.artifact === void 0 ? {} : { artifact: options.artifact }
-    },
-    ...options.artifactPin === void 0 ? {} : { artifactPin: options.artifactPin }
-  };
+    expiry
+  });
   unsignedShareEnvelopeV3Schema.parse(unsigned);
   const envelopeSignature = await options.authority.sign((0, import_sha2562.sha256)(textEncoder.encode(`${ENVELOPE_V3_DOMAIN}${canonicalize(unsigned)}`)));
   if (envelopeSignature.byteLength !== 64) throw new TypeError("v3 envelope signature must be Ed25519");
-  const envelope = { ...unsigned, signature: { signerDid: options.authority.ownerDid, algorithm: "Ed25519", value: toBase64Url(envelopeSignature) } };
+  const envelope = signedAddressedEnvelope(unsigned, options.authority.ownerDid, envelopeSignature);
   shareEnvelopeV3Schema.parse(envelope);
   const envelopeBytes = textEncoder.encode(canonicalize(envelope));
   const envelopeKeyBytes = generateKey();
   const sealed = await seal(envelopeBytes, envelopeKeyBytes);
   const envelopeKey = toBase64Url(envelopeKeyBytes);
-  const url = await encodeSealedInlineShareUrl({
-    origin: options.shareOrigin,
-    ciphertext: sealed.blob,
-    key32: envelopeKeyBytes
+  if (sealed.blob.length > await linkBodyLimit()) {
+    throw new AddressedShareOverLimitError({ policyCid: created.policyCid, policyRootCid: policyRoot.cid, enforcementRootCid: enforcementRoot.cid });
+  }
+  const links = await import("@tinycloud/share-envelope/links");
+  const { record } = await links.prepareLinkRecord({
+    type: "share",
+    sealed: { blob: sealed.blob, key: envelopeKeyBytes },
+    issuerKey: { did: options.authority.ownerDid, sign: (digest3) => options.authority.sign(digest3) },
+    apiOrigin: options.apiOrigin ?? links.DEFAULT_LINKS_API_ORIGIN,
+    expiresAt: new Date(expiry),
+    enforceServiceLife: false
   });
+  const url = links.buildFullLink({ origin: options.shareOrigin, key: envelopeKeyBytes, record });
   const deliveryMaterial = {
     envelope,
     shareCid: sealed.cid,
@@ -7041,6 +7052,149 @@ async function publishAddressedShare(input) {
     deliveryMaterial
   });
 }
+var ADDRESSED_SHARE_TOO_LARGE_MESSAGE = "This share is too large to send as a link, so nothing was shared. Use a shorter path or fewer folders.";
+var AddressedShareOverLimitError = class extends SharePublishError {
+  constructor(written) {
+    super("max-bytes-exceeded", ADDRESSED_SHARE_TOO_LARGE_MESSAGE);
+    this.written = written;
+    this.name = "AddressedShareOverLimitError";
+  }
+};
+async function linkBodyLimit() {
+  return (await import("@tinycloud/share-envelope/links")).MAX_LINK_BODY_BYTES;
+}
+var ROOT_CID_BOUND_CHARS = 128;
+var NODE_TIMESTAMP_BOUND = "2026-01-01T00:00:00.123456789+00:00";
+var ED25519_DID_KEY_CHARS = 56;
+function rootAuthorizationBound(input) {
+  const attenuation = {};
+  for (const capability of input.capabilities) {
+    attenuation[capability.resource] = capability.kind === "encryption" ? { [capability.action]: [{}] } : Object.fromEntries(capability.actions.map((action) => [action, [{ type: "xyz.tinycloud.resource/selector", kind: capability.selector, value: capability.resource }]]));
+  }
+  const facts = {
+    role: input.role,
+    mode: input.role === "policy-authority" ? "policy-source" : "conditional-mint",
+    ownerDid: input.ownerDid,
+    policyId: input.policyId,
+    policyDigestHex: input.policyDigestHex,
+    policyCid: input.policyCid,
+    contentSourceDigestHex: input.contentSourceDigestHex,
+    capabilityCeilingHashHex: input.capabilityCeilingHashHex,
+    nativeProjectionHashHex: input.nativeProjectionHashHex,
+    nodeAudience: input.nodeAudience,
+    ...input.role === "policy-enforcement" ? { enforcerDid: input.audienceDid } : {}
+  };
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: "A".repeat(43) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: attenuation,
+    aud: input.audienceDid,
+    exp: Number.MAX_SAFE_INTEGER,
+    fct: [facts],
+    iss: `${input.ownerDid}#${input.ownerDid.slice("did:key:".length)}`,
+    nbf: Number.MAX_SAFE_INTEGER,
+    nnc: "A".repeat(36),
+    prf: []
+  };
+  return `${toBase64Url(textEncoder.encode(canonicalize(header)))}.${toBase64Url(textEncoder.encode(canonicalize(payload)))}.${"A".repeat(86)}`;
+}
+async function sealedBodyUpperBound(options) {
+  const plan = addressedPlan(options);
+  const signature = new Uint8Array(64);
+  const created = await createPolicy({ ...options, authority: { ownerDid: options.ownerDid, sign: async () => signature } }, plan.capabilities);
+  const common = {
+    ownerDid: options.ownerDid,
+    policyId: created.policy.policyId,
+    policyDigestHex: created.policyDigestHex,
+    policyCid: created.policyCid,
+    contentSourceDigestHex: plan.contentSourceDigestHex,
+    capabilityCeilingHashHex: plan.capabilityCeilingHashHex,
+    nativeProjectionHashHex: plan.nativeProjectionHashHex,
+    nodeAudience: options.nodeAudience,
+    capabilities: plan.capabilities
+  };
+  const policyRoot = {
+    cid: "b".repeat(ROOT_CID_BOUND_CHARS),
+    role: "policy-authority",
+    authorization: rootAuthorizationBound({ ...common, role: "policy-authority", audienceDid: `did:tinycloud:policy:${created.policyDigestHex}` })
+  };
+  const enforcementRoot = {
+    cid: "b".repeat(ROOT_CID_BOUND_CHARS),
+    role: "policy-enforcement",
+    authorization: rootAuthorizationBound({ ...common, role: "policy-enforcement", audienceDid: options.enforcerDid })
+  };
+  const nodeDid = options.enforcerDid.padEnd(ED25519_DID_KEY_CHARS, "z");
+  const unsigned = unsignedAddressedEnvelope({
+    options,
+    matcher: options.matcher,
+    policy: created.policy,
+    policyCid: created.policyCid,
+    policyRoot,
+    enforcementRoot,
+    attestedEnforcerBinding: {
+      schema: "xyz.tinycloud.policy/attested-enforcer/v2",
+      enforcerDid: nodeDid,
+      nodeAudience: nodeDid,
+      attestationBindingDigestHex: "f".repeat(64),
+      issuedAt: NODE_TIMESTAMP_BOUND,
+      expiresAt: NODE_TIMESTAMP_BOUND,
+      signature: { suite: "Ed25519", signerDid: nodeDid, value: "A".repeat(86) }
+    },
+    contentSourceDigestHex: plan.contentSourceDigestHex,
+    expiry: plan.expiry
+  });
+  const envelope = signedAddressedEnvelope(unsigned, options.ownerDid, signature);
+  return (await seal(textEncoder.encode(canonicalize(envelope)), generateKey())).blob.length;
+}
+async function assertSealedBodyFits(options) {
+  if (await sealedBodyUpperBound(options) > await linkBodyLimit()) throw new SharePublishError("max-bytes-exceeded", ADDRESSED_SHARE_TOO_LARGE_MESSAGE);
+}
+async function addressedShareBodyUpperBound(input) {
+  const { target, credentialRequirement } = prepareAddressedShare(input);
+  const deliveryEmail = input.deliveryEmail ?? (target.kind === "email" && isEnvelopeDeliveryEmail(target.address) ? target.address : void 0);
+  const artifactStorage = "artifactId" in input.storage ? input.storage : void 0;
+  const path = "path" in input.storage ? input.storage.path : `${ARTIFACT_ROOT}/${input.storage.artifactId}/versions/${Number.MAX_SAFE_INTEGER}/${input.storage.storageName}`;
+  const contentSource = {
+    shareId: input.shareId,
+    kvResource: `${input.spaceId}/kv/${path}`,
+    selector: input.resource.kind,
+    encryptionNetwork: input.encryptionNetwork,
+    encryptedSymmetricKeyDigestHex: "f".repeat(64),
+    keyVersion: Number.MAX_SAFE_INTEGER,
+    mode: "immutable",
+    initialCiphertextDigestHex: "f".repeat(64)
+  };
+  const artifactPin = artifactStorage === void 0 ? void 0 : {
+    v: 1,
+    artifactId: artifactStorage.artifactId,
+    version: Number.MAX_SAFE_INTEGER,
+    manifestSha256: "f".repeat(64),
+    files: [{ path: artifactStorage.storageName, sha256: "f".repeat(64), bytes: Number.MAX_SAFE_INTEGER }]
+  };
+  return sealedBodyUpperBound({
+    shareId: input.shareId,
+    nodeOrigin: input.nodeOrigin,
+    nodeAudience: input.nodeAudience,
+    enforcerDid: input.enforcerDid,
+    spaceId: input.spaceId,
+    actions: input.actions,
+    policyActions: input.policyActions,
+    resource: { kind: input.resource.kind, path },
+    contentSource,
+    ...artifactPin === void 0 ? {} : { artifactPin },
+    ...credentialRequirement === void 0 ? {} : { credentialRequirement },
+    ...deliveryEmail === void 0 ? {} : { deliveryEmail },
+    ...input.artifact === void 0 ? {} : { artifact: input.artifact },
+    filename: canonicalShareFilename(input.filename),
+    mediaType: input.mediaType,
+    byteLength: input.byteLength,
+    expiresAt: input.expiresAt,
+    matcher: targetMatcher(target),
+    ownerDid: input.ownerDid
+  });
+}
+async function assertAddressedShareFits(input) {
+  if (await addressedShareBodyUpperBound(input) > await linkBodyLimit()) throw new SharePublishError("max-bytes-exceeded", ADDRESSED_SHARE_TOO_LARGE_MESSAGE);
+}
 
 // src/cache.ts
 var import_sha2563 = require("@noble/hashes/sha256");
@@ -8137,7 +8291,8 @@ async function notifyShare(input) {
           reason: "delivery-window-expired"
         };
       }
-      if (error !== null && typeof error === "object" && "status" in error && (error.status === 401 || error.status === 403)) {
+      const refused = error !== null && typeof error === "object" && "code" in error && error.code === "delivery-authorization-invalid";
+      if (refused || error !== null && typeof error === "object" && "status" in error && (error.status === 401 || error.status === 403)) {
         return {
           protocol: "tinycloud-share",
           version: 1,
@@ -8189,6 +8344,7 @@ function canonicalOrigin(value) {
 function object2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+var MAX_INVITATION_LINK_BYTES = 512;
 async function validateReceipt(receipt, shareUrl) {
   if (!object2(receipt) || !object2(receipt.request) || !object2(receipt.admission) || !object2(receipt.proof)) {
     throw new CredentialInvitationError(
@@ -8202,27 +8358,17 @@ async function validateReceipt(receipt, shareUrl) {
       "credential invitation is not bound to the share link"
     );
   }
-  let link;
-  try {
-    link = new URL(shareUrl);
-  } catch {
-    throw new CredentialInvitationError(
-      "invalid-receipt",
-      "credential invitation share link is invalid"
-    );
-  }
-  if (link.search !== "" || link.pathname !== "/s/inline") {
-    throw new CredentialInvitationError(
-      "invalid-receipt",
-      "credential invitation share link must be sealed inline"
-    );
-  }
+  const links = await import("@tinycloud/share-envelope/links");
   try {
-    await parseSealedInlineShareUrl(shareUrl);
+    const origin = new URL(shareUrl).origin;
+    const parsed = links.parseLink(shareUrl, { trustedOrigins: [origin] });
+    if (parsed.form !== "short" || parsed.pathType !== "share" || shareUrl.length > MAX_INVITATION_LINK_BYTES || shareUrl !== links.buildShortLink({ origin, type: "share", id: parsed.id, key: parsed.key, bodyCid: parsed.c })) {
+      throw new Error("not a short share link");
+    }
   } catch {
     throw new CredentialInvitationError(
       "invalid-receipt",
-      "credential invitation share link is invalid"
+      "credential invitation share link must be a short share link"
     );
   }
 }
@@ -8889,6 +9035,8 @@ async function openNativeShare(sharing, link) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ADDRESSED_SHARE_TOO_LARGE_MESSAGE,
+  AddressedShareOverLimitError,
   ArtifactPinError,
   CredentialInvitationError,
   DEFAULT_MAX_CONTENT_BLOB_BYTES,
@@ -8912,7 +9060,9 @@ async function openNativeShare(sharing, link) {
   ShareReceiveError,
   ShareRecipientClient,
   addressedCredentialRequirement,
+  addressedShareBodyUpperBound,
   artifactBindingView,
+  assertAddressedShareFits,
   assertArtifactBinding,
   authorizationMethodForTarget,
   authorizeShare,