@tinycloud/share-sdk 0.3.0-beta.1 → 1.0.0-beta.3

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { ShareEnvelopeV2, ShareEnvelope, ShareEnvelopeV3, ShareAction, ContentSource } from '@tinycloud/share-envelope';
+import { ShareEnvelopeV2, ShareEnvelopeV3, UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1 } from '@tinycloud/share-envelope';
 export { CheckBearerDelegationOptions, DelegationCheckResult, canonicalize, checkBearerDelegation, fromBase64Url, requiredResourceUri, resourceUriCovers, toBase64Url } from '@tinycloud/share-envelope';
 
 /** The only interactive boundary exposed by the headless SDK. */
@@ -79,9 +79,7 @@ declare function authorizationMethodForTarget(target: {
 
 type ShareErrorCode = "invalid-link" | "fetch-failed" | "max-bytes-exceeded" | "cid-mismatch" | "decrypt-failed" | "envelope-invalid" | "origin-mismatch" | "signature-invalid" | "capability-invalid" | "expired" | "unsupported-target" | "authorization-denied" | "content-integrity-failed";
 declare const SHARE_RESULT_VERSION: 1;
-/** Maximum stored-block size accepted by the headless verifier by default. */
 declare const DEFAULT_MAX_SEALED_BLOB_BYTES: number;
-/** Content metadata permits at most 100 MiB of plaintext plus sealed overhead. */
 declare const DEFAULT_MAX_CONTENT_BLOB_BYTES: number;
 declare class ShareReceiveError extends Error {
     readonly code: ShareErrorCode;
@@ -95,7 +93,6 @@ declare class ShareReceiveError extends Error {
         readonly stage?: "envelope" | "content";
         readonly reason?: "policy-target" | "recipient-did-target" | "prefix-resource";
     });
-    /** Machine output is deliberately code-only; diagnostics belong on stderr. */
     toJSON(): ShareErrorInfo;
 }
 interface ShareErrorInfo {
@@ -105,71 +102,16 @@ interface ShareErrorInfo {
         readonly code: ShareErrorCode;
     };
 }
-/** Convert unknown failures to the redacted public error schema. */
 declare function toShareErrorInfo(error: unknown): ShareErrorInfo;
+/** Policy/v3 links are self-contained authorization metadata; no blob fetch adapter exists. */
 interface ShareFetchOptions {
-    readonly registryBaseUrl?: string;
-    readonly fetchBlob?: (input: {
-        readonly origin: string;
-        readonly cid: string;
-        readonly signal?: AbortSignal;
-    }) => Promise<Uint8Array>;
-    readonly fetchFn?: typeof globalThis.fetch;
-    readonly signal?: AbortSignal;
     readonly expectedOrigin?: string;
-    /** Out-of-band signer trust root for addressed envelopes. */
-    readonly trustedSignerDid?: string;
-    /**
-     * Out-of-band policy authority.  The policy bytes carried by an envelope
-     * are only a CID-addressed integrity witness; they are never a trust root.
-     */
-    readonly trustedPolicyAuthority?: SharePolicyAuthority;
+    readonly signal?: AbortSignal;
     readonly now?: () => number;
     readonly maxSealedBlobBytes?: number;
     readonly maxContentBlobBytes?: number;
-    /** Observability-only hook; the SDK zeroes this authority-bearing buffer. */
-    readonly onKeyParsed?: (key32: Uint8Array) => void;
-    /** Optional node/OpenKey/email adapter for addressed v2 shares. */
-    readonly authorization?: ShareAuthorizationAdapter<ShareAuthorizedContent>;
-    readonly authorizationResumeToken?: string;
-    readonly authorizationProof?: unknown;
-    /** Addressed-only presentation hook. Bearer envelopes and their keys never cross this boundary. */
-    readonly onResolvedAddressedEnvelope?: (envelope: ShareEnvelope | ShareEnvelopeV2 | ShareEnvelopeV3, cid: string) => void;
-}
-interface SharePolicyEvidence {
-    readonly policyCid: string;
-    readonly signerDid: string;
-    readonly registrationCid: string;
-    readonly shareId: string;
-    readonly recipientMatcher: unknown;
-    readonly target: {
-        readonly origin: string;
-        readonly nodeAudience: string;
-        readonly spaceId: string;
-    };
-    readonly resource: {
-        readonly kind: "exact" | "prefix";
-        readonly path: string;
-    };
-    readonly actions: readonly string[];
-    readonly contentSource: unknown;
-    readonly contentSourceDigest: string;
-    readonly delegationCid: string;
-    readonly authorityMaterialHandle: string;
-    readonly authorityMaterialDigest: string;
-    readonly expiresAt: string;
-}
-interface SharePolicyAuthority {
-    resolve(input: {
-        readonly policyCid: string;
-        readonly envelope: ShareEnvelopeV2;
-    }): Promise<SharePolicyEvidence | undefined>;
+    readonly onResolvedAddressedEnvelope?: (envelope: ShareEnvelopeV3, cid: string) => void;
 }
-interface VerifyBearerEnvelopeOptions {
-    readonly expectedOrigin?: string;
-    readonly now?: () => number;
-}
-/** Redacted metadata; link keys, delegations, policy bytes, and claims never appear here. */
 interface ShareMetadata {
     readonly protocol: "tinycloud-share";
     readonly version: 1;
@@ -192,16 +134,13 @@ interface ShareMetadata {
         readonly filename?: string;
         readonly mode?: string;
     };
-    readonly content?: {
-        readonly cid: string;
-    };
 }
 interface ShareInspection {
     readonly metadata: ShareMetadata;
     readonly link: {
         readonly origin: string;
         readonly cid: string;
-        readonly kind: "compact" | "inline";
+        readonly kind: "policy";
     };
 }
 interface ShareReceiveAuthorizationRequired {
@@ -210,18 +149,20 @@ interface ShareReceiveAuthorizationRequired {
     readonly continueUrl?: string;
     readonly resumeToken?: string;
 }
+/** Retained as the result consumed after the node authorization ceremony. */
 interface ShareReceiveResult extends ShareInspection {
     readonly bytes: Uint8Array;
     readonly text?: string;
 }
 type ShareReceiveOutcome = ShareReceiveResult | ShareReceiveAuthorizationRequired;
-/** Verify a decrypted bearer envelope for browser adapters that own transport. */
-declare function verifyBearerEnvelope(envelope: ShareEnvelope, linkOrigin: string, options?: VerifyBearerEnvelopeOptions): Promise<void>;
 declare function inspectShare(link: string, options?: ShareFetchOptions): Promise<ShareInspection>;
+/**
+ * Resolve and verify invitation metadata only. Actual content access is an
+ * invocation against the owner node and is performed by the receiver SDK.
+ */
 declare function receiveShare(link: string, options?: ShareFetchOptions): Promise<ShareReceiveOutcome>;
 
 declare const SHARE_CONTENT_LIMIT: number;
-declare const SHARE_SEALED_OVERHEAD: number;
 declare const SHARE_PUBLISH_RESULT_VERSION: 1;
 declare const DEFAULT_SHARE_LIFETIME_MS: number;
 type SharePublishTarget = {
@@ -236,48 +177,17 @@ type SharePublishTarget = {
     readonly kind: "emailDomain";
     readonly domain: string;
 };
-interface ShareUploadInput {
-    readonly blob: Uint8Array;
-    readonly cid: string;
-    readonly deleteAfter: string;
-    readonly contentLength: number;
-}
-interface ShareUploadResult {
-    readonly cid: string;
-    readonly deleteAfter: string;
-}
-type ShareUpload = (input: ShareUploadInput) => Promise<ShareUploadResult>;
-type ShareUploadAuthorization = string | HeadersInit;
+/** Input shared by the native bearer and Policy/v3 addressed publishers. */
 interface SharePublishOptions {
     readonly source: Uint8Array | AsyncIterable<Uint8Array>;
     readonly filename: string;
     readonly mediaType?: string;
-    /** Browser Share also publishes binary files; the CLI leaves this false. */
     readonly allowBinary?: boolean;
     readonly target?: SharePublishTarget;
     readonly expiresAt?: Date;
     readonly origin: string;
-    readonly nodeAudience?: string;
-    readonly spaceId?: string;
-    readonly inline?: boolean;
     readonly maxBytes?: number;
     readonly now?: () => number;
-    readonly registryBaseUrl?: string;
-    readonly fetchFn?: typeof globalThis.fetch;
-    /**
-     * Signs the complete upload request, including its digest, size, expiry,
-     * and session binding. Production callers must provide this or explicitly
-     * opt into browser cookie credentials; an unsigned public upload is never
-     * attempted.
-     */
-    readonly authorizeUpload?: (input: ShareUploadInput) => Promise<ShareUploadAuthorization>;
-    /** Origin to which any cookie-bearing upload authorization is scoped. */
-    readonly authorizationOrigin?: string;
-    readonly credentials?: RequestCredentials;
-    /** Test/dev-only escape hatch for a local HTTP registry. */
-    readonly allowInsecureRegistry?: boolean;
-    /** A hermetic or service-specific uploader can own transport completely. */
-    readonly uploadBlob?: ShareUpload;
 }
 interface PublishedShareMetadata {
     readonly protocol: "tinycloud-share";
@@ -300,10 +210,6 @@ interface PublishedShareMetadata {
         readonly filename?: string;
         readonly senderName?: string;
     };
-    readonly content?: {
-        readonly cid: string;
-    };
-    /** Addressed publication receipts are copied into encrypted history only. */
     readonly recipientMatcher?: {
         readonly kind: "bearer" | "recipientDid" | "exactEmail" | "emailDomain";
         readonly value?: string;
@@ -318,27 +224,31 @@ interface PublishedShareMetadata {
     readonly envelopeCid?: string;
     readonly shareCid?: string;
 }
+/** Sender-only Policy/v3 material retained in encrypted history for delivery retries. */
+interface PublishedShareDeliveryMaterial {
+    readonly envelope: Readonly<Record<string, unknown>>;
+    readonly shareCid: string;
+}
 interface PublishedShare {
     readonly protocol: "tinycloud-share";
     readonly version: typeof SHARE_PUBLISH_RESULT_VERSION;
-    /** The only authority-bearing value returned by publish. */
+    /** The complete link is deliberately non-enumerable on production results. */
     readonly url: string;
     readonly link: {
-        readonly kind: "compact" | "inline";
+        readonly kind: "native" | "policy";
         readonly cid: string;
     };
     readonly metadata: PublishedShareMetadata;
-    readonly registryDeleteAfter: string;
+    /** Non-enumerable Policy/v3 delivery material; never included in command output. */
+    readonly deliveryMaterial?: PublishedShareDeliveryMaterial;
 }
-/** Machine-readable output omits the complete bearer capability. */
-declare function redactPublishedShare(result: PublishedShare): Omit<PublishedShare, "url">;
-type SharePublishErrorCode = "invalid-argument" | "unsupported-target" | "upload-auth-required" | "upload-failed" | "max-bytes-exceeded" | "inline-too-large";
+/** Machine-readable output omits the complete bearer capability and delivery material. */
+declare function redactPublishedShare(result: PublishedShare): Omit<PublishedShare, "url" | "deliveryMaterial">;
+type SharePublishErrorCode = "invalid-argument" | "authority-required" | "max-bytes-exceeded";
 declare class SharePublishError extends Error {
     readonly code: SharePublishErrorCode;
     constructor(code: SharePublishErrorCode, message: string);
 }
-/** Publish a bounded bearer Markdown artifact using the canonical envelope. */
-declare function publishShare(options: SharePublishOptions): Promise<PublishedShare>;
 
 interface ParsedAddressedEnvelope {
     readonly envelope: ShareEnvelopeV2;
@@ -348,6 +258,44 @@ interface ParsedAddressedEnvelope {
 /** Parse and bind the signed policy bytes before any holder or node effect. */
 declare function parseAddressedEnvelope(value: unknown): Promise<ParsedAddressedEnvelope>;
 
+type ShareTarget = SharePublishTarget;
+interface TargetPublishInput {
+    readonly source: Uint8Array;
+    readonly filename: string;
+    /** Additional files for a prefix resource; source remains the first file for compatibility. */
+    readonly files?: readonly {
+        readonly bytes: Uint8Array;
+        readonly filename: string;
+        readonly mediaType?: string;
+    }[];
+    readonly target: ShareTarget;
+    readonly expiresAt: Date;
+    readonly origin: string;
+    readonly mediaType?: string;
+    readonly resourceKind?: "exact" | "prefix";
+    readonly actions?: readonly ("read" | "list" | "edit")[];
+    readonly notify?: boolean;
+}
+type TargetPublishOutcome = PublishedShare | ShareAuthorizationRequired;
+interface TargetPublishAdapter {
+    publish(input: TargetPublishInput): Promise<TargetPublishOutcome>;
+}
+declare function normalizeShareTarget(target: ShareTarget): ShareTarget;
+declare function targetAuthorizationMethod(target: ShareTarget): ShareAuthorizationMethod | undefined;
+/** Route every share through the authenticated TinyCloud authority adapter. */
+declare function publishTargetShare(input: SharePublishOptions & {
+    readonly target: ShareTarget;
+    readonly notify?: boolean;
+    readonly targetAdapter?: TargetPublishAdapter;
+    readonly files?: readonly {
+        readonly bytes: Uint8Array;
+        readonly filename: string;
+        readonly mediaType?: string;
+    }[];
+    readonly resourceKind?: "exact" | "prefix";
+    readonly actions?: readonly ("read" | "list" | "edit")[];
+}): Promise<TargetPublishOutcome>;
+
 interface OwnerDelegationReceipt {
     readonly delegationCid: string;
     readonly signedDagCbor: Uint8Array;
@@ -536,52 +484,68 @@ declare function validateOwnerSharePolicyRegistration(value: unknown, expected:
 /** Validate the exact UTF-8 response bytes emitted by the registration route. */
 declare function validateOwnerSharePolicyRegistrationBytes(bytesValue: Uint8Array, expected: RegisterOwnerSharePolicyParams): OwnerSharePolicyRegistrationReceipt;
 
-type ShareTarget = SharePublishTarget;
-interface TargetPublishInput {
-    readonly source: Uint8Array;
-    readonly filename: string;
-    /** Additional files for a prefix resource; source remains the first file for compatibility. */
-    readonly files?: readonly {
-        readonly bytes: Uint8Array;
-        readonly filename: string;
-        readonly mediaType?: string;
-    }[];
-    readonly target: Exclude<ShareTarget, {
-        readonly kind: "bearer";
-    }>;
+interface AddressedOwnerRootInput {
+    readonly ownerDid: string;
+    readonly role: "policy-authority" | "policy-enforcement";
+    readonly audienceDid: string;
+    readonly policyId: string;
+    readonly policyDigestHex: string;
+    readonly policyCid: string;
+    readonly contentSourceDigestHex: string;
+    readonly capabilityCeilingHashHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly notBefore: Date;
     readonly expiresAt: Date;
-    readonly origin: string;
-    readonly mediaType?: string;
-    readonly resourceKind?: "exact" | "prefix";
-    readonly actions?: readonly ("read" | "list" | "edit")[];
-    readonly inline?: boolean;
-    readonly upload?: AddressedSharePublishOptions["upload"];
-    readonly notify?: boolean;
+    readonly nodeAudience: string;
+    readonly capabilities: readonly UnifiedPolicyCapability[];
 }
-type TargetPublishOutcome = PublishedShare | ShareAuthorizationRequired;
-interface TargetPublishAdapter {
-    publish(input: TargetPublishInput): Promise<TargetPublishOutcome>;
+interface AddressedOwnerRootReceipt {
+    readonly cid: string;
+    readonly delegationHeader: {
+        readonly Authorization: string;
+    };
 }
-declare function normalizeShareTarget(target: ShareTarget): ShareTarget;
-declare function targetAuthorizationMethod(target: ShareTarget): ShareAuthorizationMethod | undefined;
-/** Publish bearer shares locally, and route addressed shares to an authority adapter. */
-declare function publishTargetShare(input: SharePublishOptions & {
-    readonly target: ShareTarget;
-    readonly notify?: boolean;
-    readonly targetAdapter?: TargetPublishAdapter;
-    readonly files?: readonly {
-        readonly bytes: Uint8Array;
-        readonly filename: string;
-        readonly mediaType?: string;
-    }[];
-    readonly resourceKind?: "exact" | "prefix";
-    readonly actions?: readonly ("read" | "list" | "edit")[];
-}): Promise<TargetPublishOutcome>;
-
+interface AddressedPolicyRegistrationInput {
+    readonly policyCid: string;
+    readonly policy: Readonly<Record<string, unknown>>;
+    readonly policyRoot: {
+        readonly cid: string;
+        readonly authorization: string;
+    };
+    readonly enforcementRoot: {
+        readonly cid: string;
+        readonly authorization: string;
+    };
+    readonly contentSourceDigestHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly rootExpiresAt: string;
+    readonly enforcerDid: string;
+    readonly expectedNodeAudience: string;
+}
+interface AddressedPolicyRegistrationReceipt {
+    readonly policyCid: string;
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly attestedEnforcerBinding: {
+        readonly schema: "xyz.tinycloud.policy/attested-enforcer/v2";
+        readonly enforcerDid: string;
+        readonly nodeAudience: string;
+        readonly attestationBindingDigestHex: string;
+        readonly issuedAt: string;
+        readonly expiresAt: string;
+        readonly signature: {
+            readonly suite: "Ed25519";
+            readonly signerDid: string;
+            readonly value: string;
+        };
+    };
+}
+/** App-neutral owner authority. Node SDK owns all Policy/v3 transport. */
 interface AddressedPublishAuthority {
     readonly ownerDid: string;
-    createOwnerDelegation(input: CreateOwnerDelegationParams): Promise<OwnerDelegationReceipt>;
-    registerOwnerSharePolicy(input: RegisterOwnerSharePolicyParams): Promise<OwnerSharePolicyRegistrationReceipt>;
+    createOwnerRoot(input: AddressedOwnerRootInput): Promise<AddressedOwnerRootReceipt>;
+    sign(bytes: Uint8Array): Promise<Uint8Array>;
+    registerPolicy(input: AddressedPolicyRegistrationInput): Promise<AddressedPolicyRegistrationReceipt>;
 }
 interface AddressedSharePublishOptions {
     readonly shareId: string;
@@ -599,46 +563,24 @@ interface AddressedSharePublishOptions {
     };
     readonly actions: readonly ShareAction[];
     readonly policyActions: readonly OwnerShareAction[];
-    readonly contentSource: ContentSource;
-    readonly contentSourceDigest?: string;
+    readonly contentSource: UnifiedContentSource;
+    readonly credentialRequirement?: PolicyCredentialRequirementV1;
     readonly filename: string;
     readonly mediaType: string;
     readonly byteLength: number;
     readonly artifact?: "html";
     readonly deliveryEmail?: string;
     readonly expiresAt: Date;
-    readonly decryption?: OwnerShareDecryption;
-    readonly inline?: boolean;
+    /** Sender-history material required by Node's Policy/v3 delivery authorization. */
+    readonly onDeliveryMaterial?: (input: {
+        readonly envelope: Readonly<Record<string, unknown>>;
+        readonly shareCid: string;
+    }) => void;
     readonly authority: AddressedPublishAuthority;
-    readonly upload: Pick<SharePublishOptions, "registryBaseUrl" | "fetchFn" | "authorizeUpload" | "authorizationOrigin" | "credentials" | "allowInsecureRegistry" | "uploadBlob">;
 }
-/**
- * Canonical addressed publisher shared by browser and CLI.
- *
- * Callers own authenticated KV writes and transport. This function alone owns
- * the policy, delegation, outer-authority, signed-envelope, encryption, and
- * link bytes.
- */
+/** Canonical application-neutral Policy/v3 addressed publisher shared by browser and CLI. */
 declare function publishAddressedShare(options: AddressedSharePublishOptions): Promise<PublishedShare>;
 
-interface RegisteredPolicyAuthorityOptions {
-    readonly nodeProof: {
-        readonly kid: string;
-        readonly publicKey: Uint8Array;
-    };
-    readonly expectedTarget: {
-        readonly origin: string;
-        readonly nodeAudience: string;
-        readonly enforcerDid: string;
-    };
-}
-/**
- * Build a policy authority from an enrolled node receipt key. The encrypted
- * envelope carries the receipt as evidence, but only the separately pinned
- * key can make that evidence authoritative.
- */
-declare function createRegisteredPolicyAuthority(options: RegisteredPolicyAuthorityOptions): SharePolicyAuthority;
-
 interface ShareCacheKey {
     readonly cid: string;
     readonly expiresAt: string;
@@ -678,102 +620,6 @@ declare class MemoryShareCache implements ShareCache {
     clear(): Promise<void>;
 }
 
-/** Matches V2_DELIVERY_DOMAIN in tinycloud-node-server/src/share_v2.rs. */
-declare const SHARE_DELIVERY_AUTHORIZATION_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v2\0";
-/** Exact camelCase mirror of the Rust `V2DeliveryRequest` wire struct. */
-interface ShareDeliveryAuthorizationRequest {
-    readonly envelopeCid: string;
-    readonly shareCid: string;
-    readonly shareId: string;
-    readonly registrationCid: string;
-    readonly policyCid: string;
-    readonly delegationCid: string;
-    readonly enforcementDelegationCid: string;
-    readonly recipientEmail: string;
-    readonly shareUrl: string;
-    readonly documentName: string;
-    readonly jti: string;
-    readonly idempotencyKey: string;
-    readonly expiresAt: string;
-    readonly requestBodyDigest: string;
-}
-/** Exact mirror of the `authorization` object the Node route signs and returns. */
-interface ShareDeliveryAuthorization {
-    readonly type: "TinyCloudShareDeliveryAuthorization";
-    readonly version: 2;
-    readonly jti: string;
-    readonly shareCid: string;
-    readonly shareId: string;
-    readonly registrationCid: string;
-    readonly delegationCid: string;
-    readonly enforcementDelegationCid: string;
-    readonly envelopeCid: string;
-    readonly policyCid: string;
-    readonly nodeAudience: string;
-    readonly targetOrigin: string;
-    /**
-     * The OpenCredentials witness this delivery is scoped to, sourced from
-     * Node's own trusted credentials origin. Deliberately distinct from
-     * `nodeAudience` (the node's own DID) and `returnOrigin` (Share's page
-     * origin) — conflating any of these three would let a party impersonate
-     * another's audience.
-     */
-    readonly openCredentialsAudience: string;
-    readonly holder: string;
-    readonly recipientMatcher: unknown;
-    readonly deliveryEmail: string;
-    readonly shareUrl: string;
-    readonly returnOrigin: string;
-    readonly documentName: string;
-    readonly senderDid: string;
-    readonly senderTrust: string;
-    readonly contentSource: unknown;
-    readonly contentSourceDigest: string;
-    readonly shareExpiresAt: string;
-    readonly issuedAt: string;
-    readonly reportAbuseToken: string;
-    readonly actions: readonly string[];
-    readonly resource: string;
-    readonly authorityMaterialHandle: string;
-    readonly authorityMaterialDigest: string;
-    readonly requestBodyDigest: string;
-    readonly idempotencyKey: string;
-    readonly expiresAt: string;
-    readonly dataAuthority: false;
-}
-interface ShareDeliveryAuthorizationReceipt {
-    readonly authorization: ShareDeliveryAuthorization;
-    readonly proof: {
-        readonly alg: "EdDSA";
-        readonly kid: string;
-        readonly signature: string;
-    };
-}
-interface ValidateShareDeliveryAuthorizationExpected {
-    readonly request: ShareDeliveryAuthorizationRequest;
-    /** The enrolled receipt key from the node trust bundle. */
-    readonly nodeProof: {
-        readonly kid: string;
-        readonly publicKey: Uint8Array;
-    };
-    /**
-     * The OpenCredentials witness origin the caller trusts, from the same
-     * trust bundle as `nodeProof`. Validated independently of the
-     * authorization's own `nodeAudience`/`returnOrigin` fields so a Node that
-     * mislabels or omits its credentials origin fails closed here rather than
-     * silently inheriting one of those unrelated identities.
-     */
-    readonly credentialsAudience: string;
-}
-/**
- * Validate the exact UTF-8 response bytes emitted by
- * `POST /share/v2/deliveries/authorize`, bind them to the submitted
- * request, and verify the Node's detached EdDSA proof.
- */
-declare function validateShareDeliveryAuthorizationBytes(bytesValue: Uint8Array, expected: ValidateShareDeliveryAuthorizationExpected): ShareDeliveryAuthorizationReceipt;
-/** Build the trusted-signer descriptor `did:key:...#z...` expects from a raw node signing key. */
-declare function shareDeliveryTrustedKid(publicKey: Uint8Array): string;
-
 interface EncryptedShareHistoryStorage {
     put(value: Uint8Array): Promise<void>;
     list(): Promise<readonly Uint8Array[]>;
@@ -821,17 +667,17 @@ interface SenderShareRecord {
     /** Complete bearer links are encrypted at rest and only revealed explicitly. */
     readonly link?: string;
     readonly filename?: string;
+    /** Policy/v3 delivery material. The containing history record must remain encrypted at rest. */
+    readonly deliveryMaterial?: PublishedShareDeliveryMaterial;
 }
 /** Create the durable encrypted-history shape from canonical publication receipts. */
 declare function historyRecordForPublishedShare(result: PublishedShare, now?: Date): SenderShareRecord;
 /**
- * "direct" revokes only this share's enforcement delegation. "ancestor"
- * revokes the owner delegation the share descends from, which transitively
- * denies every share built on it (see `revocation_in_ancestry` in
- * `tinycloud-node-server/src/share_v2.rs`). Both are existing CIDs that a
- * caller passes to the node's generic `tinycloud.delegation/revoke`
- * invocation (`DelegationManager.revoke` / `TinyCloudNode.revokeDelegation`)
- * -- there is no share-v2-specific revoke route.
+ * "direct" selects the Policy/v3 enforcement root; "ancestor" selects its
+ * policy-authority sibling. Addressed shares revoke that signed root through
+ * the Node Policy/v3 endpoint, which cuts off existing sessions as well as
+ * fresh admission and delivery. Bearer shares retain ordinary delegation
+ * revocation.
  */
 type SenderShareRevocationScope = "direct" | "ancestor";
 interface SenderShareRecordStorage {
@@ -959,26 +805,36 @@ declare function notifyShare(input: {
 
 type ShareRevocationResult = {
     readonly state: "revoked";
-    readonly target: "recipientDid" | "email" | "emailDomain";
+    readonly target: "bearer" | "recipientDid" | "email" | "emailDomain";
     readonly delegationCid: string;
     readonly revokedAt: string;
-} | {
-    readonly state: "retention-only";
-    readonly target: "bearer";
-    readonly reason: "bearer-capability-cannot-be-revoked";
 } | {
     readonly state: "unsupported";
     readonly target: string;
     readonly reason: string;
     readonly code: "unsupported-target";
 };
+interface SharePolicyRootRevocation {
+    readonly rootCid: string;
+    readonly targetRole: "policy-authority" | "policy-enforcement";
+    readonly ownerDid: string;
+    readonly nodeOrigin: string;
+    readonly nodeAudience: string;
+}
 interface ShareRevocationAdapter {
-    revokeDelegation(input: {
+    /** Native bearer authority uses the ordinary node delegation endpoint. */
+    revokeDelegation?(input: {
         readonly delegationCid: string;
         readonly scope: "direct" | "ancestor";
     }): Promise<void>;
+    /**
+     * Addressed Policy/v3 authority uses the Node's signed root-revocation
+     * endpoint. The Node checks that root for active sessions, new admission,
+     * and delivery; this is not a separate share authority plane.
+     */
+    revokePolicyRoot?(input: SharePolicyRootRevocation): Promise<void>;
 }
-/** Report retention for bearer shares; only node-enforced targets are revokeable. */
+/** Revoke the native bearer delegation or the selected signed Policy/v3 root. */
 declare function revokeShare(input: {
     readonly record: SenderShareRecord;
     /** Optional durable store; successful revocation is persisted before return. */
@@ -1003,26 +859,6 @@ declare function showShare(input: {
     readonly link?: string;
 }): Promise<ShareHistoryView>;
 
-interface LegacyShareReader<T> {
-    read(link: string): Promise<T>;
-}
-interface LegacyMigrationResult<T> {
-    readonly protocol: "tinycloud-share";
-    readonly version: 1;
-    readonly legacy: true;
-    readonly migrated: PublishedShare;
-    readonly value: T;
-}
-declare function isLegacyShareLink(value: string): boolean;
-/** Modern commands never call this function implicitly. */
-declare function receiveLegacyShare<T>(link: string, reader: LegacyShareReader<T>): Promise<T>;
-/** Read tc1, then explicitly re-mint through the modern publisher. */
-declare function migrateShare<T>(input: {
-    readonly link: string;
-    readonly reader: LegacyShareReader<T>;
-    readonly publish: (value: T) => Promise<PublishedShare>;
-}): Promise<LegacyMigrationResult<T>>;
-
 interface ShareNodeTrust {
     readonly invitationKid: string;
     readonly invitationPublicKey: Uint8Array;
@@ -1055,7 +891,8 @@ interface SharePolicyChallenge {
 }
 interface ShareRecipientClientOptions {
     readonly nodeOrigin: string;
-    readonly trustedNode: ShareNodeTrust;
+    /** Required only by the retired v2 response-proof adapter. Policy/v3 trusts its signed attested binding. */
+    readonly trustedNode?: ShareNodeTrust;
     readonly holderDid: string;
     readonly envelope: ShareEnvelopeV2 | ShareEnvelopeV3;
     readonly fetchFn?: typeof fetch;
@@ -1181,4 +1018,37 @@ declare function resumeShareAuthorization<T>(input: {
     readonly adapter: ShareAuthorizationAdapter<T>;
 }): Promise<ShareAuthorizationResult<T>>;
 
-export { type AddressedPublishAuthority, type AddressedSharePublishOptions, type CreateOwnerDelegationParams, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DEFAULT_SHARE_LIFETIME_MS, type DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, type LegacyMigrationResult, type LegacyShareReader, MAX_CONTENT_BYTES, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, OWNER_SHARE_REGISTRATION_DOMAIN, type OwnerDelegationPermission, type OwnerDelegationReceipt, type OwnerShareAction, type OwnerShareDecryption, type OwnerShareMatcher, type OwnerSharePolicyRegistration, type OwnerSharePolicyRegistrationReceipt, type OwnerSharePolicyV2, type ParsedAddressedEnvelope, type PublishedShare, type PublishedShareMetadata, type RegisterOwnerSharePolicyParams, type RegisteredPolicyAuthorityOptions, SHARE_CONTENT_LIMIT, SHARE_DELIVERY_AUTHORIZATION_DOMAIN, SHARE_PUBLISH_RESULT_VERSION, SHARE_RESULT_VERSION, SHARE_SEALED_OVERHEAD, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, type ShareAuthorizationAdapter, type ShareAuthorizationDenied, type ShareAuthorizationMethod, type ShareAuthorizationReady, type ShareAuthorizationRequired, type ShareAuthorizationResult, type ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareDeliveryAuthorization, type ShareDeliveryAuthorizationReceipt, type ShareDeliveryAuthorizationRequest, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyAuthority, type SharePolicyChallenge, type SharePolicyEvidence, type SharePolicyPublishAdapter, type SharePolicySession, type SharePresentationMaterial, SharePublishError, type SharePublishErrorCode, type SharePublishOptions, type SharePublishTarget, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, type ShareTarget, type ShareUpload, type ShareUploadAuthorization, type ShareUploadInput, type ShareUploadResult, type SignedDelegation, type TargetPublishAdapter, type TargetPublishInput, type TargetPublishOutcome, type ValidateShareDeliveryAuthorizationExpected, type VerifyBearerEnvelopeOptions, authorizationMethodForTarget, authorizeShare, canonicalOwnerSharePolicy, claimShare, computeOwnerShareRegistrationCid, createAddressedAuthorization, createDelegatedShareKey, createPolicyEnforcementDelegation, createRegisteredPolicyAuthority, createShareV2HolderBindingArtifact, historyRecordForPublishedShare, inspectShare, isLegacyShareLink, listShares, migrateShare, normalizeShareTarget, notifyShare, parseAddressedEnvelope, publishAddressedShare, publishPolicyShare, publishShare, publishTargetShare, receiveLegacyShare, receiveShare, recipientMatchesShareRecord, redactPublishedShare, restoreDelegatedShareKey, resumeShareAuthorization, revokeShare, shareDeliveryTrustedKid, showShare, targetAuthorizationMethod, toShareErrorInfo, validateOwnerSharePolicyRegistration, validateOwnerSharePolicyRegistrationBytes, validateShareDeliveryAuthorizationBytes, verifyBearerEnvelope };
+/** Fragment-only adapter for TinyCloud's public SharingService. */
+declare const NATIVE_SHARE_FRAGMENT_PARAMETER = "tc1";
+interface NativeSharingService {
+    generate(params: {
+        readonly path: string;
+        readonly actions: string[];
+        readonly expiry: Date;
+    }): Promise<unknown>;
+    receive(token: string, options: {
+        readonly autoSubdelegate: false;
+        readonly useSessionKey: false;
+    }): Promise<unknown>;
+    decodeLink(token: string): {
+        readonly spaceId: string;
+        readonly path: string;
+    };
+}
+/** Generate exactly one read-only TinyCloud delegation and put its tc1 token in the fragment. */
+declare function createNativeShare(sharing: NativeSharingService, input: {
+    readonly path: string;
+    readonly expiresAt: Date;
+    readonly viewerOrigin: string;
+}): Promise<{
+    readonly url: string;
+    readonly delegationCid: string;
+    readonly expiresAt: Date;
+    readonly spaceId: string;
+}>;
+/** Extract only a single tc1 fragment. Path/query/mixed legacy forms are refused. */
+declare function parseNativeShareUrl(value: string): string;
+/** Receive through the public SDK without creating another transport protocol. */
+declare function openNativeShare(sharing: NativeSharingService, link: string): Promise<unknown>;
+
+export { type AddressedOwnerRootInput, type AddressedOwnerRootReceipt, type AddressedPolicyRegistrationInput, type AddressedPolicyRegistrationReceipt, type AddressedPublishAuthority, type AddressedSharePublishOptions, type CreateOwnerDelegationParams, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DEFAULT_SHARE_LIFETIME_MS, type DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, MAX_CONTENT_BYTES, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeSharingService, OWNER_SHARE_REGISTRATION_DOMAIN, type OwnerDelegationPermission, type OwnerDelegationReceipt, type OwnerShareAction, type OwnerShareDecryption, type OwnerShareMatcher, type OwnerSharePolicyRegistration, type OwnerSharePolicyRegistrationReceipt, type OwnerSharePolicyV2, type ParsedAddressedEnvelope, type PublishedShare, type PublishedShareDeliveryMaterial, type PublishedShareMetadata, type RegisterOwnerSharePolicyParams, SHARE_CONTENT_LIMIT, SHARE_PUBLISH_RESULT_VERSION, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, type ShareAuthorizationAdapter, type ShareAuthorizationDenied, type ShareAuthorizationMethod, type ShareAuthorizationReady, type ShareAuthorizationRequired, type ShareAuthorizationResult, type ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, SharePublishError, type SharePublishErrorCode, type SharePublishOptions, type SharePublishTarget, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, type ShareTarget, type SignedDelegation, type TargetPublishAdapter, type TargetPublishInput, type TargetPublishOutcome, authorizationMethodForTarget, authorizeShare, canonicalOwnerSharePolicy, claimShare, computeOwnerShareRegistrationCid, createAddressedAuthorization, createDelegatedShareKey, createNativeShare, createPolicyEnforcementDelegation, createShareV2HolderBindingArtifact, historyRecordForPublishedShare, inspectShare, listShares, normalizeShareTarget, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, publishAddressedShare, publishPolicyShare, publishTargetShare, receiveShare, recipientMatchesShareRecord, redactPublishedShare, restoreDelegatedShareKey, resumeShareAuthorization, revokeShare, showShare, targetAuthorizationMethod, toShareErrorInfo, validateOwnerSharePolicyRegistration, validateOwnerSharePolicyRegistrationBytes };