@tinycloud/share-sdk 1.2.0-beta.2 → 1.2.0-beta.4

package/dist/addressed-publish-BDaGyQA9.d.ts

@@ -0,0 +1,240 @@
+import { ShareEnvelopeV2, UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1 } from '@tinycloud/share-envelope';
+import { p as SharePublishTarget, P as PublishedShare, o as SharePublishOptions, d as OwnerShareAction, j as PublishedShareDeliveryMaterial } from './owner-policy-BqzRlkb6.js';
+
+/** The only interactive boundary exposed by the headless SDK. */
+type ShareAuthorizationMethod = "openkey-device" | "email-claim" | "email-otp";
+interface ShareAuthorizationRequired {
+    readonly state: "authorization-required";
+    readonly method: ShareAuthorizationMethod;
+    /** A browser-safe continuation location. It must never contain a claim secret. */
+    readonly continueUrl?: string;
+    /** An opaque, short-lived, nonce-bound handle. It is not a bearer credential. */
+    readonly resumeToken?: string;
+}
+interface ShareAuthorizationDenied {
+    readonly state: "denied";
+    readonly reason: "rejected" | "expired" | "revoked" | "unsupported";
+}
+interface ShareAuthorizationReady<T> {
+    readonly state: "ready";
+    readonly value: T;
+}
+type ShareAuthorizationResult<T> = ShareAuthorizationReady<T> | ShareAuthorizationRequired | ShareAuthorizationDenied;
+interface ShareAuthorizationAdapter<T> {
+    begin(input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly method: ShareAuthorizationMethod;
+    }): Promise<ShareAuthorizationResult<T>>;
+    resume(input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly method: ShareAuthorizationMethod;
+        readonly resumeToken: string;
+        readonly proof?: unknown;
+    }): Promise<ShareAuthorizationResult<T>>;
+    /** Verify the detached node proof against a pinned authority trust bundle. */
+    readonly verifyResult?: (input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly value: T;
+        readonly proof: unknown;
+    }) => Promise<boolean>;
+}
+/**
+ * A node-authorized addressed read.  Returning plaintext alone is not an
+ * authorization result: the caller must also return the signed response
+ * binding and digest that the node produced for that exact share.
+ */
+interface ShareAuthorizedContent {
+    readonly bytes: Uint8Array;
+    readonly bodyDigest: string;
+    readonly contentSourceDigest: string;
+    readonly binding: {
+        readonly shareId: string;
+        readonly delegationCid: string;
+        readonly authorityMaterialHandle: string;
+        readonly authorityMaterialDigest: string;
+        readonly resource: {
+            readonly kind: "exact" | "prefix";
+            readonly path: string;
+        };
+        readonly action?: string;
+    };
+    /** A detached node proof; self-reported bytes and digests are not authorization. */
+    readonly proof: unknown;
+}
+/**
+ * Start or continue a target authorization without ever guessing a device,
+ * claim, or delegation secret. Adapters own their protocol and are expected
+ * to bind their resume token to a server challenge and expiry.
+ */
+declare function authorizeShare<T>(input: {
+    readonly envelope: ShareEnvelopeV2;
+    readonly method: ShareAuthorizationMethod;
+    readonly adapter: ShareAuthorizationAdapter<T>;
+    readonly resumeToken?: string;
+    readonly proof?: unknown;
+}): Promise<ShareAuthorizationResult<T>>;
+declare function authorizationMethodForTarget(target: {
+    readonly kind: string;
+}): ShareAuthorizationMethod | undefined;
+
+type ShareTarget = SharePublishTarget;
+interface TargetPublishInput {
+    readonly source: Uint8Array;
+    readonly filename: string;
+    readonly mediaType?: string;
+    /** Additional files for a prefix resource; source remains the first file for compatibility. */
+    readonly files?: readonly {
+        readonly bytes: Uint8Array;
+        readonly filename: string;
+        readonly mediaType?: string;
+    }[];
+    readonly target: ShareTarget;
+    readonly expiresAt: Date;
+    readonly expiryWasExplicit?: boolean;
+    readonly origin: string;
+    readonly resourceKind?: "exact" | "prefix";
+    readonly actions?: readonly ("read" | "list" | "edit")[];
+    readonly notify?: boolean;
+    /** Publish as the next write-once version of this artifact and pin the share to it (TC-1428). */
+    readonly artifact?: {
+        readonly id: string;
+        readonly note?: string;
+    };
+}
+type TargetPublishOutcome = PublishedShare | ShareAuthorizationRequired;
+interface TargetPublishAdapter {
+    publish(input: TargetPublishInput): Promise<TargetPublishOutcome>;
+}
+declare function normalizeShareTarget(target: ShareTarget): ShareTarget;
+declare function targetAuthorizationMethod(target: ShareTarget): ShareAuthorizationMethod | undefined;
+/** Route every share through the authenticated TinyCloud authority adapter. */
+declare function publishTargetShare(input: SharePublishOptions & {
+    readonly target: ShareTarget;
+    readonly notify?: boolean;
+    readonly targetAdapter?: TargetPublishAdapter;
+    readonly files?: readonly {
+        readonly bytes: Uint8Array;
+        readonly filename: string;
+        readonly mediaType?: string;
+    }[];
+    readonly resourceKind?: "exact" | "prefix";
+    readonly actions?: readonly ("read" | "list" | "edit")[];
+}): Promise<TargetPublishOutcome>;
+
+interface AddressedOwnerRootInput {
+    readonly ownerDid: string;
+    readonly role: "policy-authority" | "policy-enforcement";
+    readonly audienceDid: string;
+    readonly policyId: string;
+    readonly policyDigestHex: string;
+    readonly policyCid: string;
+    readonly contentSourceDigestHex: string;
+    readonly capabilityCeilingHashHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly notBefore: Date;
+    readonly expiresAt: Date;
+    readonly nodeAudience: string;
+    readonly capabilities: readonly UnifiedPolicyCapability[];
+}
+interface AddressedOwnerRootReceipt {
+    readonly cid: string;
+    readonly delegationHeader: {
+        readonly Authorization: string;
+    };
+}
+interface AddressedPolicyRegistrationInput {
+    readonly policyCid: string;
+    readonly policy: Readonly<Record<string, unknown>>;
+    readonly policyRoot: {
+        readonly cid: string;
+        readonly authorization: string;
+    };
+    readonly enforcementRoot: {
+        readonly cid: string;
+        readonly authorization: string;
+    };
+    readonly contentSourceDigestHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly rootExpiresAt: string;
+    readonly enforcerDid: string;
+    readonly expectedNodeAudience: string;
+}
+interface AddressedPolicyRegistrationReceipt {
+    readonly policyCid: string;
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly attestedEnforcerBinding: {
+        readonly schema: "xyz.tinycloud.policy/attested-enforcer/v2";
+        readonly enforcerDid: string;
+        readonly nodeAudience: string;
+        readonly attestationBindingDigestHex: string;
+        readonly issuedAt: string;
+        readonly expiresAt: string;
+        readonly signature: {
+            readonly suite: "Ed25519";
+            readonly signerDid: string;
+            readonly value: string;
+        };
+    };
+}
+/** App-neutral owner authority. Node SDK owns all Policy/v3 transport. */
+interface AddressedPublishAuthority {
+    readonly ownerDid: string;
+    createOwnerRoot(input: AddressedOwnerRootInput): Promise<AddressedOwnerRootReceipt>;
+    sign(bytes: Uint8Array): Promise<Uint8Array>;
+    registerPolicy(input: AddressedPolicyRegistrationInput): Promise<AddressedPolicyRegistrationReceipt>;
+}
+interface AddressedSharePublishOptions {
+    readonly shareId: string;
+    readonly shareOrigin: string;
+    readonly nodeOrigin: string;
+    readonly nodeAudience: string;
+    readonly enforcerDid: string;
+    readonly spaceId: string;
+    readonly target: Exclude<ShareTarget, {
+        readonly kind: "bearer";
+    }>;
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly path: string;
+    };
+    readonly actions: readonly ShareAction[];
+    readonly policyActions: readonly OwnerShareAction[];
+    readonly contentSource: UnifiedContentSource;
+    readonly credentialRequirement?: PolicyCredentialRequirementV1;
+    readonly filename: string;
+    readonly mediaType: string;
+    readonly byteLength: number;
+    readonly artifact?: "html";
+    readonly deliveryEmail?: string;
+    readonly expiresAt: Date;
+    /** Sender-history material required by Node's Policy/v3 delivery authorization. */
+    readonly onDeliveryMaterial?: (input: PublishedShareDeliveryMaterial) => void;
+    readonly authority: AddressedPublishAuthority;
+}
+type MailboxTarget = Extract<ShareTarget, {
+    readonly kind: "email" | "emailDomain";
+}>;
+/** The Policy/v2 credential commitment a share addressed to `target` must carry. */
+declare function addressedCredentialRequirement(target: MailboxTarget): PolicyCredentialRequirementV1;
+/** Facts every addressed-share check needs, available before any side effect. */
+type AddressedShareRequest = Pick<AddressedSharePublishOptions, "target" | "actions" | "policyActions" | "filename" | "deliveryEmail">;
+interface PreparedAddressedShare {
+    /** The canonical target the envelope's recipient matcher will carry. */
+    readonly target: Exclude<ShareTarget, {
+        readonly kind: "bearer";
+    }>;
+    /** Present for mailbox targets: the Policy/v2 commitment to pass to `publishAddressedShare`. */
+    readonly credentialRequirement?: PolicyCredentialRequirementV1;
+}
+/**
+ * Runs every argument and target check of `publishAddressedShare` that does
+ * not depend on stored content, and derives the credential commitment. It has
+ * no side effects, so senders call it before uploading content or publishing
+ * a location record; a refused share then leaves nothing behind.
+ */
+declare function prepareAddressedShare(request: AddressedShareRequest): PreparedAddressedShare;
+/** Canonical application-neutral Policy/v3 addressed publisher shared by browser and CLI. */
+declare function publishAddressedShare(input: AddressedSharePublishOptions): Promise<PublishedShare>;
+
+export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareAuthorizationMethod as S, type TargetPublishOutcome as T, type ShareAuthorizedContent as a, type ShareAuthorizationAdapter as b, type TargetPublishInput as c, type ShareAuthorizationResult as d, type ShareTarget as e, type AddressedOwnerRootReceipt as f, type AddressedPolicyRegistrationInput as g, type AddressedPolicyRegistrationReceipt as h, type AddressedPublishAuthority as i, type AddressedSharePublishOptions as j, type AddressedShareRequest as k, type ShareAuthorizationDenied as l, type ShareAuthorizationReady as m, type ShareAuthorizationRequired as n, type TargetPublishAdapter as o, addressedCredentialRequirement as p, authorizationMethodForTarget as q, authorizeShare as r, normalizeShareTarget as s, prepareAddressedShare as t, publishAddressedShare as u, publishTargetShare as v, targetAuthorizationMethod as w };

package/dist/addressed-publish-DVvTlGog.d.cts

@@ -0,0 +1,240 @@
+import { ShareEnvelopeV2, UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1 } from '@tinycloud/share-envelope';
+import { p as SharePublishTarget, P as PublishedShare, o as SharePublishOptions, d as OwnerShareAction, j as PublishedShareDeliveryMaterial } from './owner-policy-BqzRlkb6.cjs';
+
+/** The only interactive boundary exposed by the headless SDK. */
+type ShareAuthorizationMethod = "openkey-device" | "email-claim" | "email-otp";
+interface ShareAuthorizationRequired {
+    readonly state: "authorization-required";
+    readonly method: ShareAuthorizationMethod;
+    /** A browser-safe continuation location. It must never contain a claim secret. */
+    readonly continueUrl?: string;
+    /** An opaque, short-lived, nonce-bound handle. It is not a bearer credential. */
+    readonly resumeToken?: string;
+}
+interface ShareAuthorizationDenied {
+    readonly state: "denied";
+    readonly reason: "rejected" | "expired" | "revoked" | "unsupported";
+}
+interface ShareAuthorizationReady<T> {
+    readonly state: "ready";
+    readonly value: T;
+}
+type ShareAuthorizationResult<T> = ShareAuthorizationReady<T> | ShareAuthorizationRequired | ShareAuthorizationDenied;
+interface ShareAuthorizationAdapter<T> {
+    begin(input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly method: ShareAuthorizationMethod;
+    }): Promise<ShareAuthorizationResult<T>>;
+    resume(input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly method: ShareAuthorizationMethod;
+        readonly resumeToken: string;
+        readonly proof?: unknown;
+    }): Promise<ShareAuthorizationResult<T>>;
+    /** Verify the detached node proof against a pinned authority trust bundle. */
+    readonly verifyResult?: (input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly value: T;
+        readonly proof: unknown;
+    }) => Promise<boolean>;
+}
+/**
+ * A node-authorized addressed read.  Returning plaintext alone is not an
+ * authorization result: the caller must also return the signed response
+ * binding and digest that the node produced for that exact share.
+ */
+interface ShareAuthorizedContent {
+    readonly bytes: Uint8Array;
+    readonly bodyDigest: string;
+    readonly contentSourceDigest: string;
+    readonly binding: {
+        readonly shareId: string;
+        readonly delegationCid: string;
+        readonly authorityMaterialHandle: string;
+        readonly authorityMaterialDigest: string;
+        readonly resource: {
+            readonly kind: "exact" | "prefix";
+            readonly path: string;
+        };
+        readonly action?: string;
+    };
+    /** A detached node proof; self-reported bytes and digests are not authorization. */
+    readonly proof: unknown;
+}
+/**
+ * Start or continue a target authorization without ever guessing a device,
+ * claim, or delegation secret. Adapters own their protocol and are expected
+ * to bind their resume token to a server challenge and expiry.
+ */
+declare function authorizeShare<T>(input: {
+    readonly envelope: ShareEnvelopeV2;
+    readonly method: ShareAuthorizationMethod;
+    readonly adapter: ShareAuthorizationAdapter<T>;
+    readonly resumeToken?: string;
+    readonly proof?: unknown;
+}): Promise<ShareAuthorizationResult<T>>;
+declare function authorizationMethodForTarget(target: {
+    readonly kind: string;
+}): ShareAuthorizationMethod | undefined;
+
+type ShareTarget = SharePublishTarget;
+interface TargetPublishInput {
+    readonly source: Uint8Array;
+    readonly filename: string;
+    readonly mediaType?: string;
+    /** Additional files for a prefix resource; source remains the first file for compatibility. */
+    readonly files?: readonly {
+        readonly bytes: Uint8Array;
+        readonly filename: string;
+        readonly mediaType?: string;
+    }[];
+    readonly target: ShareTarget;
+    readonly expiresAt: Date;
+    readonly expiryWasExplicit?: boolean;
+    readonly origin: string;
+    readonly resourceKind?: "exact" | "prefix";
+    readonly actions?: readonly ("read" | "list" | "edit")[];
+    readonly notify?: boolean;
+    /** Publish as the next write-once version of this artifact and pin the share to it (TC-1428). */
+    readonly artifact?: {
+        readonly id: string;
+        readonly note?: string;
+    };
+}
+type TargetPublishOutcome = PublishedShare | ShareAuthorizationRequired;
+interface TargetPublishAdapter {
+    publish(input: TargetPublishInput): Promise<TargetPublishOutcome>;
+}
+declare function normalizeShareTarget(target: ShareTarget): ShareTarget;
+declare function targetAuthorizationMethod(target: ShareTarget): ShareAuthorizationMethod | undefined;
+/** Route every share through the authenticated TinyCloud authority adapter. */
+declare function publishTargetShare(input: SharePublishOptions & {
+    readonly target: ShareTarget;
+    readonly notify?: boolean;
+    readonly targetAdapter?: TargetPublishAdapter;
+    readonly files?: readonly {
+        readonly bytes: Uint8Array;
+        readonly filename: string;
+        readonly mediaType?: string;
+    }[];
+    readonly resourceKind?: "exact" | "prefix";
+    readonly actions?: readonly ("read" | "list" | "edit")[];
+}): Promise<TargetPublishOutcome>;
+
+interface AddressedOwnerRootInput {
+    readonly ownerDid: string;
+    readonly role: "policy-authority" | "policy-enforcement";
+    readonly audienceDid: string;
+    readonly policyId: string;
+    readonly policyDigestHex: string;
+    readonly policyCid: string;
+    readonly contentSourceDigestHex: string;
+    readonly capabilityCeilingHashHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly notBefore: Date;
+    readonly expiresAt: Date;
+    readonly nodeAudience: string;
+    readonly capabilities: readonly UnifiedPolicyCapability[];
+}
+interface AddressedOwnerRootReceipt {
+    readonly cid: string;
+    readonly delegationHeader: {
+        readonly Authorization: string;
+    };
+}
+interface AddressedPolicyRegistrationInput {
+    readonly policyCid: string;
+    readonly policy: Readonly<Record<string, unknown>>;
+    readonly policyRoot: {
+        readonly cid: string;
+        readonly authorization: string;
+    };
+    readonly enforcementRoot: {
+        readonly cid: string;
+        readonly authorization: string;
+    };
+    readonly contentSourceDigestHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly rootExpiresAt: string;
+    readonly enforcerDid: string;
+    readonly expectedNodeAudience: string;
+}
+interface AddressedPolicyRegistrationReceipt {
+    readonly policyCid: string;
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly attestedEnforcerBinding: {
+        readonly schema: "xyz.tinycloud.policy/attested-enforcer/v2";
+        readonly enforcerDid: string;
+        readonly nodeAudience: string;
+        readonly attestationBindingDigestHex: string;
+        readonly issuedAt: string;
+        readonly expiresAt: string;
+        readonly signature: {
+            readonly suite: "Ed25519";
+            readonly signerDid: string;
+            readonly value: string;
+        };
+    };
+}
+/** App-neutral owner authority. Node SDK owns all Policy/v3 transport. */
+interface AddressedPublishAuthority {
+    readonly ownerDid: string;
+    createOwnerRoot(input: AddressedOwnerRootInput): Promise<AddressedOwnerRootReceipt>;
+    sign(bytes: Uint8Array): Promise<Uint8Array>;
+    registerPolicy(input: AddressedPolicyRegistrationInput): Promise<AddressedPolicyRegistrationReceipt>;
+}
+interface AddressedSharePublishOptions {
+    readonly shareId: string;
+    readonly shareOrigin: string;
+    readonly nodeOrigin: string;
+    readonly nodeAudience: string;
+    readonly enforcerDid: string;
+    readonly spaceId: string;
+    readonly target: Exclude<ShareTarget, {
+        readonly kind: "bearer";
+    }>;
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly path: string;
+    };
+    readonly actions: readonly ShareAction[];
+    readonly policyActions: readonly OwnerShareAction[];
+    readonly contentSource: UnifiedContentSource;
+    readonly credentialRequirement?: PolicyCredentialRequirementV1;
+    readonly filename: string;
+    readonly mediaType: string;
+    readonly byteLength: number;
+    readonly artifact?: "html";
+    readonly deliveryEmail?: string;
+    readonly expiresAt: Date;
+    /** Sender-history material required by Node's Policy/v3 delivery authorization. */
+    readonly onDeliveryMaterial?: (input: PublishedShareDeliveryMaterial) => void;
+    readonly authority: AddressedPublishAuthority;
+}
+type MailboxTarget = Extract<ShareTarget, {
+    readonly kind: "email" | "emailDomain";
+}>;
+/** The Policy/v2 credential commitment a share addressed to `target` must carry. */
+declare function addressedCredentialRequirement(target: MailboxTarget): PolicyCredentialRequirementV1;
+/** Facts every addressed-share check needs, available before any side effect. */
+type AddressedShareRequest = Pick<AddressedSharePublishOptions, "target" | "actions" | "policyActions" | "filename" | "deliveryEmail">;
+interface PreparedAddressedShare {
+    /** The canonical target the envelope's recipient matcher will carry. */
+    readonly target: Exclude<ShareTarget, {
+        readonly kind: "bearer";
+    }>;
+    /** Present for mailbox targets: the Policy/v2 commitment to pass to `publishAddressedShare`. */
+    readonly credentialRequirement?: PolicyCredentialRequirementV1;
+}
+/**
+ * Runs every argument and target check of `publishAddressedShare` that does
+ * not depend on stored content, and derives the credential commitment. It has
+ * no side effects, so senders call it before uploading content or publishing
+ * a location record; a refused share then leaves nothing behind.
+ */
+declare function prepareAddressedShare(request: AddressedShareRequest): PreparedAddressedShare;
+/** Canonical application-neutral Policy/v3 addressed publisher shared by browser and CLI. */
+declare function publishAddressedShare(input: AddressedSharePublishOptions): Promise<PublishedShare>;
+
+export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareAuthorizationMethod as S, type TargetPublishOutcome as T, type ShareAuthorizedContent as a, type ShareAuthorizationAdapter as b, type TargetPublishInput as c, type ShareAuthorizationResult as d, type ShareTarget as e, type AddressedOwnerRootReceipt as f, type AddressedPolicyRegistrationInput as g, type AddressedPolicyRegistrationReceipt as h, type AddressedPublishAuthority as i, type AddressedSharePublishOptions as j, type AddressedShareRequest as k, type ShareAuthorizationDenied as l, type ShareAuthorizationReady as m, type ShareAuthorizationRequired as n, type TargetPublishAdapter as o, addressedCredentialRequirement as p, authorizationMethodForTarget as q, authorizeShare as r, normalizeShareTarget as s, prepareAddressedShare as t, publishAddressedShare as u, publishTargetShare as v, targetAuthorizationMethod as w };

package/dist/history-CUWDK0lE.d.cts

@@ -0,0 +1,180 @@
+import { d as OwnerShareAction, f as OwnerShareMatcher, j as PublishedShareDeliveryMaterial, q as SignedDelegation, h as OwnerSharePolicyRegistrationReceipt, a as DelegatedShareKey, P as PublishedShare } from './owner-policy-BqzRlkb6.cjs';
+
+interface EncryptedShareHistoryStorage {
+    put(value: Uint8Array): Promise<void>;
+    list(): Promise<readonly Uint8Array[]>;
+    clear(): Promise<void>;
+}
+declare class MemoryEncryptedShareHistoryStorage implements EncryptedShareHistoryStorage {
+    private readonly values;
+    put(value: Uint8Array): Promise<void>;
+    list(): Promise<readonly Uint8Array[]>;
+    clear(): Promise<void>;
+}
+/**
+ * The durable record a sender needs, after a reload, to display and manage
+ * a share it created. Every identity/CID here comes verbatim from the
+ * Node-verified {@link OwnerSharePolicyRegistrationReceipt}; nothing is
+ * re-derived or guessed.
+ */
+interface SenderShareRecord {
+    readonly shareId: string;
+    readonly registrationCid?: string;
+    readonly policyCid?: string;
+    readonly ownerDelegationCid?: string;
+    readonly enforcementDelegationCid?: string;
+    readonly shareKeyDid?: string;
+    readonly ownerDid?: string;
+    readonly enforcerDid?: string;
+    readonly target: {
+        readonly origin: string;
+        readonly nodeAudience: string;
+        readonly spaceId: string;
+    };
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly path: string;
+    };
+    readonly actions: readonly OwnerShareAction[];
+    readonly recipientMatcher: OwnerShareMatcher;
+    /** The signed target discriminator, retained separately from the email matcher. */
+    readonly targetKind?: "bearer" | "recipientDid" | "email" | "emailDomain";
+    readonly registeredAt: string;
+    readonly expiresAt: string;
+    readonly revokedAt?: string;
+    readonly envelopeCid?: string;
+    readonly shareCid?: string;
+    /** Complete bearer links are encrypted at rest and only revealed explicitly. */
+    readonly link?: string;
+    readonly filename?: string;
+    /** Policy/v3 delivery material. The containing history record must remain encrypted at rest. */
+    readonly deliveryMaterial?: PublishedShareDeliveryMaterial;
+    /** Canonical mailboxes whose invitation delivery was confirmed; history is encrypted at rest. */
+    readonly deliveredRecipients?: readonly string[];
+    /**
+     * `migrated`: imported once from a CLI's local history by the OWNER's
+     * session (slice 5), at an owner-layout key `records/<shareId>`. Such a
+     * record is exempt from the ±1-day `registeredAt` window and nothing else:
+     * its chain is verified like an agent record's, it never ranks as a web
+     * row, and it cannot override a revocation. A record claiming `migrated`
+     * inside an agent subtree is rejected.
+     */
+    readonly provenance?: "migrated";
+    /**
+     * The signed chain behind every CID this record claims (TC-1432 C1), as
+     * exact bytes. Agent records carry it so the owner's browser can verify
+     * the chain without a node lookup. Policy/v3 records prove through
+     * `deliveryMaterial.envelope` plus `session`.
+     */
+    readonly proofs?: SenderShareRecordProofs;
+}
+interface SenderShareRecordProofs {
+    /** Owner→session SIWE CACAO (base64url DAG-CBOR) of the issuing session; absent when it is gone. */
+    readonly session?: string;
+    /** Native bearer link delegation (compact UCAN); its CID is `enforcementDelegationCid`. */
+    readonly link?: string;
+    /** Policy/v2 owner-policy chain: policy bytes (base64url), owner→share-key SIWE CACAO (base64url), enforcement delegation and node registration receipt. */
+    readonly ownerPolicy?: string;
+    readonly ownerDelegation?: string;
+    readonly enforcementDelegation?: SignedDelegation;
+    readonly registration?: OwnerSharePolicyRegistrationReceipt;
+}
+/** Create the durable encrypted-history shape from canonical publication receipts. */
+declare function historyRecordForPublishedShare(result: PublishedShare, now?: Date): SenderShareRecord;
+/**
+ * "direct" selects the Policy/v3 enforcement root; "ancestor" selects its
+ * policy-authority sibling. Addressed shares revoke that signed root through
+ * the Node Policy/v3 endpoint, which cuts off existing sessions as well as
+ * fresh admission and delivery. Bearer shares retain ordinary delegation
+ * revocation.
+ */
+type SenderShareRevocationScope = "direct" | "ancestor";
+interface SenderShareRecordStorage {
+    put(record: SenderShareRecord): Promise<void>;
+    /** Atomically transform the latest record, if present. Implementations that
+     * provide this must serialize the read and write with every other writer. */
+    update?(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
+    list(): Promise<readonly SenderShareRecord[]>;
+    get(shareId: string): Promise<SenderShareRecord | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+interface StoredSenderShareKey {
+    readonly cryptoKey: CryptoKey;
+    readonly publicKey: Uint8Array;
+    readonly extractable: boolean;
+}
+interface SenderShareKeyStorage {
+    put(shareId: string, key: StoredSenderShareKey): Promise<void>;
+    get(shareId: string): Promise<StoredSenderShareKey | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+/** In-memory reference implementation. Real deployments back these with IndexedDB so the non-extractable `CryptoKey` survives a reload via structured clone. */
+declare class MemorySenderShareRecordStorage implements SenderShareRecordStorage {
+    private readonly records;
+    private operation;
+    private serialize;
+    put(record: SenderShareRecord): Promise<void>;
+    update(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
+    list(): Promise<readonly SenderShareRecord[]>;
+    get(shareId: string): Promise<SenderShareRecord | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+declare class MemorySenderShareKeyStorage implements SenderShareKeyStorage {
+    private readonly keys;
+    put(shareId: string, key: StoredSenderShareKey): Promise<void>;
+    get(shareId: string): Promise<StoredSenderShareKey | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+interface SenderShareStoreOptions {
+    readonly records: SenderShareRecordStorage;
+    readonly keys: SenderShareKeyStorage;
+    readonly now?: () => Date;
+}
+/**
+ * Reload-safe sender-side management for shares created through
+ * {@link canonicalOwnerSharePolicy} / `registerOwnerSharePolicy`. Persists
+ * the registration receipt's canonical identity tuple plus the ephemeral
+ * share key's non-extractable `CryptoKey` handle, so a sender can list,
+ * inspect, and revoke shares it created in an earlier session -- without
+ * ever re-exporting private key material.
+ */
+declare class SenderShareStore {
+    private readonly records;
+    private readonly keys;
+    private readonly now;
+    constructor(options: SenderShareStoreOptions);
+    /** Persist a Node-verified registration receipt and its share key handle. */
+    save(receipt: OwnerSharePolicyRegistrationReceipt, key: DelegatedShareKey): Promise<SenderShareRecord>;
+    /** List shares created in any session, most recent first. */
+    list(options?: {
+        readonly includeRevoked?: boolean;
+        readonly includeExpired?: boolean;
+    }): Promise<readonly SenderShareRecord[]>;
+    get(shareId: string): Promise<SenderShareRecord | undefined>;
+    /** Recover a signer for the persisted share key after a reload. */
+    loadKey(shareId: string): Promise<DelegatedShareKey | undefined>;
+    /**
+     * The delegation CID to pass to the node's existing generic
+     * `tinycloud.delegation/revoke` invocation to revoke this share at the
+     * requested scope. Does not itself call the node -- callers invoke
+     * their own `revokeDelegation`/`DelegationManager.revoke` with the
+     * returned CID, then call {@link markRevoked} once that succeeds.
+     */
+    revocationTarget(shareId: string, scope: SenderShareRevocationScope): Promise<string>;
+    /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */
+    markRevoked(shareId: string, revokedAt?: string): Promise<SenderShareRecord>;
+    /** Forget a share and clear its persisted key handle. */
+    remove(shareId: string): Promise<void>;
+}
+/** WebCrypto-backed persistence adapter; links and private material are absent. */
+declare class EncryptedSenderShareHistory {
+    private readonly storage;
+    private readonly key;
+    private readonly now;
+    constructor(storage: EncryptedShareHistoryStorage, key: CryptoKey, now?: () => Date);
+    put(record: SenderShareRecord): Promise<void>;
+    list(): Promise<readonly SenderShareRecord[]>;
+    clear(): Promise<void>;
+}
+
+export { EncryptedSenderShareHistory as E, MemoryEncryptedShareHistoryStorage as M, type SenderShareRecord as S, type SenderShareRecordStorage as a, type EncryptedShareHistoryStorage as b, MemorySenderShareKeyStorage as c, MemorySenderShareRecordStorage as d, type SenderShareKeyStorage as e, type SenderShareRecordProofs as f, type SenderShareRevocationScope as g, SenderShareStore as h, historyRecordForPublishedShare as i };