@tinycloud/share-sdk 1.2.0-beta.3 → 1.2.0-beta.4

package/dist/history-CyT6x8h4.d.ts

@@ -0,0 +1,180 @@
+import { d as OwnerShareAction, f as OwnerShareMatcher, j as PublishedShareDeliveryMaterial, q as SignedDelegation, h as OwnerSharePolicyRegistrationReceipt, a as DelegatedShareKey, P as PublishedShare } from './owner-policy-BqzRlkb6.js';
+
+interface EncryptedShareHistoryStorage {
+    put(value: Uint8Array): Promise<void>;
+    list(): Promise<readonly Uint8Array[]>;
+    clear(): Promise<void>;
+}
+declare class MemoryEncryptedShareHistoryStorage implements EncryptedShareHistoryStorage {
+    private readonly values;
+    put(value: Uint8Array): Promise<void>;
+    list(): Promise<readonly Uint8Array[]>;
+    clear(): Promise<void>;
+}
+/**
+ * The durable record a sender needs, after a reload, to display and manage
+ * a share it created. Every identity/CID here comes verbatim from the
+ * Node-verified {@link OwnerSharePolicyRegistrationReceipt}; nothing is
+ * re-derived or guessed.
+ */
+interface SenderShareRecord {
+    readonly shareId: string;
+    readonly registrationCid?: string;
+    readonly policyCid?: string;
+    readonly ownerDelegationCid?: string;
+    readonly enforcementDelegationCid?: string;
+    readonly shareKeyDid?: string;
+    readonly ownerDid?: string;
+    readonly enforcerDid?: string;
+    readonly target: {
+        readonly origin: string;
+        readonly nodeAudience: string;
+        readonly spaceId: string;
+    };
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly path: string;
+    };
+    readonly actions: readonly OwnerShareAction[];
+    readonly recipientMatcher: OwnerShareMatcher;
+    /** The signed target discriminator, retained separately from the email matcher. */
+    readonly targetKind?: "bearer" | "recipientDid" | "email" | "emailDomain";
+    readonly registeredAt: string;
+    readonly expiresAt: string;
+    readonly revokedAt?: string;
+    readonly envelopeCid?: string;
+    readonly shareCid?: string;
+    /** Complete bearer links are encrypted at rest and only revealed explicitly. */
+    readonly link?: string;
+    readonly filename?: string;
+    /** Policy/v3 delivery material. The containing history record must remain encrypted at rest. */
+    readonly deliveryMaterial?: PublishedShareDeliveryMaterial;
+    /** Canonical mailboxes whose invitation delivery was confirmed; history is encrypted at rest. */
+    readonly deliveredRecipients?: readonly string[];
+    /**
+     * `migrated`: imported once from a CLI's local history by the OWNER's
+     * session (slice 5), at an owner-layout key `records/<shareId>`. Such a
+     * record is exempt from the ±1-day `registeredAt` window and nothing else:
+     * its chain is verified like an agent record's, it never ranks as a web
+     * row, and it cannot override a revocation. A record claiming `migrated`
+     * inside an agent subtree is rejected.
+     */
+    readonly provenance?: "migrated";
+    /**
+     * The signed chain behind every CID this record claims (TC-1432 C1), as
+     * exact bytes. Agent records carry it so the owner's browser can verify
+     * the chain without a node lookup. Policy/v3 records prove through
+     * `deliveryMaterial.envelope` plus `session`.
+     */
+    readonly proofs?: SenderShareRecordProofs;
+}
+interface SenderShareRecordProofs {
+    /** Owner→session SIWE CACAO (base64url DAG-CBOR) of the issuing session; absent when it is gone. */
+    readonly session?: string;
+    /** Native bearer link delegation (compact UCAN); its CID is `enforcementDelegationCid`. */
+    readonly link?: string;
+    /** Policy/v2 owner-policy chain: policy bytes (base64url), owner→share-key SIWE CACAO (base64url), enforcement delegation and node registration receipt. */
+    readonly ownerPolicy?: string;
+    readonly ownerDelegation?: string;
+    readonly enforcementDelegation?: SignedDelegation;
+    readonly registration?: OwnerSharePolicyRegistrationReceipt;
+}
+/** Create the durable encrypted-history shape from canonical publication receipts. */
+declare function historyRecordForPublishedShare(result: PublishedShare, now?: Date): SenderShareRecord;
+/**
+ * "direct" selects the Policy/v3 enforcement root; "ancestor" selects its
+ * policy-authority sibling. Addressed shares revoke that signed root through
+ * the Node Policy/v3 endpoint, which cuts off existing sessions as well as
+ * fresh admission and delivery. Bearer shares retain ordinary delegation
+ * revocation.
+ */
+type SenderShareRevocationScope = "direct" | "ancestor";
+interface SenderShareRecordStorage {
+    put(record: SenderShareRecord): Promise<void>;
+    /** Atomically transform the latest record, if present. Implementations that
+     * provide this must serialize the read and write with every other writer. */
+    update?(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
+    list(): Promise<readonly SenderShareRecord[]>;
+    get(shareId: string): Promise<SenderShareRecord | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+interface StoredSenderShareKey {
+    readonly cryptoKey: CryptoKey;
+    readonly publicKey: Uint8Array;
+    readonly extractable: boolean;
+}
+interface SenderShareKeyStorage {
+    put(shareId: string, key: StoredSenderShareKey): Promise<void>;
+    get(shareId: string): Promise<StoredSenderShareKey | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+/** In-memory reference implementation. Real deployments back these with IndexedDB so the non-extractable `CryptoKey` survives a reload via structured clone. */
+declare class MemorySenderShareRecordStorage implements SenderShareRecordStorage {
+    private readonly records;
+    private operation;
+    private serialize;
+    put(record: SenderShareRecord): Promise<void>;
+    update(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
+    list(): Promise<readonly SenderShareRecord[]>;
+    get(shareId: string): Promise<SenderShareRecord | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+declare class MemorySenderShareKeyStorage implements SenderShareKeyStorage {
+    private readonly keys;
+    put(shareId: string, key: StoredSenderShareKey): Promise<void>;
+    get(shareId: string): Promise<StoredSenderShareKey | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+interface SenderShareStoreOptions {
+    readonly records: SenderShareRecordStorage;
+    readonly keys: SenderShareKeyStorage;
+    readonly now?: () => Date;
+}
+/**
+ * Reload-safe sender-side management for shares created through
+ * {@link canonicalOwnerSharePolicy} / `registerOwnerSharePolicy`. Persists
+ * the registration receipt's canonical identity tuple plus the ephemeral
+ * share key's non-extractable `CryptoKey` handle, so a sender can list,
+ * inspect, and revoke shares it created in an earlier session -- without
+ * ever re-exporting private key material.
+ */
+declare class SenderShareStore {
+    private readonly records;
+    private readonly keys;
+    private readonly now;
+    constructor(options: SenderShareStoreOptions);
+    /** Persist a Node-verified registration receipt and its share key handle. */
+    save(receipt: OwnerSharePolicyRegistrationReceipt, key: DelegatedShareKey): Promise<SenderShareRecord>;
+    /** List shares created in any session, most recent first. */
+    list(options?: {
+        readonly includeRevoked?: boolean;
+        readonly includeExpired?: boolean;
+    }): Promise<readonly SenderShareRecord[]>;
+    get(shareId: string): Promise<SenderShareRecord | undefined>;
+    /** Recover a signer for the persisted share key after a reload. */
+    loadKey(shareId: string): Promise<DelegatedShareKey | undefined>;
+    /**
+     * The delegation CID to pass to the node's existing generic
+     * `tinycloud.delegation/revoke` invocation to revoke this share at the
+     * requested scope. Does not itself call the node -- callers invoke
+     * their own `revokeDelegation`/`DelegationManager.revoke` with the
+     * returned CID, then call {@link markRevoked} once that succeeds.
+     */
+    revocationTarget(shareId: string, scope: SenderShareRevocationScope): Promise<string>;
+    /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */
+    markRevoked(shareId: string, revokedAt?: string): Promise<SenderShareRecord>;
+    /** Forget a share and clear its persisted key handle. */
+    remove(shareId: string): Promise<void>;
+}
+/** WebCrypto-backed persistence adapter; links and private material are absent. */
+declare class EncryptedSenderShareHistory {
+    private readonly storage;
+    private readonly key;
+    private readonly now;
+    constructor(storage: EncryptedShareHistoryStorage, key: CryptoKey, now?: () => Date);
+    put(record: SenderShareRecord): Promise<void>;
+    list(): Promise<readonly SenderShareRecord[]>;
+    clear(): Promise<void>;
+}
+
+export { EncryptedSenderShareHistory as E, MemoryEncryptedShareHistoryStorage as M, type SenderShareRecord as S, type SenderShareRecordStorage as a, type EncryptedShareHistoryStorage as b, MemorySenderShareKeyStorage as c, MemorySenderShareRecordStorage as d, type SenderShareKeyStorage as e, type SenderShareRecordProofs as f, type SenderShareRevocationScope as g, SenderShareStore as h, historyRecordForPublishedShare as i };