@tinycloud/share-sdk 1.2.0-beta.3 → 1.2.0-beta.5

package/dist/index.d.cts

@@ -1,7 +1,10 @@
-import { ShareEnvelopeV3, ShareEnvelopeV2 } from '@tinycloud/share-envelope';
+import { ShareEnvelopeV3, ShareEnvelopeV2, ArtifactPin, UnsignedShareEnvelopeV3 } from '@tinycloud/share-envelope';
 export { CheckBearerDelegationOptions, DelegationCheckResult, canonicalize, checkBearerDelegation, fromBase64Url, requiredResourceUri, resourceUriCovers, toBase64Url } from '@tinycloud/share-envelope';
-import { S as ShareAuthorizationMethod, O as OwnerShareAction, a as OwnerShareMatcher, P as PublishedShareDeliveryMaterial, b as OwnerSharePolicyRegistrationReceipt, D as DelegatedShareKey, c as PublishedShare, d as ShareAuthorizedContent, e as ShareAuthorizationAdapter, T as TargetPublishOutcome, f as TargetPublishInput, g as ShareAuthorizationResult, h as ShareTarget } from './addressed-publish-CsUS7-SI.cjs';
-export { A as AddressedOwnerRootInput, i as AddressedOwnerRootReceipt, j as AddressedPolicyRegistrationInput, k as AddressedPolicyRegistrationReceipt, l as AddressedPublishAuthority, m as AddressedSharePublishOptions, n as AddressedShareRequest, C as CreateOwnerDelegationParams, o as DEFAULT_SHARE_LIFETIME_MS, M as MAX_CONTENT_BYTES, p as OWNER_SHARE_REGISTRATION_DOMAIN, q as OwnerDelegationPermission, r as OwnerDelegationReceipt, s as OwnerShareDecryption, t as OwnerSharePolicyRegistration, u as OwnerSharePolicyV2, v as PreparedAddressedShare, w as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, x as SHARE_CONTENT_LIMIT, y as SHARE_PUBLISH_RESULT_VERSION, z as ShareAuthorizationDenied, B as ShareAuthorizationReady, E as ShareAuthorizationRequired, F as SharePublishError, G as SharePublishErrorCode, H as SharePublishOptions, I as SharePublishTarget, J as SignedDelegation, K as TargetPublishAdapter, L as addressedCredentialRequirement, N as authorizationMethodForTarget, Q as authorizeShare, U as canonicalOwnerSharePolicy, V as computeOwnerShareRegistrationCid, W as createDelegatedShareKey, X as createPolicyEnforcementDelegation, Y as normalizeShareTarget, Z as prepareAddressedShare, _ as publishAddressedShare, $ as publishTargetShare, a0 as redactPublishedShare, a1 as restoreDelegatedShareKey, a2 as targetAuthorizationMethod, a3 as validateOwnerSharePolicyRegistration, a4 as validateOwnerSharePolicyRegistrationBytes } from './addressed-publish-CsUS7-SI.cjs';
+import { S as ShareAuthorizationMethod, a as ShareAuthorizedContent, b as ShareAuthorizationAdapter, T as TargetPublishOutcome, c as TargetPublishInput, d as ShareAuthorizationResult, e as ShareTarget } from './addressed-publish-DtcLNG2m.cjs';
+export { A as AddressedOwnerRootInput, f as AddressedOwnerRootReceipt, g as AddressedPolicyRegistrationInput, h as AddressedPolicyRegistrationReceipt, i as AddressedPublishAuthority, j as AddressedSharePublishOptions, k as AddressedShareRequest, P as PreparedAddressedShare, l as ShareAuthorizationDenied, m as ShareAuthorizationReady, n as ShareAuthorizationRequired, o as TargetPublishAdapter, p as addressedCredentialRequirement, q as authorizationMethodForTarget, r as authorizeShare, s as normalizeShareTarget, t as prepareAddressedShare, u as publishAddressedShare, v as publishTargetShare, w as targetAuthorizationMethod } from './addressed-publish-DtcLNG2m.cjs';
+export { C as CreateOwnerDelegationParams, D as DEFAULT_SHARE_LIFETIME_MS, a as DelegatedShareKey, M as MAX_CONTENT_BYTES, O as OWNER_SHARE_REGISTRATION_DOMAIN, b as OwnerDelegationPermission, c as OwnerDelegationReceipt, d as OwnerShareAction, e as OwnerShareDecryption, f as OwnerShareMatcher, g as OwnerSharePolicyRegistration, h as OwnerSharePolicyRegistrationReceipt, i as OwnerSharePolicyV2, P as PublishedShare, j as PublishedShareDeliveryMaterial, k as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, S as SHARE_CONTENT_LIMIT, l as SHARE_PUBLISH_RESULT_VERSION, m as SharePublishError, n as SharePublishErrorCode, o as SharePublishOptions, p as SharePublishTarget, q as SignedDelegation, r as canonicalOwnerSharePolicy, s as computeOwnerShareRegistrationCid, t as createDelegatedShareKey, u as createPolicyEnforcementDelegation, v as redactPublishedShare, w as restoreDelegatedShareKey, x as validateOwnerSharePolicyRegistration, y as validateOwnerSharePolicyRegistrationBytes } from './owner-policy-BqzRlkb6.cjs';
+import { S as SenderShareRecord, a as SenderShareRecordStorage } from './history-CUWDK0lE.cjs';
+export { E as EncryptedSenderShareHistory, b as EncryptedShareHistoryStorage, M as MemoryEncryptedShareHistoryStorage, c as MemorySenderShareKeyStorage, d as MemorySenderShareRecordStorage, e as SenderShareKeyStorage, f as SenderShareRecordProofs, g as SenderShareRevocationScope, h as SenderShareStore, i as historyRecordForPublishedShare } from './history-CUWDK0lE.cjs';
 
 declare function hasUnsafeFilenameCodePoint(value: string): boolean;
 /** A single display/download filename, never a path. Returns the NFC form. */
@@ -64,6 +67,11 @@ interface ShareMetadata {
         readonly filename?: string;
         readonly mode?: string;
     };
+    /** Set when the share is pinned to one artifact version; the owner's signature covers it (TC-1428). */
+    readonly artifact?: {
+        readonly id: string;
+        readonly version: number;
+    };
 }
 interface ShareInspection {
     readonly metadata: ShareMetadata;
@@ -139,156 +147,6 @@ declare class MemoryShareCache implements ShareCache {
     clear(): Promise<void>;
 }
 
-interface EncryptedShareHistoryStorage {
-    put(value: Uint8Array): Promise<void>;
-    list(): Promise<readonly Uint8Array[]>;
-    clear(): Promise<void>;
-}
-declare class MemoryEncryptedShareHistoryStorage implements EncryptedShareHistoryStorage {
-    private readonly values;
-    put(value: Uint8Array): Promise<void>;
-    list(): Promise<readonly Uint8Array[]>;
-    clear(): Promise<void>;
-}
-/**
- * The durable record a sender needs, after a reload, to display and manage
- * a share it created. Every identity/CID here comes verbatim from the
- * Node-verified {@link OwnerSharePolicyRegistrationReceipt}; nothing is
- * re-derived or guessed.
- */
-interface SenderShareRecord {
-    readonly shareId: string;
-    readonly registrationCid?: string;
-    readonly policyCid?: string;
-    readonly ownerDelegationCid?: string;
-    readonly enforcementDelegationCid?: string;
-    readonly shareKeyDid?: string;
-    readonly ownerDid?: string;
-    readonly enforcerDid?: string;
-    readonly target: {
-        readonly origin: string;
-        readonly nodeAudience: string;
-        readonly spaceId: string;
-    };
-    readonly resource: {
-        readonly kind: "exact" | "prefix";
-        readonly path: string;
-    };
-    readonly actions: readonly OwnerShareAction[];
-    readonly recipientMatcher: OwnerShareMatcher;
-    /** The signed target discriminator, retained separately from the email matcher. */
-    readonly targetKind?: "bearer" | "recipientDid" | "email" | "emailDomain";
-    readonly registeredAt: string;
-    readonly expiresAt: string;
-    readonly revokedAt?: string;
-    readonly envelopeCid?: string;
-    readonly shareCid?: string;
-    /** Complete bearer links are encrypted at rest and only revealed explicitly. */
-    readonly link?: string;
-    readonly filename?: string;
-    /** Policy/v3 delivery material. The containing history record must remain encrypted at rest. */
-    readonly deliveryMaterial?: PublishedShareDeliveryMaterial;
-    /** Canonical mailboxes whose invitation delivery was confirmed; history is encrypted at rest. */
-    readonly deliveredRecipients?: readonly string[];
-}
-/** Create the durable encrypted-history shape from canonical publication receipts. */
-declare function historyRecordForPublishedShare(result: PublishedShare, now?: Date): SenderShareRecord;
-/**
- * "direct" selects the Policy/v3 enforcement root; "ancestor" selects its
- * policy-authority sibling. Addressed shares revoke that signed root through
- * the Node Policy/v3 endpoint, which cuts off existing sessions as well as
- * fresh admission and delivery. Bearer shares retain ordinary delegation
- * revocation.
- */
-type SenderShareRevocationScope = "direct" | "ancestor";
-interface SenderShareRecordStorage {
-    put(record: SenderShareRecord): Promise<void>;
-    /** Atomically transform the latest record, if present. Implementations that
-     * provide this must serialize the read and write with every other writer. */
-    update?(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
-    list(): Promise<readonly SenderShareRecord[]>;
-    get(shareId: string): Promise<SenderShareRecord | undefined>;
-    delete(shareId: string): Promise<void>;
-}
-interface StoredSenderShareKey {
-    readonly cryptoKey: CryptoKey;
-    readonly publicKey: Uint8Array;
-    readonly extractable: boolean;
-}
-interface SenderShareKeyStorage {
-    put(shareId: string, key: StoredSenderShareKey): Promise<void>;
-    get(shareId: string): Promise<StoredSenderShareKey | undefined>;
-    delete(shareId: string): Promise<void>;
-}
-/** In-memory reference implementation. Real deployments back these with IndexedDB so the non-extractable `CryptoKey` survives a reload via structured clone. */
-declare class MemorySenderShareRecordStorage implements SenderShareRecordStorage {
-    private readonly records;
-    private operation;
-    private serialize;
-    put(record: SenderShareRecord): Promise<void>;
-    update(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
-    list(): Promise<readonly SenderShareRecord[]>;
-    get(shareId: string): Promise<SenderShareRecord | undefined>;
-    delete(shareId: string): Promise<void>;
-}
-declare class MemorySenderShareKeyStorage implements SenderShareKeyStorage {
-    private readonly keys;
-    put(shareId: string, key: StoredSenderShareKey): Promise<void>;
-    get(shareId: string): Promise<StoredSenderShareKey | undefined>;
-    delete(shareId: string): Promise<void>;
-}
-interface SenderShareStoreOptions {
-    readonly records: SenderShareRecordStorage;
-    readonly keys: SenderShareKeyStorage;
-    readonly now?: () => Date;
-}
-/**
- * Reload-safe sender-side management for shares created through
- * {@link canonicalOwnerSharePolicy} / `registerOwnerSharePolicy`. Persists
- * the registration receipt's canonical identity tuple plus the ephemeral
- * share key's non-extractable `CryptoKey` handle, so a sender can list,
- * inspect, and revoke shares it created in an earlier session -- without
- * ever re-exporting private key material.
- */
-declare class SenderShareStore {
-    private readonly records;
-    private readonly keys;
-    private readonly now;
-    constructor(options: SenderShareStoreOptions);
-    /** Persist a Node-verified registration receipt and its share key handle. */
-    save(receipt: OwnerSharePolicyRegistrationReceipt, key: DelegatedShareKey): Promise<SenderShareRecord>;
-    /** List shares created in any session, most recent first. */
-    list(options?: {
-        readonly includeRevoked?: boolean;
-        readonly includeExpired?: boolean;
-    }): Promise<readonly SenderShareRecord[]>;
-    get(shareId: string): Promise<SenderShareRecord | undefined>;
-    /** Recover a signer for the persisted share key after a reload. */
-    loadKey(shareId: string): Promise<DelegatedShareKey | undefined>;
-    /**
-     * The delegation CID to pass to the node's existing generic
-     * `tinycloud.delegation/revoke` invocation to revoke this share at the
-     * requested scope. Does not itself call the node -- callers invoke
-     * their own `revokeDelegation`/`DelegationManager.revoke` with the
-     * returned CID, then call {@link markRevoked} once that succeeds.
-     */
-    revocationTarget(shareId: string, scope: SenderShareRevocationScope): Promise<string>;
-    /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */
-    markRevoked(shareId: string, revokedAt?: string): Promise<SenderShareRecord>;
-    /** Forget a share and clear its persisted key handle. */
-    remove(shareId: string): Promise<void>;
-}
-/** WebCrypto-backed persistence adapter; links and private material are absent. */
-declare class EncryptedSenderShareHistory {
-    private readonly storage;
-    private readonly key;
-    private readonly now;
-    constructor(storage: EncryptedShareHistoryStorage, key: CryptoKey, now?: () => Date);
-    put(record: SenderShareRecord): Promise<void>;
-    list(): Promise<readonly SenderShareRecord[]>;
-    clear(): Promise<void>;
-}
-
 type ShareNotifyState = "delivered" | "already-delivered" | "partial-failure";
 interface ShareNotifyResult {
     readonly protocol: "tinycloud-share";
@@ -632,4 +490,85 @@ declare function parseNativeShareUrl(value: string): string;
 /** Receive through the public SDK without creating another transport protocol. */
 declare function openNativeShare(sharing: NativeSharingService, link: string): Promise<unknown>;
 
-export { CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, OwnerShareAction, OwnerShareMatcher, OwnerSharePolicyRegistrationReceipt, type ParsedAddressedEnvelope, PublishedShare, PublishedShareDeliveryMaterial, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, ShareAuthorizationAdapter, ShareAuthorizationMethod, ShareAuthorizationResult, ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, ShareTarget, TargetPublishInput, TargetPublishOutcome, canonicalShareFilename, claimShare, createAddressedAuthorization, createNativeShare, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, historyRecordForPublishedShare, inspectShare, listShares, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, publishPolicyShare, receiveShare, recipientMatchesShareRecord, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, toShareErrorInfo };
+/**
+ * Artifact pin verification (TC-1428). Small on purpose: this is the one place that decides whether an addressed
+ * share that reads an artifact version may be trusted.
+ *
+ * What is signed. The owner signs the whole Policy/v3 envelope (Ed25519, `verifyEnvelopeV3SignatureOnly`). `artifactPin` is a
+ * field of that envelope, so the signature covers it: artifact id, version, the sha256 of the version's
+ * `manifest.json`, and the sha256 and size of the one stored file the share reads. The manifest stays an owner-side
+ * record; a recipient never needs to fetch it. Policy/v3 already binds the file's ciphertext digest
+ * (`contentSource.initialCiphertextDigestHex`); the pin binds that digest to an artifact identity and a version, so a
+ * share cannot be re-pointed at another version or another artifact's path without breaking the signature.
+ *
+ * Trust model (accepted, TC-1428 finding 3): the owner is the trusted signer. The node has no write-once ACL, so the
+ * owner (or whoever holds the owner's session) can overwrite `versions/<n>/<file>` afterwards. A recipient then
+ * detects the substitution through the pin digest and fails closed; it cannot tell a malicious owner from a node
+ * serving stale or altered bytes, and does not try to.
+ *
+ * Fails closed: any addressed share whose content source lies under `artifacts/` must carry a valid pin that matches
+ * that source. A pin on any other path is refused. `artifacts/<id>/current/...` has no pin form in v1 and is refused.
+ */
+
+type ArtifactPinErrorCode = "missing-pin" | "unsupported-artifact-path" | "wrong-signer" | "bad-signature" | "pin-source-mismatch" | "pinned-share-writable" | "expectation-mismatch" | "file-digest-mismatch" | "manifest-mismatch";
+declare class ArtifactPinError extends Error {
+    readonly code: ArtifactPinErrorCode;
+    /** The code is the message: stable, short, and what callers and tests match on. */
+    constructor(code: ArtifactPinErrorCode);
+}
+/**
+ * What the caller already knows about the share it is opening, from outside the envelope. Optional: a v1 pinned share
+ * names its version in its own signed pin and nothing outside the link says which one to expect, so no production
+ * caller passes it. A caller that does learn a version out of band (a listing, a "newer version" link) uses it to
+ * refuse an older or different pin.
+ */
+interface ExpectedArtifact {
+    readonly artifactId?: string;
+    readonly version?: number;
+}
+interface VerifyArtifactShareOptions {
+    /** The did:key the caller trusts as the sender. `signature.signerDid` is self-asserted and proves nothing alone. */
+    readonly expectedOwnerDid: string;
+    readonly expected?: ExpectedArtifact;
+}
+/**
+ * The fields of an envelope (or of a share about to be built) that the pin binds. Taking a view lets the publisher run
+ * the identical check before it registers anything, and the recipient run it again where it reads.
+ */
+interface ArtifactBindingView {
+    readonly artifactPin?: ArtifactPin;
+    readonly target: {
+        readonly spaceId: string;
+    };
+    readonly contentSource: {
+        readonly kvResource: string;
+        readonly selector: "exact" | "prefix";
+        readonly mode: "mutable" | "immutable";
+        readonly initialCiphertextDigestHex?: string | undefined;
+    };
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly path: string;
+    };
+    /** Share actions (`read` | `list` | `edit`). */
+    readonly actions: readonly string[];
+    /** KV abilities the signed policy grants on the content source. */
+    readonly policyKvActions: readonly string[];
+}
+declare function artifactBindingView(envelope: UnsignedShareEnvelopeV3 | ShareEnvelopeV3): ArtifactBindingView;
+/**
+ * The pin and the content source must say the same thing, and a pinned share must be read-only. Synchronous and
+ * signature-free, so the publisher can run it before registering anything and the recipient can re-run it at the
+ * point of reading. Returns the pin for an artifact share and `undefined` for any other share.
+ */
+declare function assertArtifactBinding(view: ArtifactBindingView, expected?: ExpectedArtifact): ArtifactPin | undefined;
+/**
+ * Check that the trusted owner signed this envelope (and so its pin), then the pin binding. Throws `ArtifactPinError`;
+ * never returns a partial answer. Only the owner's Ed25519 signature over the envelope is checked here, because that
+ * is what authenticates the pin. The rest of the envelope (policy signature, owner roots, enforcer binding) is
+ * `verifyEnvelopeV3`'s job, and `resolvePolicyShare` runs both before it trusts a link. (Folding the two into one
+ * call was measured: +911 gzip bytes in the canonical ESM bundle, for a saved ed25519 verify.)
+ */
+declare function verifyArtifactShare(envelope: ShareEnvelopeV3, options: VerifyArtifactShareOptions): ArtifactPin | undefined;
+
+export { type ArtifactBindingView, ArtifactPinError, type ArtifactPinErrorCode, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, type ExpectedArtifact, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, type ParsedAddressedEnvelope, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, SenderShareRecord, SenderShareRecordStorage, ShareAuthorizationAdapter, ShareAuthorizationMethod, ShareAuthorizationResult, ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, ShareTarget, TargetPublishInput, TargetPublishOutcome, type VerifyArtifactShareOptions, artifactBindingView, assertArtifactBinding, canonicalShareFilename, claimShare, createAddressedAuthorization, createNativeShare, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, inspectShare, listShares, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, publishPolicyShare, receiveShare, recipientMatchesShareRecord, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, toShareErrorInfo, verifyArtifactShare };

package/dist/index.d.ts

@@ -1,7 +1,10 @@
-import { ShareEnvelopeV3, ShareEnvelopeV2 } from '@tinycloud/share-envelope';
+import { ShareEnvelopeV3, ShareEnvelopeV2, ArtifactPin, UnsignedShareEnvelopeV3 } from '@tinycloud/share-envelope';
 export { CheckBearerDelegationOptions, DelegationCheckResult, canonicalize, checkBearerDelegation, fromBase64Url, requiredResourceUri, resourceUriCovers, toBase64Url } from '@tinycloud/share-envelope';
-import { S as ShareAuthorizationMethod, O as OwnerShareAction, a as OwnerShareMatcher, P as PublishedShareDeliveryMaterial, b as OwnerSharePolicyRegistrationReceipt, D as DelegatedShareKey, c as PublishedShare, d as ShareAuthorizedContent, e as ShareAuthorizationAdapter, T as TargetPublishOutcome, f as TargetPublishInput, g as ShareAuthorizationResult, h as ShareTarget } from './addressed-publish-CsUS7-SI.js';
-export { A as AddressedOwnerRootInput, i as AddressedOwnerRootReceipt, j as AddressedPolicyRegistrationInput, k as AddressedPolicyRegistrationReceipt, l as AddressedPublishAuthority, m as AddressedSharePublishOptions, n as AddressedShareRequest, C as CreateOwnerDelegationParams, o as DEFAULT_SHARE_LIFETIME_MS, M as MAX_CONTENT_BYTES, p as OWNER_SHARE_REGISTRATION_DOMAIN, q as OwnerDelegationPermission, r as OwnerDelegationReceipt, s as OwnerShareDecryption, t as OwnerSharePolicyRegistration, u as OwnerSharePolicyV2, v as PreparedAddressedShare, w as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, x as SHARE_CONTENT_LIMIT, y as SHARE_PUBLISH_RESULT_VERSION, z as ShareAuthorizationDenied, B as ShareAuthorizationReady, E as ShareAuthorizationRequired, F as SharePublishError, G as SharePublishErrorCode, H as SharePublishOptions, I as SharePublishTarget, J as SignedDelegation, K as TargetPublishAdapter, L as addressedCredentialRequirement, N as authorizationMethodForTarget, Q as authorizeShare, U as canonicalOwnerSharePolicy, V as computeOwnerShareRegistrationCid, W as createDelegatedShareKey, X as createPolicyEnforcementDelegation, Y as normalizeShareTarget, Z as prepareAddressedShare, _ as publishAddressedShare, $ as publishTargetShare, a0 as redactPublishedShare, a1 as restoreDelegatedShareKey, a2 as targetAuthorizationMethod, a3 as validateOwnerSharePolicyRegistration, a4 as validateOwnerSharePolicyRegistrationBytes } from './addressed-publish-CsUS7-SI.js';
+import { S as ShareAuthorizationMethod, a as ShareAuthorizedContent, b as ShareAuthorizationAdapter, T as TargetPublishOutcome, c as TargetPublishInput, d as ShareAuthorizationResult, e as ShareTarget } from './addressed-publish-BnSBJ-MX.js';
+export { A as AddressedOwnerRootInput, f as AddressedOwnerRootReceipt, g as AddressedPolicyRegistrationInput, h as AddressedPolicyRegistrationReceipt, i as AddressedPublishAuthority, j as AddressedSharePublishOptions, k as AddressedShareRequest, P as PreparedAddressedShare, l as ShareAuthorizationDenied, m as ShareAuthorizationReady, n as ShareAuthorizationRequired, o as TargetPublishAdapter, p as addressedCredentialRequirement, q as authorizationMethodForTarget, r as authorizeShare, s as normalizeShareTarget, t as prepareAddressedShare, u as publishAddressedShare, v as publishTargetShare, w as targetAuthorizationMethod } from './addressed-publish-BnSBJ-MX.js';
+export { C as CreateOwnerDelegationParams, D as DEFAULT_SHARE_LIFETIME_MS, a as DelegatedShareKey, M as MAX_CONTENT_BYTES, O as OWNER_SHARE_REGISTRATION_DOMAIN, b as OwnerDelegationPermission, c as OwnerDelegationReceipt, d as OwnerShareAction, e as OwnerShareDecryption, f as OwnerShareMatcher, g as OwnerSharePolicyRegistration, h as OwnerSharePolicyRegistrationReceipt, i as OwnerSharePolicyV2, P as PublishedShare, j as PublishedShareDeliveryMaterial, k as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, S as SHARE_CONTENT_LIMIT, l as SHARE_PUBLISH_RESULT_VERSION, m as SharePublishError, n as SharePublishErrorCode, o as SharePublishOptions, p as SharePublishTarget, q as SignedDelegation, r as canonicalOwnerSharePolicy, s as computeOwnerShareRegistrationCid, t as createDelegatedShareKey, u as createPolicyEnforcementDelegation, v as redactPublishedShare, w as restoreDelegatedShareKey, x as validateOwnerSharePolicyRegistration, y as validateOwnerSharePolicyRegistrationBytes } from './owner-policy-BqzRlkb6.js';
+import { S as SenderShareRecord, a as SenderShareRecordStorage } from './history-CyT6x8h4.js';
+export { E as EncryptedSenderShareHistory, b as EncryptedShareHistoryStorage, M as MemoryEncryptedShareHistoryStorage, c as MemorySenderShareKeyStorage, d as MemorySenderShareRecordStorage, e as SenderShareKeyStorage, f as SenderShareRecordProofs, g as SenderShareRevocationScope, h as SenderShareStore, i as historyRecordForPublishedShare } from './history-CyT6x8h4.js';
 
 declare function hasUnsafeFilenameCodePoint(value: string): boolean;
 /** A single display/download filename, never a path. Returns the NFC form. */
@@ -64,6 +67,11 @@ interface ShareMetadata {
         readonly filename?: string;
         readonly mode?: string;
     };
+    /** Set when the share is pinned to one artifact version; the owner's signature covers it (TC-1428). */
+    readonly artifact?: {
+        readonly id: string;
+        readonly version: number;
+    };
 }
 interface ShareInspection {
     readonly metadata: ShareMetadata;
@@ -139,156 +147,6 @@ declare class MemoryShareCache implements ShareCache {
     clear(): Promise<void>;
 }
 
-interface EncryptedShareHistoryStorage {
-    put(value: Uint8Array): Promise<void>;
-    list(): Promise<readonly Uint8Array[]>;
-    clear(): Promise<void>;
-}
-declare class MemoryEncryptedShareHistoryStorage implements EncryptedShareHistoryStorage {
-    private readonly values;
-    put(value: Uint8Array): Promise<void>;
-    list(): Promise<readonly Uint8Array[]>;
-    clear(): Promise<void>;
-}
-/**
- * The durable record a sender needs, after a reload, to display and manage
- * a share it created. Every identity/CID here comes verbatim from the
- * Node-verified {@link OwnerSharePolicyRegistrationReceipt}; nothing is
- * re-derived or guessed.
- */
-interface SenderShareRecord {
-    readonly shareId: string;
-    readonly registrationCid?: string;
-    readonly policyCid?: string;
-    readonly ownerDelegationCid?: string;
-    readonly enforcementDelegationCid?: string;
-    readonly shareKeyDid?: string;
-    readonly ownerDid?: string;
-    readonly enforcerDid?: string;
-    readonly target: {
-        readonly origin: string;
-        readonly nodeAudience: string;
-        readonly spaceId: string;
-    };
-    readonly resource: {
-        readonly kind: "exact" | "prefix";
-        readonly path: string;
-    };
-    readonly actions: readonly OwnerShareAction[];
-    readonly recipientMatcher: OwnerShareMatcher;
-    /** The signed target discriminator, retained separately from the email matcher. */
-    readonly targetKind?: "bearer" | "recipientDid" | "email" | "emailDomain";
-    readonly registeredAt: string;
-    readonly expiresAt: string;
-    readonly revokedAt?: string;
-    readonly envelopeCid?: string;
-    readonly shareCid?: string;
-    /** Complete bearer links are encrypted at rest and only revealed explicitly. */
-    readonly link?: string;
-    readonly filename?: string;
-    /** Policy/v3 delivery material. The containing history record must remain encrypted at rest. */
-    readonly deliveryMaterial?: PublishedShareDeliveryMaterial;
-    /** Canonical mailboxes whose invitation delivery was confirmed; history is encrypted at rest. */
-    readonly deliveredRecipients?: readonly string[];
-}
-/** Create the durable encrypted-history shape from canonical publication receipts. */
-declare function historyRecordForPublishedShare(result: PublishedShare, now?: Date): SenderShareRecord;
-/**
- * "direct" selects the Policy/v3 enforcement root; "ancestor" selects its
- * policy-authority sibling. Addressed shares revoke that signed root through
- * the Node Policy/v3 endpoint, which cuts off existing sessions as well as
- * fresh admission and delivery. Bearer shares retain ordinary delegation
- * revocation.
- */
-type SenderShareRevocationScope = "direct" | "ancestor";
-interface SenderShareRecordStorage {
-    put(record: SenderShareRecord): Promise<void>;
-    /** Atomically transform the latest record, if present. Implementations that
-     * provide this must serialize the read and write with every other writer. */
-    update?(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
-    list(): Promise<readonly SenderShareRecord[]>;
-    get(shareId: string): Promise<SenderShareRecord | undefined>;
-    delete(shareId: string): Promise<void>;
-}
-interface StoredSenderShareKey {
-    readonly cryptoKey: CryptoKey;
-    readonly publicKey: Uint8Array;
-    readonly extractable: boolean;
-}
-interface SenderShareKeyStorage {
-    put(shareId: string, key: StoredSenderShareKey): Promise<void>;
-    get(shareId: string): Promise<StoredSenderShareKey | undefined>;
-    delete(shareId: string): Promise<void>;
-}
-/** In-memory reference implementation. Real deployments back these with IndexedDB so the non-extractable `CryptoKey` survives a reload via structured clone. */
-declare class MemorySenderShareRecordStorage implements SenderShareRecordStorage {
-    private readonly records;
-    private operation;
-    private serialize;
-    put(record: SenderShareRecord): Promise<void>;
-    update(shareId: string, change: (record: SenderShareRecord) => SenderShareRecord | Promise<SenderShareRecord>): Promise<SenderShareRecord | undefined>;
-    list(): Promise<readonly SenderShareRecord[]>;
-    get(shareId: string): Promise<SenderShareRecord | undefined>;
-    delete(shareId: string): Promise<void>;
-}
-declare class MemorySenderShareKeyStorage implements SenderShareKeyStorage {
-    private readonly keys;
-    put(shareId: string, key: StoredSenderShareKey): Promise<void>;
-    get(shareId: string): Promise<StoredSenderShareKey | undefined>;
-    delete(shareId: string): Promise<void>;
-}
-interface SenderShareStoreOptions {
-    readonly records: SenderShareRecordStorage;
-    readonly keys: SenderShareKeyStorage;
-    readonly now?: () => Date;
-}
-/**
- * Reload-safe sender-side management for shares created through
- * {@link canonicalOwnerSharePolicy} / `registerOwnerSharePolicy`. Persists
- * the registration receipt's canonical identity tuple plus the ephemeral
- * share key's non-extractable `CryptoKey` handle, so a sender can list,
- * inspect, and revoke shares it created in an earlier session -- without
- * ever re-exporting private key material.
- */
-declare class SenderShareStore {
-    private readonly records;
-    private readonly keys;
-    private readonly now;
-    constructor(options: SenderShareStoreOptions);
-    /** Persist a Node-verified registration receipt and its share key handle. */
-    save(receipt: OwnerSharePolicyRegistrationReceipt, key: DelegatedShareKey): Promise<SenderShareRecord>;
-    /** List shares created in any session, most recent first. */
-    list(options?: {
-        readonly includeRevoked?: boolean;
-        readonly includeExpired?: boolean;
-    }): Promise<readonly SenderShareRecord[]>;
-    get(shareId: string): Promise<SenderShareRecord | undefined>;
-    /** Recover a signer for the persisted share key after a reload. */
-    loadKey(shareId: string): Promise<DelegatedShareKey | undefined>;
-    /**
-     * The delegation CID to pass to the node's existing generic
-     * `tinycloud.delegation/revoke` invocation to revoke this share at the
-     * requested scope. Does not itself call the node -- callers invoke
-     * their own `revokeDelegation`/`DelegationManager.revoke` with the
-     * returned CID, then call {@link markRevoked} once that succeeds.
-     */
-    revocationTarget(shareId: string, scope: SenderShareRevocationScope): Promise<string>;
-    /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */
-    markRevoked(shareId: string, revokedAt?: string): Promise<SenderShareRecord>;
-    /** Forget a share and clear its persisted key handle. */
-    remove(shareId: string): Promise<void>;
-}
-/** WebCrypto-backed persistence adapter; links and private material are absent. */
-declare class EncryptedSenderShareHistory {
-    private readonly storage;
-    private readonly key;
-    private readonly now;
-    constructor(storage: EncryptedShareHistoryStorage, key: CryptoKey, now?: () => Date);
-    put(record: SenderShareRecord): Promise<void>;
-    list(): Promise<readonly SenderShareRecord[]>;
-    clear(): Promise<void>;
-}
-
 type ShareNotifyState = "delivered" | "already-delivered" | "partial-failure";
 interface ShareNotifyResult {
     readonly protocol: "tinycloud-share";
@@ -632,4 +490,85 @@ declare function parseNativeShareUrl(value: string): string;
 /** Receive through the public SDK without creating another transport protocol. */
 declare function openNativeShare(sharing: NativeSharingService, link: string): Promise<unknown>;
 
-export { CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, DelegatedShareKey, EncryptedSenderShareHistory, type EncryptedShareHistoryStorage, MemoryEncryptedShareHistoryStorage, MemorySenderShareKeyStorage, MemorySenderShareRecordStorage, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, OwnerShareAction, OwnerShareMatcher, OwnerSharePolicyRegistrationReceipt, type ParsedAddressedEnvelope, PublishedShare, PublishedShareDeliveryMaterial, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, type SenderShareKeyStorage, type SenderShareRecord, type SenderShareRecordStorage, type SenderShareRevocationScope, SenderShareStore, ShareAuthorizationAdapter, ShareAuthorizationMethod, ShareAuthorizationResult, ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, ShareTarget, TargetPublishInput, TargetPublishOutcome, canonicalShareFilename, claimShare, createAddressedAuthorization, createNativeShare, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, historyRecordForPublishedShare, inspectShare, listShares, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, publishPolicyShare, receiveShare, recipientMatchesShareRecord, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, toShareErrorInfo };
+/**
+ * Artifact pin verification (TC-1428). Small on purpose: this is the one place that decides whether an addressed
+ * share that reads an artifact version may be trusted.
+ *
+ * What is signed. The owner signs the whole Policy/v3 envelope (Ed25519, `verifyEnvelopeV3SignatureOnly`). `artifactPin` is a
+ * field of that envelope, so the signature covers it: artifact id, version, the sha256 of the version's
+ * `manifest.json`, and the sha256 and size of the one stored file the share reads. The manifest stays an owner-side
+ * record; a recipient never needs to fetch it. Policy/v3 already binds the file's ciphertext digest
+ * (`contentSource.initialCiphertextDigestHex`); the pin binds that digest to an artifact identity and a version, so a
+ * share cannot be re-pointed at another version or another artifact's path without breaking the signature.
+ *
+ * Trust model (accepted, TC-1428 finding 3): the owner is the trusted signer. The node has no write-once ACL, so the
+ * owner (or whoever holds the owner's session) can overwrite `versions/<n>/<file>` afterwards. A recipient then
+ * detects the substitution through the pin digest and fails closed; it cannot tell a malicious owner from a node
+ * serving stale or altered bytes, and does not try to.
+ *
+ * Fails closed: any addressed share whose content source lies under `artifacts/` must carry a valid pin that matches
+ * that source. A pin on any other path is refused. `artifacts/<id>/current/...` has no pin form in v1 and is refused.
+ */
+
+type ArtifactPinErrorCode = "missing-pin" | "unsupported-artifact-path" | "wrong-signer" | "bad-signature" | "pin-source-mismatch" | "pinned-share-writable" | "expectation-mismatch" | "file-digest-mismatch" | "manifest-mismatch";
+declare class ArtifactPinError extends Error {
+    readonly code: ArtifactPinErrorCode;
+    /** The code is the message: stable, short, and what callers and tests match on. */
+    constructor(code: ArtifactPinErrorCode);
+}
+/**
+ * What the caller already knows about the share it is opening, from outside the envelope. Optional: a v1 pinned share
+ * names its version in its own signed pin and nothing outside the link says which one to expect, so no production
+ * caller passes it. A caller that does learn a version out of band (a listing, a "newer version" link) uses it to
+ * refuse an older or different pin.
+ */
+interface ExpectedArtifact {
+    readonly artifactId?: string;
+    readonly version?: number;
+}
+interface VerifyArtifactShareOptions {
+    /** The did:key the caller trusts as the sender. `signature.signerDid` is self-asserted and proves nothing alone. */
+    readonly expectedOwnerDid: string;
+    readonly expected?: ExpectedArtifact;
+}
+/**
+ * The fields of an envelope (or of a share about to be built) that the pin binds. Taking a view lets the publisher run
+ * the identical check before it registers anything, and the recipient run it again where it reads.
+ */
+interface ArtifactBindingView {
+    readonly artifactPin?: ArtifactPin;
+    readonly target: {
+        readonly spaceId: string;
+    };
+    readonly contentSource: {
+        readonly kvResource: string;
+        readonly selector: "exact" | "prefix";
+        readonly mode: "mutable" | "immutable";
+        readonly initialCiphertextDigestHex?: string | undefined;
+    };
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly path: string;
+    };
+    /** Share actions (`read` | `list` | `edit`). */
+    readonly actions: readonly string[];
+    /** KV abilities the signed policy grants on the content source. */
+    readonly policyKvActions: readonly string[];
+}
+declare function artifactBindingView(envelope: UnsignedShareEnvelopeV3 | ShareEnvelopeV3): ArtifactBindingView;
+/**
+ * The pin and the content source must say the same thing, and a pinned share must be read-only. Synchronous and
+ * signature-free, so the publisher can run it before registering anything and the recipient can re-run it at the
+ * point of reading. Returns the pin for an artifact share and `undefined` for any other share.
+ */
+declare function assertArtifactBinding(view: ArtifactBindingView, expected?: ExpectedArtifact): ArtifactPin | undefined;
+/**
+ * Check that the trusted owner signed this envelope (and so its pin), then the pin binding. Throws `ArtifactPinError`;
+ * never returns a partial answer. Only the owner's Ed25519 signature over the envelope is checked here, because that
+ * is what authenticates the pin. The rest of the envelope (policy signature, owner roots, enforcer binding) is
+ * `verifyEnvelopeV3`'s job, and `resolvePolicyShare` runs both before it trusts a link. (Folding the two into one
+ * call was measured: +911 gzip bytes in the canonical ESM bundle, for a saved ed25519 verify.)
+ */
+declare function verifyArtifactShare(envelope: ShareEnvelopeV3, options: VerifyArtifactShareOptions): ArtifactPin | undefined;
+
+export { type ArtifactBindingView, ArtifactPinError, type ArtifactPinErrorCode, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, type ExpectedArtifact, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, type ParsedAddressedEnvelope, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, SenderShareRecord, SenderShareRecordStorage, ShareAuthorizationAdapter, ShareAuthorizationMethod, ShareAuthorizationResult, ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, ShareTarget, TargetPublishInput, TargetPublishOutcome, type VerifyArtifactShareOptions, artifactBindingView, assertArtifactBinding, canonicalShareFilename, claimShare, createAddressedAuthorization, createNativeShare, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, inspectShare, listShares, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, publishPolicyShare, receiveShare, recipientMatchesShareRecord, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, toShareErrorInfo, verifyArtifactShare };