@tinycloud/share-sdk 1.2.0-beta.4 → 1.2.0-beta.5

package/dist/share-root.d.cts

@@ -1,5 +1,5 @@
 import { CompactUcanAuthorization, UnifiedContentSource } from '@tinycloud/share-envelope';
-import { A as AddressedOwnerRootInput, f as AddressedOwnerRootReceipt, i as AddressedPublishAuthority } from './addressed-publish-DVvTlGog.cjs';
+import { A as AddressedOwnerRootInput, f as AddressedOwnerRootReceipt, i as AddressedPublishAuthority } from './addressed-publish-DtcLNG2m.cjs';
 import { C as CreateOwnerDelegationParams, c as OwnerDelegationReceipt, a as DelegatedShareKey } from './owner-policy-BqzRlkb6.cjs';
 
 /**

package/dist/share-root.d.ts

@@ -1,5 +1,5 @@
 import { CompactUcanAuthorization, UnifiedContentSource } from '@tinycloud/share-envelope';
-import { A as AddressedOwnerRootInput, f as AddressedOwnerRootReceipt, i as AddressedPublishAuthority } from './addressed-publish-BDaGyQA9.js';
+import { A as AddressedOwnerRootInput, f as AddressedOwnerRootReceipt, i as AddressedPublishAuthority } from './addressed-publish-BnSBJ-MX.js';
 import { C as CreateOwnerDelegationParams, c as OwnerDelegationReceipt, a as DelegatedShareKey } from './owner-policy-BqzRlkb6.js';
 
 /**

package/dist/share-root.js

@@ -5312,6 +5312,20 @@ var v3TargetSchema = external_exports.object({
   nodeAudience: external_exports.string().min(1),
   spaceId: external_exports.string().refine(isCanonicalPathSegment, { message: "expected a canonical space id" })
 }).strict();
+var ARTIFACT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{2,62}$/;
+var artifactPinSchema = external_exports.object({
+  v: external_exports.literal(1),
+  artifactId: external_exports.string().regex(ARTIFACT_ID_PATTERN),
+  version: external_exports.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+  /** SHA-256 (lowercase hex) of the exact `manifest.json` bytes. The manifest itself stays an owner-side record. */
+  manifestSha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  /** An addressed share reads one exact file, so exactly one entry: the stored bytes (ciphertext) it will fetch. */
+  files: external_exports.array(external_exports.object({
+    path: external_exports.string().min(1).max(255),
+    sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+    bytes: external_exports.number().int().nonnegative()
+  }).strict()).length(1)
+}).strict();
 var unsignedShareEnvelopeV3BaseSchema = external_exports.object({
   version: external_exports.literal(3),
   shareId: external_exports.string().min(1),
@@ -5331,7 +5345,13 @@ var unsignedShareEnvelopeV3BaseSchema = external_exports.object({
   expiry: external_exports.string().datetime({ offset: true }),
   display: displaySchema,
   encrypted: external_exports.literal(true),
-  metadata: contentMetadataSchema
+  metadata: contentMetadataSchema,
+  /**
+   * TC-1428: an owner-signed statement that this share reads one write-once artifact version. Additive: absent on
+   * every other share, and covered by the envelope signature because the signature spans the whole unsigned object.
+   * The shape is checked here; its binding to the content source is `verifyArtifactShare` in share-sdk.
+   */
+  artifactPin: artifactPinSchema.optional()
 }).strict();
 function validateV3Invariants(value, ctx) {
   const actions = [...value.actions];
@@ -6985,6 +7005,8 @@ async function ensureShareRoot(input) {
 
 // src/artifact.ts
 import { sha256 as sha2564 } from "@noble/hashes/sha256";
+
+// src/artifact-core.ts
 function parseArtifactVersionPath(path) {
   const match = /^artifacts\/([a-z0-9][a-z0-9_-]{2,62})\/versions\/([1-9][0-9]{0,14})\/([^/]+)$/.exec(path);
   if (match === null) return void 0;