@tinycloud/share-sdk 1.2.0-beta.4 → 1.2.0-beta.6

package/dist/{addressed-publish-BDaGyQA9.d.ts → addressed-publish-BnSBJ-MX.d.ts}

@@ -1,4 +1,4 @@
-import { ShareEnvelopeV2, UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1 } from '@tinycloud/share-envelope';
+import { ShareEnvelopeV2, UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1, ArtifactPin } from '@tinycloud/share-envelope';
 import { p as SharePublishTarget, P as PublishedShare, o as SharePublishOptions, d as OwnerShareAction, j as PublishedShareDeliveryMaterial } from './owner-policy-BqzRlkb6.js';
 
 /** The only interactive boundary exposed by the headless SDK. */
@@ -206,6 +206,8 @@ interface AddressedSharePublishOptions {
     readonly mediaType: string;
     readonly byteLength: number;
     readonly artifact?: "html";
+    /** TC-1428: pins the share to one write-once artifact version; signed with the envelope. Required when the content source is under `artifacts/`. */
+    readonly artifactPin?: ArtifactPin;
     readonly deliveryEmail?: string;
     readonly expiresAt: Date;
     /** Sender-history material required by Node's Policy/v3 delivery authorization. */

package/dist/{addressed-publish-DVvTlGog.d.cts → addressed-publish-DtcLNG2m.d.cts}

@@ -1,4 +1,4 @@
-import { ShareEnvelopeV2, UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1 } from '@tinycloud/share-envelope';
+import { ShareEnvelopeV2, UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1, ArtifactPin } from '@tinycloud/share-envelope';
 import { p as SharePublishTarget, P as PublishedShare, o as SharePublishOptions, d as OwnerShareAction, j as PublishedShareDeliveryMaterial } from './owner-policy-BqzRlkb6.cjs';
 
 /** The only interactive boundary exposed by the headless SDK. */
@@ -206,6 +206,8 @@ interface AddressedSharePublishOptions {
     readonly mediaType: string;
     readonly byteLength: number;
     readonly artifact?: "html";
+    /** TC-1428: pins the share to one write-once artifact version; signed with the envelope. Required when the content source is under `artifacts/`. */
+    readonly artifactPin?: ArtifactPin;
     readonly deliveryEmail?: string;
     readonly expiresAt: Date;
     /** Sender-history material required by Node's Policy/v3 delivery authorization. */

package/dist/artifact.cjs

@@ -29,16 +29,18 @@ __export(artifact_exports, {
   artifactVersionResource: () => artifactVersionResource,
   artifactVersionsPrefix: () => artifactVersionsPrefix,
   assertArtifactId: () => assertArtifactId,
+  buildArtifactPin: () => buildArtifactPin,
   listArtifactVersions: () => listArtifactVersions,
   manifestBytes: () => manifestBytes,
   newArtifactId: () => newArtifactId,
   parseArtifactManifest: () => parseArtifactManifest,
   parseArtifactVersionPath: () => parseArtifactVersionPath,
   publishArtifactVersion: () => publishArtifactVersion,
-  sha256Hex: () => sha256Hex
+  sha256Hex: () => sha256Hex,
+  verifyArtifactFileBytes: () => verifyArtifactFileBytes,
+  verifyArtifactManifestBytes: () => verifyArtifactManifestBytes
 });
 module.exports = __toCommonJS(artifact_exports);
-var import_sha2562 = require("@noble/hashes/sha256");
 
 // ../share-envelope/dist/index.js
 var import_sha2 = require("@noble/hashes/sha2");
@@ -5322,6 +5324,20 @@ var v3TargetSchema = external_exports.object({
   nodeAudience: external_exports.string().min(1),
   spaceId: external_exports.string().refine(isCanonicalPathSegment, { message: "expected a canonical space id" })
 }).strict();
+var ARTIFACT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{2,62}$/;
+var artifactPinSchema = external_exports.object({
+  v: external_exports.literal(1),
+  artifactId: external_exports.string().regex(ARTIFACT_ID_PATTERN),
+  version: external_exports.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+  /** SHA-256 (lowercase hex) of the exact `manifest.json` bytes. The manifest itself stays an owner-side record. */
+  manifestSha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  /** An addressed share reads one exact file, so exactly one entry: the stored bytes (ciphertext) it will fetch. */
+  files: external_exports.array(external_exports.object({
+    path: external_exports.string().min(1).max(255),
+    sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+    bytes: external_exports.number().int().nonnegative()
+  }).strict()).length(1)
+}).strict();
 var unsignedShareEnvelopeV3BaseSchema = external_exports.object({
   version: external_exports.literal(3),
   shareId: external_exports.string().min(1),
@@ -5341,7 +5357,13 @@ var unsignedShareEnvelopeV3BaseSchema = external_exports.object({
   expiry: external_exports.string().datetime({ offset: true }),
   display: displaySchema,
   encrypted: external_exports.literal(true),
-  metadata: contentMetadataSchema
+  metadata: contentMetadataSchema,
+  /**
+   * TC-1428: an owner-signed statement that this share reads one write-once artifact version. Additive: absent on
+   * every other share, and covered by the envelope signature because the signature spans the whole unsigned object.
+   * The shape is checked here; its binding to the content source is `verifyArtifactShare` in share-sdk.
+   */
+  artifactPin: artifactPinSchema.optional()
 }).strict();
 function validateV3Invariants(value, ctx) {
   const actions = [...value.actions];
@@ -5440,6 +5462,17 @@ function canonicalize(value) {
 }
 var MAX_INLINE_BYTES = 256 * 1024;
 
+// src/artifact.ts
+var import_sha2562 = require("@noble/hashes/sha256");
+
+// src/artifact-core.ts
+var ARTIFACT_ROOT = "artifacts";
+function parseArtifactVersionPath(path) {
+  const match = /^artifacts\/([a-z0-9][a-z0-9_-]{2,62})\/versions\/([1-9][0-9]{0,14})\/([^/]+)$/.exec(path);
+  if (match === null) return void 0;
+  return { artifactId: match[1], version: Number(match[2]), file: match[3] };
+}
+
 // src/filename-policy.ts
 var UNSAFE_FILENAME_CODE_POINT = /[\p{Cc}\p{Cf}\p{Cs}\u2028\u2029]/u;
 function hasUnsafeFilenameCodePoint(value) {
@@ -5453,8 +5486,21 @@ function canonicalShareFilename(value) {
   return canonical;
 }
 
+// src/artifact-pin.ts
+var ArtifactPinError = class extends Error {
+  code;
+  /** The code is the message: stable, short, and what callers and tests match on. */
+  constructor(code2) {
+    super(code2);
+    this.name = "ArtifactPinError";
+    this.code = code2;
+  }
+};
+
 // src/artifact.ts
-var ARTIFACT_ROOT = "artifacts";
+function sha256Hex(bytes) {
+  return Array.from((0, import_sha2562.sha256)(bytes), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 var ARTIFACT_MANIFEST_NAME = "manifest.json";
 var ARTIFACT_MANIFEST_VERSION = 1;
 var ARTIFACT_MAX_PUBLISH_ATTEMPTS = 16;
@@ -5468,9 +5514,6 @@ var ArtifactError = class extends Error {
     this.code = code2;
   }
 };
-function sha256Hex(bytes) {
-  return Array.from((0, import_sha2562.sha256)(bytes), (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
 function newArtifactId(random = (length2) => crypto.getRandomValues(new Uint8Array(length2))) {
   return `art_${Array.from(random(8), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
@@ -5493,11 +5536,6 @@ function artifactVersionResource(artifactId, version) {
 function artifactVersionFilePath(artifactId, version, filename) {
   return `${artifactVersionResource(artifactId, version)}/${filename}`;
 }
-function parseArtifactVersionPath(path) {
-  const match = /^artifacts\/([a-z0-9][a-z0-9_-]{2,62})\/versions\/([1-9][0-9]{0,14})\/([^/]+)$/.exec(path);
-  if (match === null) return void 0;
-  return { artifactId: match[1], version: Number(match[2]), file: match[3] };
-}
 function manifestBytes(manifest) {
   return new TextEncoder().encode(canonicalize(manifest));
 }
@@ -5643,6 +5681,40 @@ async function publishArtifactVersion(store, input) {
   }
   throw new ArtifactError("conflict", "could not claim an artifact version number after repeated races; retry");
 }
+function buildArtifactPin(version, filename) {
+  const entry = version.manifest.files.find((candidate) => candidate.path === filename);
+  if (entry === void 0) throw new ArtifactError("invalid-argument", "artifact manifest does not list that file");
+  return {
+    v: 1,
+    artifactId: version.artifactId,
+    version: version.version,
+    manifestSha256: version.manifestSha256,
+    files: [{ path: entry.path, sha256: entry.sha256, bytes: entry.bytes }]
+  };
+}
+function verifyArtifactManifestBytes(pin, manifestBytes2) {
+  if (sha256Hex(manifestBytes2) !== pin.manifestSha256) {
+    throw new ArtifactPinError("manifest-mismatch");
+  }
+  let manifest;
+  try {
+    manifest = parseArtifactManifest(manifestBytes2);
+  } catch {
+    throw new ArtifactPinError("manifest-mismatch");
+  }
+  const file = pin.files[0];
+  const listed = manifest.files.find((candidate) => candidate.path === file.path);
+  if (listed === void 0 || listed.sha256 !== file.sha256 || listed.bytes !== file.bytes) {
+    throw new ArtifactPinError("manifest-mismatch");
+  }
+  return manifest;
+}
+function verifyArtifactFileBytes(pin, storedBytes) {
+  const file = pin.files[0];
+  if (storedBytes.byteLength !== file.bytes || sha256Hex(storedBytes) !== file.sha256) {
+    throw new ArtifactPinError("file-digest-mismatch");
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ARTIFACT_MANIFEST_NAME,
@@ -5654,12 +5726,15 @@ async function publishArtifactVersion(store, input) {
   artifactVersionResource,
   artifactVersionsPrefix,
   assertArtifactId,
+  buildArtifactPin,
   listArtifactVersions,
   manifestBytes,
   newArtifactId,
   parseArtifactManifest,
   parseArtifactVersionPath,
   publishArtifactVersion,
-  sha256Hex
+  sha256Hex,
+  verifyArtifactFileBytes,
+  verifyArtifactManifestBytes
 });
 //# sourceMappingURL=artifact.cjs.map