@tinycloud/share-sdk 1.2.1-beta.0 → 1.3.0-beta.0

package/README.md

@@ -0,0 +1,5 @@
+# @tinycloud/share-sdk
+
+## Subpath exports
+
+- `@tinycloud/share-sdk/web-recipient`: `inspectShare`, `ShareRecipientClient`, and the `ShareMetadata` type. The browser recipient surface, imported without the package root barrel. Its contents are fixed to these three names.

package/dist/{addressed-publish-BnSBJ-MX.d.ts → addressed-publish-CAdGCqiX.d.ts}

@@ -1,81 +1,6 @@
-import { ShareEnvelopeV2, UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1, ArtifactPin } from '@tinycloud/share-envelope';
-import { p as SharePublishTarget, P as PublishedShare, o as SharePublishOptions, d as OwnerShareAction, j as PublishedShareDeliveryMaterial } from './owner-policy-BqzRlkb6.js';
-
-/** The only interactive boundary exposed by the headless SDK. */
-type ShareAuthorizationMethod = "openkey-device" | "email-claim" | "email-otp";
-interface ShareAuthorizationRequired {
-    readonly state: "authorization-required";
-    readonly method: ShareAuthorizationMethod;
-    /** A browser-safe continuation location. It must never contain a claim secret. */
-    readonly continueUrl?: string;
-    /** An opaque, short-lived, nonce-bound handle. It is not a bearer credential. */
-    readonly resumeToken?: string;
-}
-interface ShareAuthorizationDenied {
-    readonly state: "denied";
-    readonly reason: "rejected" | "expired" | "revoked" | "unsupported";
-}
-interface ShareAuthorizationReady<T> {
-    readonly state: "ready";
-    readonly value: T;
-}
-type ShareAuthorizationResult<T> = ShareAuthorizationReady<T> | ShareAuthorizationRequired | ShareAuthorizationDenied;
-interface ShareAuthorizationAdapter<T> {
-    begin(input: {
-        readonly envelope: ShareEnvelopeV2;
-        readonly method: ShareAuthorizationMethod;
-    }): Promise<ShareAuthorizationResult<T>>;
-    resume(input: {
-        readonly envelope: ShareEnvelopeV2;
-        readonly method: ShareAuthorizationMethod;
-        readonly resumeToken: string;
-        readonly proof?: unknown;
-    }): Promise<ShareAuthorizationResult<T>>;
-    /** Verify the detached node proof against a pinned authority trust bundle. */
-    readonly verifyResult?: (input: {
-        readonly envelope: ShareEnvelopeV2;
-        readonly value: T;
-        readonly proof: unknown;
-    }) => Promise<boolean>;
-}
-/**
- * A node-authorized addressed read.  Returning plaintext alone is not an
- * authorization result: the caller must also return the signed response
- * binding and digest that the node produced for that exact share.
- */
-interface ShareAuthorizedContent {
-    readonly bytes: Uint8Array;
-    readonly bodyDigest: string;
-    readonly contentSourceDigest: string;
-    readonly binding: {
-        readonly shareId: string;
-        readonly delegationCid: string;
-        readonly authorityMaterialHandle: string;
-        readonly authorityMaterialDigest: string;
-        readonly resource: {
-            readonly kind: "exact" | "prefix";
-            readonly path: string;
-        };
-        readonly action?: string;
-    };
-    /** A detached node proof; self-reported bytes and digests are not authorization. */
-    readonly proof: unknown;
-}
-/**
- * Start or continue a target authorization without ever guessing a device,
- * claim, or delegation secret. Adapters own their protocol and are expected
- * to bind their resume token to a server challenge and expiry.
- */
-declare function authorizeShare<T>(input: {
-    readonly envelope: ShareEnvelopeV2;
-    readonly method: ShareAuthorizationMethod;
-    readonly adapter: ShareAuthorizationAdapter<T>;
-    readonly resumeToken?: string;
-    readonly proof?: unknown;
-}): Promise<ShareAuthorizationResult<T>>;
-declare function authorizationMethodForTarget(target: {
-    readonly kind: string;
-}): ShareAuthorizationMethod | undefined;
+import { UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1, ArtifactPin } from '@tinycloud/share-envelope';
+import { d as SharePublishTarget, c as PublishedShare, e as SharePublishOptions, O as OwnerShareAction, P as PublishedShareDeliveryMaterial } from './owner-policy-CRFeEC98.js';
+import { S as ShareAuthorizationRequired, a as ShareAuthorizationMethod } from './authorization-CmP1skO8.js';
 
 type ShareTarget = SharePublishTarget;
 interface TargetPublishInput {
@@ -239,4 +164,4 @@ declare function prepareAddressedShare(request: AddressedShareRequest): Prepared
 /** Canonical application-neutral Policy/v3 addressed publisher shared by browser and CLI. */
 declare function publishAddressedShare(input: AddressedSharePublishOptions): Promise<PublishedShare>;
 
-export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareAuthorizationMethod as S, type TargetPublishOutcome as T, type ShareAuthorizedContent as a, type ShareAuthorizationAdapter as b, type TargetPublishInput as c, type ShareAuthorizationResult as d, type ShareTarget as e, type AddressedOwnerRootReceipt as f, type AddressedPolicyRegistrationInput as g, type AddressedPolicyRegistrationReceipt as h, type AddressedPublishAuthority as i, type AddressedSharePublishOptions as j, type AddressedShareRequest as k, type ShareAuthorizationDenied as l, type ShareAuthorizationReady as m, type ShareAuthorizationRequired as n, type TargetPublishAdapter as o, addressedCredentialRequirement as p, authorizationMethodForTarget as q, authorizeShare as r, normalizeShareTarget as s, prepareAddressedShare as t, publishAddressedShare as u, publishTargetShare as v, targetAuthorizationMethod as w };
+export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareTarget as S, type TargetPublishOutcome as T, type AddressedOwnerRootReceipt as a, type AddressedPublishAuthority as b, type TargetPublishInput as c, type AddressedPolicyRegistrationInput as d, type AddressedPolicyRegistrationReceipt as e, type AddressedSharePublishOptions as f, type AddressedShareRequest as g, type TargetPublishAdapter as h, addressedCredentialRequirement as i, publishAddressedShare as j, publishTargetShare as k, normalizeShareTarget as n, prepareAddressedShare as p, targetAuthorizationMethod as t };

package/dist/{addressed-publish-DtcLNG2m.d.cts → addressed-publish-Db-6rqkA.d.cts}

@@ -1,81 +1,6 @@
-import { ShareEnvelopeV2, UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1, ArtifactPin } from '@tinycloud/share-envelope';
-import { p as SharePublishTarget, P as PublishedShare, o as SharePublishOptions, d as OwnerShareAction, j as PublishedShareDeliveryMaterial } from './owner-policy-BqzRlkb6.cjs';
-
-/** The only interactive boundary exposed by the headless SDK. */
-type ShareAuthorizationMethod = "openkey-device" | "email-claim" | "email-otp";
-interface ShareAuthorizationRequired {
-    readonly state: "authorization-required";
-    readonly method: ShareAuthorizationMethod;
-    /** A browser-safe continuation location. It must never contain a claim secret. */
-    readonly continueUrl?: string;
-    /** An opaque, short-lived, nonce-bound handle. It is not a bearer credential. */
-    readonly resumeToken?: string;
-}
-interface ShareAuthorizationDenied {
-    readonly state: "denied";
-    readonly reason: "rejected" | "expired" | "revoked" | "unsupported";
-}
-interface ShareAuthorizationReady<T> {
-    readonly state: "ready";
-    readonly value: T;
-}
-type ShareAuthorizationResult<T> = ShareAuthorizationReady<T> | ShareAuthorizationRequired | ShareAuthorizationDenied;
-interface ShareAuthorizationAdapter<T> {
-    begin(input: {
-        readonly envelope: ShareEnvelopeV2;
-        readonly method: ShareAuthorizationMethod;
-    }): Promise<ShareAuthorizationResult<T>>;
-    resume(input: {
-        readonly envelope: ShareEnvelopeV2;
-        readonly method: ShareAuthorizationMethod;
-        readonly resumeToken: string;
-        readonly proof?: unknown;
-    }): Promise<ShareAuthorizationResult<T>>;
-    /** Verify the detached node proof against a pinned authority trust bundle. */
-    readonly verifyResult?: (input: {
-        readonly envelope: ShareEnvelopeV2;
-        readonly value: T;
-        readonly proof: unknown;
-    }) => Promise<boolean>;
-}
-/**
- * A node-authorized addressed read.  Returning plaintext alone is not an
- * authorization result: the caller must also return the signed response
- * binding and digest that the node produced for that exact share.
- */
-interface ShareAuthorizedContent {
-    readonly bytes: Uint8Array;
-    readonly bodyDigest: string;
-    readonly contentSourceDigest: string;
-    readonly binding: {
-        readonly shareId: string;
-        readonly delegationCid: string;
-        readonly authorityMaterialHandle: string;
-        readonly authorityMaterialDigest: string;
-        readonly resource: {
-            readonly kind: "exact" | "prefix";
-            readonly path: string;
-        };
-        readonly action?: string;
-    };
-    /** A detached node proof; self-reported bytes and digests are not authorization. */
-    readonly proof: unknown;
-}
-/**
- * Start or continue a target authorization without ever guessing a device,
- * claim, or delegation secret. Adapters own their protocol and are expected
- * to bind their resume token to a server challenge and expiry.
- */
-declare function authorizeShare<T>(input: {
-    readonly envelope: ShareEnvelopeV2;
-    readonly method: ShareAuthorizationMethod;
-    readonly adapter: ShareAuthorizationAdapter<T>;
-    readonly resumeToken?: string;
-    readonly proof?: unknown;
-}): Promise<ShareAuthorizationResult<T>>;
-declare function authorizationMethodForTarget(target: {
-    readonly kind: string;
-}): ShareAuthorizationMethod | undefined;
+import { UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1, ArtifactPin } from '@tinycloud/share-envelope';
+import { d as SharePublishTarget, c as PublishedShare, e as SharePublishOptions, O as OwnerShareAction, P as PublishedShareDeliveryMaterial } from './owner-policy-CRFeEC98.cjs';
+import { S as ShareAuthorizationRequired, a as ShareAuthorizationMethod } from './authorization-CmP1skO8.cjs';
 
 type ShareTarget = SharePublishTarget;
 interface TargetPublishInput {
@@ -239,4 +164,4 @@ declare function prepareAddressedShare(request: AddressedShareRequest): Prepared
 /** Canonical application-neutral Policy/v3 addressed publisher shared by browser and CLI. */
 declare function publishAddressedShare(input: AddressedSharePublishOptions): Promise<PublishedShare>;
 
-export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareAuthorizationMethod as S, type TargetPublishOutcome as T, type ShareAuthorizedContent as a, type ShareAuthorizationAdapter as b, type TargetPublishInput as c, type ShareAuthorizationResult as d, type ShareTarget as e, type AddressedOwnerRootReceipt as f, type AddressedPolicyRegistrationInput as g, type AddressedPolicyRegistrationReceipt as h, type AddressedPublishAuthority as i, type AddressedSharePublishOptions as j, type AddressedShareRequest as k, type ShareAuthorizationDenied as l, type ShareAuthorizationReady as m, type ShareAuthorizationRequired as n, type TargetPublishAdapter as o, addressedCredentialRequirement as p, authorizationMethodForTarget as q, authorizeShare as r, normalizeShareTarget as s, prepareAddressedShare as t, publishAddressedShare as u, publishTargetShare as v, targetAuthorizationMethod as w };
+export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareTarget as S, type TargetPublishOutcome as T, type AddressedOwnerRootReceipt as a, type AddressedPublishAuthority as b, type TargetPublishInput as c, type AddressedPolicyRegistrationInput as d, type AddressedPolicyRegistrationReceipt as e, type AddressedSharePublishOptions as f, type AddressedShareRequest as g, type TargetPublishAdapter as h, addressedCredentialRequirement as i, publishAddressedShare as j, publishTargetShare as k, normalizeShareTarget as n, prepareAddressedShare as p, targetAuthorizationMethod as t };

package/dist/authorization-CmP1skO8.d.cts

@@ -0,0 +1,79 @@
+import { ShareEnvelopeV2 } from '@tinycloud/share-envelope';
+
+/** The only interactive boundary exposed by the headless SDK. */
+type ShareAuthorizationMethod = "openkey-device" | "email-claim" | "email-otp";
+interface ShareAuthorizationRequired {
+    readonly state: "authorization-required";
+    readonly method: ShareAuthorizationMethod;
+    /** A browser-safe continuation location. It must never contain a claim secret. */
+    readonly continueUrl?: string;
+    /** An opaque, short-lived, nonce-bound handle. It is not a bearer credential. */
+    readonly resumeToken?: string;
+}
+interface ShareAuthorizationDenied {
+    readonly state: "denied";
+    readonly reason: "rejected" | "expired" | "revoked" | "unsupported";
+}
+interface ShareAuthorizationReady<T> {
+    readonly state: "ready";
+    readonly value: T;
+}
+type ShareAuthorizationResult<T> = ShareAuthorizationReady<T> | ShareAuthorizationRequired | ShareAuthorizationDenied;
+interface ShareAuthorizationAdapter<T> {
+    begin(input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly method: ShareAuthorizationMethod;
+    }): Promise<ShareAuthorizationResult<T>>;
+    resume(input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly method: ShareAuthorizationMethod;
+        readonly resumeToken: string;
+        readonly proof?: unknown;
+    }): Promise<ShareAuthorizationResult<T>>;
+    /** Verify the detached node proof against a pinned authority trust bundle. */
+    readonly verifyResult?: (input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly value: T;
+        readonly proof: unknown;
+    }) => Promise<boolean>;
+}
+/**
+ * A node-authorized addressed read.  Returning plaintext alone is not an
+ * authorization result: the caller must also return the signed response
+ * binding and digest that the node produced for that exact share.
+ */
+interface ShareAuthorizedContent {
+    readonly bytes: Uint8Array;
+    readonly bodyDigest: string;
+    readonly contentSourceDigest: string;
+    readonly binding: {
+        readonly shareId: string;
+        readonly delegationCid: string;
+        readonly authorityMaterialHandle: string;
+        readonly authorityMaterialDigest: string;
+        readonly resource: {
+            readonly kind: "exact" | "prefix";
+            readonly path: string;
+        };
+        readonly action?: string;
+    };
+    /** A detached node proof; self-reported bytes and digests are not authorization. */
+    readonly proof: unknown;
+}
+/**
+ * Start or continue a target authorization without ever guessing a device,
+ * claim, or delegation secret. Adapters own their protocol and are expected
+ * to bind their resume token to a server challenge and expiry.
+ */
+declare function authorizeShare<T>(input: {
+    readonly envelope: ShareEnvelopeV2;
+    readonly method: ShareAuthorizationMethod;
+    readonly adapter: ShareAuthorizationAdapter<T>;
+    readonly resumeToken?: string;
+    readonly proof?: unknown;
+}): Promise<ShareAuthorizationResult<T>>;
+declare function authorizationMethodForTarget(target: {
+    readonly kind: string;
+}): ShareAuthorizationMethod | undefined;
+
+export { type ShareAuthorizationRequired as S, type ShareAuthorizationMethod as a, type ShareAuthorizationResult as b, type ShareAuthorizationAdapter as c, type ShareAuthorizationDenied as d, type ShareAuthorizationReady as e, type ShareAuthorizedContent as f, authorizationMethodForTarget as g, authorizeShare as h };

package/dist/authorization-CmP1skO8.d.ts

@@ -0,0 +1,79 @@
+import { ShareEnvelopeV2 } from '@tinycloud/share-envelope';
+
+/** The only interactive boundary exposed by the headless SDK. */
+type ShareAuthorizationMethod = "openkey-device" | "email-claim" | "email-otp";
+interface ShareAuthorizationRequired {
+    readonly state: "authorization-required";
+    readonly method: ShareAuthorizationMethod;
+    /** A browser-safe continuation location. It must never contain a claim secret. */
+    readonly continueUrl?: string;
+    /** An opaque, short-lived, nonce-bound handle. It is not a bearer credential. */
+    readonly resumeToken?: string;
+}
+interface ShareAuthorizationDenied {
+    readonly state: "denied";
+    readonly reason: "rejected" | "expired" | "revoked" | "unsupported";
+}
+interface ShareAuthorizationReady<T> {
+    readonly state: "ready";
+    readonly value: T;
+}
+type ShareAuthorizationResult<T> = ShareAuthorizationReady<T> | ShareAuthorizationRequired | ShareAuthorizationDenied;
+interface ShareAuthorizationAdapter<T> {
+    begin(input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly method: ShareAuthorizationMethod;
+    }): Promise<ShareAuthorizationResult<T>>;
+    resume(input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly method: ShareAuthorizationMethod;
+        readonly resumeToken: string;
+        readonly proof?: unknown;
+    }): Promise<ShareAuthorizationResult<T>>;
+    /** Verify the detached node proof against a pinned authority trust bundle. */
+    readonly verifyResult?: (input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly value: T;
+        readonly proof: unknown;
+    }) => Promise<boolean>;
+}
+/**
+ * A node-authorized addressed read.  Returning plaintext alone is not an
+ * authorization result: the caller must also return the signed response
+ * binding and digest that the node produced for that exact share.
+ */
+interface ShareAuthorizedContent {
+    readonly bytes: Uint8Array;
+    readonly bodyDigest: string;
+    readonly contentSourceDigest: string;
+    readonly binding: {
+        readonly shareId: string;
+        readonly delegationCid: string;
+        readonly authorityMaterialHandle: string;
+        readonly authorityMaterialDigest: string;
+        readonly resource: {
+            readonly kind: "exact" | "prefix";
+            readonly path: string;
+        };
+        readonly action?: string;
+    };
+    /** A detached node proof; self-reported bytes and digests are not authorization. */
+    readonly proof: unknown;
+}
+/**
+ * Start or continue a target authorization without ever guessing a device,
+ * claim, or delegation secret. Adapters own their protocol and are expected
+ * to bind their resume token to a server challenge and expiry.
+ */
+declare function authorizeShare<T>(input: {
+    readonly envelope: ShareEnvelopeV2;
+    readonly method: ShareAuthorizationMethod;
+    readonly adapter: ShareAuthorizationAdapter<T>;
+    readonly resumeToken?: string;
+    readonly proof?: unknown;
+}): Promise<ShareAuthorizationResult<T>>;
+declare function authorizationMethodForTarget(target: {
+    readonly kind: string;
+}): ShareAuthorizationMethod | undefined;
+
+export { type ShareAuthorizationRequired as S, type ShareAuthorizationMethod as a, type ShareAuthorizationResult as b, type ShareAuthorizationAdapter as c, type ShareAuthorizationDenied as d, type ShareAuthorizationReady as e, type ShareAuthorizedContent as f, authorizationMethodForTarget as g, authorizeShare as h };

package/dist/{history-CUWDK0lE.d.cts → history-ZJFHV-IU.d.cts}

@@ -1,4 +1,4 @@
-import { d as OwnerShareAction, f as OwnerShareMatcher, j as PublishedShareDeliveryMaterial, q as SignedDelegation, h as OwnerSharePolicyRegistrationReceipt, a as DelegatedShareKey, P as PublishedShare } from './owner-policy-BqzRlkb6.cjs';
+import { O as OwnerShareAction, a as OwnerShareMatcher, P as PublishedShareDeliveryMaterial, S as SignedDelegation, b as OwnerSharePolicyRegistrationReceipt, D as DelegatedShareKey, c as PublishedShare } from './owner-policy-CRFeEC98.cjs';
 
 interface EncryptedShareHistoryStorage {
     put(value: Uint8Array): Promise<void>;

package/dist/{history-CyT6x8h4.d.ts → history-q0ALXTv7.d.ts}

@@ -1,4 +1,4 @@
-import { d as OwnerShareAction, f as OwnerShareMatcher, j as PublishedShareDeliveryMaterial, q as SignedDelegation, h as OwnerSharePolicyRegistrationReceipt, a as DelegatedShareKey, P as PublishedShare } from './owner-policy-BqzRlkb6.js';
+import { O as OwnerShareAction, a as OwnerShareMatcher, P as PublishedShareDeliveryMaterial, S as SignedDelegation, b as OwnerSharePolicyRegistrationReceipt, D as DelegatedShareKey, c as PublishedShare } from './owner-policy-CRFeEC98.js';
 
 interface EncryptedShareHistoryStorage {
     put(value: Uint8Array): Promise<void>;

package/dist/index.d.cts

@@ -1,105 +1,18 @@
-import { ShareEnvelopeV3, ShareEnvelopeV2, ArtifactPin, UnsignedShareEnvelopeV3 } from '@tinycloud/share-envelope';
+export { D as DEFAULT_MAX_CONTENT_BLOB_BYTES, a as DEFAULT_MAX_SEALED_BLOB_BYTES, S as SHARE_RESULT_VERSION, b as ShareErrorCode, c as ShareErrorInfo, d as ShareFetchOptions, e as ShareInspection, f as ShareMetadata, g as ShareNodeTrust, h as SharePolicyChallenge, i as SharePolicyDelegationLink, j as SharePolicySession, k as SharePresentationMaterial, l as ShareReceiveAuthorizationRequired, m as ShareReceiveError, n as ShareReceiveOutcome, o as ShareReceiveResult, p as ShareRecipientClient, q as ShareRecipientClientOptions, r as createAddressedAuthorization, s as inspectShare, t as receiveShare, u as toShareErrorInfo } from './web-recipient-entry-D9IJEyRA.cjs';
+export { C as CreateOwnerDelegationParams, g as DEFAULT_SHARE_LIFETIME_MS, D as DelegatedShareKey, M as MAX_CONTENT_BYTES, h as OWNER_SHARE_REGISTRATION_DOMAIN, i as OwnerDelegationPermission, f as OwnerDelegationReceipt, O as OwnerShareAction, j as OwnerShareDecryption, a as OwnerShareMatcher, k as OwnerSharePolicyRegistration, b as OwnerSharePolicyRegistrationReceipt, l as OwnerSharePolicyV2, c as PublishedShare, P as PublishedShareDeliveryMaterial, m as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, n as SHARE_CONTENT_LIMIT, o as SHARE_PUBLISH_RESULT_VERSION, p as SharePublishError, q as SharePublishErrorCode, e as SharePublishOptions, d as SharePublishTarget, S as SignedDelegation, r as canonicalOwnerSharePolicy, s as computeOwnerShareRegistrationCid, t as createDelegatedShareKey, u as createPolicyEnforcementDelegation, v as redactPublishedShare, w as restoreDelegatedShareKey, x as validateOwnerSharePolicyRegistration, y as validateOwnerSharePolicyRegistrationBytes } from './owner-policy-CRFeEC98.cjs';
+import { ShareEnvelopeV2, ArtifactPin, UnsignedShareEnvelopeV3, ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 export { CheckBearerDelegationOptions, DelegationCheckResult, canonicalize, checkBearerDelegation, fromBase64Url, requiredResourceUri, resourceUriCovers, toBase64Url } from '@tinycloud/share-envelope';
-import { S as ShareAuthorizationMethod, a as ShareAuthorizedContent, b as ShareAuthorizationAdapter, T as TargetPublishOutcome, c as TargetPublishInput, d as ShareAuthorizationResult, e as ShareTarget } from './addressed-publish-DtcLNG2m.cjs';
-export { A as AddressedOwnerRootInput, f as AddressedOwnerRootReceipt, g as AddressedPolicyRegistrationInput, h as AddressedPolicyRegistrationReceipt, i as AddressedPublishAuthority, j as AddressedSharePublishOptions, k as AddressedShareRequest, P as PreparedAddressedShare, l as ShareAuthorizationDenied, m as ShareAuthorizationReady, n as ShareAuthorizationRequired, o as TargetPublishAdapter, p as addressedCredentialRequirement, q as authorizationMethodForTarget, r as authorizeShare, s as normalizeShareTarget, t as prepareAddressedShare, u as publishAddressedShare, v as publishTargetShare, w as targetAuthorizationMethod } from './addressed-publish-DtcLNG2m.cjs';
-export { C as CreateOwnerDelegationParams, D as DEFAULT_SHARE_LIFETIME_MS, a as DelegatedShareKey, M as MAX_CONTENT_BYTES, O as OWNER_SHARE_REGISTRATION_DOMAIN, b as OwnerDelegationPermission, c as OwnerDelegationReceipt, d as OwnerShareAction, e as OwnerShareDecryption, f as OwnerShareMatcher, g as OwnerSharePolicyRegistration, h as OwnerSharePolicyRegistrationReceipt, i as OwnerSharePolicyV2, P as PublishedShare, j as PublishedShareDeliveryMaterial, k as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, S as SHARE_CONTENT_LIMIT, l as SHARE_PUBLISH_RESULT_VERSION, m as SharePublishError, n as SharePublishErrorCode, o as SharePublishOptions, p as SharePublishTarget, q as SignedDelegation, r as canonicalOwnerSharePolicy, s as computeOwnerShareRegistrationCid, t as createDelegatedShareKey, u as createPolicyEnforcementDelegation, v as redactPublishedShare, w as restoreDelegatedShareKey, x as validateOwnerSharePolicyRegistration, y as validateOwnerSharePolicyRegistrationBytes } from './owner-policy-BqzRlkb6.cjs';
-import { S as SenderShareRecord, a as SenderShareRecordStorage } from './history-CUWDK0lE.cjs';
-export { E as EncryptedSenderShareHistory, b as EncryptedShareHistoryStorage, M as MemoryEncryptedShareHistoryStorage, c as MemorySenderShareKeyStorage, d as MemorySenderShareRecordStorage, e as SenderShareKeyStorage, f as SenderShareRecordProofs, g as SenderShareRevocationScope, h as SenderShareStore, i as historyRecordForPublishedShare } from './history-CUWDK0lE.cjs';
+import { T as TargetPublishOutcome, c as TargetPublishInput, S as ShareTarget } from './addressed-publish-Db-6rqkA.cjs';
+export { A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, d as AddressedPolicyRegistrationInput, e as AddressedPolicyRegistrationReceipt, b as AddressedPublishAuthority, f as AddressedSharePublishOptions, g as AddressedShareRequest, P as PreparedAddressedShare, h as TargetPublishAdapter, i as addressedCredentialRequirement, n as normalizeShareTarget, p as prepareAddressedShare, j as publishAddressedShare, k as publishTargetShare, t as targetAuthorizationMethod } from './addressed-publish-Db-6rqkA.cjs';
+import { S as SenderShareRecord, a as SenderShareRecordStorage } from './history-ZJFHV-IU.cjs';
+export { E as EncryptedSenderShareHistory, b as EncryptedShareHistoryStorage, M as MemoryEncryptedShareHistoryStorage, c as MemorySenderShareKeyStorage, d as MemorySenderShareRecordStorage, e as SenderShareKeyStorage, f as SenderShareRecordProofs, g as SenderShareRevocationScope, h as SenderShareStore, i as historyRecordForPublishedShare } from './history-ZJFHV-IU.cjs';
+import { b as ShareAuthorizationResult, c as ShareAuthorizationAdapter } from './authorization-CmP1skO8.cjs';
+export { d as ShareAuthorizationDenied, a as ShareAuthorizationMethod, e as ShareAuthorizationReady, S as ShareAuthorizationRequired, f as ShareAuthorizedContent, g as authorizationMethodForTarget, h as authorizeShare } from './authorization-CmP1skO8.cjs';
 
 declare function hasUnsafeFilenameCodePoint(value: string): boolean;
 /** A single display/download filename, never a path. Returns the NFC form. */
 declare function canonicalShareFilename(value: string): string;
 
-type ShareErrorCode = "invalid-link" | "fetch-failed" | "max-bytes-exceeded" | "cid-mismatch" | "decrypt-failed" | "envelope-invalid" | "origin-mismatch" | "signature-invalid" | "capability-invalid" | "expired" | "unsupported-target" | "authorization-denied" | "content-integrity-failed";
-declare const SHARE_RESULT_VERSION: 1;
-declare const DEFAULT_MAX_SEALED_BLOB_BYTES: number;
-declare const DEFAULT_MAX_CONTENT_BLOB_BYTES: number;
-declare class ShareReceiveError extends Error {
-    readonly code: ShareErrorCode;
-    readonly details: {
-        readonly expiresAt?: string;
-        readonly stage?: "envelope" | "content";
-        readonly reason?: "policy-target" | "recipient-did-target" | "prefix-resource";
-    } | undefined;
-    constructor(code: ShareErrorCode, message: string, details?: {
-        readonly expiresAt?: string;
-        readonly stage?: "envelope" | "content";
-        readonly reason?: "policy-target" | "recipient-did-target" | "prefix-resource";
-    });
-    toJSON(): ShareErrorInfo;
-}
-interface ShareErrorInfo {
-    readonly protocol: "tinycloud-share";
-    readonly version: typeof SHARE_RESULT_VERSION;
-    readonly error: {
-        readonly code: ShareErrorCode;
-    };
-}
-declare function toShareErrorInfo(error: unknown): ShareErrorInfo;
-/** Policy/v3 links seal their authorization metadata in a fragment; no blob fetch adapter exists. */
-interface ShareFetchOptions {
-    readonly expectedOrigin?: string;
-    readonly signal?: AbortSignal;
-    readonly now?: () => number;
-    readonly maxSealedBlobBytes?: number;
-    readonly maxContentBlobBytes?: number;
-    readonly onResolvedAddressedEnvelope?: (envelope: ShareEnvelopeV3, cid: string) => void;
-}
-interface ShareMetadata {
-    readonly protocol: "tinycloud-share";
-    readonly version: 1;
-    readonly shareId: string;
-    readonly origin: string;
-    readonly target: {
-        readonly kind: "bearer" | "recipientDid" | "email" | "emailDomain";
-        readonly origin: string;
-        readonly nodeAudience: string;
-        readonly spaceId: string;
-    };
-    readonly resource: {
-        readonly kind: "exact" | "prefix";
-        readonly path: string;
-    };
-    readonly actions: readonly string[];
-    readonly expiresAt: string;
-    readonly display: {
-        readonly senderName?: string;
-        readonly filename?: string;
-        readonly mode?: string;
-    };
-    /** Set when the share is pinned to one artifact version; the owner's signature covers it (TC-1428). */
-    readonly artifact?: {
-        readonly id: string;
-        readonly version: number;
-    };
-}
-interface ShareInspection {
-    readonly metadata: ShareMetadata;
-    readonly link: {
-        readonly origin: string;
-        readonly cid: string;
-        readonly kind: "policy";
-    };
-}
-interface ShareReceiveAuthorizationRequired {
-    readonly state: "authorization-required";
-    readonly method: ShareAuthorizationMethod;
-    readonly continueUrl?: string;
-    readonly resumeToken?: string;
-}
-/** Retained as the result consumed after the node authorization ceremony. */
-interface ShareReceiveResult extends ShareInspection {
-    readonly bytes: Uint8Array;
-    readonly text?: string;
-}
-type ShareReceiveOutcome = ShareReceiveResult | ShareReceiveAuthorizationRequired;
-declare function inspectShare(link: string, options?: ShareFetchOptions): Promise<ShareInspection>;
-/**
- * Resolve and verify invitation metadata only. Actual content access is an
- * invocation against the owner node and is performed by the receiver SDK.
- */
-declare function receiveShare(link: string, options?: ShareFetchOptions): Promise<ShareReceiveOutcome>;
-
 interface ParsedAddressedEnvelope {
     readonly envelope: ShareEnvelopeV2;
     readonly policy: Record<string, unknown>;
@@ -288,118 +201,6 @@ declare function showShare(input: {
     readonly link?: string;
 }): Promise<ShareHistoryView>;
 
-interface ShareNodeTrust {
-    readonly invitationKid: string;
-    readonly invitationPublicKey: Uint8Array;
-}
-interface SharePresentationMaterial {
-    readonly holderDid: string;
-    readonly credential: string;
-    readonly credentialDigest?: string;
-    readonly holderBinding: Record<string, unknown>;
-    readonly proof: Record<string, unknown>;
-    readonly sign?: (bytes: Uint8Array) => Promise<Uint8Array>;
-    readonly email?: string;
-    /** Exact v3 credential claim returned by the verified holder ceremony. */
-    readonly claim?: Record<string, unknown>;
-    /** Exact v3 presentation returned by the verified holder ceremony. */
-    readonly presentation?: Record<string, unknown>;
-    /** Exact verified issuer envelope used by accountless v4 admission. */
-    readonly credentialEnvelope?: Record<string, unknown>;
-    /** Exact credential requirement committed by the signed policy. */
-    readonly requirement?: Record<string, unknown>;
-}
-interface SharePolicyChallenge {
-    readonly challengeId: string;
-    readonly nonce: string;
-    readonly expiresAt: string;
-    readonly enforcerDid?: string;
-    readonly action: string;
-    readonly requestBodyDigest: string;
-    readonly [key: string]: unknown;
-}
-interface ShareRecipientClientOptions {
-    readonly nodeOrigin: string;
-    /** Required only by the retired v2 response-proof adapter. Policy/v3 trusts its signed attested binding. */
-    readonly trustedNode?: ShareNodeTrust;
-    readonly holderDid: string;
-    readonly envelope: ShareEnvelopeV2 | ShareEnvelopeV3;
-    readonly fetchFn?: typeof fetch;
-    readonly buildPresentation?: (input: {
-        readonly challenge: SharePolicyChallenge;
-        readonly envelope: ShareEnvelopeV2 | ShareEnvelopeV3;
-        readonly policy: Record<string, unknown>;
-    }) => Promise<SharePresentationMaterial>;
-    readonly sign?: (bytes: Uint8Array) => Promise<Uint8Array>;
-    readonly signal?: AbortSignal;
-    readonly onStage?: (stage: "policy-admission" | "delegation-import" | "invocation" | "decryption") => void;
-    /**
-     * A previously admitted and imported policy session (S0), optionally with
-     * the descendants that re-delegate it, in order, down to this holder.
-     */
-    readonly policyAuthorization?: {
-        readonly authorization: string;
-        readonly cid: string;
-        readonly descendants?: readonly SharePolicyDelegationLink[];
-    };
-}
-/** One signed link of a policy delegation chain, as imported into the Node. */
-interface SharePolicyDelegationLink {
-    readonly authorization: string;
-    readonly cid: string;
-}
-interface SharePolicySession {
-    readonly sessionId: string;
-    readonly expiresAt: string;
-    readonly actions: readonly ("read" | "list" | "edit")[];
-    readonly resource: {
-        readonly kind: "exact" | "prefix";
-        readonly path: string;
-    };
-}
-declare class ShareRecipientClient {
-    private readonly options;
-    private readonly fetchFn;
-    private session;
-    private signer;
-    private nativeSigner;
-    private holderProof;
-    private v3Authorization;
-    private v3NodeAudience;
-    private v3ContentKey;
-    private v3ContentEnvelope;
-    constructor(options: ShareRecipientClientOptions);
-    beginChallenge(envelope: ShareEnvelopeV2): Promise<SharePolicyChallenge>;
-    private establish;
-    authorize(envelope: ShareEnvelopeV2): Promise<ShareAuthorizedContent>;
-    establishPolicySession(): Promise<SharePolicySession>;
-    private establishV3;
-    /** Decrypt a v3 KV value through a fresh recipient-signed decrypt invocation. */
-    decryptV3Content(bytes: Uint8Array): Promise<{
-        readonly bytes: Uint8Array;
-        readonly mediaType: string;
-    }>;
-    /** Re-encrypt edited v3 content with the admitted content key. */
-    encryptV3Content(bytes: Uint8Array, mediaType: string): Promise<Uint8Array>;
-    resumeWithProof(envelope: ShareEnvelopeV2, resumeToken: string, proof: unknown): Promise<ShareAuthorizedContent>;
-    nativeInvoke(request: {
-        readonly action: string;
-        readonly resource?: Record<string, unknown>;
-        readonly body?: number[];
-        readonly bodyDigest?: number[];
-        readonly ifMatch?: string;
-        readonly contentType?: string;
-    }): Promise<Response>;
-    private nativeInvokeV3;
-}
-declare function createAddressedAuthorization(input: Omit<ShareRecipientClientOptions, "envelope" | "buildPresentation"> & {
-    readonly buildPresentation?: (input: {
-        readonly challenge: SharePolicyChallenge;
-        readonly envelope: ShareEnvelopeV2;
-        readonly policy: Record<string, unknown>;
-    }) => Promise<SharePresentationMaterial>;
-}): ShareAuthorizationAdapter<ShareAuthorizedContent>;
-
 declare const SHARE_V2_PROTOCOL: Readonly<{
     readonly challengeDomain: "xyz.tinycloud.share/policy-challenge/v2\0";
     readonly sessionDomain: "xyz.tinycloud.share/policy-session/v2\0";
@@ -571,4 +372,4 @@ declare function assertArtifactBinding(view: ArtifactBindingView, expected?: Exp
  */
 declare function verifyArtifactShare(envelope: ShareEnvelopeV3, options: VerifyArtifactShareOptions): ArtifactPin | undefined;
 
-export { type ArtifactBindingView, ArtifactPinError, type ArtifactPinErrorCode, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, type ExpectedArtifact, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, type ParsedAddressedEnvelope, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, SenderShareRecord, SenderShareRecordStorage, ShareAuthorizationAdapter, ShareAuthorizationMethod, ShareAuthorizationResult, ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, ShareTarget, TargetPublishInput, TargetPublishOutcome, type VerifyArtifactShareOptions, artifactBindingView, assertArtifactBinding, canonicalShareFilename, claimShare, createAddressedAuthorization, createNativeShare, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, inspectShare, listShares, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, publishPolicyShare, receiveShare, recipientMatchesShareRecord, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, toShareErrorInfo, verifyArtifactShare };
+export { type ArtifactBindingView, ArtifactPinError, type ArtifactPinErrorCode, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, type ExpectedArtifact, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, type ParsedAddressedEnvelope, SHARE_V2_PROTOCOL, SenderShareRecord, SenderShareRecordStorage, ShareAuthorizationAdapter, ShareAuthorizationResult, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareHistoryView, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type ShareRevocationAdapter, type ShareRevocationResult, ShareTarget, TargetPublishInput, TargetPublishOutcome, type VerifyArtifactShareOptions, artifactBindingView, assertArtifactBinding, canonicalShareFilename, claimShare, createNativeShare, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, listShares, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, publishPolicyShare, recipientMatchesShareRecord, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, verifyArtifactShare };