@tinycloud/share-sdk 1.2.1 → 1.3.0-beta.0

package/dist/index.d.ts

@@ -1,105 +1,18 @@
-import { ShareEnvelopeV3, ShareEnvelopeV2, ArtifactPin, UnsignedShareEnvelopeV3 } from '@tinycloud/share-envelope';
+export { D as DEFAULT_MAX_CONTENT_BLOB_BYTES, a as DEFAULT_MAX_SEALED_BLOB_BYTES, S as SHARE_RESULT_VERSION, b as ShareErrorCode, c as ShareErrorInfo, d as ShareFetchOptions, e as ShareInspection, f as ShareMetadata, g as ShareNodeTrust, h as SharePolicyChallenge, i as SharePolicyDelegationLink, j as SharePolicySession, k as SharePresentationMaterial, l as ShareReceiveAuthorizationRequired, m as ShareReceiveError, n as ShareReceiveOutcome, o as ShareReceiveResult, p as ShareRecipientClient, q as ShareRecipientClientOptions, r as createAddressedAuthorization, s as inspectShare, t as receiveShare, u as toShareErrorInfo } from './web-recipient-entry-CKA_vCi5.js';
+export { C as CreateOwnerDelegationParams, g as DEFAULT_SHARE_LIFETIME_MS, D as DelegatedShareKey, M as MAX_CONTENT_BYTES, h as OWNER_SHARE_REGISTRATION_DOMAIN, i as OwnerDelegationPermission, f as OwnerDelegationReceipt, O as OwnerShareAction, j as OwnerShareDecryption, a as OwnerShareMatcher, k as OwnerSharePolicyRegistration, b as OwnerSharePolicyRegistrationReceipt, l as OwnerSharePolicyV2, c as PublishedShare, P as PublishedShareDeliveryMaterial, m as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, n as SHARE_CONTENT_LIMIT, o as SHARE_PUBLISH_RESULT_VERSION, p as SharePublishError, q as SharePublishErrorCode, e as SharePublishOptions, d as SharePublishTarget, S as SignedDelegation, r as canonicalOwnerSharePolicy, s as computeOwnerShareRegistrationCid, t as createDelegatedShareKey, u as createPolicyEnforcementDelegation, v as redactPublishedShare, w as restoreDelegatedShareKey, x as validateOwnerSharePolicyRegistration, y as validateOwnerSharePolicyRegistrationBytes } from './owner-policy-CRFeEC98.js';
+import { ShareEnvelopeV2, ArtifactPin, UnsignedShareEnvelopeV3, ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 export { CheckBearerDelegationOptions, DelegationCheckResult, canonicalize, checkBearerDelegation, fromBase64Url, requiredResourceUri, resourceUriCovers, toBase64Url } from '@tinycloud/share-envelope';
-import { S as ShareAuthorizationMethod, a as ShareAuthorizedContent, b as ShareAuthorizationAdapter, T as TargetPublishOutcome, c as TargetPublishInput, d as ShareAuthorizationResult, e as ShareTarget } from './addressed-publish-BnSBJ-MX.js';
-export { A as AddressedOwnerRootInput, f as AddressedOwnerRootReceipt, g as AddressedPolicyRegistrationInput, h as AddressedPolicyRegistrationReceipt, i as AddressedPublishAuthority, j as AddressedSharePublishOptions, k as AddressedShareRequest, P as PreparedAddressedShare, l as ShareAuthorizationDenied, m as ShareAuthorizationReady, n as ShareAuthorizationRequired, o as TargetPublishAdapter, p as addressedCredentialRequirement, q as authorizationMethodForTarget, r as authorizeShare, s as normalizeShareTarget, t as prepareAddressedShare, u as publishAddressedShare, v as publishTargetShare, w as targetAuthorizationMethod } from './addressed-publish-BnSBJ-MX.js';
-export { C as CreateOwnerDelegationParams, D as DEFAULT_SHARE_LIFETIME_MS, a as DelegatedShareKey, M as MAX_CONTENT_BYTES, O as OWNER_SHARE_REGISTRATION_DOMAIN, b as OwnerDelegationPermission, c as OwnerDelegationReceipt, d as OwnerShareAction, e as OwnerShareDecryption, f as OwnerShareMatcher, g as OwnerSharePolicyRegistration, h as OwnerSharePolicyRegistrationReceipt, i as OwnerSharePolicyV2, P as PublishedShare, j as PublishedShareDeliveryMaterial, k as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, S as SHARE_CONTENT_LIMIT, l as SHARE_PUBLISH_RESULT_VERSION, m as SharePublishError, n as SharePublishErrorCode, o as SharePublishOptions, p as SharePublishTarget, q as SignedDelegation, r as canonicalOwnerSharePolicy, s as computeOwnerShareRegistrationCid, t as createDelegatedShareKey, u as createPolicyEnforcementDelegation, v as redactPublishedShare, w as restoreDelegatedShareKey, x as validateOwnerSharePolicyRegistration, y as validateOwnerSharePolicyRegistrationBytes } from './owner-policy-BqzRlkb6.js';
-import { S as SenderShareRecord, a as SenderShareRecordStorage } from './history-CyT6x8h4.js';
-export { E as EncryptedSenderShareHistory, b as EncryptedShareHistoryStorage, M as MemoryEncryptedShareHistoryStorage, c as MemorySenderShareKeyStorage, d as MemorySenderShareRecordStorage, e as SenderShareKeyStorage, f as SenderShareRecordProofs, g as SenderShareRevocationScope, h as SenderShareStore, i as historyRecordForPublishedShare } from './history-CyT6x8h4.js';
+import { T as TargetPublishOutcome, c as TargetPublishInput, S as ShareTarget } from './addressed-publish-CAdGCqiX.js';
+export { A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, d as AddressedPolicyRegistrationInput, e as AddressedPolicyRegistrationReceipt, b as AddressedPublishAuthority, f as AddressedSharePublishOptions, g as AddressedShareRequest, P as PreparedAddressedShare, h as TargetPublishAdapter, i as addressedCredentialRequirement, n as normalizeShareTarget, p as prepareAddressedShare, j as publishAddressedShare, k as publishTargetShare, t as targetAuthorizationMethod } from './addressed-publish-CAdGCqiX.js';
+import { S as SenderShareRecord, a as SenderShareRecordStorage } from './history-q0ALXTv7.js';
+export { E as EncryptedSenderShareHistory, b as EncryptedShareHistoryStorage, M as MemoryEncryptedShareHistoryStorage, c as MemorySenderShareKeyStorage, d as MemorySenderShareRecordStorage, e as SenderShareKeyStorage, f as SenderShareRecordProofs, g as SenderShareRevocationScope, h as SenderShareStore, i as historyRecordForPublishedShare } from './history-q0ALXTv7.js';
+import { b as ShareAuthorizationResult, c as ShareAuthorizationAdapter } from './authorization-CmP1skO8.js';
+export { d as ShareAuthorizationDenied, a as ShareAuthorizationMethod, e as ShareAuthorizationReady, S as ShareAuthorizationRequired, f as ShareAuthorizedContent, g as authorizationMethodForTarget, h as authorizeShare } from './authorization-CmP1skO8.js';
 
 declare function hasUnsafeFilenameCodePoint(value: string): boolean;
 /** A single display/download filename, never a path. Returns the NFC form. */
 declare function canonicalShareFilename(value: string): string;
 
-type ShareErrorCode = "invalid-link" | "fetch-failed" | "max-bytes-exceeded" | "cid-mismatch" | "decrypt-failed" | "envelope-invalid" | "origin-mismatch" | "signature-invalid" | "capability-invalid" | "expired" | "unsupported-target" | "authorization-denied" | "content-integrity-failed";
-declare const SHARE_RESULT_VERSION: 1;
-declare const DEFAULT_MAX_SEALED_BLOB_BYTES: number;
-declare const DEFAULT_MAX_CONTENT_BLOB_BYTES: number;
-declare class ShareReceiveError extends Error {
-    readonly code: ShareErrorCode;
-    readonly details: {
-        readonly expiresAt?: string;
-        readonly stage?: "envelope" | "content";
-        readonly reason?: "policy-target" | "recipient-did-target" | "prefix-resource";
-    } | undefined;
-    constructor(code: ShareErrorCode, message: string, details?: {
-        readonly expiresAt?: string;
-        readonly stage?: "envelope" | "content";
-        readonly reason?: "policy-target" | "recipient-did-target" | "prefix-resource";
-    });
-    toJSON(): ShareErrorInfo;
-}
-interface ShareErrorInfo {
-    readonly protocol: "tinycloud-share";
-    readonly version: typeof SHARE_RESULT_VERSION;
-    readonly error: {
-        readonly code: ShareErrorCode;
-    };
-}
-declare function toShareErrorInfo(error: unknown): ShareErrorInfo;
-/** Policy/v3 links seal their authorization metadata in a fragment; no blob fetch adapter exists. */
-interface ShareFetchOptions {
-    readonly expectedOrigin?: string;
-    readonly signal?: AbortSignal;
-    readonly now?: () => number;
-    readonly maxSealedBlobBytes?: number;
-    readonly maxContentBlobBytes?: number;
-    readonly onResolvedAddressedEnvelope?: (envelope: ShareEnvelopeV3, cid: string) => void;
-}
-interface ShareMetadata {
-    readonly protocol: "tinycloud-share";
-    readonly version: 1;
-    readonly shareId: string;
-    readonly origin: string;
-    readonly target: {
-        readonly kind: "bearer" | "recipientDid" | "email" | "emailDomain";
-        readonly origin: string;
-        readonly nodeAudience: string;
-        readonly spaceId: string;
-    };
-    readonly resource: {
-        readonly kind: "exact" | "prefix";
-        readonly path: string;
-    };
-    readonly actions: readonly string[];
-    readonly expiresAt: string;
-    readonly display: {
-        readonly senderName?: string;
-        readonly filename?: string;
-        readonly mode?: string;
-    };
-    /** Set when the share is pinned to one artifact version; the owner's signature covers it (TC-1428). */
-    readonly artifact?: {
-        readonly id: string;
-        readonly version: number;
-    };
-}
-interface ShareInspection {
-    readonly metadata: ShareMetadata;
-    readonly link: {
-        readonly origin: string;
-        readonly cid: string;
-        readonly kind: "policy";
-    };
-}
-interface ShareReceiveAuthorizationRequired {
-    readonly state: "authorization-required";
-    readonly method: ShareAuthorizationMethod;
-    readonly continueUrl?: string;
-    readonly resumeToken?: string;
-}
-/** Retained as the result consumed after the node authorization ceremony. */
-interface ShareReceiveResult extends ShareInspection {
-    readonly bytes: Uint8Array;
-    readonly text?: string;
-}
-type ShareReceiveOutcome = ShareReceiveResult | ShareReceiveAuthorizationRequired;
-declare function inspectShare(link: string, options?: ShareFetchOptions): Promise<ShareInspection>;
-/**
- * Resolve and verify invitation metadata only. Actual content access is an
- * invocation against the owner node and is performed by the receiver SDK.
- */
-declare function receiveShare(link: string, options?: ShareFetchOptions): Promise<ShareReceiveOutcome>;
-
 interface ParsedAddressedEnvelope {
     readonly envelope: ShareEnvelopeV2;
     readonly policy: Record<string, unknown>;
@@ -288,118 +201,6 @@ declare function showShare(input: {
     readonly link?: string;
 }): Promise<ShareHistoryView>;
 
-interface ShareNodeTrust {
-    readonly invitationKid: string;
-    readonly invitationPublicKey: Uint8Array;
-}
-interface SharePresentationMaterial {
-    readonly holderDid: string;
-    readonly credential: string;
-    readonly credentialDigest?: string;
-    readonly holderBinding: Record<string, unknown>;
-    readonly proof: Record<string, unknown>;
-    readonly sign?: (bytes: Uint8Array) => Promise<Uint8Array>;
-    readonly email?: string;
-    /** Exact v3 credential claim returned by the verified holder ceremony. */
-    readonly claim?: Record<string, unknown>;
-    /** Exact v3 presentation returned by the verified holder ceremony. */
-    readonly presentation?: Record<string, unknown>;
-    /** Exact verified issuer envelope used by accountless v4 admission. */
-    readonly credentialEnvelope?: Record<string, unknown>;
-    /** Exact credential requirement committed by the signed policy. */
-    readonly requirement?: Record<string, unknown>;
-}
-interface SharePolicyChallenge {
-    readonly challengeId: string;
-    readonly nonce: string;
-    readonly expiresAt: string;
-    readonly enforcerDid?: string;
-    readonly action: string;
-    readonly requestBodyDigest: string;
-    readonly [key: string]: unknown;
-}
-interface ShareRecipientClientOptions {
-    readonly nodeOrigin: string;
-    /** Required only by the retired v2 response-proof adapter. Policy/v3 trusts its signed attested binding. */
-    readonly trustedNode?: ShareNodeTrust;
-    readonly holderDid: string;
-    readonly envelope: ShareEnvelopeV2 | ShareEnvelopeV3;
-    readonly fetchFn?: typeof fetch;
-    readonly buildPresentation?: (input: {
-        readonly challenge: SharePolicyChallenge;
-        readonly envelope: ShareEnvelopeV2 | ShareEnvelopeV3;
-        readonly policy: Record<string, unknown>;
-    }) => Promise<SharePresentationMaterial>;
-    readonly sign?: (bytes: Uint8Array) => Promise<Uint8Array>;
-    readonly signal?: AbortSignal;
-    readonly onStage?: (stage: "policy-admission" | "delegation-import" | "invocation" | "decryption") => void;
-    /**
-     * A previously admitted and imported policy session (S0), optionally with
-     * the descendants that re-delegate it, in order, down to this holder.
-     */
-    readonly policyAuthorization?: {
-        readonly authorization: string;
-        readonly cid: string;
-        readonly descendants?: readonly SharePolicyDelegationLink[];
-    };
-}
-/** One signed link of a policy delegation chain, as imported into the Node. */
-interface SharePolicyDelegationLink {
-    readonly authorization: string;
-    readonly cid: string;
-}
-interface SharePolicySession {
-    readonly sessionId: string;
-    readonly expiresAt: string;
-    readonly actions: readonly ("read" | "list" | "edit")[];
-    readonly resource: {
-        readonly kind: "exact" | "prefix";
-        readonly path: string;
-    };
-}
-declare class ShareRecipientClient {
-    private readonly options;
-    private readonly fetchFn;
-    private session;
-    private signer;
-    private nativeSigner;
-    private holderProof;
-    private v3Authorization;
-    private v3NodeAudience;
-    private v3ContentKey;
-    private v3ContentEnvelope;
-    constructor(options: ShareRecipientClientOptions);
-    beginChallenge(envelope: ShareEnvelopeV2): Promise<SharePolicyChallenge>;
-    private establish;
-    authorize(envelope: ShareEnvelopeV2): Promise<ShareAuthorizedContent>;
-    establishPolicySession(): Promise<SharePolicySession>;
-    private establishV3;
-    /** Decrypt a v3 KV value through a fresh recipient-signed decrypt invocation. */
-    decryptV3Content(bytes: Uint8Array): Promise<{
-        readonly bytes: Uint8Array;
-        readonly mediaType: string;
-    }>;
-    /** Re-encrypt edited v3 content with the admitted content key. */
-    encryptV3Content(bytes: Uint8Array, mediaType: string): Promise<Uint8Array>;
-    resumeWithProof(envelope: ShareEnvelopeV2, resumeToken: string, proof: unknown): Promise<ShareAuthorizedContent>;
-    nativeInvoke(request: {
-        readonly action: string;
-        readonly resource?: Record<string, unknown>;
-        readonly body?: number[];
-        readonly bodyDigest?: number[];
-        readonly ifMatch?: string;
-        readonly contentType?: string;
-    }): Promise<Response>;
-    private nativeInvokeV3;
-}
-declare function createAddressedAuthorization(input: Omit<ShareRecipientClientOptions, "envelope" | "buildPresentation"> & {
-    readonly buildPresentation?: (input: {
-        readonly challenge: SharePolicyChallenge;
-        readonly envelope: ShareEnvelopeV2;
-        readonly policy: Record<string, unknown>;
-    }) => Promise<SharePresentationMaterial>;
-}): ShareAuthorizationAdapter<ShareAuthorizedContent>;
-
 declare const SHARE_V2_PROTOCOL: Readonly<{
     readonly challengeDomain: "xyz.tinycloud.share/policy-challenge/v2\0";
     readonly sessionDomain: "xyz.tinycloud.share/policy-session/v2\0";
@@ -571,4 +372,4 @@ declare function assertArtifactBinding(view: ArtifactBindingView, expected?: Exp
  */
 declare function verifyArtifactShare(envelope: ShareEnvelopeV3, options: VerifyArtifactShareOptions): ArtifactPin | undefined;
 
-export { type ArtifactBindingView, ArtifactPinError, type ArtifactPinErrorCode, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, DEFAULT_MAX_CONTENT_BLOB_BYTES, DEFAULT_MAX_SEALED_BLOB_BYTES, type ExpectedArtifact, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, type ParsedAddressedEnvelope, SHARE_RESULT_VERSION, SHARE_V2_PROTOCOL, SenderShareRecord, SenderShareRecordStorage, ShareAuthorizationAdapter, ShareAuthorizationMethod, ShareAuthorizationResult, ShareAuthorizedContent, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareErrorCode, type ShareErrorInfo, type ShareFetchOptions, type ShareHistoryView, type ShareInspection, type ShareMetadata, type ShareNodeTrust, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyChallenge, type SharePolicyDelegationLink, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type SharePolicySession, type SharePresentationMaterial, type ShareReceiveAuthorizationRequired, ShareReceiveError, type ShareReceiveOutcome, type ShareReceiveResult, ShareRecipientClient, type ShareRecipientClientOptions, type ShareRevocationAdapter, type ShareRevocationResult, ShareTarget, TargetPublishInput, TargetPublishOutcome, type VerifyArtifactShareOptions, artifactBindingView, assertArtifactBinding, canonicalShareFilename, claimShare, createAddressedAuthorization, createNativeShare, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, inspectShare, listShares, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, publishPolicyShare, receiveShare, recipientMatchesShareRecord, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, toShareErrorInfo, verifyArtifactShare };
+export { type ArtifactBindingView, ArtifactPinError, type ArtifactPinErrorCode, CredentialInvitationError, type CredentialInvitationErrorCode, type CredentialInvitationReceipt, type CredentialInvitationResult, type ExpectedArtifact, MemoryShareCache, NATIVE_SHARE_FRAGMENT_PARAMETER, type NativeShareResult, type NativeSharingService, type ParsedAddressedEnvelope, SHARE_V2_PROTOCOL, SenderShareRecord, SenderShareRecordStorage, ShareAuthorizationAdapter, ShareAuthorizationResult, type ShareCache, type ShareCacheEntry, type ShareCacheKey, type ShareCacheMetadata, type ShareDeliveryAdapter, type ShareHistoryView, ShareNotifyError, type ShareNotifyInput, type ShareNotifyResult, type ShareNotifyState, type SharePolicyPublishAdapter, type SharePolicyRootRevocation, type ShareRevocationAdapter, type ShareRevocationResult, ShareTarget, TargetPublishInput, TargetPublishOutcome, type VerifyArtifactShareOptions, artifactBindingView, assertArtifactBinding, canonicalShareFilename, claimShare, createNativeShare, createShareV2HolderBindingArtifact, deliverCredentialInvitation, hasUnsafeFilenameCodePoint, listShares, notifyShare, openNativeShare, parseAddressedEnvelope, parseNativeShareUrl, publishPolicyShare, recipientMatchesShareRecord, resumeShareAuthorization, revokeShare, shareDeliveryWindowExpiresAt, showShare, verifyArtifactShare };

package/dist/{owner-policy-BqzRlkb6.d.cts → owner-policy-CRFeEC98.d.cts}

@@ -294,4 +294,4 @@ declare function validateOwnerSharePolicyRegistration(value: unknown, expected:
 /** Validate the exact UTF-8 response bytes emitted by the registration route. */
 declare function validateOwnerSharePolicyRegistrationBytes(bytesValue: Uint8Array, expected: RegisterOwnerSharePolicyParams): OwnerSharePolicyRegistrationReceipt;
 
-export { type CreateOwnerDelegationParams as C, DEFAULT_SHARE_LIFETIME_MS as D, MAX_CONTENT_BYTES as M, OWNER_SHARE_REGISTRATION_DOMAIN as O, type PublishedShare as P, type RegisterOwnerSharePolicyParams as R, SHARE_CONTENT_LIMIT as S, type DelegatedShareKey as a, type OwnerDelegationPermission as b, type OwnerDelegationReceipt as c, type OwnerShareAction as d, type OwnerShareDecryption as e, type OwnerShareMatcher as f, type OwnerSharePolicyRegistration as g, type OwnerSharePolicyRegistrationReceipt as h, type OwnerSharePolicyV2 as i, type PublishedShareDeliveryMaterial as j, type PublishedShareMetadata as k, SHARE_PUBLISH_RESULT_VERSION as l, SharePublishError as m, type SharePublishErrorCode as n, type SharePublishOptions as o, type SharePublishTarget as p, type SignedDelegation as q, canonicalOwnerSharePolicy as r, computeOwnerShareRegistrationCid as s, createDelegatedShareKey as t, createPolicyEnforcementDelegation as u, redactPublishedShare as v, restoreDelegatedShareKey as w, validateOwnerSharePolicyRegistration as x, validateOwnerSharePolicyRegistrationBytes as y };
+export { type CreateOwnerDelegationParams as C, type DelegatedShareKey as D, MAX_CONTENT_BYTES as M, type OwnerShareAction as O, type PublishedShareDeliveryMaterial as P, type RegisterOwnerSharePolicyParams as R, type SignedDelegation as S, type OwnerShareMatcher as a, type OwnerSharePolicyRegistrationReceipt as b, type PublishedShare as c, type SharePublishTarget as d, type SharePublishOptions as e, type OwnerDelegationReceipt as f, DEFAULT_SHARE_LIFETIME_MS as g, OWNER_SHARE_REGISTRATION_DOMAIN as h, type OwnerDelegationPermission as i, type OwnerShareDecryption as j, type OwnerSharePolicyRegistration as k, type OwnerSharePolicyV2 as l, type PublishedShareMetadata as m, SHARE_CONTENT_LIMIT as n, SHARE_PUBLISH_RESULT_VERSION as o, SharePublishError as p, type SharePublishErrorCode as q, canonicalOwnerSharePolicy as r, computeOwnerShareRegistrationCid as s, createDelegatedShareKey as t, createPolicyEnforcementDelegation as u, redactPublishedShare as v, restoreDelegatedShareKey as w, validateOwnerSharePolicyRegistration as x, validateOwnerSharePolicyRegistrationBytes as y };

package/dist/{owner-policy-BqzRlkb6.d.ts → owner-policy-CRFeEC98.d.ts}

@@ -294,4 +294,4 @@ declare function validateOwnerSharePolicyRegistration(value: unknown, expected:
 /** Validate the exact UTF-8 response bytes emitted by the registration route. */
 declare function validateOwnerSharePolicyRegistrationBytes(bytesValue: Uint8Array, expected: RegisterOwnerSharePolicyParams): OwnerSharePolicyRegistrationReceipt;
 
-export { type CreateOwnerDelegationParams as C, DEFAULT_SHARE_LIFETIME_MS as D, MAX_CONTENT_BYTES as M, OWNER_SHARE_REGISTRATION_DOMAIN as O, type PublishedShare as P, type RegisterOwnerSharePolicyParams as R, SHARE_CONTENT_LIMIT as S, type DelegatedShareKey as a, type OwnerDelegationPermission as b, type OwnerDelegationReceipt as c, type OwnerShareAction as d, type OwnerShareDecryption as e, type OwnerShareMatcher as f, type OwnerSharePolicyRegistration as g, type OwnerSharePolicyRegistrationReceipt as h, type OwnerSharePolicyV2 as i, type PublishedShareDeliveryMaterial as j, type PublishedShareMetadata as k, SHARE_PUBLISH_RESULT_VERSION as l, SharePublishError as m, type SharePublishErrorCode as n, type SharePublishOptions as o, type SharePublishTarget as p, type SignedDelegation as q, canonicalOwnerSharePolicy as r, computeOwnerShareRegistrationCid as s, createDelegatedShareKey as t, createPolicyEnforcementDelegation as u, redactPublishedShare as v, restoreDelegatedShareKey as w, validateOwnerSharePolicyRegistration as x, validateOwnerSharePolicyRegistrationBytes as y };
+export { type CreateOwnerDelegationParams as C, type DelegatedShareKey as D, MAX_CONTENT_BYTES as M, type OwnerShareAction as O, type PublishedShareDeliveryMaterial as P, type RegisterOwnerSharePolicyParams as R, type SignedDelegation as S, type OwnerShareMatcher as a, type OwnerSharePolicyRegistrationReceipt as b, type PublishedShare as c, type SharePublishTarget as d, type SharePublishOptions as e, type OwnerDelegationReceipt as f, DEFAULT_SHARE_LIFETIME_MS as g, OWNER_SHARE_REGISTRATION_DOMAIN as h, type OwnerDelegationPermission as i, type OwnerShareDecryption as j, type OwnerSharePolicyRegistration as k, type OwnerSharePolicyV2 as l, type PublishedShareMetadata as m, SHARE_CONTENT_LIMIT as n, SHARE_PUBLISH_RESULT_VERSION as o, SharePublishError as p, type SharePublishErrorCode as q, canonicalOwnerSharePolicy as r, computeOwnerShareRegistrationCid as s, createDelegatedShareKey as t, createPolicyEnforcementDelegation as u, redactPublishedShare as v, restoreDelegatedShareKey as w, validateOwnerSharePolicyRegistration as x, validateOwnerSharePolicyRegistrationBytes as y };

package/dist/share-index.d.cts

@@ -1,6 +1,6 @@
-import { a as SenderShareRecordStorage, S as SenderShareRecord } from './history-CUWDK0lE.cjs';
-export { f as SenderShareRecordProofs } from './history-CUWDK0lE.cjs';
-import { j as PublishedShareDeliveryMaterial, q as SignedDelegation, g as OwnerSharePolicyRegistration } from './owner-policy-BqzRlkb6.cjs';
+import { a as SenderShareRecordStorage, S as SenderShareRecord } from './history-ZJFHV-IU.cjs';
+export { f as SenderShareRecordProofs } from './history-ZJFHV-IU.cjs';
+import { P as PublishedShareDeliveryMaterial, S as SignedDelegation, k as OwnerSharePolicyRegistration } from './owner-policy-CRFeEC98.cjs';
 import { ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 
 /**

package/dist/share-index.d.ts

@@ -1,6 +1,6 @@
-import { a as SenderShareRecordStorage, S as SenderShareRecord } from './history-CyT6x8h4.js';
-export { f as SenderShareRecordProofs } from './history-CyT6x8h4.js';
-import { j as PublishedShareDeliveryMaterial, q as SignedDelegation, g as OwnerSharePolicyRegistration } from './owner-policy-BqzRlkb6.js';
+import { a as SenderShareRecordStorage, S as SenderShareRecord } from './history-q0ALXTv7.js';
+export { f as SenderShareRecordProofs } from './history-q0ALXTv7.js';
+import { P as PublishedShareDeliveryMaterial, S as SignedDelegation, k as OwnerSharePolicyRegistration } from './owner-policy-CRFeEC98.js';
 import { ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 
 /**

package/dist/share-root.d.cts

@@ -1,6 +1,7 @@
 import { CompactUcanAuthorization, UnifiedContentSource } from '@tinycloud/share-envelope';
-import { A as AddressedOwnerRootInput, f as AddressedOwnerRootReceipt, i as AddressedPublishAuthority } from './addressed-publish-DtcLNG2m.cjs';
-import { C as CreateOwnerDelegationParams, c as OwnerDelegationReceipt, a as DelegatedShareKey } from './owner-policy-BqzRlkb6.cjs';
+import { A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, b as AddressedPublishAuthority } from './addressed-publish-Db-6rqkA.cjs';
+import { C as CreateOwnerDelegationParams, f as OwnerDelegationReceipt, D as DelegatedShareKey } from './owner-policy-CRFeEC98.cjs';
+import './authorization-CmP1skO8.cjs';
 
 /**
  * The fields of an owner-signed SIWE CACAO that bound its authority. Read

package/dist/share-root.d.ts

@@ -1,6 +1,7 @@
 import { CompactUcanAuthorization, UnifiedContentSource } from '@tinycloud/share-envelope';
-import { A as AddressedOwnerRootInput, f as AddressedOwnerRootReceipt, i as AddressedPublishAuthority } from './addressed-publish-BnSBJ-MX.js';
-import { C as CreateOwnerDelegationParams, c as OwnerDelegationReceipt, a as DelegatedShareKey } from './owner-policy-BqzRlkb6.js';
+import { A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, b as AddressedPublishAuthority } from './addressed-publish-CAdGCqiX.js';
+import { C as CreateOwnerDelegationParams, f as OwnerDelegationReceipt, D as DelegatedShareKey } from './owner-policy-CRFeEC98.js';
+import './authorization-CmP1skO8.js';
 
 /**
  * The fields of an owner-signed SIWE CACAO that bound its authority. Read

package/dist/web-recipient-entry-CKA_vCi5.d.ts

@@ -0,0 +1,206 @@
+import { ShareEnvelopeV3, ShareEnvelopeV2 } from '@tinycloud/share-envelope';
+import { a as ShareAuthorizationMethod, f as ShareAuthorizedContent, c as ShareAuthorizationAdapter } from './authorization-CmP1skO8.js';
+
+type ShareErrorCode = "invalid-link" | "fetch-failed" | "max-bytes-exceeded" | "cid-mismatch" | "decrypt-failed" | "envelope-invalid" | "origin-mismatch" | "signature-invalid" | "capability-invalid" | "expired" | "unsupported-target" | "authorization-denied" | "content-integrity-failed";
+declare const SHARE_RESULT_VERSION: 1;
+declare const DEFAULT_MAX_SEALED_BLOB_BYTES: number;
+declare const DEFAULT_MAX_CONTENT_BLOB_BYTES: number;
+declare class ShareReceiveError extends Error {
+    readonly code: ShareErrorCode;
+    readonly details: {
+        readonly expiresAt?: string;
+        readonly stage?: "envelope" | "content";
+        readonly reason?: "policy-target" | "recipient-did-target" | "prefix-resource";
+    } | undefined;
+    constructor(code: ShareErrorCode, message: string, details?: {
+        readonly expiresAt?: string;
+        readonly stage?: "envelope" | "content";
+        readonly reason?: "policy-target" | "recipient-did-target" | "prefix-resource";
+    });
+    toJSON(): ShareErrorInfo;
+}
+interface ShareErrorInfo {
+    readonly protocol: "tinycloud-share";
+    readonly version: typeof SHARE_RESULT_VERSION;
+    readonly error: {
+        readonly code: ShareErrorCode;
+    };
+}
+declare function toShareErrorInfo(error: unknown): ShareErrorInfo;
+/** Policy/v3 links seal their authorization metadata in a fragment; no blob fetch adapter exists. */
+interface ShareFetchOptions {
+    readonly expectedOrigin?: string;
+    readonly signal?: AbortSignal;
+    readonly now?: () => number;
+    readonly maxSealedBlobBytes?: number;
+    readonly maxContentBlobBytes?: number;
+    readonly onResolvedAddressedEnvelope?: (envelope: ShareEnvelopeV3, cid: string) => void;
+}
+interface ShareMetadata {
+    readonly protocol: "tinycloud-share";
+    readonly version: 1;
+    readonly shareId: string;
+    readonly origin: string;
+    readonly target: {
+        readonly kind: "bearer" | "recipientDid" | "email" | "emailDomain";
+        readonly origin: string;
+        readonly nodeAudience: string;
+        readonly spaceId: string;
+    };
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly path: string;
+    };
+    readonly actions: readonly string[];
+    readonly expiresAt: string;
+    readonly display: {
+        readonly senderName?: string;
+        readonly filename?: string;
+        readonly mode?: string;
+    };
+    /** Set when the share is pinned to one artifact version; the owner's signature covers it (TC-1428). */
+    readonly artifact?: {
+        readonly id: string;
+        readonly version: number;
+    };
+}
+interface ShareInspection {
+    readonly metadata: ShareMetadata;
+    readonly link: {
+        readonly origin: string;
+        readonly cid: string;
+        readonly kind: "policy";
+    };
+}
+interface ShareReceiveAuthorizationRequired {
+    readonly state: "authorization-required";
+    readonly method: ShareAuthorizationMethod;
+    readonly continueUrl?: string;
+    readonly resumeToken?: string;
+}
+/** Retained as the result consumed after the node authorization ceremony. */
+interface ShareReceiveResult extends ShareInspection {
+    readonly bytes: Uint8Array;
+    readonly text?: string;
+}
+type ShareReceiveOutcome = ShareReceiveResult | ShareReceiveAuthorizationRequired;
+declare function inspectShare(link: string, options?: ShareFetchOptions): Promise<ShareInspection>;
+/**
+ * Resolve and verify invitation metadata only. Actual content access is an
+ * invocation against the owner node and is performed by the receiver SDK.
+ */
+declare function receiveShare(link: string, options?: ShareFetchOptions): Promise<ShareReceiveOutcome>;
+
+interface ShareNodeTrust {
+    readonly invitationKid: string;
+    readonly invitationPublicKey: Uint8Array;
+}
+interface SharePresentationMaterial {
+    readonly holderDid: string;
+    readonly credential: string;
+    readonly credentialDigest?: string;
+    readonly holderBinding: Record<string, unknown>;
+    readonly proof: Record<string, unknown>;
+    readonly sign?: (bytes: Uint8Array) => Promise<Uint8Array>;
+    readonly email?: string;
+    /** Exact v3 credential claim returned by the verified holder ceremony. */
+    readonly claim?: Record<string, unknown>;
+    /** Exact v3 presentation returned by the verified holder ceremony. */
+    readonly presentation?: Record<string, unknown>;
+    /** Exact verified issuer envelope used by accountless v4 admission. */
+    readonly credentialEnvelope?: Record<string, unknown>;
+    /** Exact credential requirement committed by the signed policy. */
+    readonly requirement?: Record<string, unknown>;
+}
+interface SharePolicyChallenge {
+    readonly challengeId: string;
+    readonly nonce: string;
+    readonly expiresAt: string;
+    readonly enforcerDid?: string;
+    readonly action: string;
+    readonly requestBodyDigest: string;
+    readonly [key: string]: unknown;
+}
+interface ShareRecipientClientOptions {
+    readonly nodeOrigin: string;
+    /** Required only by the retired v2 response-proof adapter. Policy/v3 trusts its signed attested binding. */
+    readonly trustedNode?: ShareNodeTrust;
+    readonly holderDid: string;
+    readonly envelope: ShareEnvelopeV2 | ShareEnvelopeV3;
+    readonly fetchFn?: typeof fetch;
+    readonly buildPresentation?: (input: {
+        readonly challenge: SharePolicyChallenge;
+        readonly envelope: ShareEnvelopeV2 | ShareEnvelopeV3;
+        readonly policy: Record<string, unknown>;
+    }) => Promise<SharePresentationMaterial>;
+    readonly sign?: (bytes: Uint8Array) => Promise<Uint8Array>;
+    readonly signal?: AbortSignal;
+    readonly onStage?: (stage: "policy-admission" | "delegation-import" | "invocation" | "decryption") => void;
+    /**
+     * A previously admitted and imported policy session (S0), optionally with
+     * the descendants that re-delegate it, in order, down to this holder.
+     */
+    readonly policyAuthorization?: {
+        readonly authorization: string;
+        readonly cid: string;
+        readonly descendants?: readonly SharePolicyDelegationLink[];
+    };
+}
+/** One signed link of a policy delegation chain, as imported into the Node. */
+interface SharePolicyDelegationLink {
+    readonly authorization: string;
+    readonly cid: string;
+}
+interface SharePolicySession {
+    readonly sessionId: string;
+    readonly expiresAt: string;
+    readonly actions: readonly ("read" | "list" | "edit")[];
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly path: string;
+    };
+}
+declare class ShareRecipientClient {
+    private readonly options;
+    private readonly fetchFn;
+    private session;
+    private signer;
+    private nativeSigner;
+    private holderProof;
+    private v3Authorization;
+    private v3NodeAudience;
+    private v3ContentKey;
+    private v3ContentEnvelope;
+    constructor(options: ShareRecipientClientOptions);
+    beginChallenge(envelope: ShareEnvelopeV2): Promise<SharePolicyChallenge>;
+    private establish;
+    authorize(envelope: ShareEnvelopeV2): Promise<ShareAuthorizedContent>;
+    establishPolicySession(): Promise<SharePolicySession>;
+    private establishV3;
+    /** Decrypt a v3 KV value through a fresh recipient-signed decrypt invocation. */
+    decryptV3Content(bytes: Uint8Array): Promise<{
+        readonly bytes: Uint8Array;
+        readonly mediaType: string;
+    }>;
+    /** Re-encrypt edited v3 content with the admitted content key. */
+    encryptV3Content(bytes: Uint8Array, mediaType: string): Promise<Uint8Array>;
+    resumeWithProof(envelope: ShareEnvelopeV2, resumeToken: string, proof: unknown): Promise<ShareAuthorizedContent>;
+    nativeInvoke(request: {
+        readonly action: string;
+        readonly resource?: Record<string, unknown>;
+        readonly body?: number[];
+        readonly bodyDigest?: number[];
+        readonly ifMatch?: string;
+        readonly contentType?: string;
+    }): Promise<Response>;
+    private nativeInvokeV3;
+}
+declare function createAddressedAuthorization(input: Omit<ShareRecipientClientOptions, "envelope" | "buildPresentation"> & {
+    readonly buildPresentation?: (input: {
+        readonly challenge: SharePolicyChallenge;
+        readonly envelope: ShareEnvelopeV2;
+        readonly policy: Record<string, unknown>;
+    }) => Promise<SharePresentationMaterial>;
+}): ShareAuthorizationAdapter<ShareAuthorizedContent>;
+
+export { DEFAULT_MAX_CONTENT_BLOB_BYTES as D, SHARE_RESULT_VERSION as S, DEFAULT_MAX_SEALED_BLOB_BYTES as a, type ShareErrorCode as b, type ShareErrorInfo as c, type ShareFetchOptions as d, type ShareInspection as e, type ShareMetadata as f, type ShareNodeTrust as g, type SharePolicyChallenge as h, type SharePolicyDelegationLink as i, type SharePolicySession as j, type SharePresentationMaterial as k, type ShareReceiveAuthorizationRequired as l, ShareReceiveError as m, type ShareReceiveOutcome as n, type ShareReceiveResult as o, ShareRecipientClient as p, type ShareRecipientClientOptions as q, createAddressedAuthorization as r, inspectShare as s, receiveShare as t, toShareErrorInfo as u };