@tinycloud/share-sdk 1.3.0 → 1.4.0-beta.0

package/dist/share-index.d.cts

@@ -1,6 +1,6 @@
-import { a as SenderShareRecordStorage, S as SenderShareRecord } from './history-ZJFHV-IU.cjs';
-export { f as SenderShareRecordProofs } from './history-ZJFHV-IU.cjs';
-import { P as PublishedShareDeliveryMaterial, S as SignedDelegation, k as OwnerSharePolicyRegistration } from './owner-policy-CRFeEC98.cjs';
+import { a as SenderShareRecordStorage, S as SenderShareRecord } from './history-Bg25JIsi.cjs';
+export { f as SenderShareRecordProofs } from './history-Bg25JIsi.cjs';
+import { P as PublishedShareDeliveryMaterial, S as SignedDelegation, l as OwnerSharePolicyRegistration } from './owner-policy-aPmXIR3e.cjs';
 import { ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 
 /**
@@ -61,13 +61,14 @@ declare function classifyRecordKey(key: string): ClassifiedRecordKey;
  * accepted only when it is https on a configured share origin and has one of
  * the share link shapes:
  * - `/s/<cid>#k=<key>`: registry envelope link;
- * - `/s/inline#v=2&p=<payload>`: Node Policy/v3 sealed-inline link (what
- *   `publishAddressedShare` emits);
+ * - `/s/<id>#v=4&k=<key>&c=<cid>` or `/s/full#v=4&k=<key>&r=<record>`: the
+ *   short or full link of a Policy/v3 share (what `publishAddressedShare`
+ *   emits and the links service stores);
  * - `/viewer#tc1=<token>`: native bearer link (`createNativeShare`).
  *
  * The result names the shape only; the link itself is never copied into it.
  */
-type ShareLinkShape = "envelope" | "inline" | "native";
+type ShareLinkShape = "envelope" | "link" | "native";
 type ShareLinkCheck = {
     readonly ok: true;
     readonly shape: ShareLinkShape;
@@ -436,12 +437,6 @@ interface AgentShareRecordStoreOptions {
     /** KEK_a from the same key; absent for a remote-signer-only profile (records are then owner-readable only). */
     readonly agentKey?: AgentKeyMaterial;
     readonly cas?: CasPolicy;
-    /**
-     * The share origin on which records read back get their Policy/v3
-     * `/s/inline` link rebuilt (the stored form keeps no link; see
-     * `delivery.ts`). Absent: records read back carry no v3 link.
-     */
-    readonly shareOrigin?: string;
 }
 declare class AgentShareRecordStore implements SenderShareRecordStorage {
     private readonly options;
@@ -470,14 +465,13 @@ declare class AgentShareRecordStore implements SenderShareRecordStorage {
  *
  * A Policy/v3 record's `deliveryMaterial.envelope` is exactly what
  * `sealedEnvelope` decrypts to under `envelopeKey` (`publishAddressedShare`
- * seals `canonicalize(envelope)`), and its `/s/inline` link is
- * `sealedEnvelope`, its CID and `envelopeKey` encoded again. Both are
- * dropped before an agent record is sealed and rebuilt when needed:
- * {@link openDeliveryEnvelope} for the verifier and a delivery retry,
- * {@link shareLinkForRecord} at Open/Copy. `sealedEnvelope` stays (the node
- * reopens that exact value and its nonce is random) and so does the session
- * CACAO (it proves the chain). A bearer record keeps its `link`, which is
- * not derivable.
+ * seals `canonicalize(envelope)`). It is omitted before an agent record is
+ * sealed and rebuilt when needed by {@link openDeliveryEnvelope}, for the
+ * verifier and a delivery retry. `sealedEnvelope` stays (the node reopens that
+ * exact value and its nonce is random) and so does the session CACAO (it
+ * proves the chain). A short `v=4` link the sender printed is kept (it is not
+ * derivable: it carries an id only the links service knows) and must be the
+ * link of this material; a full link is not kept (see {@link compactShareRecord}).
  *
  * Security-sensitive: the sealed bytes are checked against `shareCid` before
  * they are opened, and the plaintext must be the canonical JSON of the
@@ -497,24 +491,28 @@ declare class DeliveryMaterialError extends Error {
 /** The signed envelope inside `sealedEnvelope`; throws {@link DeliveryMaterialError} unless it is exactly that. */
 declare function openDeliveryEnvelope(material: StoredDeliveryMaterial): Promise<Record<string, unknown>>;
 /**
- * The link to show at Open/Copy: a bearer record's stored `link`, or a
- * Policy/v3 record's `/s/inline` link rebuilt on `shareOrigin` (the
- * viewer's configured share origin) from `sealedEnvelope` and `envelopeKey`.
+ * A `v=4` link names its content key and body: a short link by the key `k` and
+ * the body CID `c`, a full link by `k` and the record whose body it carries.
+ * Either must be exactly this delivery material's key and sealed envelope.
+ * Returns the link's form.
  */
-declare function shareLinkForRecord(record: Pick<StoredShareRecord, "link" | "deliveryMaterial">, shareOrigin: string): Promise<string | undefined>;
+declare function assertLinkBoundToMaterial(link: string, material: StoredDeliveryMaterial): "short" | "full";
 /**
  * The stored form of `record`. For a Policy/v3 record (one with
- * `deliveryMaterial`), drops `deliveryMaterial.envelope` and `link` after
- * checking they are exactly what the sealed material rebuilds, so nothing is
- * lost. Throws {@link DeliveryMaterialError} otherwise.
+ * `deliveryMaterial`), omits `deliveryMaterial.envelope` after checking it is
+ * exactly what the sealed material opens to, and checks that a `link` is the
+ * link of that material. A short link is kept. A full link is not: it embeds
+ * the sealed envelope a second time, which the record size cap does not leave
+ * room for, so the sender's own history holds it. Throws
+ * {@link DeliveryMaterialError} otherwise.
  */
 declare function compactShareRecord(record: SenderShareRecord | StoredShareRecord): Promise<StoredShareRecord>;
 /**
  * The full record again (for a delivery retry or a caller that wants the
  * {@link SenderShareRecord} shape): the envelope reopened from the sealed
- * material and, when `shareOrigin` is given, the `/s/inline` link rebuilt.
+ * material. The stored `link` is returned as it was stored.
  */
-declare function expandShareRecord(record: StoredShareRecord, shareOrigin?: string): Promise<SenderShareRecord>;
+declare function expandShareRecord(record: StoredShareRecord): Promise<SenderShareRecord>;
 
 /**
  * Index document schema v1, rows, `project()`, and the versioned agent-record
@@ -1060,4 +1058,4 @@ declare function checkRegistrationReceipt(value: unknown, expected: {
 
 declare function verifyEnvelopeV3At(envelope: ShareEnvelopeV3, expectedSignerDid: string, now: number): Promise<boolean>;
 
-export { AGENT_ID_LENGTH, AGENT_RECORD_VERSION, type AgentKeyMaterial, AgentRecordError, type AgentRecordFailure, type AgentRecordHeader, type AgentRejectReason, AgentShareRecordStore, type AgentShareRecordStoreOptions, type Attenuation, type CasPolicy, type ChainContext, type ChainVerdict, type CheckedRegistration, type ClaimDecision, type ClassifiedRecordKey, DEFAULT_CAS_POLICY, DEFAULT_SHARE_INDEX_LIMITS, DeliveryMaterialError, INDEX_MAIN_KEY, INDEX_SCHEMA_VERSION, INVALID_ETAG_MESSAGE, MAX_AGENT_RECORD_BYTES, MemoryShareIndexOutbox, type OwnerNetworkUnwrap, type OwnerNetworkWrap, OwnerUnwrapUnavailableError, type ParsedSiweCacao, type RegistrationKey, SHARE_RECORDS_VAULT_PREFIX, STORED_DELIVERY_MATERIAL_KEYS, SUPPORTED_AGENT_RECORD_V, SenderShareIndex, type SenderShareIndexOptions, SenderShareRecord, type ShareDocumentRead, type ShareIndexAgentEntry, type ShareIndexArchiveDocument, type ShareIndexBackend, ShareIndexCasError, type ShareIndexCasErrorCode, type ShareIndexDocument, type ShareIndexFlushResult, type ShareIndexLimits, type ShareIndexLoad, type ShareIndexOp, type ShareIndexOutbox, type ShareIndexReconcileReport, type ShareIndexRow, type ShareIndexWriteOutcome, type ShareIndexWriteStatus, type ShareLinkCheck, type ShareLinkShape, type ShareListResult, type ShareProofState, type ShareRawRead, ShareRecordSchemaError, type ShareRegistrationKey, type ShareStatusPort, type ShareWriteCondition, type ShareWriteResult, type SignedUcanDelegation, type SiweCacaoParser, type StoredAgentRecord, type StoredDeliveryMaterial, type StoredShareRecord, type TinyCloudShareIndexBackendOptions, type TinyCloudShareIndexClient, type VaultNetworkRead, WebShareRecordStore, agentIdFromDid, agentRecordBinding, agentRecordKey, agentRecordPrefix, attenuationCovers, checkRegistrationReceipt, claimRank, classifyRecordKey, compactShareRecord, createTinyCloudShareIndexBackend, decideClaim, deriveAgentKeyMaterial, displayName, expandShareRecord, headerBytes, isAgentId, isShareId, isSpaceOwnedBy, openAgentRecordAsAgent, openAgentRecordAsOwner, openDeliveryEnvelope, parseIndexDocument, parseSignedUcan, parseStoredAgentRecord, project, sealAgentRecord, shareLinkForRecord, validateShareLink, verifyAgentRecordChain, verifyEnvelopeV3At, verifyOwnerSessionDelegation, verifyPolicyEnforcementDelegation };
+export { AGENT_ID_LENGTH, AGENT_RECORD_VERSION, type AgentKeyMaterial, AgentRecordError, type AgentRecordFailure, type AgentRecordHeader, type AgentRejectReason, AgentShareRecordStore, type AgentShareRecordStoreOptions, type Attenuation, type CasPolicy, type ChainContext, type ChainVerdict, type CheckedRegistration, type ClaimDecision, type ClassifiedRecordKey, DEFAULT_CAS_POLICY, DEFAULT_SHARE_INDEX_LIMITS, DeliveryMaterialError, INDEX_MAIN_KEY, INDEX_SCHEMA_VERSION, INVALID_ETAG_MESSAGE, MAX_AGENT_RECORD_BYTES, MemoryShareIndexOutbox, type OwnerNetworkUnwrap, type OwnerNetworkWrap, OwnerUnwrapUnavailableError, type ParsedSiweCacao, type RegistrationKey, SHARE_RECORDS_VAULT_PREFIX, STORED_DELIVERY_MATERIAL_KEYS, SUPPORTED_AGENT_RECORD_V, SenderShareIndex, type SenderShareIndexOptions, SenderShareRecord, type ShareDocumentRead, type ShareIndexAgentEntry, type ShareIndexArchiveDocument, type ShareIndexBackend, ShareIndexCasError, type ShareIndexCasErrorCode, type ShareIndexDocument, type ShareIndexFlushResult, type ShareIndexLimits, type ShareIndexLoad, type ShareIndexOp, type ShareIndexOutbox, type ShareIndexReconcileReport, type ShareIndexRow, type ShareIndexWriteOutcome, type ShareIndexWriteStatus, type ShareLinkCheck, type ShareLinkShape, type ShareListResult, type ShareProofState, type ShareRawRead, ShareRecordSchemaError, type ShareRegistrationKey, type ShareStatusPort, type ShareWriteCondition, type ShareWriteResult, type SignedUcanDelegation, type SiweCacaoParser, type StoredAgentRecord, type StoredDeliveryMaterial, type StoredShareRecord, type TinyCloudShareIndexBackendOptions, type TinyCloudShareIndexClient, type VaultNetworkRead, WebShareRecordStore, agentIdFromDid, agentRecordBinding, agentRecordKey, agentRecordPrefix, assertLinkBoundToMaterial, attenuationCovers, checkRegistrationReceipt, claimRank, classifyRecordKey, compactShareRecord, createTinyCloudShareIndexBackend, decideClaim, deriveAgentKeyMaterial, displayName, expandShareRecord, headerBytes, isAgentId, isShareId, isSpaceOwnedBy, openAgentRecordAsAgent, openAgentRecordAsOwner, openDeliveryEnvelope, parseIndexDocument, parseSignedUcan, parseStoredAgentRecord, project, sealAgentRecord, validateShareLink, verifyAgentRecordChain, verifyEnvelopeV3At, verifyOwnerSessionDelegation, verifyPolicyEnforcementDelegation };

package/dist/share-index.d.ts

@@ -1,6 +1,6 @@
-import { a as SenderShareRecordStorage, S as SenderShareRecord } from './history-q0ALXTv7.js';
-export { f as SenderShareRecordProofs } from './history-q0ALXTv7.js';
-import { P as PublishedShareDeliveryMaterial, S as SignedDelegation, k as OwnerSharePolicyRegistration } from './owner-policy-CRFeEC98.js';
+import { a as SenderShareRecordStorage, S as SenderShareRecord } from './history-kwJxrZgq.js';
+export { f as SenderShareRecordProofs } from './history-kwJxrZgq.js';
+import { P as PublishedShareDeliveryMaterial, S as SignedDelegation, l as OwnerSharePolicyRegistration } from './owner-policy-aPmXIR3e.js';
 import { ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 
 /**
@@ -61,13 +61,14 @@ declare function classifyRecordKey(key: string): ClassifiedRecordKey;
  * accepted only when it is https on a configured share origin and has one of
  * the share link shapes:
  * - `/s/<cid>#k=<key>`: registry envelope link;
- * - `/s/inline#v=2&p=<payload>`: Node Policy/v3 sealed-inline link (what
- *   `publishAddressedShare` emits);
+ * - `/s/<id>#v=4&k=<key>&c=<cid>` or `/s/full#v=4&k=<key>&r=<record>`: the
+ *   short or full link of a Policy/v3 share (what `publishAddressedShare`
+ *   emits and the links service stores);
  * - `/viewer#tc1=<token>`: native bearer link (`createNativeShare`).
  *
  * The result names the shape only; the link itself is never copied into it.
  */
-type ShareLinkShape = "envelope" | "inline" | "native";
+type ShareLinkShape = "envelope" | "link" | "native";
 type ShareLinkCheck = {
     readonly ok: true;
     readonly shape: ShareLinkShape;
@@ -436,12 +437,6 @@ interface AgentShareRecordStoreOptions {
     /** KEK_a from the same key; absent for a remote-signer-only profile (records are then owner-readable only). */
     readonly agentKey?: AgentKeyMaterial;
     readonly cas?: CasPolicy;
-    /**
-     * The share origin on which records read back get their Policy/v3
-     * `/s/inline` link rebuilt (the stored form keeps no link; see
-     * `delivery.ts`). Absent: records read back carry no v3 link.
-     */
-    readonly shareOrigin?: string;
 }
 declare class AgentShareRecordStore implements SenderShareRecordStorage {
     private readonly options;
@@ -470,14 +465,13 @@ declare class AgentShareRecordStore implements SenderShareRecordStorage {
  *
  * A Policy/v3 record's `deliveryMaterial.envelope` is exactly what
  * `sealedEnvelope` decrypts to under `envelopeKey` (`publishAddressedShare`
- * seals `canonicalize(envelope)`), and its `/s/inline` link is
- * `sealedEnvelope`, its CID and `envelopeKey` encoded again. Both are
- * dropped before an agent record is sealed and rebuilt when needed:
- * {@link openDeliveryEnvelope} for the verifier and a delivery retry,
- * {@link shareLinkForRecord} at Open/Copy. `sealedEnvelope` stays (the node
- * reopens that exact value and its nonce is random) and so does the session
- * CACAO (it proves the chain). A bearer record keeps its `link`, which is
- * not derivable.
+ * seals `canonicalize(envelope)`). It is omitted before an agent record is
+ * sealed and rebuilt when needed by {@link openDeliveryEnvelope}, for the
+ * verifier and a delivery retry. `sealedEnvelope` stays (the node reopens that
+ * exact value and its nonce is random) and so does the session CACAO (it
+ * proves the chain). A short `v=4` link the sender printed is kept (it is not
+ * derivable: it carries an id only the links service knows) and must be the
+ * link of this material; a full link is not kept (see {@link compactShareRecord}).
  *
  * Security-sensitive: the sealed bytes are checked against `shareCid` before
  * they are opened, and the plaintext must be the canonical JSON of the
@@ -497,24 +491,28 @@ declare class DeliveryMaterialError extends Error {
 /** The signed envelope inside `sealedEnvelope`; throws {@link DeliveryMaterialError} unless it is exactly that. */
 declare function openDeliveryEnvelope(material: StoredDeliveryMaterial): Promise<Record<string, unknown>>;
 /**
- * The link to show at Open/Copy: a bearer record's stored `link`, or a
- * Policy/v3 record's `/s/inline` link rebuilt on `shareOrigin` (the
- * viewer's configured share origin) from `sealedEnvelope` and `envelopeKey`.
+ * A `v=4` link names its content key and body: a short link by the key `k` and
+ * the body CID `c`, a full link by `k` and the record whose body it carries.
+ * Either must be exactly this delivery material's key and sealed envelope.
+ * Returns the link's form.
  */
-declare function shareLinkForRecord(record: Pick<StoredShareRecord, "link" | "deliveryMaterial">, shareOrigin: string): Promise<string | undefined>;
+declare function assertLinkBoundToMaterial(link: string, material: StoredDeliveryMaterial): "short" | "full";
 /**
  * The stored form of `record`. For a Policy/v3 record (one with
- * `deliveryMaterial`), drops `deliveryMaterial.envelope` and `link` after
- * checking they are exactly what the sealed material rebuilds, so nothing is
- * lost. Throws {@link DeliveryMaterialError} otherwise.
+ * `deliveryMaterial`), omits `deliveryMaterial.envelope` after checking it is
+ * exactly what the sealed material opens to, and checks that a `link` is the
+ * link of that material. A short link is kept. A full link is not: it embeds
+ * the sealed envelope a second time, which the record size cap does not leave
+ * room for, so the sender's own history holds it. Throws
+ * {@link DeliveryMaterialError} otherwise.
  */
 declare function compactShareRecord(record: SenderShareRecord | StoredShareRecord): Promise<StoredShareRecord>;
 /**
  * The full record again (for a delivery retry or a caller that wants the
  * {@link SenderShareRecord} shape): the envelope reopened from the sealed
- * material and, when `shareOrigin` is given, the `/s/inline` link rebuilt.
+ * material. The stored `link` is returned as it was stored.
  */
-declare function expandShareRecord(record: StoredShareRecord, shareOrigin?: string): Promise<SenderShareRecord>;
+declare function expandShareRecord(record: StoredShareRecord): Promise<SenderShareRecord>;
 
 /**
  * Index document schema v1, rows, `project()`, and the versioned agent-record
@@ -1060,4 +1058,4 @@ declare function checkRegistrationReceipt(value: unknown, expected: {
 
 declare function verifyEnvelopeV3At(envelope: ShareEnvelopeV3, expectedSignerDid: string, now: number): Promise<boolean>;
 
-export { AGENT_ID_LENGTH, AGENT_RECORD_VERSION, type AgentKeyMaterial, AgentRecordError, type AgentRecordFailure, type AgentRecordHeader, type AgentRejectReason, AgentShareRecordStore, type AgentShareRecordStoreOptions, type Attenuation, type CasPolicy, type ChainContext, type ChainVerdict, type CheckedRegistration, type ClaimDecision, type ClassifiedRecordKey, DEFAULT_CAS_POLICY, DEFAULT_SHARE_INDEX_LIMITS, DeliveryMaterialError, INDEX_MAIN_KEY, INDEX_SCHEMA_VERSION, INVALID_ETAG_MESSAGE, MAX_AGENT_RECORD_BYTES, MemoryShareIndexOutbox, type OwnerNetworkUnwrap, type OwnerNetworkWrap, OwnerUnwrapUnavailableError, type ParsedSiweCacao, type RegistrationKey, SHARE_RECORDS_VAULT_PREFIX, STORED_DELIVERY_MATERIAL_KEYS, SUPPORTED_AGENT_RECORD_V, SenderShareIndex, type SenderShareIndexOptions, SenderShareRecord, type ShareDocumentRead, type ShareIndexAgentEntry, type ShareIndexArchiveDocument, type ShareIndexBackend, ShareIndexCasError, type ShareIndexCasErrorCode, type ShareIndexDocument, type ShareIndexFlushResult, type ShareIndexLimits, type ShareIndexLoad, type ShareIndexOp, type ShareIndexOutbox, type ShareIndexReconcileReport, type ShareIndexRow, type ShareIndexWriteOutcome, type ShareIndexWriteStatus, type ShareLinkCheck, type ShareLinkShape, type ShareListResult, type ShareProofState, type ShareRawRead, ShareRecordSchemaError, type ShareRegistrationKey, type ShareStatusPort, type ShareWriteCondition, type ShareWriteResult, type SignedUcanDelegation, type SiweCacaoParser, type StoredAgentRecord, type StoredDeliveryMaterial, type StoredShareRecord, type TinyCloudShareIndexBackendOptions, type TinyCloudShareIndexClient, type VaultNetworkRead, WebShareRecordStore, agentIdFromDid, agentRecordBinding, agentRecordKey, agentRecordPrefix, attenuationCovers, checkRegistrationReceipt, claimRank, classifyRecordKey, compactShareRecord, createTinyCloudShareIndexBackend, decideClaim, deriveAgentKeyMaterial, displayName, expandShareRecord, headerBytes, isAgentId, isShareId, isSpaceOwnedBy, openAgentRecordAsAgent, openAgentRecordAsOwner, openDeliveryEnvelope, parseIndexDocument, parseSignedUcan, parseStoredAgentRecord, project, sealAgentRecord, shareLinkForRecord, validateShareLink, verifyAgentRecordChain, verifyEnvelopeV3At, verifyOwnerSessionDelegation, verifyPolicyEnforcementDelegation };
+export { AGENT_ID_LENGTH, AGENT_RECORD_VERSION, type AgentKeyMaterial, AgentRecordError, type AgentRecordFailure, type AgentRecordHeader, type AgentRejectReason, AgentShareRecordStore, type AgentShareRecordStoreOptions, type Attenuation, type CasPolicy, type ChainContext, type ChainVerdict, type CheckedRegistration, type ClaimDecision, type ClassifiedRecordKey, DEFAULT_CAS_POLICY, DEFAULT_SHARE_INDEX_LIMITS, DeliveryMaterialError, INDEX_MAIN_KEY, INDEX_SCHEMA_VERSION, INVALID_ETAG_MESSAGE, MAX_AGENT_RECORD_BYTES, MemoryShareIndexOutbox, type OwnerNetworkUnwrap, type OwnerNetworkWrap, OwnerUnwrapUnavailableError, type ParsedSiweCacao, type RegistrationKey, SHARE_RECORDS_VAULT_PREFIX, STORED_DELIVERY_MATERIAL_KEYS, SUPPORTED_AGENT_RECORD_V, SenderShareIndex, type SenderShareIndexOptions, SenderShareRecord, type ShareDocumentRead, type ShareIndexAgentEntry, type ShareIndexArchiveDocument, type ShareIndexBackend, ShareIndexCasError, type ShareIndexCasErrorCode, type ShareIndexDocument, type ShareIndexFlushResult, type ShareIndexLimits, type ShareIndexLoad, type ShareIndexOp, type ShareIndexOutbox, type ShareIndexReconcileReport, type ShareIndexRow, type ShareIndexWriteOutcome, type ShareIndexWriteStatus, type ShareLinkCheck, type ShareLinkShape, type ShareListResult, type ShareProofState, type ShareRawRead, ShareRecordSchemaError, type ShareRegistrationKey, type ShareStatusPort, type ShareWriteCondition, type ShareWriteResult, type SignedUcanDelegation, type SiweCacaoParser, type StoredAgentRecord, type StoredDeliveryMaterial, type StoredShareRecord, type TinyCloudShareIndexBackendOptions, type TinyCloudShareIndexClient, type VaultNetworkRead, WebShareRecordStore, agentIdFromDid, agentRecordBinding, agentRecordKey, agentRecordPrefix, assertLinkBoundToMaterial, attenuationCovers, checkRegistrationReceipt, claimRank, classifyRecordKey, compactShareRecord, createTinyCloudShareIndexBackend, decideClaim, deriveAgentKeyMaterial, displayName, expandShareRecord, headerBytes, isAgentId, isShareId, isSpaceOwnedBy, openAgentRecordAsAgent, openAgentRecordAsOwner, openDeliveryEnvelope, parseIndexDocument, parseSignedUcan, parseStoredAgentRecord, project, sealAgentRecord, validateShareLink, verifyAgentRecordChain, verifyEnvelopeV3At, verifyOwnerSessionDelegation, verifyPolicyEnforcementDelegation };

package/dist/share-index.js

@@ -4924,7 +4924,8 @@ function isCanonicalRawCid(cidString) {
   } catch {
     return false;
   }
-  return cid2.version === 1 && cid2.code === code && cid2.multihash.code === SHA256_CODE && cid2.toString() === cidString;
+  return cid2.version === 1 && cid2.code === code && cid2.multihash.code === SHA256_CODE && // `toString` of a parsed CID gives back the string it was parsed from; a fresh CID is encoded again.
+  CID.createV1(cid2.code, cid2.multihash).toString() === cidString;
 }
 var base64 = rfc4648({
   prefix: "m",
@@ -5540,7 +5541,6 @@ function verifyEnvelopeV3SignatureOnly(envelope) {
   return ed255193.verify(fromBase64Url(signature.value), sha2562(signingBytesV3(unsigned)), ed25519PublicKeyFromDidKey(signature.signerDid), ED25519_VERIFY_OPTS2);
 }
 var KEY_LENGTH2 = 32;
-var MAX_INLINE_BYTES = 256 * 1024;
 function assertCanonicalCid(cidString) {
   const cid2 = CID.parse(cidString);
   if (cid2.version !== 1 || cid2.code !== code || cid2.multihash.code !== 18 || // sha2-256 (0x12) only, at the link layer too
@@ -5548,21 +5548,6 @@ function assertCanonicalCid(cidString) {
     throw new TypeError(`not a canonical CIDv1 raw sha2-256 base32 CID: ${cidString}`);
   }
 }
-async function encodeSealedInlineShareUrl(parts) {
-  if (!isCanonicalHttpsOrigin(parts.origin)) throw new TypeError("origin must be a canonical https origin");
-  if (parts.ciphertext.byteLength === 0 || parts.ciphertext.byteLength > MAX_INLINE_BYTES) throw new RangeError("inline ciphertext is outside the allowed size");
-  if (parts.key32.byteLength !== KEY_LENGTH2) throw new TypeError("inline key must be 32 bytes");
-  const ciphertextCid = await computeCid(parts.ciphertext);
-  const payload = canonicalize({
-    v: 2,
-    c: toBase64Url(parts.ciphertext),
-    cid: ciphertextCid,
-    k: toBase64Url(parts.key32)
-  });
-  const payloadBytes = new TextEncoder().encode(payload);
-  if (payloadBytes.byteLength > MAX_INLINE_BYTES * 2) throw new RangeError("inline URL is too large");
-  return `${parts.origin}/s/inline#v=2&p=${toBase64Url(payloadBytes)}`;
-}
 function parseShareUrl(url, options = {}) {
   const parsed = new URL(url);
   if (parsed.protocol !== "https:") {
@@ -5601,47 +5586,6 @@ function parseShareUrl(url, options = {}) {
   }
   return { ciphertextCid, key32 };
 }
-async function parseSealedInlineShareUrl(url, options = {}) {
-  const parsed = new URL(url);
-  if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") throw new TypeError("sealed inline share URL must be canonical HTTPS without userinfo");
-  if (!isCanonicalHttpsOrigin(parsed.origin) || options.expectedOrigin !== void 0 && parsed.origin !== options.expectedOrigin) throw new TypeError("sealed inline share URL origin is not trusted");
-  if (parsed.pathname !== "/s/inline" || parsed.search !== "") throw new TypeError("not a Node sealed-inline share URL");
-  if (url !== `${parsed.origin}/s/inline${parsed.hash}`) throw new TypeError("sealed inline share URL is not lexically canonical");
-  const prefix = "#v=2&p=";
-  if (!parsed.hash.startsWith(prefix)) throw new TypeError("sealed inline URL is missing its canonical fragment");
-  const encoded = parsed.hash.slice(prefix.length);
-  if (encoded.length === 0 || parsed.hash !== `${prefix}${encoded}`) throw new TypeError("sealed inline URL fragment is not canonical");
-  let payloadBytes;
-  try {
-    payloadBytes = fromBase64Url(encoded);
-  } catch {
-    throw new TypeError("sealed inline payload is not canonical base64url");
-  }
-  if (payloadBytes.byteLength === 0 || payloadBytes.byteLength > MAX_INLINE_BYTES * 2) throw new TypeError("sealed inline payload is too large");
-  const payloadText = new TextDecoder("utf-8", { fatal: true }).decode(payloadBytes);
-  let value;
-  try {
-    value = JSON.parse(payloadText);
-  } catch {
-    throw new TypeError("sealed inline payload is not valid JSON");
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value) || canonicalize(value) !== payloadText) throw new TypeError("sealed inline payload is not canonical JSON");
-  const record2 = value;
-  if (Object.keys(record2).length !== 4 || record2.v !== 2 || typeof record2.c !== "string" || typeof record2.cid !== "string" || typeof record2.k !== "string") throw new TypeError("sealed inline payload has invalid fields");
-  let ciphertext;
-  let key32;
-  try {
-    ciphertext = fromBase64Url(record2.c);
-    key32 = fromBase64Url(record2.k);
-  } catch {
-    throw new TypeError("sealed inline payload has invalid base64url material");
-  }
-  if (ciphertext.byteLength === 0 || ciphertext.byteLength > MAX_INLINE_BYTES) throw new TypeError("sealed inline ciphertext is outside the allowed size");
-  if (key32.byteLength !== KEY_LENGTH2) throw new TypeError("sealed inline key must be 32 bytes");
-  assertCanonicalCid(record2.cid);
-  if (await computeCid(ciphertext) !== record2.cid) throw new TypeError("sealed inline ciphertext does not match its CID");
-  return { kind: "inline", ciphertextCid: record2.cid, ciphertext, key32 };
-}
 
 // src/share-index/ids.ts
 var SHARE_RECORDS_VAULT_PREFIX = "sender-history/v2/records/";
@@ -5694,6 +5638,9 @@ function classifyRecordKey(key) {
   return { kind: "rejected", ...owner };
 }
 
+// src/share-index/link.ts
+import { MAX_LINK_REQUEST_BYTES, parseLink } from "@tinycloud/share-envelope/links";
+
 // src/native.ts
 var NATIVE_SHARE_FRAGMENT_PARAMETER = "tc1";
 function parseNativeShareUrl(value) {
@@ -5707,14 +5654,17 @@ function parseNativeShareUrl(value) {
 
 // src/share-index/link.ts
 var MAX_LINK_LENGTH = 12 * 1024;
+var MAX_FULL_LINK_LENGTH = Math.ceil(MAX_LINK_REQUEST_BYTES * 4 / 3) + 512;
+var V4_SHARE_PATH = /^\/s\/([A-Za-z2-7]{26}|full)$/;
 function validateShareLink(link, shareOrigins) {
-  if (typeof link !== "string" || link.length === 0 || link.length > MAX_LINK_LENGTH || /[\s\u0000-\u001f\u007f]/.test(link)) return { ok: false };
+  if (typeof link !== "string" || link.length === 0 || link.length > MAX_FULL_LINK_LENGTH || /[\s\u0000-\u001f\u007f]/.test(link)) return { ok: false };
   let url;
   try {
     url = new URL(link);
   } catch {
     return { ok: false };
   }
+  if (link.length > MAX_LINK_LENGTH && url.pathname !== "/s/full") return { ok: false };
   if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.search !== "") return { ok: false };
   if (!isCanonicalHttpsOrigin(url.origin) || !shareOrigins.includes(url.origin)) return { ok: false };
   try {
@@ -5722,8 +5672,9 @@ function validateShareLink(link, shareOrigins) {
       parseNativeShareUrl(link);
       return link === `${url.origin}/viewer${url.hash}` ? { ok: true, shape: "native" } : { ok: false };
     }
-    if (url.pathname === "/s/inline") {
-      return link === `${url.origin}/s/inline${url.hash}` && /^#v=2&p=[A-Za-z0-9_-]+$/.test(url.hash) ? { ok: true, shape: "inline" } : { ok: false };
+    if (V4_SHARE_PATH.test(url.pathname)) {
+      const parsed = parseLink(link, { trustedOrigins: shareOrigins });
+      return parsed.form === "full" || parsed.pathType === "share" ? { ok: true, shape: "link" } : { ok: false };
     }
     parseShareUrl(link, { expectedOrigin: url.origin });
     return { ok: true, shape: "envelope" };
@@ -6084,6 +6035,7 @@ async function runCas(key, policy, attempt) {
 }
 
 // src/share-index/delivery.ts
+import { parseLink as parseLink2 } from "@tinycloud/share-envelope/links";
 var STORED_DELIVERY_MATERIAL_KEYS = ["shareCid", "sealedEnvelope", "envelopeKey"];
 var DeliveryMaterialError = class extends Error {
   constructor(message) {
@@ -6121,13 +6073,17 @@ async function openDeliveryEnvelope(material) {
   if (value === null || typeof value !== "object" || Array.isArray(value) || canonicalize(value) !== text) throw new DeliveryMaterialError("sealed envelope is not canonical JSON");
   return value;
 }
-async function shareLinkForRecord(record2, shareOrigin) {
-  if (record2.link !== void 0) return record2.link;
-  const material = record2.deliveryMaterial;
-  if (material === void 0) return void 0;
+function assertLinkBoundToMaterial(link, material) {
   const { sealed, key } = sealedParts(material);
-  if (await computeCid(sealed) !== material.shareCid) throw new DeliveryMaterialError("sealed envelope does not match shareCid");
-  return encodeSealedInlineShareUrl({ origin: shareOrigin, ciphertext: sealed, key32: key });
+  let parsed;
+  try {
+    parsed = parseLink2(link, { trustedOrigins: [new URL(link).origin] });
+  } catch {
+    throw new DeliveryMaterialError("link is not a v=4 share link");
+  }
+  const sameBody = parsed.form === "short" ? parsed.c === material.shareCid : typeof parsed.record === "object" && parsed.record !== null && "body" in parsed.record && parsed.record.body === toBase64Url(sealed);
+  if (!sameBody || !equalBytes(parsed.key, key)) throw new DeliveryMaterialError("link is not the link of this delivery material");
+  return parsed.form;
 }
 async function compactShareRecord(record2) {
   const material = record2.deliveryMaterial;
@@ -6137,29 +6093,17 @@ async function compactShareRecord(record2) {
   const opened = await openDeliveryEnvelope(stored);
   if (material.envelope !== void 0 && canonicalize(opened) !== canonicalize(material.envelope)) throw new DeliveryMaterialError("envelope is not the sealed envelope");
   const { link, deliveryMaterial: _material, ...rest } = record2;
-  if (link !== void 0) {
-    const { sealed, key } = sealedParts(stored);
-    let parsed;
-    try {
-      parsed = await parseSealedInlineShareUrl(link);
-    } catch {
-      parsed = void 0;
-    }
-    if (parsed === void 0 || parsed.ciphertextCid !== stored.shareCid || !equalBytes(parsed.ciphertext, sealed) || !equalBytes(parsed.key32, key)) {
-      throw new DeliveryMaterialError("link is not the sealed-inline link of this delivery material");
-    }
-  }
-  return { ...rest, deliveryMaterial: stored };
+  const keptLink = link !== void 0 && assertLinkBoundToMaterial(link, stored) === "short" ? link : void 0;
+  return { ...rest, ...keptLink === void 0 ? {} : { link: keptLink }, deliveryMaterial: stored };
 }
 function equalBytes(left, right) {
   return left.length === right.length && left.every((byte, index) => byte === right[index]);
 }
-async function expandShareRecord(record2, shareOrigin) {
+async function expandShareRecord(record2) {
   const material = record2.deliveryMaterial;
   if (material === void 0) return record2;
   const envelope = await openDeliveryEnvelope(material);
-  const link = shareOrigin === void 0 ? record2.link : await shareLinkForRecord(record2, shareOrigin);
-  return { ...record2, ...link === void 0 ? {} : { link }, deliveryMaterial: { ...material, envelope } };
+  return { ...record2, deliveryMaterial: { ...material, envelope } };
 }
 
 // src/share-index/record-store.ts
@@ -6266,7 +6210,7 @@ var AgentShareRecordStore = class {
     }
     if (!isRecordShape(value) || value.shareId !== shareId) throw new AgentRecordError("shape");
     try {
-      return await expandShareRecord(value, this.options.shareOrigin);
+      return await expandShareRecord(value);
     } catch {
       throw new AgentRecordError("shape");
     }
@@ -6457,6 +6401,15 @@ var ShareRecordSchemaError = class extends Error {
     this.name = "ShareRecordSchemaError";
   }
 };
+function carriesSealedRecord(link) {
+  try {
+    const url = new URL(link);
+    const fragment = new URLSearchParams(url.hash.slice(1));
+    return url.pathname === "/s/full" || fragment.has("r") || fragment.has("p");
+  } catch {
+    return false;
+  }
+}
 function checkAgentRecordSchema(value, context) {
   const fail2 = () => {
     throw new ShareRecordSchemaError("schema");
@@ -6493,7 +6446,7 @@ function checkAgentRecordSchema(value, context) {
   if (record2.deliveryMaterial !== void 0) {
     const material = record2.deliveryMaterial;
     if (!isObject(material) || Object.keys(material).length !== STORED_DELIVERY_MATERIAL_KEYS.length || !STORED_DELIVERY_MATERIAL_KEYS.every((key) => typeof material[key] === "string")) return fail2();
-    if (record2.link !== void 0) return fail2();
+    if (typeof record2.link === "string" && carriesSealedRecord(record2.link)) return fail2();
   }
   if (record2.deliveredRecipients !== void 0 && (!Array.isArray(record2.deliveredRecipients) || !record2.deliveredRecipients.every((item) => typeof item === "string"))) return fail2();
   if (record2.proofs !== void 0) {
@@ -8231,6 +8184,13 @@ var SenderShareIndex = class {
       return { kind: "reject", reason: error instanceof ShareRecordSchemaError && error.reason === "provenance" ? "provenance" : "schema" };
     }
     if (record2.link !== void 0 && !validateShareLink(record2.link, this.options.shareOrigins).ok) return { kind: "reject", reason: "link" };
+    if (record2.link !== void 0 && record2.deliveryMaterial !== void 0) {
+      try {
+        assertLinkBoundToMaterial(record2.link, record2.deliveryMaterial);
+      } catch {
+        return { kind: "reject", reason: "link" };
+      }
+    }
     const verdict = await verifyAgentRecordChain(record2, {
       accountOwnerDid: this.options.ownerDid,
       agentDid: input.agentDid,
@@ -8610,6 +8570,7 @@ export {
   agentRecordBinding,
   agentRecordKey,
   agentRecordPrefix,
+  assertLinkBoundToMaterial,
   attenuationCovers,
   checkRegistrationReceipt,
   claimRank,
@@ -8632,7 +8593,6 @@ export {
   parseStoredAgentRecord,
   project,
   sealAgentRecord,
-  shareLinkForRecord,
   validateShareLink,
   verifyAgentRecordChain,
   verifyEnvelopeV3At,