@tinycloud/share-sdk 1.4.1 → 1.4.2-beta.1

package/dist/share-index.js

@@ -6058,7 +6058,7 @@ async function runCas(key, policy, attempt) {
 }
 
 // src/share-index/delivery.ts
-import { parseLink as parseLink2 } from "@tinycloud/share-envelope/links";
+import { buildFullLink, checkLinkRecord, linkSignatureV1Schema, openLinkRecord, parseLink as parseLink2, validateLinkHeader } from "@tinycloud/share-envelope/links";
 var STORED_DELIVERY_MATERIAL_KEYS = ["shareCid", "sealedEnvelope", "envelopeKey"];
 var DeliveryMaterialError = class extends Error {
   constructor(message) {
@@ -6066,6 +6066,16 @@ var DeliveryMaterialError = class extends Error {
     this.name = "DeliveryMaterialError";
   }
 };
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function checkStoredFullShareLink(value) {
+  if (!isObject(value) || Object.keys(value).length !== 3 || !["origin", "header", "signature"].every((key) => Object.hasOwn(value, key)) || typeof value.origin !== "string" || !isCanonicalHttpsOrigin(value.origin)) throw new DeliveryMaterialError("full link metadata is invalid");
+  const header = validateLinkHeader(value.header, { mode: "signed" });
+  const signature = linkSignatureV1Schema.parse(value.signature);
+  if (header.type !== "share") throw new DeliveryMaterialError("full link is not a share");
+  return { origin: value.origin, header, signature };
+}
 function sealedParts(material) {
   let sealed;
   let key;
@@ -6082,18 +6092,24 @@ async function openDeliveryEnvelope(material) {
   const { sealed, key } = sealedParts(material);
   if (await computeCid(sealed) !== material.shareCid) throw new DeliveryMaterialError("sealed envelope does not match shareCid");
   let text;
-  try {
-    text = new TextDecoder("utf-8", { fatal: true }).decode(await open(sealed, key));
-  } catch {
-    throw new DeliveryMaterialError("sealed envelope does not open under its key");
-  }
   let value;
   try {
-    value = JSON.parse(text);
-  } catch {
-    throw new DeliveryMaterialError("sealed envelope is not JSON");
+    if (material.fullLink === void 0) {
+      text = new TextDecoder("utf-8", { fatal: true }).decode(await open(sealed, key));
+      value = JSON.parse(text);
+    } else {
+      const metadata = checkStoredFullShareLink(material.fullLink);
+      if (metadata.header.bodyCid !== material.shareCid) throw new DeliveryMaterialError("full link names another sealed body");
+      const opened = await openLinkRecord({ header: metadata.header, signature: metadata.signature, body: material.sealedEnvelope }, key, { now: Date.parse(metadata.header.issuedAt) });
+      text = new TextDecoder("utf-8", { fatal: true }).decode(opened.plaintext);
+      value = opened.value;
+      if (typeof opened.value.expiry !== "string" || Date.parse(opened.value.expiry) !== Date.parse(metadata.header.expiresAt)) throw new DeliveryMaterialError("full link expiry differs from the sealed envelope");
+    }
+  } catch (error) {
+    if (error instanceof DeliveryMaterialError) throw error;
+    throw new DeliveryMaterialError(material.fullLink === void 0 ? "sealed envelope does not open under its key" : "original full link is invalid");
   }
-  if (value === null || typeof value !== "object" || Array.isArray(value) || canonicalize(value) !== text) throw new DeliveryMaterialError("sealed envelope is not canonical JSON");
+  if (!isObject(value) || canonicalize(value) !== text) throw new DeliveryMaterialError("sealed envelope is not canonical JSON");
   return value;
 }
 function assertLinkBoundToMaterial(link, material) {
@@ -6112,21 +6128,58 @@ async function compactShareRecord(record2) {
   const material = record2.deliveryMaterial;
   if (material === void 0) return record2;
   if (typeof material.shareCid !== "string" || typeof material.sealedEnvelope !== "string" || typeof material.envelopeKey !== "string") throw new DeliveryMaterialError("delivery material is incomplete");
-  const stored = { shareCid: material.shareCid, sealedEnvelope: material.sealedEnvelope, envelopeKey: material.envelopeKey };
-  const opened = await openDeliveryEnvelope(stored);
-  if (material.envelope !== void 0 && canonicalize(opened) !== canonicalize(material.envelope)) throw new DeliveryMaterialError("envelope is not the sealed envelope");
+  let fullLink = "fullLink" in material ? checkStoredFullShareLink(material.fullLink) : void 0;
   const { link, deliveryMaterial: _material, ...rest } = record2;
-  const keptLink = link !== void 0 && assertLinkBoundToMaterial(link, stored) === "short" ? link : void 0;
+  let keptLink;
+  if (link !== void 0) {
+    if (assertLinkBoundToMaterial(link, material) === "short") keptLink = link;
+    else {
+      const parsed = parseLink2(link, { trustedOrigins: [new URL(link).origin] });
+      if (parsed.form !== "full" || !isObject(parsed.record)) throw new DeliveryMaterialError("full link record is invalid");
+      const header = validateLinkHeader(parsed.record.header, { mode: "signed" });
+      const checked = await checkLinkRecord(parsed.record, Date.parse(header.issuedAt));
+      if (checked.signature === void 0) throw new DeliveryMaterialError("full link signature is missing");
+      const original = checkStoredFullShareLink({ origin: parsed.origin, header: checked.header, signature: checked.signature });
+      if (fullLink !== void 0 && canonicalize(fullLink) !== canonicalize(original)) throw new DeliveryMaterialError("full link metadata differs from the original link");
+      fullLink = original;
+    }
+  }
+  const stored = { shareCid: material.shareCid, sealedEnvelope: material.sealedEnvelope, envelopeKey: material.envelopeKey, ...fullLink === void 0 ? {} : { fullLink } };
+  const opened = await openDeliveryEnvelope(stored);
+  if ("envelope" in material && material.envelope !== void 0 && canonicalize(opened) !== canonicalize(material.envelope)) throw new DeliveryMaterialError("envelope is not the sealed envelope");
+  if (fullLink !== void 0 && Date.parse(fullLink.header.expiresAt) !== Date.parse(record2.expiresAt)) throw new DeliveryMaterialError("full link expiry differs from the record");
   return { ...rest, ...keptLink === void 0 ? {} : { link: keptLink }, deliveryMaterial: stored };
 }
 function equalBytes(left, right) {
   return left.length === right.length && left.every((byte, index) => byte === right[index]);
 }
-async function expandShareRecord(record2) {
+function recordLink(record2, shareOrigins) {
   const material = record2.deliveryMaterial;
-  if (material === void 0) return record2;
+  if (material?.fullLink === void 0) return record2.link;
+  const metadata = checkStoredFullShareLink(material.fullLink);
+  if (!shareOrigins.includes(metadata.origin)) throw new DeliveryMaterialError("full link origin is not trusted");
+  if (Date.parse(metadata.header.expiresAt) !== Date.parse(record2.expiresAt)) throw new DeliveryMaterialError("full link expiry differs from the record");
+  const full = buildFullLink({ origin: metadata.origin, key: sealedParts(material).key, record: { header: metadata.header, signature: metadata.signature, body: material.sealedEnvelope } });
+  if (record2.link !== void 0) {
+    parseLink2(record2.link, { trustedOrigins: shareOrigins });
+    assertLinkBoundToMaterial(record2.link, material);
+  }
+  return record2.link ?? full;
+}
+async function restoreShareRecordLink(record2, shareOrigins) {
+  if (record2.deliveryMaterial?.fullLink !== void 0) await openDeliveryEnvelope(record2.deliveryMaterial);
+  return recordLink(record2, shareOrigins);
+}
+async function expandShareRecord(record2, options = {}) {
+  const material = record2.deliveryMaterial;
+  if (material === void 0) {
+    const { deliveryMaterial: _material, ...withoutMaterial } = record2;
+    return withoutMaterial;
+  }
   const envelope = await openDeliveryEnvelope(material);
-  return { ...record2, deliveryMaterial: { ...material, envelope } };
+  const origins = options.shareOrigins ?? (material.fullLink === void 0 ? [] : [checkStoredFullShareLink(material.fullLink).origin]);
+  const link = recordLink(record2, origins);
+  return { ...record2, ...link === void 0 ? {} : { link }, deliveryMaterial: { ...material, envelope } };
 }
 
 // src/share-index/record-store.ts
@@ -6298,6 +6351,14 @@ var AgentShareRecordStore = class {
   }
 };
 
+// src/artifact-core.ts
+var ARTIFACT_ROOT = "artifacts";
+function parseArtifactVersionPath(path) {
+  const match = /^artifacts\/([a-z0-9][a-z0-9_-]{2,62})\/versions\/([1-9][0-9]{0,14})\/([^/]+)$/.exec(path);
+  if (match === null) return void 0;
+  return { artifactId: match[1], version: Number(match[2]), file: match[3] };
+}
+
 // src/share-index/schema.ts
 var INDEX_SCHEMA_VERSION = 1;
 function emptyIndexDocument(input) {
@@ -6314,7 +6375,7 @@ function emptyIndexDocument(input) {
     rows: {}
   };
 }
-function isObject(value) {
+function isObject2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function isIsoTime(value) {
@@ -6323,25 +6384,25 @@ function isIsoTime(value) {
   return Number.isFinite(parsed) && new Date(parsed).toISOString() === `${match[1]}.${(match[2] ?? "").padEnd(3, "0").slice(0, 3)}Z`;
 }
 function isRow(value) {
-  if (!isObject(value)) return false;
-  return typeof value.n === "string" && (value.k === "file" || value.k === "folder") && typeof value.ak === "string" && typeof value.al === "string" && Array.isArray(value.a) && value.a.every((item) => typeof item === "string") && typeof value.c === "string" && typeof value.x === "string" && (value.r === void 0 || isObject(value.r) && typeof value.r.at === "string" && typeof value.r.confirmed === "boolean") && typeof value.rk === "string" && (value.cid === void 0 || typeof value.cid === "string") && (value.cc === void 0 || Array.isArray(value.cc) && value.cc.every((item) => typeof item === "string")) && typeof value.src === "string";
+  if (!isObject2(value)) return false;
+  return typeof value.n === "string" && (value.k === "file" || value.k === "folder") && typeof value.ak === "string" && typeof value.al === "string" && Array.isArray(value.a) && value.a.every((item) => typeof item === "string") && typeof value.c === "string" && typeof value.x === "string" && (value.r === void 0 || isObject2(value.r) && typeof value.r.at === "string" && typeof value.r.confirmed === "boolean") && typeof value.rk === "string" && (value.cid === void 0 || typeof value.cid === "string") && (value.cc === void 0 || Array.isArray(value.cc) && value.cc.every((item) => typeof item === "string")) && typeof value.src === "string";
 }
 function isAgentEntry(value) {
-  return isObject(value) && (value.did === null || typeof value.did === "string") && Number.isSafeInteger(value.rows) && isObject(value.rejected) && Object.values(value.rejected).every((count) => Number.isSafeInteger(count)) && Array.isArray(value.rejectedKeys) && value.rejectedKeys.every((item) => typeof item === "string") && (value.newerKeys === void 0 || Array.isArray(value.newerKeys) && value.newerKeys.every((item) => typeof item === "string")) && (value.paused === false || isObject(value.paused) && typeof value.paused.reason === "string" && typeof value.paused.at === "string") && typeof value.firstSeen === "string";
+  return isObject2(value) && (value.did === null || typeof value.did === "string") && Number.isSafeInteger(value.rows) && isObject2(value.rejected) && Object.values(value.rejected).every((count) => Number.isSafeInteger(count)) && Array.isArray(value.rejectedKeys) && value.rejectedKeys.every((item) => typeof item === "string") && (value.newerKeys === void 0 || Array.isArray(value.newerKeys) && value.newerKeys.every((item) => typeof item === "string")) && (value.paused === false || isObject2(value.paused) && typeof value.paused.reason === "string" && typeof value.paused.at === "string") && typeof value.firstSeen === "string";
 }
 function parseIndexDocument(value) {
-  if (!isObject(value) || !Number.isSafeInteger(value.v)) return { status: "invalid" };
+  if (!isObject2(value) || !Number.isSafeInteger(value.v)) return { status: "invalid" };
   if (value.v > INDEX_SCHEMA_VERSION) return { status: "newer", v: value.v };
   if (value.v !== INDEX_SCHEMA_VERSION || typeof value.ownerDid !== "string" || typeof value.spaceId !== "string" || typeof value.updatedAt !== "string" || typeof value.updatedBy !== "string") return { status: "invalid" };
-  if (!Array.isArray(value.archives) || !value.archives.every((item) => isObject(item) && typeof item.name === "string" && Array.isArray(item.ids) && item.ids.every((id) => typeof id === "string"))) return { status: "invalid" };
-  if (!Array.isArray(value.tombstones) || !value.tombstones.every((item) => isObject(item) && typeof item.key === "string" && typeof item.at === "string")) return { status: "invalid" };
-  if (!isObject(value.reconcile) || value.reconcile.cursor !== void 0 && typeof value.reconcile.cursor !== "string") return { status: "invalid" };
-  if (!isObject(value.agents) || !Object.values(value.agents).every(isAgentEntry)) return { status: "invalid" };
-  if (!isObject(value.rows) || !Object.values(value.rows).every(isRow)) return { status: "invalid" };
+  if (!Array.isArray(value.archives) || !value.archives.every((item) => isObject2(item) && typeof item.name === "string" && Array.isArray(item.ids) && item.ids.every((id) => typeof id === "string"))) return { status: "invalid" };
+  if (!Array.isArray(value.tombstones) || !value.tombstones.every((item) => isObject2(item) && typeof item.key === "string" && typeof item.at === "string")) return { status: "invalid" };
+  if (!isObject2(value.reconcile) || value.reconcile.cursor !== void 0 && typeof value.reconcile.cursor !== "string") return { status: "invalid" };
+  if (!isObject2(value.agents) || !Object.values(value.agents).every(isAgentEntry)) return { status: "invalid" };
+  if (!isObject2(value.rows) || !Object.values(value.rows).every(isRow)) return { status: "invalid" };
   return { status: "ok", doc: value };
 }
 function parseArchiveDocument(value) {
-  if (!isObject(value) || value.v !== INDEX_SCHEMA_VERSION || !isObject(value.rows) || !Object.values(value.rows).every(isRow)) return void 0;
+  if (!isObject2(value) || value.v !== INDEX_SCHEMA_VERSION || !isObject2(value.rows) || !Object.values(value.rows).every(isRow)) return void 0;
   return value;
 }
 var UNSAFE_TEXT = /[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u206f\ufeff\ufff9-\ufffb]/g;
@@ -6403,7 +6464,7 @@ var FIELDS_BY_RECORD_V = {
 };
 function isShareResourcePath(path) {
   if (typeof path !== "string" || path.length === 0 || path.length > 1024 || /[\\%\u0000-\u001f]/.test(path)) return false;
-  if (!SHARE_RESOURCE_PREFIXES.some((prefix) => path.startsWith(prefix) && path.length > prefix.length)) return false;
+  if (!SHARE_RESOURCE_PREFIXES.some((prefix) => path.startsWith(prefix) && path.length > prefix.length) && parseArtifactVersionPath(path) === void 0) return false;
   return path.split("/").every((segment, index, all) => (segment !== "" || index === all.length - 1) && segment !== "." && segment !== "..");
 }
 function isSpaceOwnedBy(spaceId, ownerDid) {
@@ -6438,7 +6499,7 @@ function checkAgentRecordSchema(value, context) {
     throw new ShareRecordSchemaError("schema");
   };
   const fields = FIELDS_BY_RECORD_V[context.recordV];
-  if (fields === void 0 || !isObject(value)) return fail2();
+  if (fields === void 0 || !isObject2(value)) return fail2();
   const keys = Object.keys(value);
   if (!fields.required.every((key) => keys.includes(key)) || !keys.every((key) => fields.required.includes(key) || fields.optional.includes(key))) return fail2();
   const record2 = value;
@@ -6447,13 +6508,15 @@ function checkAgentRecordSchema(value, context) {
   if (record2.shareId !== context.shareId) return fail2();
   const target = record2.target;
   const targetKeys = Object.keys(target ?? {});
-  if (!isObject(target) || !targetKeys.every((key) => ["origin", "nodeAudience", "spaceId", "kind"].includes(key)) || typeof target.origin !== "string" || typeof target.nodeAudience !== "string" || typeof target.spaceId !== "string" || target.kind !== void 0 && (typeof target.kind !== "string" || !["bearer", "recipientDid", "email", "emailDomain"].includes(target.kind))) return fail2();
+  if (!isObject2(target) || !targetKeys.every((key) => ["origin", "nodeAudience", "spaceId", "kind"].includes(key)) || typeof target.origin !== "string" || typeof target.nodeAudience !== "string" || typeof target.spaceId !== "string" || target.kind !== void 0 && (typeof target.kind !== "string" || !["bearer", "recipientDid", "email", "emailDomain"].includes(target.kind))) return fail2();
   if (!isSpaceOwnedBy(target.spaceId, context.accountOwnerDid)) return fail2();
   const resource = record2.resource;
-  if (!isObject(resource) || Object.keys(resource).length !== 2 || resource.kind !== "exact" && resource.kind !== "prefix" || !isShareResourcePath(resource.path)) return fail2();
+  if (!isObject2(resource) || Object.keys(resource).length !== 2 || resource.kind !== "exact" && resource.kind !== "prefix" || !isShareResourcePath(resource.path)) return fail2();
   if (!Array.isArray(record2.actions) || record2.actions.length === 0 || new Set(record2.actions).size !== record2.actions.length || !record2.actions.every((action) => typeof action === "string" && SHARE_ACTIONS.includes(action))) return fail2();
+  const artifact = parseArtifactVersionPath(resource.path) !== void 0;
+  if (artifact && (resource.kind !== "exact" || record2.actions.some((action) => action !== "tinycloud.kv/get" && action !== "tinycloud.kv/metadata"))) return fail2();
   const matcher = record2.recipientMatcher;
-  if (!isObject(matcher) || !(matcher.kind === "bearer" ? Object.keys(matcher).length === 1 : ["exactEmail", "emailDomain", "recipientDid"].includes(matcher.kind) && Object.keys(matcher).length === 2 && typeof matcher.value === "string")) return fail2();
+  if (!isObject2(matcher) || !(matcher.kind === "bearer" ? Object.keys(matcher).length === 1 : ["exactEmail", "emailDomain", "recipientDid"].includes(matcher.kind) && Object.keys(matcher).length === 2 && typeof matcher.value === "string")) return fail2();
   if (!isIsoTime(record2.registeredAt) || !isIsoTime(record2.expiresAt) || Date.parse(record2.registeredAt) >= Date.parse(record2.expiresAt)) return fail2();
   for (const key of ["registrationCid", "policyCid", "ownerDelegationCid", "enforcementDelegationCid", "envelopeCid", "shareCid"]) {
     if (record2[key] !== void 0 && (typeof record2[key] !== "string" || !/^[a-z0-9]{8,128}$/.test(record2[key]))) return fail2();
@@ -6468,13 +6531,27 @@ function checkAgentRecordSchema(value, context) {
   if (record2.filename !== void 0 && (typeof record2.filename !== "string" || record2.filename.length > 512)) return fail2();
   if (record2.deliveryMaterial !== void 0) {
     const material = record2.deliveryMaterial;
-    if (!isObject(material) || Object.keys(material).length !== STORED_DELIVERY_MATERIAL_KEYS.length || !STORED_DELIVERY_MATERIAL_KEYS.every((key) => typeof material[key] === "string")) return fail2();
+    if (!isObject2(material) || !STORED_DELIVERY_MATERIAL_KEYS.every((key) => typeof material[key] === "string") || Object.keys(material).some((key) => !STORED_DELIVERY_MATERIAL_KEYS.includes(key) && key !== "fullLink")) return fail2();
+    if (Object.hasOwn(material, "fullLink")) {
+      try {
+        checkStoredFullShareLink(material.fullLink);
+      } catch {
+        return fail2();
+      }
+    }
     if (typeof record2.link === "string" && carriesSealedRecord(record2.link)) return fail2();
   }
   if (record2.deliveredRecipients !== void 0 && (!Array.isArray(record2.deliveredRecipients) || !record2.deliveredRecipients.every((item) => typeof item === "string"))) return fail2();
   if (record2.proofs !== void 0) {
     const proofs = record2.proofs;
-    if (!isObject(proofs) || !Object.keys(proofs).every((key) => PROOF_STRING_FIELDS.includes(key) ? typeof proofs[key] === "string" : PROOF_OBJECT_FIELDS.includes(key) && isObject(proofs[key]))) return fail2();
+    if (!isObject2(proofs) || !Object.keys(proofs).every((key) => PROOF_STRING_FIELDS.includes(key) ? typeof proofs[key] === "string" : PROOF_OBJECT_FIELDS.includes(key) && isObject2(proofs[key]))) return fail2();
+  }
+  if (artifact) {
+    const proofs = record2.proofs;
+    if (isObject2(proofs) && proofs.ownerPolicy !== void 0) return fail2();
+    if (record2.deliveryMaterial !== void 0) {
+      if (record2.targetKind === void 0 || record2.targetKind === "bearer" || isObject2(proofs) && proofs.link !== void 0) return fail2();
+    } else if (record2.targetKind !== void 0 && record2.targetKind !== "bearer") return fail2();
   }
   return record2;
 }
@@ -7921,6 +7998,76 @@ async function verifyAgentRecordChain(record2, context) {
   }
 }
 
+// src/artifact-pin.ts
+var ArtifactPinError = class extends Error {
+  code;
+  /** The code is the message: stable, short, and what callers and tests match on. */
+  constructor(code3) {
+    super(code3);
+    this.name = "ArtifactPinError";
+    this.code = code3;
+  }
+};
+function artifactBindingView(envelope) {
+  return {
+    ...envelope.artifactPin === void 0 ? {} : { artifactPin: envelope.artifactPin },
+    target: envelope.target,
+    contentSource: envelope.contentSource,
+    resource: envelope.resource,
+    actions: envelope.actions,
+    policyKvActions: envelope.policy.capabilityCeiling.flatMap((capability) => capability.kind === "kv" ? capability.actions : [])
+  };
+}
+function sourcePath(view) {
+  const resource = view.contentSource.kvResource;
+  const marker = "/kv/";
+  const at = resource.indexOf(marker);
+  if (at <= 0 || resource.slice(0, at) !== view.target.spaceId) {
+    throw new ArtifactPinError("pin-source-mismatch");
+  }
+  return resource.slice(at + marker.length);
+}
+function assertArtifactBinding(view, expected = {}) {
+  const pin = view.artifactPin;
+  const path = sourcePath(view);
+  const inArtifacts = path === ARTIFACT_ROOT || path.startsWith(`${ARTIFACT_ROOT}/`);
+  if (!inArtifacts) {
+    if (pin !== void 0) throw new ArtifactPinError("pin-source-mismatch");
+    return void 0;
+  }
+  if (pin === void 0) throw new ArtifactPinError("missing-pin");
+  const parsed = parseArtifactVersionPath(path);
+  if (parsed === void 0) throw new ArtifactPinError("unsupported-artifact-path");
+  const file = pin.files[0];
+  const source = view.contentSource;
+  if (
+    // The stored ciphertext of one file: bounded like content (100 MiB) plus the envelope's own framing.
+    file.bytes > 128 * 1024 * 1024 || pin.artifactId !== parsed.artifactId || pin.version !== parsed.version || file.path !== parsed.file || view.resource.kind !== "exact" || view.resource.path !== path || source.selector !== "exact" || source.mode !== "immutable" || source.initialCiphertextDigestHex !== file.sha256
+  ) {
+    throw new ArtifactPinError("pin-source-mismatch");
+  }
+  if (view.actions.includes("edit") || view.policyKvActions.includes("tinycloud.kv/put")) {
+    throw new ArtifactPinError("pinned-share-writable");
+  }
+  if (expected.artifactId !== void 0 && expected.artifactId !== pin.artifactId || expected.version !== void 0 && expected.version !== pin.version) {
+    throw new ArtifactPinError("expectation-mismatch");
+  }
+  return pin;
+}
+function verifyArtifactShare(envelope, options) {
+  if (envelope.signature.signerDid !== options.expectedOwnerDid) {
+    throw new ArtifactPinError("wrong-signer");
+  }
+  let valid;
+  try {
+    valid = verifyEnvelopeV3SignatureOnly(envelope) && envelope.policy.ownerDid === options.expectedOwnerDid;
+  } catch {
+    valid = false;
+  }
+  if (!valid) throw new ArtifactPinError("bad-signature");
+  return assertArtifactBinding(artifactBindingView(envelope), options.expected);
+}
+
 // src/share-index/sender-share-index.ts
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_SHARE_INDEX_LIMITS = {
@@ -7966,13 +8113,13 @@ function basename(key) {
 function agentOf(row) {
   return row.src.startsWith("agent:") ? row.src.slice("agent:".length) : void 0;
 }
-function isObject2(item) {
+function isObject3(item) {
   return item !== null && typeof item === "object" && !Array.isArray(item);
 }
 function isWebRecord(value) {
-  if (!isObject2(value)) return false;
+  if (!isObject3(value)) return false;
   const { shareId, target, resource, actions, recipientMatcher, registeredAt, expiresAt } = value;
-  return typeof shareId === "string" && isObject2(target) && typeof target.spaceId === "string" && isObject2(resource) && typeof resource.path === "string" && Array.isArray(actions) && actions.every((item) => typeof item === "string") && isObject2(recipientMatcher) && typeof recipientMatcher.kind === "string" && typeof registeredAt === "string" && typeof expiresAt === "string";
+  return typeof shareId === "string" && isObject3(target) && typeof target.spaceId === "string" && isObject3(resource) && typeof resource.path === "string" && Array.isArray(actions) && actions.every((item) => typeof item === "string") && isObject3(recipientMatcher) && typeof recipientMatcher.kind === "string" && typeof registeredAt === "string" && typeof expiresAt === "string";
 }
 function unreadableRow(now) {
   const at = now.toISOString();
@@ -8206,10 +8353,16 @@ var SenderShareIndex = class {
     } catch (error) {
       return { kind: "reject", reason: error instanceof ShareRecordSchemaError && error.reason === "provenance" ? "provenance" : "schema" };
     }
-    if (record2.link !== void 0 && !validateShareLink(record2.link, this.options.shareOrigins).ok) return { kind: "reject", reason: "link" };
-    if (record2.link !== void 0 && record2.deliveryMaterial !== void 0) {
+    let link;
+    try {
+      link = await restoreShareRecordLink(record2, this.options.shareOrigins);
+    } catch {
+      return { kind: "reject", reason: "link" };
+    }
+    if (link !== void 0 && !validateShareLink(link, this.options.shareOrigins).ok) return { kind: "reject", reason: "link" };
+    if (link !== void 0 && record2.deliveryMaterial !== void 0) {
       try {
-        assertLinkBoundToMaterial(record2.link, record2.deliveryMaterial);
+        assertLinkBoundToMaterial(link, record2.deliveryMaterial);
       } catch {
         return { kind: "reject", reason: "link" };
       }
@@ -8222,6 +8375,14 @@ var SenderShareIndex = class {
       ...this.options.registrationKey === void 0 ? {} : { registrationKey: this.options.registrationKey }
     });
     if (!verdict.ok) return { kind: "reject", reason: "proof" };
+    if (parseArtifactVersionPath(record2.resource.path) !== void 0 && record2.deliveryMaterial !== void 0) {
+      try {
+        const envelope = shareEnvelopeV3Schema.parse(await openDeliveryEnvelope(record2.deliveryMaterial));
+        if (verifyArtifactShare(envelope, { expectedOwnerDid: envelope.policy.ownerDid }) === void 0) return { kind: "reject", reason: "proof" };
+      } catch {
+        return { kind: "reject", reason: "proof" };
+      }
+    }
     const window = input.source === "migrated" ? { ...verdict.issued.latest === void 0 ? {} : { latest: verdict.issued.latest } } : verdict.issued;
     if (!registeredAtFits(record2.registeredAt, window, this.now())) return { kind: "reject", reason: "schema" };
     const row = project(record2, { key: input.key, src: input.src, claims: verdict.claims, proof: { state: verdict.state, expired: verdict.expired } });
@@ -8234,7 +8395,7 @@ var SenderShareIndex = class {
   peekRecordV(bytes) {
     try {
       const value = JSON.parse(new TextDecoder().decode(bytes));
-      const recordV = isObject2(value) && isObject2(value.hdr) ? value.hdr.recordV : void 0;
+      const recordV = isObject3(value) && isObject3(value.hdr) ? value.hdr.recordV : void 0;
       return typeof recordV === "number" && Number.isSafeInteger(recordV) ? recordV : SUPPORTED_AGENT_RECORD_V + 1;
     } catch {
       return SUPPORTED_AGENT_RECORD_V + 1;
@@ -8320,7 +8481,7 @@ var SenderShareIndex = class {
         if (classified.kind === "web") {
           fetches++;
           const read3 = await this.backend.readVault(key);
-          if (read3.status === "ok" && isObject2(read3.value) && read3.value.provenance === "migrated") {
+          if (read3.status === "ok" && isObject3(read3.value) && read3.value.provenance === "migrated") {
             const checked = await this.checkRecord(read3.value, { key, shareId: classified.shareId, src: "web", source: "migrated", agentDid: "", recordV: SUPPORTED_AGENT_RECORD_V }, archivedOnce);
             findings.push({ kind: "web", key, row: checked.kind === "admit" ? checked.row : { ...unreadableRow(this.now()), pv: "migrated" } });
           } else if (read3.status === "ok") {
@@ -8595,6 +8756,7 @@ export {
   agentRecordPrefix,
   assertLinkBoundToMaterial,
   attenuationCovers,
+  checkAgentRecordSchema,
   checkRegistrationReceipt,
   claimRank,
   classifyRecordKey,
@@ -8615,6 +8777,8 @@ export {
   parseSignedUcan,
   parseStoredAgentRecord,
   project,
+  registeredAtFits,
+  restoreShareRecordLink,
   sealAgentRecord,
   validateShareLink,
   verifyAgentRecordChain,