@tinycloud/share-sdk 1.4.2-beta.0 → 1.4.2-beta.1

package/dist/share-index.d.cts

@@ -1,5 +1,6 @@
 import { a as SenderShareRecordStorage, S as SenderShareRecord } from './history-Bg25JIsi.cjs';
 export { f as SenderShareRecordProofs } from './history-Bg25JIsi.cjs';
+import { LinkHeaderV1, LinkSignatureV1 } from '@tinycloud/share-envelope/links';
 import { P as PublishedShareDeliveryMaterial, S as SignedDelegation, l as OwnerSharePolicyRegistration } from './owner-policy-aPmXIR3e.cjs';
 import { ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 
@@ -469,21 +470,28 @@ declare class AgentShareRecordStore implements SenderShareRecordStorage {
  * sealed and rebuilt when needed by {@link openDeliveryEnvelope}, for the
  * verifier and a delivery retry. `sealedEnvelope` stays (the node reopens that
  * exact value and its nonce is random) and so does the session CACAO (it
- * proves the chain). A short `v=4` link the sender printed is kept (it is not
- * derivable: it carries an id only the links service knows) and must be the
- * link of this material; a full link is not kept (see {@link compactShareRecord}).
+ * proves the chain). Short links stay verbatim; full links keep their original
+ * renderer origin, signed header and signature beside the single sealed body.
+ * Details: TC-1739
  *
  * Security-sensitive: the sealed bytes are checked against `shareCid` before
  * they are opened, and the plaintext must be the canonical JSON of the
  * envelope, so a record cannot carry one envelope for display and another for
  * the node.
  */
-type StoredDeliveryMaterial = Omit<PublishedShareDeliveryMaterial, "envelope">;
+interface StoredFullShareLink {
+    readonly origin: string;
+    readonly header: LinkHeaderV1;
+    readonly signature: LinkSignatureV1;
+}
+type StoredDeliveryMaterial = Omit<PublishedShareDeliveryMaterial, "envelope"> & {
+    readonly fullLink?: StoredFullShareLink;
+};
 /** A share record as stored at an agent (or migrated) key: {@link SenderShareRecord} without derivable blobs. */
 type StoredShareRecord = Omit<SenderShareRecord, "deliveryMaterial"> & {
     readonly deliveryMaterial?: StoredDeliveryMaterial;
 };
-/** Keys of a stored `deliveryMaterial`, exactly. */
+/** Required string fields; `fullLink` is optional original signed metadata. Details: TC-1739 */
 declare const STORED_DELIVERY_MATERIAL_KEYS: readonly string[];
 declare class DeliveryMaterialError extends Error {
     constructor(message: string);
@@ -497,22 +505,14 @@ declare function openDeliveryEnvelope(material: StoredDeliveryMaterial): Promise
  * Returns the link's form.
  */
 declare function assertLinkBoundToMaterial(link: string, material: StoredDeliveryMaterial): "short" | "full";
-/**
- * The stored form of `record`. For a Policy/v3 record (one with
- * `deliveryMaterial`), omits `deliveryMaterial.envelope` after checking it is
- * exactly what the sealed material opens to, and checks that a `link` is the
- * link of that material. A short link is kept. A full link is not: it embeds
- * the sealed envelope a second time, which the record size cap does not leave
- * room for, so the sender's own history holds it. Throws
- * {@link DeliveryMaterialError} otherwise.
- */
+/** Stores the sealed body once and retains the original signed full-link wrapper. Details: TC-1739 */
 declare function compactShareRecord(record: SenderShareRecord | StoredShareRecord): Promise<StoredShareRecord>;
-/**
- * The full record again (for a delivery retry or a caller that wants the
- * {@link SenderShareRecord} shape): the envelope reopened from the sealed
- * material. The stored `link` is returned as it was stored.
- */
-declare function expandShareRecord(record: StoredShareRecord): Promise<SenderShareRecord>;
+/** Verifies and restores original full-link metadata before owner admission. Details: TC-1739 */
+declare function restoreShareRecordLink(record: StoredShareRecord, shareOrigins: readonly string[]): Promise<string | undefined>;
+/** Expands stored material; owner admission additionally supplies trusted origins and verifies the chain. Details: TC-1739 */
+declare function expandShareRecord(record: StoredShareRecord, options?: {
+    readonly shareOrigins?: readonly string[];
+}): Promise<SenderShareRecord>;
 
 /**
  * Index document schema v1, rows, `project()`, and the versioned agent-record
@@ -643,6 +643,19 @@ declare function project(record: StoredShareRecord, input: {
         readonly expired: boolean;
     };
 }): ShareIndexRow;
+interface AgentRecordSchemaContext {
+    readonly recordV: number;
+    readonly shareId: string;
+    readonly accountOwnerDid: string;
+    /** `hdr.agentDid` for agent records; "" for migrated records, which have no agent binding. */
+    readonly agentDid: string;
+    /**
+     * `agent`: a record in `records/agents/<id>/`, which may never claim a
+     * provenance. `migrated`: an owner-layout record that must claim
+     * `provenance: "migrated"` (one-time owner import).
+     */
+    readonly source: "agent" | "migrated";
+}
 /**
  * Whether `spaceId` (`tinycloud:pkh:eip155:<chain>:<address>:<name>`) is a
  * space of the account `ownerDid` (`did:pkh:eip155:<chain>:<address>`),
@@ -650,11 +663,23 @@ declare function project(record: StoredShareRecord, input: {
  * records live in `applications`. Address spelling is ignored.
  */
 declare function isSpaceOwnedBy(spaceId: string, ownerDid: string): boolean;
+/**
+ * `registeredAt` against signed times from the verified chain, never against
+ * when the owner happens to look: inside `[earliest, latest]` (already
+ * widened by {@link REGISTERED_AT_SKEW_MS} where the bound is an issuance
+ * time) and not in the future.
+ */
+declare function registeredAtFits(registeredAt: string, window: {
+    readonly earliest?: number;
+    readonly latest?: number;
+}, now: Date): boolean;
 /** A record refused by the schema. `provenance`: an agent-subtree record claiming `migrated`. */
 declare class ShareRecordSchemaError extends Error {
     readonly reason: "schema" | "provenance";
     constructor(reason: "schema" | "provenance");
 }
+/** Throws {@link ShareRecordSchemaError} when the decrypted value fails the schema. */
+declare function checkAgentRecordSchema(value: unknown, context: AgentRecordSchemaContext): StoredShareRecord;
 
 declare function claimRank(row: Pick<ShareIndexRow, "src" | "ps" | "pv">): number;
 type ClaimDecision = {
@@ -1058,4 +1083,4 @@ declare function checkRegistrationReceipt(value: unknown, expected: {
 
 declare function verifyEnvelopeV3At(envelope: ShareEnvelopeV3, expectedSignerDid: string, now: number): Promise<boolean>;
 
-export { AGENT_ID_LENGTH, AGENT_RECORD_VERSION, type AgentKeyMaterial, AgentRecordError, type AgentRecordFailure, type AgentRecordHeader, type AgentRejectReason, AgentShareRecordStore, type AgentShareRecordStoreOptions, type Attenuation, type CasPolicy, type ChainContext, type ChainVerdict, type CheckedRegistration, type ClaimDecision, type ClassifiedRecordKey, DEFAULT_CAS_POLICY, DEFAULT_SHARE_INDEX_LIMITS, DeliveryMaterialError, INDEX_MAIN_KEY, INDEX_SCHEMA_VERSION, INVALID_ETAG_MESSAGE, MAX_AGENT_RECORD_BYTES, MemoryShareIndexOutbox, type OwnerNetworkUnwrap, type OwnerNetworkWrap, OwnerUnwrapUnavailableError, type ParsedSiweCacao, type RegistrationKey, SHARE_RECORDS_VAULT_PREFIX, STORED_DELIVERY_MATERIAL_KEYS, SUPPORTED_AGENT_RECORD_V, SenderShareIndex, type SenderShareIndexOptions, SenderShareRecord, type ShareDocumentRead, type ShareIndexAgentEntry, type ShareIndexArchiveDocument, type ShareIndexBackend, ShareIndexCasError, type ShareIndexCasErrorCode, type ShareIndexDocument, type ShareIndexFlushResult, type ShareIndexLimits, type ShareIndexLoad, type ShareIndexOp, type ShareIndexOutbox, type ShareIndexReconcileReport, type ShareIndexRow, type ShareIndexWriteOutcome, type ShareIndexWriteStatus, type ShareLinkCheck, type ShareLinkShape, type ShareListResult, type ShareProofState, type ShareRawRead, ShareRecordSchemaError, type ShareRegistrationKey, type ShareStatusPort, type ShareWriteCondition, type ShareWriteResult, type SignedUcanDelegation, type SiweCacaoParser, type StoredAgentRecord, type StoredDeliveryMaterial, type StoredShareRecord, type TinyCloudShareIndexBackendOptions, type TinyCloudShareIndexClient, type VaultNetworkRead, WebShareRecordStore, agentIdFromDid, agentRecordBinding, agentRecordKey, agentRecordPrefix, assertLinkBoundToMaterial, attenuationCovers, checkRegistrationReceipt, claimRank, classifyRecordKey, compactShareRecord, createTinyCloudShareIndexBackend, decideClaim, deriveAgentKeyMaterial, displayName, expandShareRecord, headerBytes, isAgentId, isShareId, isSpaceOwnedBy, openAgentRecordAsAgent, openAgentRecordAsOwner, openDeliveryEnvelope, parseIndexDocument, parseSignedUcan, parseStoredAgentRecord, project, sealAgentRecord, validateShareLink, verifyAgentRecordChain, verifyEnvelopeV3At, verifyOwnerSessionDelegation, verifyPolicyEnforcementDelegation };
+export { AGENT_ID_LENGTH, AGENT_RECORD_VERSION, type AgentKeyMaterial, AgentRecordError, type AgentRecordFailure, type AgentRecordHeader, type AgentRecordSchemaContext, type AgentRejectReason, AgentShareRecordStore, type AgentShareRecordStoreOptions, type Attenuation, type CasPolicy, type ChainContext, type ChainVerdict, type CheckedRegistration, type ClaimDecision, type ClassifiedRecordKey, DEFAULT_CAS_POLICY, DEFAULT_SHARE_INDEX_LIMITS, DeliveryMaterialError, INDEX_MAIN_KEY, INDEX_SCHEMA_VERSION, INVALID_ETAG_MESSAGE, MAX_AGENT_RECORD_BYTES, MemoryShareIndexOutbox, type OwnerNetworkUnwrap, type OwnerNetworkWrap, OwnerUnwrapUnavailableError, type ParsedSiweCacao, type RegistrationKey, SHARE_RECORDS_VAULT_PREFIX, STORED_DELIVERY_MATERIAL_KEYS, SUPPORTED_AGENT_RECORD_V, SenderShareIndex, type SenderShareIndexOptions, SenderShareRecord, type ShareDocumentRead, type ShareIndexAgentEntry, type ShareIndexArchiveDocument, type ShareIndexBackend, ShareIndexCasError, type ShareIndexCasErrorCode, type ShareIndexDocument, type ShareIndexFlushResult, type ShareIndexLimits, type ShareIndexLoad, type ShareIndexOp, type ShareIndexOutbox, type ShareIndexReconcileReport, type ShareIndexRow, type ShareIndexWriteOutcome, type ShareIndexWriteStatus, type ShareLinkCheck, type ShareLinkShape, type ShareListResult, type ShareProofState, type ShareRawRead, ShareRecordSchemaError, type ShareRegistrationKey, type ShareStatusPort, type ShareWriteCondition, type ShareWriteResult, type SignedUcanDelegation, type SiweCacaoParser, type StoredAgentRecord, type StoredDeliveryMaterial, type StoredFullShareLink, type StoredShareRecord, type TinyCloudShareIndexBackendOptions, type TinyCloudShareIndexClient, type VaultNetworkRead, WebShareRecordStore, agentIdFromDid, agentRecordBinding, agentRecordKey, agentRecordPrefix, assertLinkBoundToMaterial, attenuationCovers, checkAgentRecordSchema, checkRegistrationReceipt, claimRank, classifyRecordKey, compactShareRecord, createTinyCloudShareIndexBackend, decideClaim, deriveAgentKeyMaterial, displayName, expandShareRecord, headerBytes, isAgentId, isShareId, isSpaceOwnedBy, openAgentRecordAsAgent, openAgentRecordAsOwner, openDeliveryEnvelope, parseIndexDocument, parseSignedUcan, parseStoredAgentRecord, project, registeredAtFits, restoreShareRecordLink, sealAgentRecord, validateShareLink, verifyAgentRecordChain, verifyEnvelopeV3At, verifyOwnerSessionDelegation, verifyPolicyEnforcementDelegation };

package/dist/share-index.d.ts

@@ -1,5 +1,6 @@
 import { a as SenderShareRecordStorage, S as SenderShareRecord } from './history-kwJxrZgq.js';
 export { f as SenderShareRecordProofs } from './history-kwJxrZgq.js';
+import { LinkHeaderV1, LinkSignatureV1 } from '@tinycloud/share-envelope/links';
 import { P as PublishedShareDeliveryMaterial, S as SignedDelegation, l as OwnerSharePolicyRegistration } from './owner-policy-aPmXIR3e.js';
 import { ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 
@@ -469,21 +470,28 @@ declare class AgentShareRecordStore implements SenderShareRecordStorage {
  * sealed and rebuilt when needed by {@link openDeliveryEnvelope}, for the
  * verifier and a delivery retry. `sealedEnvelope` stays (the node reopens that
  * exact value and its nonce is random) and so does the session CACAO (it
- * proves the chain). A short `v=4` link the sender printed is kept (it is not
- * derivable: it carries an id only the links service knows) and must be the
- * link of this material; a full link is not kept (see {@link compactShareRecord}).
+ * proves the chain). Short links stay verbatim; full links keep their original
+ * renderer origin, signed header and signature beside the single sealed body.
+ * Details: TC-1739
  *
  * Security-sensitive: the sealed bytes are checked against `shareCid` before
  * they are opened, and the plaintext must be the canonical JSON of the
  * envelope, so a record cannot carry one envelope for display and another for
  * the node.
  */
-type StoredDeliveryMaterial = Omit<PublishedShareDeliveryMaterial, "envelope">;
+interface StoredFullShareLink {
+    readonly origin: string;
+    readonly header: LinkHeaderV1;
+    readonly signature: LinkSignatureV1;
+}
+type StoredDeliveryMaterial = Omit<PublishedShareDeliveryMaterial, "envelope"> & {
+    readonly fullLink?: StoredFullShareLink;
+};
 /** A share record as stored at an agent (or migrated) key: {@link SenderShareRecord} without derivable blobs. */
 type StoredShareRecord = Omit<SenderShareRecord, "deliveryMaterial"> & {
     readonly deliveryMaterial?: StoredDeliveryMaterial;
 };
-/** Keys of a stored `deliveryMaterial`, exactly. */
+/** Required string fields; `fullLink` is optional original signed metadata. Details: TC-1739 */
 declare const STORED_DELIVERY_MATERIAL_KEYS: readonly string[];
 declare class DeliveryMaterialError extends Error {
     constructor(message: string);
@@ -497,22 +505,14 @@ declare function openDeliveryEnvelope(material: StoredDeliveryMaterial): Promise
  * Returns the link's form.
  */
 declare function assertLinkBoundToMaterial(link: string, material: StoredDeliveryMaterial): "short" | "full";
-/**
- * The stored form of `record`. For a Policy/v3 record (one with
- * `deliveryMaterial`), omits `deliveryMaterial.envelope` after checking it is
- * exactly what the sealed material opens to, and checks that a `link` is the
- * link of that material. A short link is kept. A full link is not: it embeds
- * the sealed envelope a second time, which the record size cap does not leave
- * room for, so the sender's own history holds it. Throws
- * {@link DeliveryMaterialError} otherwise.
- */
+/** Stores the sealed body once and retains the original signed full-link wrapper. Details: TC-1739 */
 declare function compactShareRecord(record: SenderShareRecord | StoredShareRecord): Promise<StoredShareRecord>;
-/**
- * The full record again (for a delivery retry or a caller that wants the
- * {@link SenderShareRecord} shape): the envelope reopened from the sealed
- * material. The stored `link` is returned as it was stored.
- */
-declare function expandShareRecord(record: StoredShareRecord): Promise<SenderShareRecord>;
+/** Verifies and restores original full-link metadata before owner admission. Details: TC-1739 */
+declare function restoreShareRecordLink(record: StoredShareRecord, shareOrigins: readonly string[]): Promise<string | undefined>;
+/** Expands stored material; owner admission additionally supplies trusted origins and verifies the chain. Details: TC-1739 */
+declare function expandShareRecord(record: StoredShareRecord, options?: {
+    readonly shareOrigins?: readonly string[];
+}): Promise<SenderShareRecord>;
 
 /**
  * Index document schema v1, rows, `project()`, and the versioned agent-record
@@ -643,6 +643,19 @@ declare function project(record: StoredShareRecord, input: {
         readonly expired: boolean;
     };
 }): ShareIndexRow;
+interface AgentRecordSchemaContext {
+    readonly recordV: number;
+    readonly shareId: string;
+    readonly accountOwnerDid: string;
+    /** `hdr.agentDid` for agent records; "" for migrated records, which have no agent binding. */
+    readonly agentDid: string;
+    /**
+     * `agent`: a record in `records/agents/<id>/`, which may never claim a
+     * provenance. `migrated`: an owner-layout record that must claim
+     * `provenance: "migrated"` (one-time owner import).
+     */
+    readonly source: "agent" | "migrated";
+}
 /**
  * Whether `spaceId` (`tinycloud:pkh:eip155:<chain>:<address>:<name>`) is a
  * space of the account `ownerDid` (`did:pkh:eip155:<chain>:<address>`),
@@ -650,11 +663,23 @@ declare function project(record: StoredShareRecord, input: {
  * records live in `applications`. Address spelling is ignored.
  */
 declare function isSpaceOwnedBy(spaceId: string, ownerDid: string): boolean;
+/**
+ * `registeredAt` against signed times from the verified chain, never against
+ * when the owner happens to look: inside `[earliest, latest]` (already
+ * widened by {@link REGISTERED_AT_SKEW_MS} where the bound is an issuance
+ * time) and not in the future.
+ */
+declare function registeredAtFits(registeredAt: string, window: {
+    readonly earliest?: number;
+    readonly latest?: number;
+}, now: Date): boolean;
 /** A record refused by the schema. `provenance`: an agent-subtree record claiming `migrated`. */
 declare class ShareRecordSchemaError extends Error {
     readonly reason: "schema" | "provenance";
     constructor(reason: "schema" | "provenance");
 }
+/** Throws {@link ShareRecordSchemaError} when the decrypted value fails the schema. */
+declare function checkAgentRecordSchema(value: unknown, context: AgentRecordSchemaContext): StoredShareRecord;
 
 declare function claimRank(row: Pick<ShareIndexRow, "src" | "ps" | "pv">): number;
 type ClaimDecision = {
@@ -1058,4 +1083,4 @@ declare function checkRegistrationReceipt(value: unknown, expected: {
 
 declare function verifyEnvelopeV3At(envelope: ShareEnvelopeV3, expectedSignerDid: string, now: number): Promise<boolean>;
 
-export { AGENT_ID_LENGTH, AGENT_RECORD_VERSION, type AgentKeyMaterial, AgentRecordError, type AgentRecordFailure, type AgentRecordHeader, type AgentRejectReason, AgentShareRecordStore, type AgentShareRecordStoreOptions, type Attenuation, type CasPolicy, type ChainContext, type ChainVerdict, type CheckedRegistration, type ClaimDecision, type ClassifiedRecordKey, DEFAULT_CAS_POLICY, DEFAULT_SHARE_INDEX_LIMITS, DeliveryMaterialError, INDEX_MAIN_KEY, INDEX_SCHEMA_VERSION, INVALID_ETAG_MESSAGE, MAX_AGENT_RECORD_BYTES, MemoryShareIndexOutbox, type OwnerNetworkUnwrap, type OwnerNetworkWrap, OwnerUnwrapUnavailableError, type ParsedSiweCacao, type RegistrationKey, SHARE_RECORDS_VAULT_PREFIX, STORED_DELIVERY_MATERIAL_KEYS, SUPPORTED_AGENT_RECORD_V, SenderShareIndex, type SenderShareIndexOptions, SenderShareRecord, type ShareDocumentRead, type ShareIndexAgentEntry, type ShareIndexArchiveDocument, type ShareIndexBackend, ShareIndexCasError, type ShareIndexCasErrorCode, type ShareIndexDocument, type ShareIndexFlushResult, type ShareIndexLimits, type ShareIndexLoad, type ShareIndexOp, type ShareIndexOutbox, type ShareIndexReconcileReport, type ShareIndexRow, type ShareIndexWriteOutcome, type ShareIndexWriteStatus, type ShareLinkCheck, type ShareLinkShape, type ShareListResult, type ShareProofState, type ShareRawRead, ShareRecordSchemaError, type ShareRegistrationKey, type ShareStatusPort, type ShareWriteCondition, type ShareWriteResult, type SignedUcanDelegation, type SiweCacaoParser, type StoredAgentRecord, type StoredDeliveryMaterial, type StoredShareRecord, type TinyCloudShareIndexBackendOptions, type TinyCloudShareIndexClient, type VaultNetworkRead, WebShareRecordStore, agentIdFromDid, agentRecordBinding, agentRecordKey, agentRecordPrefix, assertLinkBoundToMaterial, attenuationCovers, checkRegistrationReceipt, claimRank, classifyRecordKey, compactShareRecord, createTinyCloudShareIndexBackend, decideClaim, deriveAgentKeyMaterial, displayName, expandShareRecord, headerBytes, isAgentId, isShareId, isSpaceOwnedBy, openAgentRecordAsAgent, openAgentRecordAsOwner, openDeliveryEnvelope, parseIndexDocument, parseSignedUcan, parseStoredAgentRecord, project, sealAgentRecord, validateShareLink, verifyAgentRecordChain, verifyEnvelopeV3At, verifyOwnerSessionDelegation, verifyPolicyEnforcementDelegation };
+export { AGENT_ID_LENGTH, AGENT_RECORD_VERSION, type AgentKeyMaterial, AgentRecordError, type AgentRecordFailure, type AgentRecordHeader, type AgentRecordSchemaContext, type AgentRejectReason, AgentShareRecordStore, type AgentShareRecordStoreOptions, type Attenuation, type CasPolicy, type ChainContext, type ChainVerdict, type CheckedRegistration, type ClaimDecision, type ClassifiedRecordKey, DEFAULT_CAS_POLICY, DEFAULT_SHARE_INDEX_LIMITS, DeliveryMaterialError, INDEX_MAIN_KEY, INDEX_SCHEMA_VERSION, INVALID_ETAG_MESSAGE, MAX_AGENT_RECORD_BYTES, MemoryShareIndexOutbox, type OwnerNetworkUnwrap, type OwnerNetworkWrap, OwnerUnwrapUnavailableError, type ParsedSiweCacao, type RegistrationKey, SHARE_RECORDS_VAULT_PREFIX, STORED_DELIVERY_MATERIAL_KEYS, SUPPORTED_AGENT_RECORD_V, SenderShareIndex, type SenderShareIndexOptions, SenderShareRecord, type ShareDocumentRead, type ShareIndexAgentEntry, type ShareIndexArchiveDocument, type ShareIndexBackend, ShareIndexCasError, type ShareIndexCasErrorCode, type ShareIndexDocument, type ShareIndexFlushResult, type ShareIndexLimits, type ShareIndexLoad, type ShareIndexOp, type ShareIndexOutbox, type ShareIndexReconcileReport, type ShareIndexRow, type ShareIndexWriteOutcome, type ShareIndexWriteStatus, type ShareLinkCheck, type ShareLinkShape, type ShareListResult, type ShareProofState, type ShareRawRead, ShareRecordSchemaError, type ShareRegistrationKey, type ShareStatusPort, type ShareWriteCondition, type ShareWriteResult, type SignedUcanDelegation, type SiweCacaoParser, type StoredAgentRecord, type StoredDeliveryMaterial, type StoredFullShareLink, type StoredShareRecord, type TinyCloudShareIndexBackendOptions, type TinyCloudShareIndexClient, type VaultNetworkRead, WebShareRecordStore, agentIdFromDid, agentRecordBinding, agentRecordKey, agentRecordPrefix, assertLinkBoundToMaterial, attenuationCovers, checkAgentRecordSchema, checkRegistrationReceipt, claimRank, classifyRecordKey, compactShareRecord, createTinyCloudShareIndexBackend, decideClaim, deriveAgentKeyMaterial, displayName, expandShareRecord, headerBytes, isAgentId, isShareId, isSpaceOwnedBy, openAgentRecordAsAgent, openAgentRecordAsOwner, openDeliveryEnvelope, parseIndexDocument, parseSignedUcan, parseStoredAgentRecord, project, registeredAtFits, restoreShareRecordLink, sealAgentRecord, validateShareLink, verifyAgentRecordChain, verifyEnvelopeV3At, verifyOwnerSessionDelegation, verifyPolicyEnforcementDelegation };