@defdone/annon 0.0.0-stage → 0.1.0-alpha.1

package/dist/download/http.js

@@ -0,0 +1,87 @@
+/** Shared exact-origin CORS policy for the file host and relayer. */
+import { serveFile } from './host.js';
+export const DEFAULT_ORIGINS = ['https://annon.dev', 'https://www.annon.dev'];
+const HOST_HEADERS = 'Content-Type, PAYMENT-SIGNATURE, Annon-Buyer-Proof, Range, Annon-Upload-Authorization';
+const HOST_EXPOSE = 'PAYMENT-REQUIRED, PAYMENT-RESPONSE, Retry-After, Accept-Ranges, Content-Range, Content-Length, Content-Disposition';
+function validOrigin(value, preview = false) {
+    try {
+        const u = new URL(value);
+        return (u.protocol === 'https:' &&
+            !u.username &&
+            !u.password &&
+            u.origin === value &&
+            (!preview || (!u.port && /^[a-z0-9-]+\.vercel\.app$/.test(u.hostname))));
+    }
+    catch {
+        return false;
+    }
+}
+export function corsPolicy(allowed = [], previews = [], service = 'host', maxAge = 600) {
+    if (!allowed.every((v) => validOrigin(v)) || !previews.every((v) => validOrigin(v, true)))
+        throw new TypeError('invalid CORS origin');
+    return {
+        origins: [...new Set([...allowed, ...previews])],
+        methods: service === 'host' ? 'GET, POST, PUT, OPTIONS' : 'GET, POST, OPTIONS',
+        headers: service === 'host' ? HOST_HEADERS : 'Content-Type',
+        expose: service === 'host' ? HOST_EXPOSE : 'Retry-After',
+        maxAge,
+    };
+}
+export function corsHeaders(origin, allowed = [], expose = HOST_EXPOSE) {
+    if (!origin || !validOrigin(origin) || !allowed.includes(origin))
+        return { Vary: 'Origin' };
+    return {
+        'Access-Control-Allow-Origin': origin,
+        'Access-Control-Expose-Headers': expose,
+        Vary: 'Origin',
+    };
+}
+export function preflight(headers, policy = corsPolicy()) {
+    const origin = headers.get('Origin');
+    const method = headers.get('Access-Control-Request-Method');
+    const requested = headers.get('Access-Control-Request-Headers');
+    const allowedHeaders = policy.headers
+        .toLowerCase()
+        .split(',')
+        .map((s) => s.trim());
+    const base = {
+        'Cache-Control': 'no-store',
+        Vary: 'Origin, Access-Control-Request-Method, Access-Control-Request-Headers',
+    };
+    if (!origin ||
+        !validOrigin(origin) ||
+        !policy.origins.includes(origin) ||
+        (method !== null && !policy.methods.split(', ').includes(method)) ||
+        (requested !== null &&
+            !requested.split(',').every((s) => allowedHeaders.includes(s.trim().toLowerCase()))))
+        return { status: 403, headers: base };
+    return {
+        status: 204,
+        headers: {
+            ...corsHeaders(origin, policy.origins, policy.expose),
+            ...base,
+            'Access-Control-Allow-Methods': policy.methods,
+            'Access-Control-Allow-Headers': policy.headers,
+            'Access-Control-Max-Age': String(policy.maxAge),
+        },
+    };
+}
+export function hasContentType(value, expected) {
+    return value?.split(';')[0]?.trim().toLowerCase() === expected;
+}
+export async function handle(method, headers, o) {
+    const policy = corsPolicy(o.allowedOrigins ?? [], o.previewOrigins);
+    const cors = {
+        'Cache-Control': 'no-store',
+        ...corsHeaders(headers.get('Origin'), policy.origins, policy.expose),
+    };
+    if (method === 'OPTIONS')
+        return preflight(headers, policy);
+    if ((method === 'POST' || method === 'PUT') &&
+        !hasContentType(headers.get('Content-Type'), 'application/json'))
+        return { status: 415, headers: cors };
+    if (method !== 'GET')
+        return { status: 405, headers: { ...cors, Allow: 'GET, OPTIONS' } };
+    const r = await serveFile({ headers }, o);
+    return { ...r, headers: { ...cors, ...r.headers } };
+}

package/dist/download/proof.d.ts

@@ -0,0 +1,20 @@
+export declare const BUYER_PROOF_DST = "ANNON-BUYER-PROOF-V1_BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_";
+export declare const BUYER_PROOF_HEADER = "Annon-Buyer-Proof";
+/** The header value: the one-time key's 32-byte secret signs `resourceUrl`. */
+export declare function buyerProof(secret: Uint8Array, resourceUrl: string): string;
+/**
+ * Whether `proof` is the buyer key's signature over `resourceUrl`. Both points must decode, be in
+ * their subgroups and not be the identity; anything malformed is false, never an exception.
+ */
+export declare function verifyBuyerProof(buyerKey: string, resourceUrl: string, proof: string): boolean;
+/** A client signs a proof only when the advertised `resource.url` is where the request goes. */
+export declare function sameResource(advertised: string, requested: string): boolean;
+interface PurchaseProof {
+    purchase_id: string;
+    grant: number;
+    signature: string;
+}
+/** The existing URL signature, accompanied by its final contract lookup coordinates. */
+export declare function purchaseProof(secret: Uint8Array, url: string, purchase_id: string, grant?: number): string;
+export declare function readPurchaseProof(header: string | null): PurchaseProof | null;
+export {};

package/dist/download/proof.js

@@ -0,0 +1,79 @@
+/**
+ * `Annon-Buyer-Proof` (specs/download.md section 3): a BLS signature by the purchase's one-time key
+ * over the file URL. Only the buyer holds that key's secret (the facilitator sees the payload with
+ * its public key, never this header), and the URL ties the proof to one host and file.
+ */
+import { bls12_381 as bls } from '@noble/curves/bls12-381.js';
+export const BUYER_PROOF_DST = 'ANNON-BUYER-PROOF-V1_BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_';
+export const BUYER_PROOF_HEADER = 'Annon-Buyer-Proof';
+const sigs = bls.longSignatures;
+const utf8 = new TextEncoder();
+/** `UTF8("annon/v1.1 buyer proof") || 0x0a || UTF8(resource.url)`. */
+const buyerProofMessage = (resourceUrl) => Uint8Array.from([...utf8.encode('annon/v1.1 buyer proof'), 0x0a, ...utf8.encode(resourceUrl)]);
+const b64url = (b) => btoa(String.fromCharCode(...b))
+    .replaceAll('+', '-')
+    .replaceAll('/', '_')
+    .replace(/=+$/, '');
+/** The header value: the one-time key's 32-byte secret signs `resourceUrl`. */
+export function buyerProof(secret, resourceUrl) {
+    return b64url(sigs.sign(sigs.hash(buyerProofMessage(resourceUrl), BUYER_PROOF_DST), secret).toBytes(true));
+}
+/**
+ * Whether `proof` is the buyer key's signature over `resourceUrl`. Both points must decode, be in
+ * their subgroups and not be the identity; anything malformed is false, never an exception.
+ */
+export function verifyBuyerProof(buyerKey, resourceUrl, proof) {
+    try {
+        if (!/^0x[0-9a-f]{96}$/.test(buyerKey) || !/^[A-Za-z0-9_-]{128}$/.test(proof))
+            return false;
+        const pk = bls.G1.Point.fromBytes(Uint8Array.from(buyerKey.slice(2).match(/../g) ?? [], (h) => Number.parseInt(h, 16)));
+        const raw = Uint8Array.from(atob(proof.replaceAll('-', '+').replaceAll('_', '/')), (c) => c.charCodeAt(0));
+        const sig = bls.G2.Point.fromBytes(raw);
+        if (pk.is0() || sig.is0() || !pk.isTorsionFree() || !sig.isTorsionFree())
+            return false;
+        return sigs.verify(sig, sigs.hash(buyerProofMessage(resourceUrl), BUYER_PROOF_DST), pk);
+    }
+    catch {
+        return false;
+    }
+}
+/** The URL as WHATWG parses and serializes it, without the fragment; null if it doesn't parse. */
+function canonical(url) {
+    if (!URL.canParse(url))
+        return null;
+    const u = new URL(url);
+    u.hash = '';
+    return u.href;
+}
+/** A client signs a proof only when the advertised `resource.url` is where the request goes. */
+export function sameResource(advertised, requested) {
+    const a = canonical(advertised);
+    return a !== null && a === canonical(requested);
+}
+/** The existing URL signature, accompanied by its final contract lookup coordinates. */
+export function purchaseProof(secret, url, purchase_id, grant = 0) {
+    if (!/^0x[0-9a-f]{64}$/.test(purchase_id) ||
+        !Number.isInteger(grant) ||
+        grant < 0 ||
+        grant > 0xffffffff)
+        throw new TypeError('invalid purchase/grant');
+    return b64url(utf8.encode(JSON.stringify({ purchase_id, grant, signature: buyerProof(secret, url) })));
+}
+export function readPurchaseProof(header) {
+    try {
+        if (!header || header.length > 512 || !/^[A-Za-z0-9_-]+$/.test(header))
+            return null;
+        const p = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Uint8Array.from(atob(header.replaceAll('-', '+').replaceAll('_', '/')), (c) => c.charCodeAt(0))));
+        if (Object.keys(p).sort().join() !== 'grant,purchase_id,signature' ||
+            !/^0x[0-9a-f]{64}$/.test(p.purchase_id) ||
+            !Number.isInteger(p.grant) ||
+            p.grant < 0 ||
+            p.grant > 0xffffffff ||
+            !/^[A-Za-z0-9_-]{128}$/.test(p.signature))
+            return null;
+        return p;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/download/upload.d.ts

@@ -0,0 +1,130 @@
+import { AnnonError } from '../errors.js';
+import type { NearSignedMessage } from '../near/nep413.js';
+import { type HostingReservation } from '../relay/reservation.js';
+import { type Authorization, type Identity } from '../settle-near/identity.js';
+import { type SettlementAssets, type Terms } from '../settle-near/terms.js';
+export interface UploadIntent {
+    network: string;
+    contract: string;
+    seller: Identity;
+    fileId: string;
+    cipherHash: string;
+    termsHash: string;
+    byteSize: number;
+    plaintextSize: number;
+    headerSize: number;
+    hostOrigin: string;
+    metadataHash: string;
+    nonce: string;
+    expiresAt: number;
+}
+export interface UploadManifest {
+    version: 2;
+    chunkLog2: number;
+    metaLen: number;
+    previewLen: number;
+    n: number;
+    keyCommitments: string[];
+    chunkHashes: string[];
+}
+export interface UploadMetadata {
+    filename: string;
+    title: string;
+    description: string;
+}
+export type UploadAuth = Authorization | (NearSignedMessage & {
+    kind: 'near';
+});
+export interface UploadAuthorization {
+    intent: UploadIntent;
+    auth: UploadAuth;
+}
+export interface UploadRequest extends UploadAuthorization {
+    terms: Terms;
+    manifest: UploadManifest;
+    metadata: UploadMetadata;
+}
+export interface UploadCreated {
+    uploadId: string;
+    state: 'receiving';
+    expiresAt: number;
+    bodyUrl: string;
+    headerUrl: string;
+}
+export interface UploadReserved {
+    uploadId: string;
+    state: 'reserved';
+    reservation: HostingReservation;
+}
+export interface UploadPublished {
+    fileId: string;
+    url: string;
+    header: string;
+    expiresAt: number | null;
+}
+export interface UploadBaseSplit {
+    state: 'pending' | 'ready';
+    address: string;
+    kind: 'push';
+    salt: string;
+    txHash: string | null;
+}
+interface UploadBaseSplitRequest {
+    kind: 'push';
+    salt: string;
+}
+export interface UploadBaseSplitResult {
+    baseSplit: UploadBaseSplit | null;
+}
+export type UploadStatus = (UploadCreated | UploadReserved | {
+    uploadId: string;
+    state: 'published';
+    result: UploadPublished;
+}) & UploadBaseSplitResult;
+export declare const uploadText: (i: UploadIntent) => string;
+export declare function uploadOrigin(value: string): string;
+export declare function normalizeMetadata(input: unknown): UploadMetadata;
+export declare function metadataHash(metadata: UploadMetadata): Promise<string>;
+export declare function parseUploadIntent(input: unknown): UploadIntent;
+export declare function parseUploadAuth(input: unknown): UploadAuth;
+export declare function parseUpload(input: unknown): UploadRequest;
+export declare function verifyUploadAuthorization(a: UploadAuthorization, o: {
+    network: string;
+    contract: string;
+    hostOrigin: string;
+    now: number;
+    nearRpc: string;
+    authSeconds?: number;
+}): Promise<void>;
+export declare function verifyUpload(input: UploadRequest, o: Parameters<typeof verifyUploadAuthorization>[1] & {
+    assets?: SettlementAssets;
+}): Promise<void>;
+export declare function encodeUploadAuthorization(input: UploadAuthorization): string;
+export declare function decodeUploadAuthorization(value: string, max?: number): UploadAuthorization;
+export type UploadErrorCode = 'budget' | 'disabled' | 'settlement_pending' | 'route_unavailable' | 'bad_request' | 'bad_signature' | 'too_large' | 'upload_expired' | 'upload_conflict' | 'upload_incomplete' | 'host_capacity' | 'cipher_hash_mismatch' | 'unknown_file' | 'file_invalid' | 'taken_down' | 'sales_stopped' | 'rate_limited' | 'unavailable' | 'operation_failed';
+/** HTTP failures use the shared error model and retain only checked retry evidence. */
+export type UploadResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: AnnonError & {
+        retryAfterSeconds?: number;
+    };
+};
+export declare class UploadClient {
+    readonly origin: string;
+    private readonly fetcher;
+    constructor(origin: string, options?: {
+        fetch?: typeof fetch;
+    });
+    private request;
+    private requestJson;
+    private path;
+    create(request: UploadRequest): Promise<UploadResult<UploadCreated | UploadStatus>>;
+    body(id: string, auth: UploadAuthorization, body: ReadableStream<Uint8Array> | Blob): Promise<UploadResult<UploadReserved>>;
+    header(id: string, auth: UploadAuthorization, header: Uint8Array<ArrayBuffer>): Promise<UploadResult<UploadPublished>>;
+    status(id: string, auth: UploadAuthorization): Promise<UploadResult<UploadStatus>>;
+    baseSplit(id: string, auth: UploadAuthorization, input: UploadBaseSplitRequest): Promise<UploadResult<UploadBaseSplitResult>>;
+}
+export {};