@degenerate/endpoints 0.1.7 → 0.2.0

package/dist/examples/express-server/app.js

@@ -3,7 +3,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApp = createApp;
 const express_1 = __importDefault(require("express"));
+const generic_1 = require("@degenerate/generic");
+const sharedata_1 = require("@degenerate/sharedata");
 //#region Route Imports
 const authorities_routes_1 = require("../../routes/authorities.routes");
 const events_routes_1 = require("../../routes/events.routes");
@@ -11,25 +14,35 @@ const functions_routes_1 = require("../../routes/functions.routes");
 const rules_routes_1 = require("../../routes/rules.routes");
 const share_data_routes_1 = require("../../routes/share-data.routes");
 const validation_routes_1 = require("../../routes/validation.routes");
-const generic_1 = require("@degenerate/generic");
 const cors_1 = require("../../cors");
-//#endregion Route Imports
-// create the express application
-const app = (0, express_1.default)();
-app.use(express_1.default.json());
-const authorizedAuthorities = new generic_1.AuthorizedAuthorities();
-// Initialize the authorized authorities here if needed
-// e.g., authorizedAuthorities.addAuthorizedJWTAuthority(...);
-// Make the instance available throughout the app
-app.set('authorizedAuthorities', authorizedAuthorities);
-// Make sure you enable whatever middleware you need here
-app.use('/authorities', authorities_routes_1.authorities); // add the authorities routes
-app.use('/events', events_routes_1.events); // add the events routes
-app.use('/functions', functions_routes_1.functions); // add the functions routes
-app.use('/rules', rules_routes_1.rules); // add the rules routes
-app.use('/share-data', share_data_routes_1.shareData); // add the share data routes
-app.use('/validation', validation_routes_1.validation); // add the validation routes
-app.use(cors_1.unauthorizedHandler); // the unauthorized handler should be the first error handler
-app.use(cors_1.badRequestHandler); // the bad request handler should be the second error handler
-app.use(cors_1.allErrorHandler); // the all error handler catches all remaining errors
-exports.default = app;
+/**
+ * Builds a fresh Express app with all SAFE routes wired in. Returns the app
+ * along with the shared `ShareDataManager` instance — handed back so callers
+ * (e.g. `createSafeServer` for realtime attachment) can subscribe to its
+ * events without reaching into `app.locals`.
+ *
+ * Route handlers access the manager via `req.app.get('shareDataManager')`,
+ * matching the existing `authorizedAuthorities` pattern.
+ */
+function createApp() {
+    const app = (0, express_1.default)();
+    app.use(express_1.default.json());
+    const authorizedAuthorities = new generic_1.AuthorizedAuthorities();
+    const shareDataManager = new sharedata_1.ShareDataManager();
+    app.set('authorizedAuthorities', authorizedAuthorities);
+    app.set('shareDataManager', shareDataManager);
+    app.use('/authorities', authorities_routes_1.authorities);
+    app.use('/events', events_routes_1.events);
+    app.use('/functions', functions_routes_1.functions);
+    app.use('/rules', rules_routes_1.rules);
+    app.use('/share-data', share_data_routes_1.shareData);
+    app.use('/validation', validation_routes_1.validation);
+    app.use(cors_1.unauthorizedHandler);
+    app.use(cors_1.badRequestHandler);
+    app.use(cors_1.allErrorHandler);
+    return { app, authorizedAuthorities, shareDataManager };
+}
+// Back-compat: tests and existing callers import the default app singleton.
+// New code should prefer `createApp()` so each instance is isolated.
+const defaultInstance = createApp();
+exports.default = defaultInstance.app;

package/dist/examples/express-server/authenticate-realtime.d.ts

@@ -0,0 +1,27 @@
+import type { AuthenticateUpgrade } from '@degenerate/realtime';
+/**
+ * Context attached to every accepted WebSocket connection. Replace the
+ * placeholder fields with whatever your application needs to authorize
+ * subsequent messages (subject, scopes, tenant id, etc.).
+ */
+export interface ExampleRealtimeContext {
+    subject: string;
+}
+/**
+ * Example upgrade authenticator. Accepts every connection with a synthetic
+ * subject — adequate for demos and integration tests, not for production.
+ *
+ * To wire real JWT auth, replace the body with something like:
+ *
+ *   import { ... } from '@degenerate/generic';
+ *   const token = extractTokenFromHeaderOrQuery(req);
+ *   if (!token) return null;
+ *   const payload = await verifyJwt(token, authorizedAuthorities);
+ *   return payload ? { subject: payload.sub } : null;
+ *
+ * `validateJWTShareData` in `cors/authority/jwt/` is the HTTP-side equivalent
+ * — reuse the same key resolution + claim checks here so HTTP and WS share an
+ * authorization model.
+ */
+export declare const exampleAuthenticate: AuthenticateUpgrade<ExampleRealtimeContext>;
+//# sourceMappingURL=authenticate-realtime.d.ts.map

package/dist/examples/express-server/authenticate-realtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate-realtime.d.ts","sourceRoot":"","sources":["../../../src/examples/express-server/authenticate-realtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACnC,OAAO,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,EAAE,mBAAmB,CAAC,sBAAsB,CAI3E,CAAC"}

package/dist/examples/express-server/authenticate-realtime.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exampleAuthenticate = void 0;
+/**
+ * Example upgrade authenticator. Accepts every connection with a synthetic
+ * subject — adequate for demos and integration tests, not for production.
+ *
+ * To wire real JWT auth, replace the body with something like:
+ *
+ *   import { ... } from '@degenerate/generic';
+ *   const token = extractTokenFromHeaderOrQuery(req);
+ *   if (!token) return null;
+ *   const payload = await verifyJwt(token, authorizedAuthorities);
+ *   return payload ? { subject: payload.sub } : null;
+ *
+ * `validateJWTShareData` in `cors/authority/jwt/` is the HTTP-side equivalent
+ * — reuse the same key resolution + claim checks here so HTTP and WS share an
+ * authorization model.
+ */
+const exampleAuthenticate = (_req) => {
+    return { subject: 'example-anonymous' };
+};
+exports.exampleAuthenticate = exampleAuthenticate;

package/dist/examples/express-server/server.d.ts

@@ -1,2 +1,33 @@
-export {};
+import { type Server as HttpServer } from 'http';
+import type { Express } from 'express';
+import { ShareDataManager } from '@degenerate/sharedata';
+import { type RealtimeServerHandle } from '@degenerate/realtime';
+export interface SafeServerHandle {
+    /** The Express application — the same instance imported from `./app`. */
+    readonly app: Express;
+    /** The underlying Node HTTP server. Call `.listen()` to start accepting. */
+    readonly httpServer: HttpServer;
+    /** ShareDataManager broadcasting to subscribed WebSocket clients. */
+    readonly manager: ShareDataManager;
+    /** Realtime websocket handle. Call `.close()` during shutdown. */
+    readonly realtime: RealtimeServerHandle;
+    /** Convenience: cleanly stop realtime + close the HTTP server. */
+    close(): Promise<void>;
+}
+/**
+ * Builds the example SAFE server: the existing Express app wrapped in a Node
+ * HTTP server, with the realtime WebSocket transport attached at `/realtime`.
+ * Returns handles for caller-controlled `listen()` and shutdown so this is
+ * safe to use from tests as well as a `bin/` entry point.
+ *
+ * The returned `manager` is the one wired to the realtime broadcast loop and
+ * also the one routes resolve via `req.app.get('shareDataManager')`. HTTP
+ * route mutations therefore appear as `transaction` frames on the websocket.
+ *
+ * `propose` is wired to the id-based function resolver: any `IShareFunction`
+ * registered on a ShareData with an `id` becomes addressable by clients via
+ * the `functionId` field in a `propose` message. Functions without an `id`
+ * remain invisible to the wire — useful for purely-internal functions.
+ */
+export declare function createSafeServer(): SafeServerHandle;
 //# sourceMappingURL=server.d.ts.map

package/dist/examples/express-server/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/examples/express-server/server.ts"],"names":[],"mappings":""}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/examples/express-server/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAGH,KAAK,oBAAoB,EAC5B,MAAM,sBAAsB,CAAC;AAI9B,MAAM,WAAW,gBAAgB;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,kEAAkE;IAClE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,IAAI,gBAAgB,CA6BnD"}

package/dist/examples/express-server/server.js

@@ -1,9 +1,63 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const app_1 = __importDefault(require("./app"));
-app_1.default.listen(3000, () => {
-    console.log('Server is running on port 3000');
-});
+exports.createSafeServer = createSafeServer;
+const http_1 = require("http");
+const realtime_1 = require("@degenerate/realtime");
+const app_1 = require("./app");
+const authenticate_realtime_1 = require("./authenticate-realtime");
+/**
+ * Builds the example SAFE server: the existing Express app wrapped in a Node
+ * HTTP server, with the realtime WebSocket transport attached at `/realtime`.
+ * Returns handles for caller-controlled `listen()` and shutdown so this is
+ * safe to use from tests as well as a `bin/` entry point.
+ *
+ * The returned `manager` is the one wired to the realtime broadcast loop and
+ * also the one routes resolve via `req.app.get('shareDataManager')`. HTTP
+ * route mutations therefore appear as `transaction` frames on the websocket.
+ *
+ * `propose` is wired to the id-based function resolver: any `IShareFunction`
+ * registered on a ShareData with an `id` becomes addressable by clients via
+ * the `functionId` field in a `propose` message. Functions without an `id`
+ * remain invisible to the wire — useful for purely-internal functions.
+ */
+function createSafeServer() {
+    const { app, shareDataManager: manager } = (0, app_1.createApp)();
+    const httpServer = (0, http_1.createServer)(app);
+    const realtime = (0, realtime_1.attachRealtimeServer)({
+        server: httpServer,
+        manager,
+        authenticate: authenticate_realtime_1.exampleAuthenticate,
+        path: '/realtime',
+        resolveFunction: (0, realtime_1.createIdBasedFunctionResolver)(manager),
+    });
+    let closed = false;
+    return {
+        app,
+        httpServer,
+        manager,
+        realtime,
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            await realtime.close();
+            // `httpServer.close()` errors if the server is already closed.
+            // The realtime handle may have already terminated all WS sockets,
+            // but the HTTP listener still needs to be stopped. Swallow the
+            // "not running" error so close() is idempotent.
+            await new Promise((resolve) => {
+                httpServer.close(() => resolve());
+            });
+        },
+    };
+}
+// When run directly (e.g. `node dist/examples/express-server/server.js`),
+// start the server on port 3000. Tests should call `createSafeServer()` and
+// drive `.httpServer.listen(0, ...)` themselves.
+if (require.main === module) {
+    const handle = createSafeServer();
+    handle.httpServer.listen(3000, () => {
+        // eslint-disable-next-line no-console
+        console.log('SAFE example server listening on :3000 (WS at /realtime)');
+    });
+}

package/dist/routes/events/v1.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"v1.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/events/v1.routes.ts"],"names":[],"mappings":"AAkEA,eAAO,MAAM,EAAE,4CAAS,CAAC"}
+{"version":3,"file":"v1.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/events/v1.routes.ts"],"names":[],"mappings":"AAqEA,eAAO,MAAM,EAAE,4CAAS,CAAC"}

package/dist/routes/events/v1.routes.js

@@ -47,9 +47,6 @@ const generic_1 = require("@degenerate/generic");
 const router = express.Router({ mergeParams: true });
 router.use(add_unique_tracking_1.addUniqueTracking); // add the unique tracking id to the request
 router.use(validate_jwt_events_1.validateJWTEvents); // validate the JWT token
-router.use(unauthorized_handler_1.unauthorizedHandler); // the unauthorized handler should be the first error handler
-router.use(bad_request_handler_1.badRequestHandler); // the bad request handler should be the second error handler
-router.use(all_error_handler_1.allErrorHandler); // the all error handler catches all remaining errors
 /**
  * This creates a new event object.
  */
@@ -82,4 +79,9 @@ router.delete(// https://{hostname}/events/v1
 (0, validate_incoming_request_data_1.validateIncomingRequestData)(generic_1.ISAFETransactionEventDeleteSchema), async (req, res) => {
     return res.status(200).send({ successful: true });
 });
+// Error handlers must be registered AFTER routes — express only routes
+// errors to handlers that follow the throwing middleware in the chain.
+router.use(unauthorized_handler_1.unauthorizedHandler); // the unauthorized handler should be the first error handler
+router.use(bad_request_handler_1.badRequestHandler); // the bad request handler should be the second error handler
+router.use(all_error_handler_1.allErrorHandler); // the all error handler catches all remaining errors
 exports.v1 = router; // https://{hostname}/events/v1

package/dist/routes/rules/v1/rule-set.routes.js

@@ -85,7 +85,7 @@ router.get('/', async (req, res, next) => {
  */
 router.get('/:rulesetsid', async (req, res, next) => {
     try {
-        const rulesSetsId = (0, generic_1.getParamRuleSetsId)(req); // get the rules id.
+        const rulesSetsId = (0, generic_1.getRuleSetsId)(req); // get the rules id.
         const ruleSets = ruleSetManager.getRuleSetById(rulesSetsId); // add the rule set to the rule set manager
         const returnItem = { successful: true };
         if (ruleSets) {
@@ -103,7 +103,7 @@ router.get('/:rulesetsid', async (req, res, next) => {
 router.patch('/:rulesetsid', validate_request_body_1.validateRequestBody, // make sure this is a valid request body
 (0, validate_incoming_request_data_1.validateIncomingRequestData)(generic_1.ISAFETransactionRuleSetUpdateSchema), async (req, res, next) => {
     try {
-        const rulesId = (0, generic_1.getParamRuleSetsId)(req); // get the rules id.
+        const rulesId = (0, generic_1.getRuleSetsId)(req); // get the rules id.
         const ruleSet = req.body.transaction.data.ruleSet; // get the rule set;
         if (ruleSet.id !== rulesId) {
             throw new Error('Rule set id does not match');
@@ -121,7 +121,7 @@ router.patch('/:rulesetsid', validate_request_body_1.validateRequestBody, // mak
 router.delete('/:rulesetsid', validate_request_body_1.validateRequestBody, // make sure this is a valid request body
 (0, validate_incoming_request_data_1.validateIncomingRequestData)(generic_1.ISAFETransactionRuleSetDeleteSchema), async (req, res, next) => {
     try {
-        const rulesId = (0, generic_1.getParamRuleSetsId)(req); // get the rules id.
+        const rulesId = (0, generic_1.getRuleSetsId)(req); // get the rules id.
         const ruleSet = req.body.transaction.data.ruleSet; // get the rule set;
         if (ruleSet.id !== rulesId) {
             throw new Error('Rule set id does not match');

package/dist/routes/share-data.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share-data.routes.d.ts","sourceRoot":"","sources":["../../src/routes/share-data.routes.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,SAAS,4CAAS,CAAC"}
+{"version":3,"file":"share-data.routes.d.ts","sourceRoot":"","sources":["../../src/routes/share-data.routes.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,SAAS,4CAAS,CAAC"}

package/dist/routes/share-data.routes.js

@@ -1,66 +1,24 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.shareData = void 0;
-const express = __importStar(require("express"));
+const express_1 = __importDefault(require("express"));
 const get_set_audiences_1 = require("../cors/authority/audience/get-set-audiences");
+const request_logging_1 = require("../cors/logging/request-logging");
+const v1_routes_1 = require("./sharedata/v1.routes");
+const validate_jwt_share_data_1 = require("../cors/authority/jwt/validate-jwt-share-data");
+const all_error_handler_1 = require("../cors/errors/all-error-handler");
+const bad_request_handler_1 = require("../cors/errors/bad-request-handler");
+const unauthorized_handler_1 = require("../cors/errors/unauthorized-handler");
 // eslint-disable-next-line new-cap
-const router = express.Router({ mergeParams: true });
+const router = express_1.default.Router({ mergeParams: true });
+router.use(request_logging_1.requestLogging); // log the request
 router.use(get_set_audiences_1.setAudienceShareData); // set the audience to share data (this will throw an error if the audience is not set)
-/**
- * This creates a new sharedata object.
- */
-router.post('/', async (req, res) => {
-    return res.status(200).send({ successful: true });
-});
-/**
- * This gets the sharedata object.
- */
-router.get('/', async (req, res) => {
-    return res.status(200).send({ successful: true });
-});
-/**
- * This updates the sharedata object.
- */
-router.patch('/', async (req, res) => {
-    return res.status(200).send({ successful: true });
-});
-/**
- * This deletes the sharedata object.
- */
-router.delete('/', async (req, res) => {
-    return res.status(200).send({ successful: true });
-});
+router.use(validate_jwt_share_data_1.validateJWTShareData); // get the audience authority
+router.use('/v1', v1_routes_1.v1); // use the v1 routes
+router.use(unauthorized_handler_1.unauthorizedHandler); // the unauthorized handler should be the first error handler
+router.use(bad_request_handler_1.badRequestHandler); // the bad request handler should be the second error handler
+router.use(all_error_handler_1.allErrorHandler); // the all error handler catches all remaining errors
 exports.shareData = router;

package/dist/routes/sharedata/v1.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"v1.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/sharedata/v1.routes.ts"],"names":[],"mappings":"AAqEA,eAAO,MAAM,EAAE,4CAAS,CAAC"}
+{"version":3,"file":"v1.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/sharedata/v1.routes.ts"],"names":[],"mappings":"AA0QA,eAAO,MAAM,EAAE,4CAAS,CAAC"}

package/dist/routes/sharedata/v1.routes.js

@@ -43,21 +43,140 @@ const all_error_handler_1 = require("../../cors/errors/all-error-handler");
 const bad_request_handler_1 = require("../../cors/errors/bad-request-handler");
 const unauthorized_handler_1 = require("../../cors/errors/unauthorized-handler");
 const generic_1 = require("@degenerate/generic");
+const shareblock_1 = require("@degenerate/shareblock");
 // eslint-disable-next-line new-cap
 const router = express.Router({ mergeParams: true });
+// The ShareDataManager is provided by the host application via
+// `app.set('shareDataManager', manager)`. Sharing the same instance across
+// HTTP and realtime is what makes route mutations broadcast to subscribed
+// WebSocket clients. Tests must `app.set('shareDataManager', new ShareDataManager())`
+// in their setup before mounting this router.
+const getManager = (req) => {
+    const manager = req.app.get('shareDataManager');
+    if (!manager) {
+        throw new Error('shareDataManager is not registered on the app — see createApp()');
+    }
+    return manager;
+};
+// Authorization claims ride on the verified JWT as loosely-typed custom
+// claims. Treat `allowedSigningKeys` as authoritative only when it is
+// genuinely an array of strings — a malformed token that supplied a bare
+// string would otherwise fall into String.prototype.includes substring
+// semantics and could wrongly authorize a partially-matching key. Both the
+// create and delete gates parse through here so they can't drift.
+const getAllowedSigningKeys = (req) => {
+    const raw = req.auth?.customClaims?.allowedSigningKeys;
+    return Array.isArray(raw) && raw.every((k) => typeof k === 'string')
+        ? raw
+        : undefined;
+};
 router.use(add_unique_tracking_1.addUniqueTracking); // add the unique tracking id to the request
 router.use(validate_jwt_share_data_1.validateJWTShareData); // validate the JWT token
-router.use(unauthorized_handler_1.unauthorizedHandler); // the unauthorized handler should be the first error handler
-router.use(bad_request_handler_1.badRequestHandler); // the bad request handler should be the second error handler
-router.use(all_error_handler_1.allErrorHandler); // the all error handler catches all remaining errors
 /**
  * This creates a new sharedata object.
  */
 router.post(// https://{hostname}/sharedata/v1
 '/', validate_request_body_1.validateRequestBody, // make sure this is a valid request body
 (0, validate_incoming_request_data_1.validateIncomingRequestData)(generic_1.ISAFETransactionShareDataAddSchema), async (req, res) => {
-    return res.status(200).send({ successful: true });
+    try {
+        const { metadata, initialState, initialCrypto, proofs } = req.body.transaction.data;
+        const creationPublicKey = initialCrypto.publicKey;
+        // Cross-check: the verified JWT must authorize the caller to sign
+        // as `creationPublicKey`. Token issuers attach
+        // `customClaims.allowedSigningKeys: string[]` listing the public
+        // keys the subject is vouched for — without this check, anyone
+        // holding a valid SHAREDATA JWT could create a block attributed to
+        // any key (since they generate the proofs themselves with their
+        // own keypair). The shared validateJWTShareData middleware has
+        // already verified signature/issuer/audience/expiry; this gate
+        // closes the subject → signing-key binding.
+        const allowedSigningKeys = getAllowedSigningKeys(req);
+        if (!allowedSigningKeys || !allowedSigningKeys.includes(creationPublicKey)) {
+            return res.status(403).send({
+                successful: false,
+                error: `creation-public-key-mismatch: JWT does not authorize signing as ${creationPublicKey}`,
+            });
+        }
+        // Cross-check: every proof in the bundle must be signed by the same
+        // key the initialCrypto attributes the block to. A mismatch means
+        // the client either swapped a proof in or supplied a forged
+        // creationPublicKey — reject early with one clear error rather
+        // than letting it surface as a verifyStructuralProof failure inside
+        // the factory.
+        for (const [purpose, proof] of Object.entries(proofs)) {
+            if (proof.publicKey !== creationPublicKey) {
+                return res.status(400).send({
+                    successful: false,
+                    error: `proof-public-key-mismatch: proof for '${purpose}' signed by ${proof.publicKey}, but initialCrypto attributes block to ${creationPublicKey}`,
+                });
+            }
+        }
+        // Cross-check: bundle covers every purpose the factory will request.
+        // Surfaces a missing proof once, here, instead of as the first
+        // MissingRequiredProofError thrown mid-construction.
+        const requiredPurposes = REQUIRED_PURPOSES_BY_BLOCK_TYPE[metadata.blockType];
+        for (const purpose of requiredPurposes) {
+            if (!(purpose in proofs)) {
+                return res.status(400).send({
+                    successful: false,
+                    error: `missing-proof: bundle is missing required proof for purpose '${purpose}' on ${metadata.blockType} ShareBlock`,
+                });
+            }
+        }
+        // Schema's literal union and the enum are the same string values —
+        // narrow once and reuse so we don't repeat the cast.
+        const blockType = metadata.blockType;
+        const proofFor = (0, shareblock_1.buildLookupProofFor)({
+            proofs,
+            initialCrypto,
+            blockType,
+        });
+        const factoryArgs = { metadata, creationPublicKey, initialState, proofFor };
+        let shareData;
+        switch (blockType) {
+            case generic_1.ShareBlockType.Clearing:
+                shareData = (0, shareblock_1.createClearingShareBlock)(factoryArgs);
+                break;
+            case generic_1.ShareBlockType.Funding:
+                shareData = (0, shareblock_1.createFundingShareBlock)(factoryArgs);
+                break;
+            case generic_1.ShareBlockType.Distribution:
+                shareData = (0, shareblock_1.createDistributionShareBlock)(factoryArgs);
+                break;
+            default: {
+                // Exhaustiveness check — schema validation should prevent
+                // reaching this, but TS doesn't know that. A runtime fallback
+                // makes the intent explicit and silences the unioned-undefined
+                // warning on `shareData`.
+                const _exhaustive = blockType;
+                return res.status(400).send({
+                    successful: false,
+                    error: `unknown blockType: ${_exhaustive}`,
+                });
+            }
+        }
+        // Carry the creation recipe so a repository-backed manager can persist
+        // this block and keep writing through as transactions accrue. The
+        // factory was handed exactly `{ metadata, creationPublicKey,
+        // initialState }`; the manager re-serializes from those.
+        await getManager(req).addShareData(shareData, {
+            blockType,
+            creationConfig: { metadata, creationPublicKey, initialState },
+        });
+        return res.status(200).send({ successful: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        return res.status(400).send({ successful: false, error: message });
+    }
 });
+// Coverage-check table — keeps the per-variant required-proof list lookup
+// in one place rather than hard-coding switches in the route body.
+const REQUIRED_PURPOSES_BY_BLOCK_TYPE = {
+    [generic_1.ShareBlockType.Clearing]: shareblock_1.CLEARING_REQUIRED_PROOF_PURPOSES,
+    [generic_1.ShareBlockType.Funding]: shareblock_1.FUNDING_REQUIRED_PROOF_PURPOSES,
+    [generic_1.ShareBlockType.Distribution]: shareblock_1.DISTRIBUTION_REQUIRED_PROOF_PURPOSES,
+};
 /**
  * This gets the sharedata objects and their data.
  */
@@ -68,19 +187,73 @@ async (req, res) => {
     return;
 });
 /**
- * This updates the sharedata object.
+ * PATCH is intentionally unsupported. The previous handler replaced the
+ * stored ShareData wholesale with the request body — bypassing the rule
+ * engine and the structural-proof trust chain entirely. That is state
+ * forgery, not merely a missing access check: a caller could overwrite a
+ * block's canonical state with arbitrary JSON. In the SAFE model, state
+ * changes are signed PROPOSALS judged by `startRuleEvaluation` (the
+ * `ShareDataManager.applyTransaction` path), never client-uploaded blobs.
+ * Until a proposal-over-HTTP endpoint exists, PATCH stays closed. Body
+ * shape is still validated first, so malformed requests get 400 before 501.
  */
 router.patch(// https://{hostname}/sharedata/v1/{sharedataid}
 '/:sharedataid', add_unique_tracking_1.addUniqueTracking, // add a unique tracking id to the request
-validate_request_body_1.validateRequestBody, (0, validate_incoming_request_data_1.validateIncomingRequestData)(generic_1.ISAFETransactionShareDataUpdateSchema), async (req, res) => {
-    return res.status(200).send({ successful: true });
+validate_request_body_1.validateRequestBody, (0, validate_incoming_request_data_1.validateIncomingRequestData)(generic_1.ISAFETransactionShareDataUpdateSchema), async (_req, res) => {
+    return res.status(501).send({
+        successful: false,
+        error: 'patch-unsupported: ShareData mutations must go through the rule-engine-verified proposal path, not a wholesale state replacement.',
+    });
 });
 /**
  * This deletes the sharedata object.
  */
-router.delete(// https://{hostname}/sharedata/v1
+router.delete(// https://{hostname}/sharedata/v1/{sharedataid}
 '/:sharedataid', add_unique_tracking_1.addUniqueTracking, // add a unique tracking id to the request
 validate_request_body_1.validateRequestBody, (0, validate_incoming_request_data_1.validateIncomingRequestData)(generic_1.ISAFETransactionShareDataDeleteSchema), async (req, res) => {
-    return res.status(200).send({ successful: true });
+    try {
+        const shareDataId = req.params.sharedataid;
+        // Body/URL agreement: the wire payload names a target block; it must
+        // match the id in the URL path. A mismatch is a malformed request.
+        const bodyId = req.body
+            .transaction.data.metadata.shareBlockId;
+        if (bodyId !== shareDataId) {
+            return res.status(400).send({
+                successful: false,
+                error: `sharedata-id-mismatch: URL id ${shareDataId} does not match body id ${bodyId}`,
+            });
+        }
+        // Per-resource authorization (BOLA gate). The router-level
+        // validateJWTShareData only proves the caller holds a valid SHAREDATA
+        // token — it does NOT prove they may act on THIS block. Look up the
+        // target and require the verified JWT to vouch for the key that
+        // created it. Authorize against the stored block's creationPublicKey,
+        // never the client-supplied body. Mirrors the POST create gate.
+        const existing = getManager(req).getShareDataById(shareDataId);
+        if (!existing) {
+            return res.status(404).send({
+                successful: false,
+                error: `not-found: no ShareData with id ${shareDataId}`,
+            });
+        }
+        const allowedSigningKeys = getAllowedSigningKeys(req);
+        if (!allowedSigningKeys || !allowedSigningKeys.includes(existing.creationPublicKey)) {
+            return res.status(403).send({
+                successful: false,
+                error: `creation-public-key-mismatch: JWT does not authorize mutating block created by ${existing.creationPublicKey}`,
+            });
+        }
+        await getManager(req).removeShareDataById(shareDataId);
+        return res.status(200).send({ successful: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        return res.status(400).send({ successful: false, error: message });
+    }
 });
+// Error handlers must be registered AFTER routes — express only routes
+// errors to handlers that follow the throwing middleware in the chain.
+router.use(unauthorized_handler_1.unauthorizedHandler); // the unauthorized handler should be the first error handler
+router.use(bad_request_handler_1.badRequestHandler); // the bad request handler should be the second error handler
+router.use(all_error_handler_1.allErrorHandler); // the all error handler catches all remaining errors
 exports.v1 = router; // https://{hostname}/sharedata/v1