@sparkvault/sdk-mobile 6.0.2 → 7.0.0

package/dist/app-sdk/ids.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Whether a value is an id of the given kind.
+ *
+ * @param {string} kind - A key of RESOURCE_ID_PREFIXES
+ * @param {unknown} value
+ * @returns {boolean}
+ * @throws {TypeError} for a kind the grammar does not name: a misspelled kind
+ *   would otherwise refuse every id without saying why
+ */
+export function isResourceIdOf(kind: string, value: unknown): boolean;
+/**
+ * Whether a value is an id of any kind.
+ *
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isResourceId(value: unknown): boolean;
+/**
+ * SparkVault resource ids: the one grammar every surface reads an id by before
+ * the id names a request path or a stored file.
+ *
+ * Core mints an id as its kind's prefix, an underscore and a body: the hex of a
+ * UUIDv7 (apps/api lib/utils.js buildPrefixedIdFromBytes), or a hex digest for
+ * an invitation and an inbox notification. The grammar admits the kind's
+ * prefix, '_' and a body of the path-safe alphabet [A-Za-z0-9_-], 128
+ * characters in all, so an id that passes is exactly one request-path segment
+ * and one file-name component: it can never name a parent path, carry a
+ * separator or a dot-segment, or read as an id of another kind.
+ *
+ * - `isResourceIdOf(kind, value)`: an id of that kind.
+ * - `isResourceId(value)`: an id of any kind, for a check that takes several.
+ *
+ * Browser-safe and import-free: sdk-js bundles it, sdk-mobile mirrors it, and
+ * the apps, the console and the mobile app import it.
+ */
+/** The prefix Core mints each resource kind's id with. */
+export const RESOURCE_ID_PREFIXES: Readonly<{
+    account: "acc";
+    folder: "fld";
+    ingot: "ing";
+    invite: "inv";
+    notification: "ntf";
+    spark: "spk";
+    user: "usr";
+    vault: "vlt";
+}>;
+/** The longest id, prefix included. */
+export const RESOURCE_ID_MAX_LENGTH: 128;

package/dist/app-sdk/ids.js

@@ -0,0 +1,65 @@
+// GENERATED FILE — do not edit by hand.
+// Source of truth: packages/app-sdk/src/ids.js
+// Regenerate with: pnpm --filter @sparkvault/sdk-mobile build
+/**
+ * SparkVault resource ids: the one grammar every surface reads an id by before
+ * the id names a request path or a stored file.
+ *
+ * Core mints an id as its kind's prefix, an underscore and a body: the hex of a
+ * UUIDv7 (apps/api lib/utils.js buildPrefixedIdFromBytes), or a hex digest for
+ * an invitation and an inbox notification. The grammar admits the kind's
+ * prefix, '_' and a body of the path-safe alphabet [A-Za-z0-9_-], 128
+ * characters in all, so an id that passes is exactly one request-path segment
+ * and one file-name component: it can never name a parent path, carry a
+ * separator or a dot-segment, or read as an id of another kind.
+ *
+ * - `isResourceIdOf(kind, value)`: an id of that kind.
+ * - `isResourceId(value)`: an id of any kind, for a check that takes several.
+ *
+ * Browser-safe and import-free: sdk-js bundles it, sdk-mobile mirrors it, and
+ * the apps, the console and the mobile app import it.
+ */
+/** The prefix Core mints each resource kind's id with. */
+export const RESOURCE_ID_PREFIXES = Object.freeze({
+    account: 'acc',
+    folder: 'fld',
+    ingot: 'ing',
+    invite: 'inv',
+    notification: 'ntf',
+    spark: 'spk',
+    user: 'usr',
+    vault: 'vlt'
+});
+/** The longest id, prefix included. */
+export const RESOURCE_ID_MAX_LENGTH = 128;
+const ID_BODY = /^[A-Za-z0-9_-]+$/;
+/**
+ * Whether a value is an id of the given kind.
+ *
+ * @param {string} kind - A key of RESOURCE_ID_PREFIXES
+ * @param {unknown} value
+ * @returns {boolean}
+ * @throws {TypeError} for a kind the grammar does not name: a misspelled kind
+ *   would otherwise refuse every id without saying why
+ */
+export function isResourceIdOf(kind, value) {
+    if (!Object.hasOwn(RESOURCE_ID_PREFIXES, kind)) {
+        throw new TypeError(`No resource kind '${kind}'`);
+    }
+    const prefix = `${RESOURCE_ID_PREFIXES[kind]}_`;
+    return typeof value === 'string'
+        && value.length <= RESOURCE_ID_MAX_LENGTH
+        && value.startsWith(prefix)
+        && ID_BODY.test(value.slice(prefix.length));
+}
+const KINDS = Object.freeze(Object.keys(RESOURCE_ID_PREFIXES));
+/**
+ * Whether a value is an id of any kind.
+ *
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isResourceId(value) {
+    return KINDS.some((kind) => isResourceIdOf(kind, value));
+}
+//# sourceMappingURL=ids.js.map

package/dist/app-sdk/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/app-sdk/ids.js"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,+CAA+C;AAC/C,8DAA8D;AAE9D;;;;;;;;;;;;;;;;;GAiBG;AAEH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,KAAK;IACnB,KAAK,EAAE,KAAK;IACZ,IAAI,EAAE,KAAK;IACX,KAAK,EAAE,KAAK;CACb,CAAC,CAAC;AAEH,uCAAuC;AACvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAI,EAAE,KAAK;IACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,KAAK,CAAC,MAAM,IAAI,sBAAsB;WACtC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;WACxB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAK;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/app-sdk/ingot-access-log.d.ts

@@ -0,0 +1,29 @@
+/**
+ * One audit entry as an access. The actor reads as the server resolved it (a
+ * member's email, an API key's name), else as the identity a SparkLink visitor
+ * gave (kept in the entry's metadata), else as the raw actor id.
+ *
+ * @param {{ timestamp: number, event_type: string, actor_id?: string | null, actor_display?: string,
+ *   ip_address?: string | null, user_agent?: string | null, metadata?: { identity?: string | null } | null }} entry
+ * @returns {{ timestamp: number, action: 'download', identity: string, ip_address: string,
+ *   user_agent: string } | null} null for an event that is not an access
+ */
+export function readIngotAccess(entry: {
+    timestamp: number;
+    event_type: string;
+    actor_id?: string | null;
+    actor_display?: string;
+    ip_address?: string | null;
+    user_agent?: string | null;
+    metadata?: {
+        identity?: string | null;
+    } | null;
+}): {
+    timestamp: number;
+    action: "download";
+    identity: string;
+    ip_address: string;
+    user_agent: string;
+} | null;
+/** The event types an access-log request asks the server for. */
+export const INGOT_ACCESS_EVENT_TYPES: readonly string[];

package/dist/app-sdk/ingot-access-log.js

@@ -0,0 +1,49 @@
+// GENERATED FILE — do not edit by hand.
+// Source of truth: packages/app-sdk/src/ingot-access-log.js
+// Regenerate with: pnpm --filter @sparkvault/sdk-mobile build
+/**
+ * Ingot access logs: which of an ingot's audit events are accesses, and how one
+ * audit entry reads as an access. Both SDKs read
+ * GET /v1/vaults/{vault_id}/ingots/{ingot_id}/audit-logs through it: sdk-js
+ * bundles this module, and sdk-mobile (which publishes standalone) carries a
+ * build-time copy pinned byte-for-byte by its drift test.
+ *
+ * An entry arrives in the server's public audit shape (AuditLogRepository
+ * toPublicFormat, annotated by the audit-log controller's actor resolution):
+ * `timestamp`, `event_type`, `actor_id`, `actor_type`, `actor_display`,
+ * `ip_address`, `user_agent`, `metadata` (null while encrypted), `encrypted`,
+ * `vault_id` and `ingot_id`.
+ */
+/**
+ * The ingot audit events that are accesses, and what each one is: Core records
+ * an access to a file as the download that delivered it, a SparkLink open of
+ * the file included.
+ */
+const ACCESS_ACTIONS = new Map([
+    ['ingot_downloaded', 'download'],
+]);
+/** The event types an access-log request asks the server for. */
+export const INGOT_ACCESS_EVENT_TYPES = Object.freeze([...ACCESS_ACTIONS.keys()]);
+/**
+ * One audit entry as an access. The actor reads as the server resolved it (a
+ * member's email, an API key's name), else as the identity a SparkLink visitor
+ * gave (kept in the entry's metadata), else as the raw actor id.
+ *
+ * @param {{ timestamp: number, event_type: string, actor_id?: string | null, actor_display?: string,
+ *   ip_address?: string | null, user_agent?: string | null, metadata?: { identity?: string | null } | null }} entry
+ * @returns {{ timestamp: number, action: 'download', identity: string, ip_address: string,
+ *   user_agent: string } | null} null for an event that is not an access
+ */
+export function readIngotAccess(entry) {
+    const action = ACCESS_ACTIONS.get(entry.event_type);
+    if (action === undefined)
+        return null;
+    return {
+        timestamp: entry.timestamp,
+        action,
+        identity: entry.actor_display || entry.metadata?.identity || entry.actor_id || 'Unknown',
+        ip_address: entry.ip_address ?? '',
+        user_agent: entry.user_agent ?? '',
+    };
+}
+//# sourceMappingURL=ingot-access-log.js.map

package/dist/app-sdk/ingot-access-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingot-access-log.js","sourceRoot":"","sources":["../../src/app-sdk/ingot-access-log.js"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,4DAA4D;AAC5D,8DAA8D;AAE9D;;;;;;;;;;;;GAYG;AAEH;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,CAAC,kBAAkB,EAAE,UAAU,CAAC;CACjC,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,KAAK;IACnC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,SAAS;QACxF,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC"}

package/dist/app-sdk/phone.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Read a typed phone number as E.164.
+ *
+ * @param {unknown} raw
+ * @returns {string|null} E.164 with its leading '+', or null when the input
+ *   names no dialable number
+ */
+export function parsePhone(raw: unknown): string | null;
+/**
+ * Whether a value is already a canonical E.164 phone number — exactly the
+ * values parsePhone returns unchanged.
+ *
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isE164Phone(value: unknown): boolean;
+/**
+ * Whether an identifier typed where either is accepted is an email address or
+ * a phone number.
+ *
+ * @param {unknown} value
+ * @returns {'email' | 'phone'}
+ */
+export function inferIdentityType(value: unknown): "email" | "phone";
+/**
+ * A phone number as a phone field shows it while it is typed: a NANP number as
+ * (XXX) XXX-XXXX; a declared country code, or a digit string that is not a NANP
+ * number, keeps every digit as given, so formatting never turns one destination
+ * into another. Text holding anything but phone characters (a letter, a
+ * dial-control character, a digit of another script) is left as typed, so it
+ * reaches parsePhone and is refused there instead of being dropped from the
+ * field.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+export function formatPhoneDisplay(value: string): string;

package/dist/app-sdk/phone.js

@@ -0,0 +1,134 @@
+// GENERATED FILE — do not edit by hand.
+// Source of truth: packages/app-sdk/src/phone.js
+// Regenerate with: pnpm --filter @sparkvault/sdk-mobile build
+/**
+ * Phone numbers a person types: how one reads as E.164, and whether a typed
+ * identifier is a phone number at all. Pure, with no imports, so a browser or
+ * an SDK bundle can carry it: Core reads and checks every phone it is given
+ * with it, the console imports it, sdk-js bundles it, and sdk-mobile carries a
+ * build-time copy pinned byte-for-byte by its drift test.
+ *
+ * A '+' ahead of the digits DECLARES the country code, so every digit is kept
+ * exactly as given: ten digits after a '+' are a foreign number (+47 Norway,
+ * +45 Denmark, +65 Singapore, +354 Iceland …), and reading them as a NANP number
+ * would hand an OTP or a bearer link to whoever holds the matching North
+ * American line. Only input WITHOUT a '+' may take the NANP shorthand: exactly
+ * ten digits, or eleven starting with the '1'. Any other bare digit string
+ * declares no country and is refused rather than guessed.
+ *
+ * A typed number holds ASCII digits, at most one '+' ahead of all of them, and
+ * the separators people type: whitespace, parentheses, dots and dashes of any
+ * script, and the invisible formatting marks a contacts app wraps a number in.
+ * The separators and marks are dropped. Anything else is refused, never
+ * dropped: stripping it would fold part of the text into the number and deliver
+ * to someone else's line — a letter or a dial-control character (',' and ';'
+ * pause, '#' and '*' are keypad tones) carries an extension ("x2", ",89"), a
+ * digit of another script ('٧', '７') is a digit the ASCII read would silently
+ * lose, and a '+' after a digit declares nothing.
+ *
+ * An identifier typed where an email address or a phone number is accepted is
+ * a phone number only when it holds phone characters only, led by a digit, '+'
+ * or '(': an email whose local part starts with a digit ("2024user@gmail.com",
+ * "12345678@qq.com") stays an email.
+ */
+/** A '+' before any digit: the caller declared the country code. */
+const DECLARED_COUNTRY_CODE = /^\D*\+/;
+/** E.164 digits once a country code is declared: 8–15, never a leading 0. */
+const E164_DIGITS = /^[1-9]\d{7,14}$/;
+/** A canonical E.164 value. */
+const E164 = /^\+[1-9]\d{7,14}$/;
+/** Invisible formatting marks (bidi embeddings, zero-width characters), in any number. */
+const FORMAT_MARKS = /\p{Cf}/gu;
+/**
+ * Typed phone text once its formatting marks are dropped: ASCII digits and
+ * separators, with at most one '+', ahead of every digit.
+ */
+const PHONE_TEXT = /^[\s().\p{Pd}]*\+?[\d\s().\p{Pd}]*$/u;
+/** How phone text starts where an identifier may be either: a digit, '+' or '('. */
+const PHONE_LEAD = /^[+(\d]/;
+/**
+ * @param {string} value
+ * @returns {string} The value without its formatting marks
+ */
+function withoutFormatMarks(value) {
+    return value.replace(FORMAT_MARKS, '');
+}
+/**
+ * Read a typed phone number as E.164.
+ *
+ * @param {unknown} raw
+ * @returns {string|null} E.164 with its leading '+', or null when the input
+ *   names no dialable number
+ */
+export function parsePhone(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const text = withoutFormatMarks(raw);
+    if (!PHONE_TEXT.test(text))
+        return null;
+    const digits = text.replace(/\D/g, '');
+    if (DECLARED_COUNTRY_CODE.test(text)) {
+        return E164_DIGITS.test(digits) ? `+${digits}` : null;
+    }
+    if (digits.length === 10)
+        return `+1${digits}`;
+    if (digits.length === 11 && digits.startsWith('1'))
+        return `+${digits}`;
+    return null;
+}
+/**
+ * Whether a value is already a canonical E.164 phone number — exactly the
+ * values parsePhone returns unchanged.
+ *
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isE164Phone(value) {
+    return typeof value === 'string' && E164.test(value);
+}
+/**
+ * Whether an identifier typed where either is accepted is an email address or
+ * a phone number.
+ *
+ * @param {unknown} value
+ * @returns {'email' | 'phone'}
+ */
+export function inferIdentityType(value) {
+    if (typeof value !== 'string')
+        return 'email';
+    const text = withoutFormatMarks(value).trim();
+    return PHONE_LEAD.test(text) && PHONE_TEXT.test(text) ? 'phone' : 'email';
+}
+/**
+ * A phone number as a phone field shows it while it is typed: a NANP number as
+ * (XXX) XXX-XXXX; a declared country code, or a digit string that is not a NANP
+ * number, keeps every digit as given, so formatting never turns one destination
+ * into another. Text holding anything but phone characters (a letter, a
+ * dial-control character, a digit of another script) is left as typed, so it
+ * reaches parsePhone and is refused there instead of being dropped from the
+ * field.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+export function formatPhoneDisplay(value) {
+    const text = withoutFormatMarks(value);
+    if (!PHONE_TEXT.test(text))
+        return value;
+    const digits = text.replace(/\D/g, '');
+    if (DECLARED_COUNTRY_CODE.test(text) && !(digits.startsWith('1') && digits.length === 11)) {
+        return `+${digits}`;
+    }
+    if (digits.length > 11 || (digits.length === 11 && !digits.startsWith('1'))) {
+        return digits;
+    }
+    const national = digits.length === 11 ? digits.slice(1) : digits;
+    if (national.length === 0)
+        return '';
+    if (national.length <= 3)
+        return `(${national}`;
+    if (national.length <= 6)
+        return `(${national.slice(0, 3)}) ${national.slice(3)}`;
+    return `(${national.slice(0, 3)}) ${national.slice(3, 6)}-${national.slice(6, 10)}`;
+}
+//# sourceMappingURL=phone.js.map

package/dist/app-sdk/phone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone.js","sourceRoot":"","sources":["../../src/app-sdk/phone.js"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,iDAAiD;AACjD,8DAA8D;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAEvC,6EAA6E;AAC7E,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,+BAA+B;AAC/B,MAAM,IAAI,GAAG,mBAAmB,CAAC;AAEjC,0FAA0F;AAC1F,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC;;;GAGG;AACH,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAE1D,oFAAoF;AACpF,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAK;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAG;IAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEvC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,MAAM,EAAE,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,MAAM,EAAE,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAK;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAK;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAK;IACtC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEvC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,MAAM,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,QAAQ,EAAE,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACtF,CAAC"}

package/dist/app-sdk/platform-domains.d.ts

@@ -0,0 +1,41 @@
+export function isSparkVaultRootOrSubdomain(hostname: any): boolean;
+export function isSparkVaultPlatformSvHost(hostname: any): boolean;
+export function isSparkVaultOwnedHostname(hostname: any): boolean;
+export function isSparkVaultReservedDomain(hostname: any): boolean;
+export function sparkVaultPlatformSvOrigins(): string[];
+export function sparkVaultWebSocketOrigins(): string[];
+/**
+ * SparkVault-owned domain registry.
+ *
+ * Keep platform domain decisions centralized: CSP, redirect safety, custom
+ * domain reservation, and Identity postMessage trust all depend on the same
+ * ownership boundary.
+ */
+export const SPARKVAULT_ROOT_DOMAIN: "sparkvault.com";
+/** The person-facing Identity portal host (auth.sv shell + hosted login). */
+export const SPARKVAULT_AUTH_HOST: "auth.sv";
+/**
+ * The Identity IdP origin's host: it serves the OIDC ceremonies (/authorize,
+ * /token), the SDK sign-in page and the Identity API, issues every Identity
+ * token (`iss` is https://{host}/{account_id}), and holds the hub session
+ * cookie. Core verifies the tokens it issues and the Identity product mints
+ * them, so both name it from here. Never the auth.sv portal host.
+ */
+export const SPARKVAULT_IDENTITY_HOST: "auth.sparkvault.com";
+/** The SparkLinks host: shared Sparks, single-use links and the Messaging recipient pages. */
+export const SPARKVAULT_LINKS_HOST: "x.sv";
+/** The durable file-share and Secure Upload Portal host. */
+export const SPARKVAULT_FILES_HOST: "files.sv";
+export const SPARKVAULT_PLATFORM_SV_HOSTS: readonly string[];
+/** The SparkVault console. */
+export const SPARKVAULT_APP_HOST: "app.sparkvault.com";
+/** Forge, the streaming encrypt/decrypt service every ingot transfer goes through. */
+export const SPARKVAULT_FORGE_HOST: "forge.sparkvault.com";
+/**
+ * The platform's own hosts as patterns over a URL's hostname: the root domain
+ * and its subdomains, and each .sv host exactly (isSparkVaultOwnedHostname).
+ * Both SDKs trust a backend-issued transfer URL on these hosts by default;
+ * their `allowedDownloadHostPatterns` option replaces the list for another
+ * deployment.
+ */
+export const SPARKVAULT_OWNED_HOST_PATTERNS: readonly RegExp[];

package/dist/app-sdk/platform-domains.js

@@ -0,0 +1,82 @@
+// GENERATED FILE — do not edit by hand.
+// Source of truth: packages/app-sdk/src/platform-domains.js
+// Regenerate with: pnpm --filter @sparkvault/sdk-mobile build
+/**
+ * SparkVault-owned domain registry.
+ *
+ * Keep platform domain decisions centralized: CSP, redirect safety, custom
+ * domain reservation, and Identity postMessage trust all depend on the same
+ * ownership boundary.
+ */
+export const SPARKVAULT_ROOT_DOMAIN = 'sparkvault.com';
+/** The person-facing Identity portal host (auth.sv shell + hosted login). */
+export const SPARKVAULT_AUTH_HOST = 'auth.sv';
+/**
+ * The Identity IdP origin's host: it serves the OIDC ceremonies (/authorize,
+ * /token), the SDK sign-in page and the Identity API, issues every Identity
+ * token (`iss` is https://{host}/{account_id}), and holds the hub session
+ * cookie. Core verifies the tokens it issues and the Identity product mints
+ * them, so both name it from here. Never the auth.sv portal host.
+ */
+export const SPARKVAULT_IDENTITY_HOST = 'auth.sparkvault.com';
+/** The SparkLinks host: shared Sparks, single-use links and the Messaging recipient pages. */
+export const SPARKVAULT_LINKS_HOST = 'x.sv';
+/** The durable file-share and Secure Upload Portal host. */
+export const SPARKVAULT_FILES_HOST = 'files.sv';
+export const SPARKVAULT_PLATFORM_SV_HOSTS = Object.freeze([
+    SPARKVAULT_AUTH_HOST,
+    SPARKVAULT_LINKS_HOST,
+    SPARKVAULT_FILES_HOST,
+    'file.sv',
+    'send.sv',
+    'spark.sv',
+    'by.sv',
+    'at.sv',
+    'db.sv'
+]);
+/** The SparkVault console. */
+export const SPARKVAULT_APP_HOST = 'app.sparkvault.com';
+/** Forge, the streaming encrypt/decrypt service every ingot transfer goes through. */
+export const SPARKVAULT_FORGE_HOST = 'forge.sparkvault.com';
+const SPARKVAULT_WEBSOCKET_HOSTS = Object.freeze([
+    'ws.sparkvault.com'
+]);
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * The platform's own hosts as patterns over a URL's hostname: the root domain
+ * and its subdomains, and each .sv host exactly (isSparkVaultOwnedHostname).
+ * Both SDKs trust a backend-issued transfer URL on these hosts by default;
+ * their `allowedDownloadHostPatterns` option replaces the list for another
+ * deployment.
+ */
+export const SPARKVAULT_OWNED_HOST_PATTERNS = Object.freeze([
+    new RegExp(`(^|\\.)${escapeRegExp(SPARKVAULT_ROOT_DOMAIN)}$`, 'i'),
+    new RegExp(`^(${SPARKVAULT_PLATFORM_SV_HOSTS.map(escapeRegExp).join('|')})$`, 'i')
+]);
+function normalizeHostname(hostname) {
+    if (typeof hostname !== 'string')
+        return '';
+    return hostname.trim().toLowerCase().replace(/\.$/, '');
+}
+export function isSparkVaultRootOrSubdomain(hostname) {
+    const normalized = normalizeHostname(hostname);
+    return normalized === SPARKVAULT_ROOT_DOMAIN || normalized.endsWith(`.${SPARKVAULT_ROOT_DOMAIN}`);
+}
+export function isSparkVaultPlatformSvHost(hostname) {
+    return SPARKVAULT_PLATFORM_SV_HOSTS.includes(normalizeHostname(hostname));
+}
+export function isSparkVaultOwnedHostname(hostname) {
+    return isSparkVaultRootOrSubdomain(hostname) || isSparkVaultPlatformSvHost(hostname);
+}
+export function isSparkVaultReservedDomain(hostname) {
+    return isSparkVaultOwnedHostname(hostname);
+}
+export function sparkVaultPlatformSvOrigins() {
+    return SPARKVAULT_PLATFORM_SV_HOSTS.map((host) => `https://${host}`);
+}
+export function sparkVaultWebSocketOrigins() {
+    return SPARKVAULT_WEBSOCKET_HOSTS.map((host) => `wss://${host}`);
+}
+//# sourceMappingURL=platform-domains.js.map

package/dist/app-sdk/platform-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-domains.js","sourceRoot":"","sources":["../../src/app-sdk/platform-domains.js"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,4DAA4D;AAC5D,8DAA8D;AAE9D;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEhD,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,SAAS;IACT,SAAS;IACT,UAAU;IACV,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,8BAA8B;AAC9B,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAExD,sFAAsF;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AAE5D,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,mBAAmB;CACpB,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,KAAK;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1D,IAAI,MAAM,CAAC,UAAU,YAAY,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC;IAClE,IAAI,MAAM,CAAC,KAAK,4BAA4B,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;CACnF,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,QAAQ;IACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,QAAQ;IAClD,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,UAAU,KAAK,sBAAsB,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAQ;IACjD,OAAO,4BAA4B,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAQ;IAChD,OAAO,2BAA2B,CAAC,QAAQ,CAAC,IAAI,0BAA0B,CAAC,QAAQ,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAQ;IACjD,OAAO,yBAAyB,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,4BAA4B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC"}

package/dist/app-sdk/request-path.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Request paths: the one rule every SDK applies before a caller-supplied value
+ * becomes part of a SparkVault request URL.
+ *
+ * A request carries the caller's credentials (a Bearer token, an API key, a
+ * Vault Access Token), so a value that smuggles '/' or a dot-segment into the
+ * path would re-target that credentialed request at another route. The rules:
+ *
+ * - `encodePathSegment`: every value interpolated into a path is encoded as
+ *   exactly one segment. Percent-encoding keeps '/', '?' and '#' inside the
+ *   segment, and the three values no encoding can keep one segment ('', '.'
+ *   and '..', which URL resolution drops or collapses) are refused.
+ * - `buildRequestPath`: the template loop an SDK's tagged path builder runs,
+ *   so every interpolated value passes `encodePathSegment` by construction.
+ * - `queryString`: the one query encoding, which leaves unset values out.
+ *
+ * A server-issued id is checked for its shape first, by the one resource-id
+ * grammar (ids.js).
+ *
+ * Browser-safe and dependency-free: sdk-js bundles it, and sdk-mobile (which
+ * publishes standalone) carries a build-time copy pinned byte-for-byte by its
+ * drift test. Each SDK wraps it in a typed front door that throws its own
+ * validation error.
+ */
+/**
+ * Encode a value as exactly one request-path segment.
+ * @param {unknown} value
+ * @returns {string | null} the encoded segment, or null when the value cannot
+ *   be one segment: not a string, empty, '.', '..', or not well-formed UTF-16
+ *   (a lone surrogate has no percent-encoding).
+ */
+export function encodePathSegment(value: unknown): string | null;
+/**
+ * Join a tagged template's literals with its values, each value encoded as
+ * exactly one path segment.
+ * @param {readonly string[]} literals
+ * @param {readonly unknown[]} values
+ * @returns {string | null} the path, or null when any value cannot be one
+ *   segment (see `encodePathSegment`).
+ */
+export function buildRequestPath(literals: readonly string[], values: readonly unknown[]): string | null;
+/**
+ * Encode query parameters, leaving out every unset value (`undefined`, `null`
+ * or `''`). Other values are sent as their string form, so `0` and `false`
+ * are sent.
+ * @param {Readonly<Record<string, string | number | boolean | null | undefined>> | undefined} params
+ * @returns {string} `?a=1&b=2`, or '' when no value is set.
+ */
+export function queryString(params: Readonly<Record<string, string | number | boolean | null | undefined>> | undefined): string;

package/dist/app-sdk/request-path.js

@@ -0,0 +1,81 @@
+// GENERATED FILE — do not edit by hand.
+// Source of truth: packages/app-sdk/src/request-path.js
+// Regenerate with: pnpm --filter @sparkvault/sdk-mobile build
+/**
+ * Request paths: the one rule every SDK applies before a caller-supplied value
+ * becomes part of a SparkVault request URL.
+ *
+ * A request carries the caller's credentials (a Bearer token, an API key, a
+ * Vault Access Token), so a value that smuggles '/' or a dot-segment into the
+ * path would re-target that credentialed request at another route. The rules:
+ *
+ * - `encodePathSegment`: every value interpolated into a path is encoded as
+ *   exactly one segment. Percent-encoding keeps '/', '?' and '#' inside the
+ *   segment, and the three values no encoding can keep one segment ('', '.'
+ *   and '..', which URL resolution drops or collapses) are refused.
+ * - `buildRequestPath`: the template loop an SDK's tagged path builder runs,
+ *   so every interpolated value passes `encodePathSegment` by construction.
+ * - `queryString`: the one query encoding, which leaves unset values out.
+ *
+ * A server-issued id is checked for its shape first, by the one resource-id
+ * grammar (ids.js).
+ *
+ * Browser-safe and dependency-free: sdk-js bundles it, and sdk-mobile (which
+ * publishes standalone) carries a build-time copy pinned byte-for-byte by its
+ * drift test. Each SDK wraps it in a typed front door that throws its own
+ * validation error.
+ */
+/**
+ * Encode a value as exactly one request-path segment.
+ * @param {unknown} value
+ * @returns {string | null} the encoded segment, or null when the value cannot
+ *   be one segment: not a string, empty, '.', '..', or not well-formed UTF-16
+ *   (a lone surrogate has no percent-encoding).
+ */
+export function encodePathSegment(value) {
+    if (typeof value !== 'string' || value === '' || value === '.' || value === '..') {
+        return null;
+    }
+    try {
+        return encodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Join a tagged template's literals with its values, each value encoded as
+ * exactly one path segment.
+ * @param {readonly string[]} literals
+ * @param {readonly unknown[]} values
+ * @returns {string | null} the path, or null when any value cannot be one
+ *   segment (see `encodePathSegment`).
+ */
+export function buildRequestPath(literals, values) {
+    let path = literals[0];
+    for (let index = 0; index < values.length; index += 1) {
+        const segment = encodePathSegment(values[index]);
+        if (segment === null)
+            return null;
+        path += segment + literals[index + 1];
+    }
+    return path;
+}
+/**
+ * Encode query parameters, leaving out every unset value (`undefined`, `null`
+ * or `''`). Other values are sent as their string form, so `0` and `false`
+ * are sent.
+ * @param {Readonly<Record<string, string | number | boolean | null | undefined>> | undefined} params
+ * @returns {string} `?a=1&b=2`, or '' when no value is set.
+ */
+export function queryString(params) {
+    const search = new URLSearchParams();
+    for (const [key, value] of Object.entries(params ?? {})) {
+        if (value === undefined || value === null || value === '')
+            continue;
+        search.append(key, String(value));
+    }
+    const query = search.toString();
+    return query ? `?${query}` : '';
+}
+//# sourceMappingURL=request-path.js.map

package/dist/app-sdk/request-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-path.js","sourceRoot":"","sources":["../../src/app-sdk/request-path.js"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,wDAAwD;AACxD,8DAA8D;AAE9D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAK;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAQ,EAAE,MAAM;IAC/C,IAAI,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,IAAI,OAAO,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAAM;IAChC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,SAAS;QACpE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC"}