@tinycloud/cli 1.0.0-beta.21 → 1.0.0-beta.23

package/dist/index.js

@@ -5590,6 +5590,23 @@ var init_zod = __esm({
   }
 });
 
+// src/lib/raw-encryption.ts
+var init_raw_encryption = __esm({
+  "src/lib/raw-encryption.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/owner-did.ts
+import { ensureEip55 } from "@tinycloud/node-sdk-wasm";
+var init_owner_did = __esm({
+  "src/lib/owner-did.ts"() {
+    "use strict";
+    init_constants();
+    init_errors();
+  }
+});
+
 // src/share/publishing-manifest.ts
 var init_publishing_manifest = __esm({
   "src/share/publishing-manifest.ts"() {
@@ -5641,6 +5658,8 @@ var init_permissions = __esm({
     init_errors();
     init_constants();
     init_space();
+    init_raw_encryption();
+    init_owner_did();
     init_publishing_manifest();
     init_types();
   }
@@ -14003,6 +14022,7 @@ function targetMatcher(target) {
 function targetKind(target) {
   return target.kind;
 }
+var OWNER_SHARE_ACTIONS = /* @__PURE__ */ new Set(["tinycloud.kv/get", "tinycloud.kv/list", "tinycloud.kv/metadata", "tinycloud.kv/put"]);
 function assertSafeInput(input) {
   if (!/^[A-Za-z0-9_-]{16,128}$/.test(input.shareId)) throw new TypeError("addressed share id is invalid");
   if (!Number.isSafeInteger(input.byteLength) || input.byteLength < 0 || input.byteLength > SHARE_CONTENT_LIMIT) throw new TypeError("addressed content length is invalid");
@@ -14126,12 +14146,12 @@ function prepareAddressedShare(request) {
     throw new TypeError("addressed filename is invalid");
   }
   if (request.actions.length === 0 || request.policyActions.length === 0) throw new TypeError("addressed share actions are empty");
+  if (request.policyActions.some((action) => !OWNER_SHARE_ACTIONS.has(action))) throw new TypeError("addressed share action is not supported");
   const target = normalizeShareTarget(request.target);
   if (target.kind === "bearer") throw new TypeError("addressed target is required");
   if (target.kind === "recipientDid") return { target };
-  if (target.kind === "emailDomain") {
-    if (!request.actions.every((action) => action === "read" || action === "list") || !request.policyActions.every((action) => action === "tinycloud.kv/get" || action === "tinycloud.kv/list" || action === "tinycloud.kv/metadata")) throw new TypeError("email-domain shares are view-only");
-    if (request.deliveryEmail !== void 0) throw new TypeError("email-domain shares are not emailed");
+  if (target.kind === "emailDomain" && request.deliveryEmail !== void 0 && (request.deliveryEmail !== request.deliveryEmail.toLowerCase() || !request.deliveryEmail.endsWith(`@${target.domain}`))) {
+    throw new TypeError("email-domain delivery address must be a lowercase mailbox at the domain");
   }
   return { target, credentialRequirement: mailboxCredentialCommitment(target) };
 }