@tinycloud/node-sdk 2.9.0 → 2.10.0-beta.1

package/dist/{core-C4dXaqwM.d.cts → core-B_i2KfID.d.cts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -1513,6 +1513,30 @@ declare class TinyCloudNode {
      * @internal
      */
     createOwnerDelegation(params: CreateOwnerDelegationParams, assertActive?: () => void): Promise<OwnerDelegationReceipt>;
+    /** Register a policy that is already bound to an activated owner delegation. */
+    registerOwnerSharePolicy(params: RegisterOwnerSharePolicyParams): Promise<OwnerSharePolicyRegistrationReceipt>;
+    /** Authorize a short-lived, one-use v2 delivery using the authenticated invocation chain. */
+    authorizeShareDelivery(input: {
+        readonly envelopeCid: string;
+        readonly shareCid: string;
+        readonly shareId: string;
+        readonly registrationCid: string;
+        readonly policyCid: string;
+        readonly delegationCid: string;
+        readonly enforcementDelegationCid: string;
+        readonly resourcePath: string;
+        readonly recipientEmail: string;
+        readonly shareUrl: string;
+        readonly documentName: string;
+        readonly expiresAt: string;
+        /** The enrolled receipt key from the node trust bundle. */
+        readonly nodeProof: {
+            readonly kid: string;
+            readonly publicKey: Uint8Array;
+        };
+        /** The trusted OpenCredentials witness origin from the same trust bundle as `nodeProof`. */
+        readonly credentialsAudience: string;
+    }): Promise<ShareDeliveryAuthorizationReceipt>;
     private createRootDelegationForSharing;
     /**
      * Track a received delegation in the capability registry.

package/dist/{core-C4dXaqwM.d.ts → core-B_i2KfID.d.ts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -1513,6 +1513,30 @@ declare class TinyCloudNode {
      * @internal
      */
     createOwnerDelegation(params: CreateOwnerDelegationParams, assertActive?: () => void): Promise<OwnerDelegationReceipt>;
+    /** Register a policy that is already bound to an activated owner delegation. */
+    registerOwnerSharePolicy(params: RegisterOwnerSharePolicyParams): Promise<OwnerSharePolicyRegistrationReceipt>;
+    /** Authorize a short-lived, one-use v2 delivery using the authenticated invocation chain. */
+    authorizeShareDelivery(input: {
+        readonly envelopeCid: string;
+        readonly shareCid: string;
+        readonly shareId: string;
+        readonly registrationCid: string;
+        readonly policyCid: string;
+        readonly delegationCid: string;
+        readonly enforcementDelegationCid: string;
+        readonly resourcePath: string;
+        readonly recipientEmail: string;
+        readonly shareUrl: string;
+        readonly documentName: string;
+        readonly expiresAt: string;
+        /** The enrolled receipt key from the node trust bundle. */
+        readonly nodeProof: {
+            readonly kid: string;
+            readonly publicKey: Uint8Array;
+        };
+        /** The trusted OpenCredentials witness origin from the same trust bundle as `nodeProof`. */
+        readonly credentialsAudience: string;
+    }): Promise<ShareDeliveryAuthorizationReceipt>;
     private createRootDelegationForSharing;
     /**
      * Track a received delegation in the capability registry.

package/dist/core.cjs

@@ -1730,8 +1730,8 @@ function decodeAuthorizationBytes(authorization) {
   if (unpadded === void 0 || remainder === 1 || paddingLength !== 0 && paddingLength !== expectedPaddingLength) {
     throw new Error("Delegation Authorization is not canonical base64url DAG-CBOR");
   }
-  const decoded = Uint8Array.from(Buffer.from(unpadded, "base64url"));
-  if (Buffer.from(decoded).toString("base64url") !== unpadded) {
+  const decoded = base64UrlDecode(unpadded);
+  if (base64UrlEncode(decoded) !== unpadded) {
     throw new Error("Delegation Authorization is not canonical base64url DAG-CBOR");
   }
   return decoded;
@@ -3887,7 +3887,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const did = binding?.did ?? this.did;
     const address = binding?.address ?? this._address;
     const chainId = binding?.chainId ?? this._chainId;
-    const crypto = this.createEncryptionCrypto();
+    const crypto2 = this.createEncryptionCrypto();
+    const descriptorCache = /* @__PURE__ */ new Map();
     const transport = {
       postDecrypt: async ({ networkId, authorization, canonicalBody, signal }) => {
         graph.assertActive();
@@ -3921,7 +3922,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     };
     return new import_sdk_core8.EncryptionService({
-      crypto,
+      crypto: crypto2,
       signer: {
         signDecryptInvocation: async (input) => {
           graph.assertActive();
@@ -3944,7 +3945,18 @@ var _TinyCloudNode = class _TinyCloudNode {
       node: {
         fetchByNetworkId: async (networkId) => {
           graph.assertActive();
-          const descriptor = await this.fetchEncryptionNetworkAt(host, networkId, graph.fetch);
+          let pending = descriptorCache.get(networkId);
+          if (!pending) {
+            pending = this.fetchEncryptionNetworkAt(host, networkId, graph.fetch).then((descriptor2) => {
+              if (descriptor2 === null) descriptorCache.delete(networkId);
+              return descriptor2;
+            }).catch((error) => {
+              descriptorCache.delete(networkId);
+              throw error;
+            });
+            descriptorCache.set(networkId, pending);
+          }
+          const descriptor = await pending;
           graph.assertActive();
           return descriptor;
         }
@@ -4319,6 +4331,63 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     };
   }
+  /** Register a policy that is already bound to an activated owner delegation. */
+  async registerOwnerSharePolicy(params) {
+    this._serviceGraph.assertActive();
+    if (params.policy.bytes.byteLength > 2 * 1024 * 1024) throw new Error("Owner share policy is too large");
+    const response = await fetch(`${this.config.host}/share/v2/policies`, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        policy: { bytes: base64UrlEncode(params.policy.bytes), cid: params.policy.cid, proof: params.policy.proof },
+        ownerDelegation: { cid: params.ownerDelegation.delegationCid, dagCbor: base64UrlEncode(params.ownerDelegation.signedDagCbor) },
+        enforcementDelegation: params.enforcementDelegation,
+        contentSourceDigest: params.contentSourceDigest
+      })
+    });
+    if (!response.ok) {
+      let code = "";
+      try {
+        const body = await response.clone().json();
+        if (typeof body.error?.code === "string") code = ` ${body.error.code}`;
+      } catch {
+      }
+      throw new Error(`Owner share policy registration failed: ${response.status}${code}`);
+    }
+    const responseBytes = new Uint8Array(await response.arrayBuffer());
+    return (0, import_sdk_core8.validateOwnerSharePolicyRegistrationBytes)(responseBytes, params);
+  }
+  /** Authorize a short-lived, one-use v2 delivery using the authenticated invocation chain. */
+  async authorizeShareDelivery(input) {
+    const session = this.currentTinyCloudSession();
+    const serviceSession = this._serviceContext?.session;
+    if (!session || !serviceSession) throw new Error("Share delivery requires an authenticated session");
+    const body = {
+      envelopeCid: input.envelopeCid,
+      shareCid: input.shareCid,
+      shareId: input.shareId,
+      registrationCid: input.registrationCid,
+      policyCid: input.policyCid,
+      delegationCid: input.delegationCid,
+      enforcementDelegationCid: input.enforcementDelegationCid,
+      recipientEmail: input.recipientEmail,
+      shareUrl: input.shareUrl,
+      documentName: input.documentName,
+      jti: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
+      expiresAt: input.expiresAt
+    };
+    const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, import_sdk_core8.canonicalizeEncryptionJson)(body)))));
+    const request = { ...body, requestBodyDigest };
+    const authorization = authorizationHeader(this.invokeAnyWithRuntimePermissions(serviceSession, [{ spaceId: session.spaceId, service: "kv", path: input.resourcePath, action: "tinycloud.kv/get" }]));
+    const response = await fetch(`${this.config.host}/share/v2/deliveries/authorize`, {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/json", authorization },
+      body: (0, import_sdk_core8.canonicalizeEncryptionJson)(request)
+    });
+    if (!response.ok) throw new Error(`Share delivery authorization failed: ${response.status}`);
+    const responseBytes = new Uint8Array(await response.arrayBuffer());
+    return (0, import_sdk_core8.validateShareDeliveryAuthorizationBytes)(responseBytes, { request, nodeProof: input.nodeProof, credentialsAudience: input.credentialsAudience });
+  }
   async createRootDelegationForSharing(params, assertActive) {
     try {
       return (await this.createOwnerDelegation({
@@ -4487,13 +4556,13 @@ var _TinyCloudNode = class _TinyCloudNode {
       ownerDid,
       threshold: { n: 1, t: 1 }
     };
-    const crypto = this.createEncryptionCrypto();
+    const crypto2 = this.createEncryptionCrypto();
     const facts = {
       type: NETWORK_ADMIN_TYPE,
       targetNode,
       networkId,
       bodyHash: (0, import_sdk_core8.canonicalHashHex)(
-        crypto.sha256,
+        crypto2.sha256,
         body
       ),
       action: NETWORK_CREATE_ACTION2