@tinycloud/node-sdk 2.9.0 → 2.10.0-beta.1

package/dist/index.cjs

@@ -14963,10 +14963,10 @@ function randomBytes(length) {
     logger21.throwArgumentError("invalid length", "length", length);
   }
   const result = new Uint8Array(length);
-  crypto.getRandomValues(result);
+  crypto2.getRandomValues(result);
   return arrayify(result);
 }
-var logger21, anyGlobal, crypto;
+var logger21, anyGlobal, crypto2;
 var init_random = __esm({
   "../../node_modules/@ethersproject/random/lib.esm/random.js"() {
     "use strict";
@@ -14975,10 +14975,10 @@ var init_random = __esm({
     init_version16();
     logger21 = new Logger(version16);
     anyGlobal = getGlobal();
-    crypto = anyGlobal.crypto || anyGlobal.msCrypto;
-    if (!crypto || !crypto.getRandomValues) {
+    crypto2 = anyGlobal.crypto || anyGlobal.msCrypto;
+    if (!crypto2 || !crypto2.getRandomValues) {
       logger21.warn("WARNING: Missing strong random number source");
-      crypto = {
+      crypto2 = {
         getRandomValues: function(buffer) {
           return logger21.throwError("no secure random source avaialble", Logger.errors.UNSUPPORTED_OPERATION, {
             operation: "crypto.getRandomValues"
@@ -18753,8 +18753,8 @@ function decodeAuthorizationBytes(authorization) {
   if (unpadded === void 0 || remainder === 1 || paddingLength !== 0 && paddingLength !== expectedPaddingLength) {
     throw new Error("Delegation Authorization is not canonical base64url DAG-CBOR");
   }
-  const decoded = Uint8Array.from(Buffer.from(unpadded, "base64url"));
-  if (Buffer.from(decoded).toString("base64url") !== unpadded) {
+  const decoded = base64UrlDecode(unpadded);
+  if (base64UrlEncode(decoded) !== unpadded) {
     throw new Error("Delegation Authorization is not canonical base64url DAG-CBOR");
   }
   return decoded;
@@ -20910,7 +20910,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const did = binding?.did ?? this.did;
     const address = binding?.address ?? this._address;
     const chainId = binding?.chainId ?? this._chainId;
-    const crypto2 = this.createEncryptionCrypto();
+    const crypto3 = this.createEncryptionCrypto();
+    const descriptorCache = /* @__PURE__ */ new Map();
     const transport = {
       postDecrypt: async ({ networkId, authorization, canonicalBody, signal }) => {
         graph.assertActive();
@@ -20944,7 +20945,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     };
     return new import_sdk_core7.EncryptionService({
-      crypto: crypto2,
+      crypto: crypto3,
       signer: {
         signDecryptInvocation: async (input) => {
           graph.assertActive();
@@ -20967,7 +20968,18 @@ var _TinyCloudNode = class _TinyCloudNode {
       node: {
         fetchByNetworkId: async (networkId) => {
           graph.assertActive();
-          const descriptor = await this.fetchEncryptionNetworkAt(host, networkId, graph.fetch);
+          let pending = descriptorCache.get(networkId);
+          if (!pending) {
+            pending = this.fetchEncryptionNetworkAt(host, networkId, graph.fetch).then((descriptor2) => {
+              if (descriptor2 === null) descriptorCache.delete(networkId);
+              return descriptor2;
+            }).catch((error) => {
+              descriptorCache.delete(networkId);
+              throw error;
+            });
+            descriptorCache.set(networkId, pending);
+          }
+          const descriptor = await pending;
           graph.assertActive();
           return descriptor;
         }
@@ -21342,6 +21354,63 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     };
   }
+  /** Register a policy that is already bound to an activated owner delegation. */
+  async registerOwnerSharePolicy(params) {
+    this._serviceGraph.assertActive();
+    if (params.policy.bytes.byteLength > 2 * 1024 * 1024) throw new Error("Owner share policy is too large");
+    const response = await fetch(`${this.config.host}/share/v2/policies`, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        policy: { bytes: base64UrlEncode(params.policy.bytes), cid: params.policy.cid, proof: params.policy.proof },
+        ownerDelegation: { cid: params.ownerDelegation.delegationCid, dagCbor: base64UrlEncode(params.ownerDelegation.signedDagCbor) },
+        enforcementDelegation: params.enforcementDelegation,
+        contentSourceDigest: params.contentSourceDigest
+      })
+    });
+    if (!response.ok) {
+      let code = "";
+      try {
+        const body = await response.clone().json();
+        if (typeof body.error?.code === "string") code = ` ${body.error.code}`;
+      } catch {
+      }
+      throw new Error(`Owner share policy registration failed: ${response.status}${code}`);
+    }
+    const responseBytes = new Uint8Array(await response.arrayBuffer());
+    return (0, import_sdk_core7.validateOwnerSharePolicyRegistrationBytes)(responseBytes, params);
+  }
+  /** Authorize a short-lived, one-use v2 delivery using the authenticated invocation chain. */
+  async authorizeShareDelivery(input) {
+    const session = this.currentTinyCloudSession();
+    const serviceSession = this._serviceContext?.session;
+    if (!session || !serviceSession) throw new Error("Share delivery requires an authenticated session");
+    const body = {
+      envelopeCid: input.envelopeCid,
+      shareCid: input.shareCid,
+      shareId: input.shareId,
+      registrationCid: input.registrationCid,
+      policyCid: input.policyCid,
+      delegationCid: input.delegationCid,
+      enforcementDelegationCid: input.enforcementDelegationCid,
+      recipientEmail: input.recipientEmail,
+      shareUrl: input.shareUrl,
+      documentName: input.documentName,
+      jti: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
+      expiresAt: input.expiresAt
+    };
+    const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, import_sdk_core7.canonicalizeEncryptionJson)(body)))));
+    const request = { ...body, requestBodyDigest };
+    const authorization = authorizationHeader(this.invokeAnyWithRuntimePermissions(serviceSession, [{ spaceId: session.spaceId, service: "kv", path: input.resourcePath, action: "tinycloud.kv/get" }]));
+    const response = await fetch(`${this.config.host}/share/v2/deliveries/authorize`, {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/json", authorization },
+      body: (0, import_sdk_core7.canonicalizeEncryptionJson)(request)
+    });
+    if (!response.ok) throw new Error(`Share delivery authorization failed: ${response.status}`);
+    const responseBytes = new Uint8Array(await response.arrayBuffer());
+    return (0, import_sdk_core7.validateShareDeliveryAuthorizationBytes)(responseBytes, { request, nodeProof: input.nodeProof, credentialsAudience: input.credentialsAudience });
+  }
   async createRootDelegationForSharing(params, assertActive) {
     try {
       return (await this.createOwnerDelegation({
@@ -21510,13 +21579,13 @@ var _TinyCloudNode = class _TinyCloudNode {
       ownerDid,
       threshold: { n: 1, t: 1 }
     };
-    const crypto2 = this.createEncryptionCrypto();
+    const crypto3 = this.createEncryptionCrypto();
     const facts = {
       type: NETWORK_ADMIN_TYPE,
       targetNode,
       networkId,
       bodyHash: (0, import_sdk_core7.canonicalHashHex)(
-        crypto2.sha256,
+        crypto3.sha256,
         body
       ),
       action: NETWORK_CREATE_ACTION2