@tinycloud/node-sdk 3.0.0-beta.6 → 3.0.0-beta.8

package/dist/index.cjs

@@ -17157,6 +17157,7 @@ __export(index_exports, {
   parseExpiry: () => import_sdk_core12.parseExpiry,
   parseNetworkId: () => import_sdk_core17.parseNetworkId,
   parsePkhDid: () => import_sdk_core11.parsePkhDid,
+  parseSecretCatalogKey: () => import_sdk_core16.parseSecretCatalogKey,
   parseSpaceUri: () => import_sdk_core21.parseSpaceUri,
   pkhDid: () => import_sdk_core11.pkhDid,
   principalDid: () => import_sdk_core11.principalDid,
@@ -19108,6 +19109,11 @@ var NodeSecretsService = class {
     if (!permission.ok) return permission;
     return options === void 0 ? this.service.list() : this.service.list(options);
   }
+  async listAll() {
+    const permission = await this.ensurePermission("", void 0, "list");
+    if (!permission.ok) return permission;
+    return this.service.listAll();
+  }
   get service() {
     return this.config.getService();
   }
@@ -19169,7 +19175,11 @@ var NodeSecretsService = class {
       (entry) => manifests.some((candidate) => {
         const resolved = (0, import_sdk_core6.resolveManifest)(candidate);
         return resolved.resources.some(
-          (resource) => resource.service === entry.service && spaceMatches(resource.space, entry.space, this.config.resolveSpace) && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
+          (resource) => resource.service === entry.service && spaceMatches(
+            resource.space,
+            entry.space,
+            this.config.resolveSpace
+          ) && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
         );
       })
     );
@@ -22211,63 +22221,19 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     };
   }
-  /** Register a policy that is already bound to an activated owner delegation. */
-  async registerOwnerSharePolicy(params) {
+  /** Register a signed policy and sibling roots with this Node's Policy/v3 runtime. */
+  async registerPolicy(params) {
     this._serviceGraph.assertActive();
-    if (params.policy.bytes.byteLength > 2 * 1024 * 1024) throw new Error("Owner share policy is too large");
-    const response = await fetch(`${this.config.host}/share/v2/policies`, {
-      method: "POST",
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({
-        policy: { bytes: base64UrlEncode(params.policy.bytes), cid: params.policy.cid, proof: params.policy.proof },
-        ownerDelegation: { cid: params.ownerDelegation.delegationCid, dagCbor: base64UrlEncode(params.ownerDelegation.signedDagCbor) },
-        enforcementDelegation: params.enforcementDelegation,
-        contentSourceDigest: params.contentSourceDigest
-      })
+    return (0, import_sdk_core7.registerPolicyV3)({
+      ...params,
+      nodeOrigin: this.config.host,
+      fetch: globalThis.fetch.bind(globalThis)
     });
-    if (!response.ok) {
-      let code = "";
-      try {
-        const body = await response.clone().json();
-        if (typeof body.error?.code === "string") code = ` ${body.error.code}`;
-      } catch {
-      }
-      throw new Error(`Owner share policy registration failed: ${response.status}${code}`);
-    }
-    const responseBytes = new Uint8Array(await response.arrayBuffer());
-    return (0, import_sdk_core7.validateOwnerSharePolicyRegistrationBytes)(responseBytes, params);
   }
-  /** Authorize a short-lived, one-use v2 delivery using the authenticated invocation chain. */
+  /** @deprecated Policy/v2 delivery transport is retired. Use authorizeShareDeliveryV3. */
   async authorizeShareDelivery(input) {
-    const session = this.currentTinyCloudSession();
-    const serviceSession = this._serviceContext?.session;
-    if (!session || !serviceSession) throw new Error("Share delivery requires an authenticated session");
-    const body = {
-      envelopeCid: input.envelopeCid,
-      shareCid: input.shareCid,
-      shareId: input.shareId,
-      registrationCid: input.registrationCid,
-      policyCid: input.policyCid,
-      delegationCid: input.delegationCid,
-      enforcementDelegationCid: input.enforcementDelegationCid,
-      recipientEmail: input.recipientEmail,
-      shareUrl: input.shareUrl,
-      documentName: input.documentName,
-      jti: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
-      idempotencyKey: input.idempotencyKey,
-      expiresAt: input.expiresAt
-    };
-    const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, import_sdk_core7.canonicalizeEncryptionJson)(body)))));
-    const request = { ...body, requestBodyDigest };
-    const authorization = authorizationHeader(this.invokeAnyWithRuntimePermissions(serviceSession, [{ spaceId: session.spaceId, service: "kv", path: input.resourcePath, action: "tinycloud.kv/get" }]));
-    const response = await fetch(`${this.config.host}/share/v2/deliveries/authorize`, {
-      method: "POST",
-      headers: { accept: "application/json", "content-type": "application/json", authorization },
-      body: (0, import_sdk_core7.canonicalizeEncryptionJson)(request)
-    });
-    if (!response.ok) throw new Error(`Share delivery authorization failed: ${response.status}`);
-    const responseBytes = new Uint8Array(await response.arrayBuffer());
-    return (0, import_sdk_core7.validateShareDeliveryAuthorizationBytes)(responseBytes, { request, nodeProof: input.nodeProof, credentialsAudience: input.credentialsAudience });
+    void input;
+    throw new Error("Policy/v2 share delivery is retired; use authorizeShareDeliveryV3");
   }
   /** Authorize one short-lived v3 delivery against the signed v3 envelope and registered roots. */
   async authorizeShareDeliveryV3(input) {
@@ -22283,22 +22249,35 @@ var _TinyCloudNode = class _TinyCloudNode {
       shareUrl: input.shareUrl,
       documentName: input.documentName,
       jti: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
-      expiresAt: input.expiresAt
+      expiresAt: new Date(input.expiresAt).toISOString().replace(/\.\d{3}Z$/, "Z")
     };
     const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, import_sdk_core7.canonicalizeEncryptionJson)(body)))));
     const request = { ...body, requestBodyDigest };
     const authorization = authorizationHeader(this.invokeAnyWithRuntimePermissions(serviceSession, [{ spaceId: session.spaceId, service: "kv", path: input.resourcePath, action: "tinycloud.kv/get" }]));
-    const response = await fetch(`${this.config.host}/share/v3/deliveries/authorize`, {
+    const response = await fetch(`${this.config.host}/policy/v3/deliveries/authorize`, {
       method: "POST",
       headers: { accept: "application/json", "content-type": "application/json", authorization },
       body: (0, import_sdk_core7.canonicalizeEncryptionJson)(request)
     });
     if (!response.ok) throw new Error(`V3 share delivery authorization failed: ${response.status}`);
-    return (0, import_sdk_core7.validateShareDeliveryAuthorizationV3Bytes)(new Uint8Array(await response.arrayBuffer()), {
+    const verified = (0, import_sdk_core7.validateShareDeliveryAuthorizationV3Bytes)(new Uint8Array(await response.arrayBuffer()), {
       request,
-      nodeProof: input.nodeProof,
+      senderKeyDid: this.credentialHolderDid,
       credentialsAudience: input.credentialsAudience
     });
+    void input.nodeProof;
+    const requestDigest = new Uint8Array(await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(`${import_sdk_core7.CREDENTIAL_INVITATION_REQUEST_DOMAIN}${(0, import_sdk_core7.canonicalizeEncryptionJson)(verified.request)}`)
+    ));
+    return {
+      ...verified,
+      proof: {
+        alg: "EdDSA",
+        kid: this.credentialHolderDid,
+        signature: base64UrlEncode(await this.signSessionBytes(requestDigest))
+      }
+    };
   }
   async createRootDelegationForSharing(params, assertActive) {
     try {
@@ -25097,6 +25076,7 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   parseExpiry,
   parseNetworkId,
   parsePkhDid,
+  parseSecretCatalogKey,
   parseSpaceUri,
   pkhDid,
   principalDid,