@tinycloud/sdk-core 3.0.0-beta.10 → 3.0.0-beta.12

package/dist/index.cjs

@@ -101,6 +101,7 @@ __export(index_exports, {
   ED25519_JCS_SIGNATURE_SUITE: () => ED25519_JCS_SIGNATURE_SUITE,
   EIP191_JCS_SIGNATURE_SUITE: () => EIP191_JCS_SIGNATURE_SUITE,
   EMAIL_CREDENTIAL_MAX_AGE_SECONDS: () => EMAIL_CREDENTIAL_MAX_AGE_SECONDS,
+  EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS: () => EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS,
   ENCRYPTION: () => import_bootstrap4.ENCRYPTION,
   ENCRYPTION_MANIFEST_SPACE: () => ENCRYPTION_MANIFEST_SPACE,
   ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_services8.ENCRYPTION_NETWORK_URN_PREFIX,
@@ -245,8 +246,10 @@ __export(index_exports, {
   buildPolicyCredentialPresentationV4: () => buildPolicyCredentialPresentationV4,
   buildSpaceUri: () => buildSpaceUri,
   canonicalDigest: () => canonicalDigest,
+  canonicalEmailDomain: () => canonicalEmailDomain,
   canonicalHashHex: () => import_sdk_services8.canonicalHashHex,
   canonicalLocationPayload: () => canonicalLocationPayload,
+  canonicalMailbox: () => canonicalMailbox,
   canonicalOwnerSharePolicy: () => canonicalOwnerSharePolicy,
   canonicalSignedResponse: () => import_sdk_services8.canonicalSignedResponse,
   canonicalizeAddress: () => canonicalizeAddress,
@@ -274,6 +277,7 @@ __export(index_exports, {
   createCapabilityKeyRegistry: () => createCapabilityKeyRegistry,
   createDelegatedShareKey: () => createDelegatedShareKey,
   createEmailCredentialRequirement: () => createEmailCredentialRequirement,
+  createEmailDomainCredentialRequirement: () => createEmailDomainCredentialRequirement,
   createHolderBinding: () => createHolderBinding,
   createInMemoryLocalNodeIdentityStore: () => createInMemoryLocalNodeIdentityStore,
   createLocalStorageLocalNodeIdentityStore: () => createLocalStorageLocalNodeIdentityStore,
@@ -346,6 +350,7 @@ __export(index_exports, {
   importPortableDelegation: () => importPortableDelegation,
   installTinyCloudDebugGlobals: () => import_sdk_services8.installTinyCloudDebugGlobals,
   intersectShareCapabilities: () => intersectShareCapabilities,
+  isCanonicalEmailDomain: () => isCanonicalEmailDomain,
   isCapabilitySubset: () => isCapabilitySubset,
   isDigest: () => isDigest,
   isEvmAddress: () => isEvmAddress,
@@ -356,6 +361,7 @@ __export(index_exports, {
   jcsCanonicalize: () => jcsCanonicalize,
   loadManifest: () => loadManifest,
   locationPayloadForRecord: () => locationPayloadForRecord,
+  mailboxBelongsToDomain: () => mailboxBelongsToDomain,
   makePkhSpaceId: () => makePkhSpaceId,
   makePublicSpaceId: () => makePublicSpaceId,
   manifestAbilitiesUnion: () => manifestAbilitiesUnion,
@@ -768,6 +774,7 @@ var CREDENTIAL_ERROR_CODES = [
   "ISSUER_UNREADY",
   "OFFLINE",
   "POPUP_BLOCKED",
+  "PROOF_REJECTED",
   "REQUEST_EXPIRED",
   "REQUEST_SUBSTITUTED",
   "SIGNATURE_REJECTED",
@@ -781,6 +788,7 @@ var RECOVERABLE = /* @__PURE__ */ new Set([
   "ISSUER_UNREADY",
   "OFFLINE",
   "POPUP_BLOCKED",
+  "PROOF_REJECTED",
   "REQUEST_EXPIRED",
   "SIGNATURE_REJECTED",
   "UNSUPPORTED_PROFILE",
@@ -849,6 +857,7 @@ function holderBindingSigningBytes(binding) {
 
 // src/credentials/descriptor.ts
 var ID = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
+var CLAIM_NAME = /^[a-z0-9][A-Za-z0-9._-]{0,127}$/;
 var STEP_TYPES = /* @__PURE__ */ new Set(["collect_input", "mailbox_otp", "holder_signature"]);
 var ENDPOINTS = {
   request: "request",
@@ -929,7 +938,7 @@ function validateCredentialFlowDescriptor(value) {
   for (const value2 of raw.claims) {
     const claim = object(value2, "claim");
     exact(claim, ["name", "matching", "selectiveDisclosure"], "claim");
-    const name2 = text(claim.name, "claim.name", ID);
+    const name2 = text(claim.name, "claim.name", CLAIM_NAME);
     if (claimNames.has(name2) || claim.matching !== "normalized_exact" || typeof claim.selectiveDisclosure !== "boolean") fail("claim is invalid");
     claimNames.add(name2);
   }
@@ -1020,9 +1029,36 @@ function isDigest(value) {
   return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
 }
 
+// src/credentials/email-domain.ts
+var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function isCanonicalEmailDomain(value) {
+  if (value.length === 0 || value.length > 253) return false;
+  const labels = value.split(".");
+  return labels.length >= 2 && labels.every((label) => LABEL.test(label)) && !/^[0-9]+$/.test(labels.at(-1));
+}
+function canonicalEmailDomain(value) {
+  const domain = value.trim().replace(/^@/, "").toLowerCase();
+  if (!/^[\x21-\x7e]+$/.test(domain) || !isCanonicalEmailDomain(domain)) throw new TypeError("email domain must be lowercase ASCII DNS labels (use the xn-- form for international domains)");
+  return domain;
+}
+function canonicalMailbox(value) {
+  const email = value.trim().toLowerCase();
+  const at = email.indexOf("@");
+  if (at <= 0 || at !== email.lastIndexOf("@")) return void 0;
+  const local = email.slice(0, at);
+  const domain = email.slice(at + 1);
+  if (local.length > 64 || !/^[a-z0-9#$&'*+/=?^_`{|}~-]+(?:\.[a-z0-9#$&'*+/=?^_`{|}~-]+)*$/.test(local) || !isCanonicalEmailDomain(domain)) return void 0;
+  return Object.freeze({ email, domain });
+}
+function mailboxBelongsToDomain(mailbox, domain) {
+  return canonicalMailbox(mailbox)?.domain === domain && isCanonicalEmailDomain(domain);
+}
+
 // src/credentials/requirement.ts
 var ID2 = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
 var EMAIL_CREDENTIAL_MAX_AGE_SECONDS = 3600;
+var EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS = 300;
+var CLAIM_NAME2 = /^[a-z0-9][A-Za-z0-9._-]{0,127}$/;
 function createEmailCredentialRequirement(input) {
   return validateCredentialRequirement({
     type: "TinyCloudCredentialRequirement",
@@ -1033,6 +1069,17 @@ function createEmailCredentialRequirement(input) {
     maxAgeSeconds: EMAIL_CREDENTIAL_MAX_AGE_SECONDS
   });
 }
+function createEmailDomainCredentialRequirement(input) {
+  if (!isCanonicalEmailDomain(input.domain)) throw new CredentialError("UNSUPPORTED_PROFILE", "Email domain is not canonical");
+  return validateCredentialRequirement({
+    type: "TinyCloudCredentialRequirement",
+    version: 1,
+    profile: input.profile,
+    credentialType: input.credentialType,
+    claims: { emailDomain: input.domain },
+    maxAgeSeconds: EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS
+  });
+}
 function validateCredentialRequirement(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential requirement is invalid");
   const raw = value;
@@ -1046,7 +1093,7 @@ function validateCredentialRequirement(value) {
   if (typeof raw.claims !== "object" || raw.claims === null || Array.isArray(raw.claims)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claims are invalid");
   const claims = {};
   for (const [key, value2] of Object.entries(raw.claims).sort(([a], [b]) => a.localeCompare(b))) {
-    if (!ID2.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
+    if (!CLAIM_NAME2.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
     claims[key] = value2;
   }
   if (raw.maxAgeSeconds !== void 0 && (!Number.isSafeInteger(raw.maxAgeSeconds) || raw.maxAgeSeconds < 1)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential freshness is invalid");