@tinycloud/sdk-core 3.0.0-beta.7 → 3.0.0-beta.9

package/dist/delegations/index.cjs

@@ -47,7 +47,6 @@ __export(delegations_exports, {
   MemorySenderShareRecordStorage: () => MemorySenderShareRecordStorage,
   MemoryShareCache: () => MemoryShareCache,
   ReceiveOptionsSchema: () => ReceiveOptionsSchema,
-  SHARE_DELIVERY_AUTHORIZATION_DOMAIN: () => SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
   SenderShareStore: () => SenderShareStore,
   ShareAccessError: () => ShareAccessError,
   ShareActionSchema: () => ShareActionSchema,
@@ -87,10 +86,8 @@ __export(delegations_exports, {
   importPortableDelegation: () => importPortableDelegation,
   inspectShare: () => import_share_sdk2.inspectShare,
   intersectShareCapabilities: () => intersectShareCapabilities,
-  isLegacyShareLink: () => import_share_sdk.isLegacyShareLink,
   isV2ShareLink: () => isV2ShareLink,
   listShares: () => import_share_sdk.listShares,
-  migrateShare: () => import_share_sdk.migrateShare,
   normalizeShareActions: () => normalizeShareActions,
   normalizeShareRecipientTarget: () => normalizeShareRecipientTarget,
   normalizeShareResource: () => normalizeShareResource,
@@ -100,14 +97,12 @@ __export(delegations_exports, {
   parseShareUrl: () => parseShareUrl,
   publishPolicyShare: () => import_share_sdk.publishPolicyShare,
   publishTargetShare: () => import_share_sdk.publishTargetShare,
-  receiveLegacyShare: () => import_share_sdk.receiveLegacyShare,
   receiveShare: () => import_share_sdk2.receiveShare,
   restoreDelegatedShareKey: () => restoreDelegatedShareKey,
   resumeShareAuthorization: () => import_share_sdk.resumeShareAuthorization,
   revokeShare: () => import_share_sdk.revokeShare,
   serializePortableDelegation: () => serializePortableDelegation,
   shareCapabilityAllows: () => shareCapabilityAllows,
-  shareDeliveryTrustedKid: () => shareDeliveryTrustedKid,
   showShare: () => import_share_sdk.showShare,
   signShareEnvelope: () => signShareEnvelope,
   toShareErrorInfo: () => import_share_sdk2.toShareErrorInfo,
@@ -115,10 +110,8 @@ __export(delegations_exports, {
   validateOwnerSharePolicyRegistration: () => validateOwnerSharePolicyRegistration,
   validateOwnerSharePolicyRegistrationBytes: () => validateOwnerSharePolicyRegistrationBytes,
   validateReceiveOptions: () => validateReceiveOptions,
-  validateShareDeliveryAuthorizationBytes: () => validateShareDeliveryAuthorizationBytes,
   validateShareDeliveryAuthorizationV3Bytes: () => validateShareDeliveryAuthorizationV3Bytes,
   validateSharingServiceConfig: () => validateSharingServiceConfig,
-  verifyBearerEnvelope: () => import_share_sdk2.verifyBearerEnvelope,
   verifyShareCid: () => verifyShareCid,
   verifyShareEnvelope: () => verifyShareEnvelope
 });
@@ -3401,25 +3394,33 @@ function parsePublishedShareLink(link, options = {}) {
   }
   const origin = normalizeOrigin(url.origin);
   if (options.trustedOrigins !== void 0 && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
-  if (url.search !== "" || url.username !== "" || url.password !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
-  if (url.pathname === "/s/inline" && url.hash.startsWith("#v=2&p=")) {
+  if (url.username !== "" || url.password !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
+  if (url.pathname === "/viewer") {
+    const secretPayload = url.search === "" && url.hash.startsWith("#tc2=") ? url.hash.slice("#tc2=".length) : void 0;
+    const publicPayload = url.hash === "" && url.searchParams.size === 1 ? url.searchParams.get("tc2") ?? void 0 : void 0;
+    if (secretPayload === void 0 && publicPayload === void 0) throw new ShareEnvelopeError("invalid-link", "published share link is invalid");
+    if (publicPayload !== void 0 && url.search !== `?tc2=${publicPayload}`) throw new ShareEnvelopeError("invalid-link", "published share link is not canonical");
     let payload;
     try {
-      const bytes2 = base64UrlToBytes(url.hash.slice("#v=2&p=".length));
+      const bytes2 = base64UrlToBytes(secretPayload ?? publicPayload);
       if (bytes2.length > (options.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES) * 2) throw new Error("inline payload too large");
-      const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
+      const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
+      const value = JSON.parse(text);
       if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("inline payload shape");
+      if (canonicalJson(value) !== text) throw new Error("inline payload is not canonical JSON");
       payload = value;
     } catch (error) {
       throw new ShareEnvelopeError("invalid-link", error instanceof Error ? error.message : "invalid inline payload");
     }
-    if (payload.v !== 2 || typeof payload.c !== "string" || typeof payload.cid !== "string" || payload.k !== void 0 && typeof payload.k !== "string" || Object.keys(payload).some((key3) => !["v", "c", "cid", "k"].includes(key3))) throw new ShareEnvelopeError("invalid-link", "inline payload fields are invalid");
+    const payloadKeys = Object.keys(payload);
+    if (payload.v !== 2 || typeof payload.c !== "string" || typeof payload.cid !== "string" || payload.k !== void 0 && typeof payload.k !== "string" || payloadKeys.some((key3) => !["v", "c", "cid", "k"].includes(key3)) || publicPayload !== void 0 && (payloadKeys.length !== 3 || payload.k !== void 0)) throw new ShareEnvelopeError("invalid-link", "inline payload fields are invalid");
     const sealed = base64UrlToBytes(payload.c);
     if (!verifyPublishedShareCid(payload.cid, sealed)) throw new ShareEnvelopeError("cid-mismatch", "inline payload CID does not match");
     const key2 = payload.k === void 0 ? void 0 : base64UrlToBytes(payload.k);
     if (key2 !== void 0 && key2.length !== 32) throw new ShareEnvelopeError("invalid-link", "inline payload key is invalid");
     return { origin, cid: payload.cid, ...key2 === void 0 ? {} : { key: key2 }, sealed };
   }
+  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
   const match = /^\/s\/([a-z2-7]+)$/.exec(url.pathname);
   if (match === null || !url.hash.startsWith("#k=")) throw new ShareEnvelopeError("invalid-link", "published share link is invalid");
   const key = base64UrlToBytes(url.hash.slice(3));
@@ -3439,13 +3440,13 @@ function parseShareUrl(link, options = {}) {
   } catch {
     throw new ShareEnvelopeError("invalid-link", "share link must be an absolute URL");
   }
-  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share links must not contain query parameters");
   const origin = normalizeOrigin(url.origin);
   if (options.trustedOrigins !== void 0 && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
-  if (url.pathname === "/s/inline" && url.hash.startsWith("#v=2&p=")) {
+  if (url.pathname === "/viewer" && (url.hash.startsWith("#tc2=") || url.searchParams.has("tc2"))) {
     const published = parsePublishedShareLink(link, options);
     return { kind: "inline", origin, cid: published.cid, key: published.key, url: `${url.origin}${url.pathname}`, protocol: "share-envelope-v2" };
   }
+  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share links must not contain query parameters");
   const match = url.pathname.match(/^\/s\/(i\/)?([^/]+)$/);
   if (!match) throw new ShareEnvelopeError("invalid-link", "share link path is invalid");
   const fragmentParams = url.hash === "" ? void 0 : new URLSearchParams(url.hash.slice(1));
@@ -3468,7 +3469,8 @@ function parseShareUrl(link, options = {}) {
 }
 function isV2ShareLink(link) {
   try {
-    return new URL(link).pathname.startsWith("/s/");
+    const url = new URL(link);
+    return url.pathname.startsWith("/s/") || url.pathname === "/viewer";
   } catch {
     return link.startsWith(INLINE_PREFIX);
   }
@@ -6707,114 +6709,13 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
   return validateOwnerSharePolicyRegistration(value, expected);
 }
 
-// src/delegations/share-delivery.ts
-var import_ed255197 = require("@noble/curves/ed25519");
-var SHARE_DELIVERY_AUTHORIZATION_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v2\0";
-function isCanonicalHttpsOrigin(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
-  }
-  return url.protocol === "https:" && url.origin === value && url.pathname === "/" && url.search === "" && url.hash === "" && url.username === "" && url.password === "";
-}
-var AUTHORIZATION_KEYS = [
-  "type",
-  "version",
-  "jti",
-  "shareCid",
-  "shareId",
-  "registrationCid",
-  "delegationCid",
-  "enforcementDelegationCid",
-  "envelopeCid",
-  "policyCid",
-  "nodeAudience",
-  "targetOrigin",
-  "openCredentialsAudience",
-  "holder",
-  "recipientMatcher",
-  "deliveryEmail",
-  "shareUrl",
-  "returnOrigin",
-  "documentName",
-  "senderDid",
-  "senderTrust",
-  "contentSource",
-  "contentSourceDigest",
-  "shareExpiresAt",
-  "issuedAt",
-  "reportAbuseToken",
-  "actions",
-  "resource",
-  "authorityMaterialHandle",
-  "authorityMaterialDigest",
-  "requestBodyDigest",
-  "idempotencyKey",
-  "expiresAt",
-  "dataAuthority"
-];
-function assertObject2(value, keys, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
-  const record = value;
-  if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);
-  return record;
-}
-function fromB642(value) {
-  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share delivery value is not canonical base64url");
-  if (typeof atob === "function") {
-    const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
-    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
-  }
-  if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(value, "base64url"));
-  throw new Error("base64url decoding is unavailable");
-}
-function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
-  let value;
-  try {
-    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytesValue));
-  } catch {
-    throw new Error("share delivery authorization response is not valid UTF-8 JSON");
-  }
-  const root = assertObject2(value, ["authorization", "proof"], "share delivery authorization response");
-  const authorization = assertObject2(root.authorization, AUTHORIZATION_KEYS, "share delivery authorization");
-  const proof = assertObject2(root.proof, ["alg", "kid", "signature"], "share delivery authorization proof");
-  const request = expected.request;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.idempotencyKey || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
-    throw new Error("share delivery authorization is not bound to the submitted request");
-  }
-  if (typeof authorization.issuedAt !== "string" || Date.parse(authorization.issuedAt) > Date.now() + 6e4) throw new Error("share delivery authorization issuedAt is invalid");
-  if (new Date(authorization.expiresAt).toISOString() !== authorization.expiresAt) throw new Error("share delivery authorization expiresAt is non-canonical");
-  if (typeof authorization.openCredentialsAudience !== "string" || !isCanonicalHttpsOrigin(authorization.openCredentialsAudience) || authorization.openCredentialsAudience !== expected.credentialsAudience || authorization.openCredentialsAudience === authorization.nodeAudience || authorization.openCredentialsAudience === authorization.returnOrigin) {
-    throw new Error("share delivery authorization openCredentialsAudience is missing or untrusted");
-  }
-  if (proof.alg !== "EdDSA" || typeof proof.kid !== "string" || typeof proof.signature !== "string") throw new Error("share delivery authorization proof is invalid");
-  if (proof.kid !== expected.nodeProof.kid) throw new Error("share delivery authorization proof key is not trusted");
-  const encodedKid = expected.nodeProof.publicKey;
-  const publicKey = encodedKid.length === 34 && encodedKid[0] === 237 && encodedKid[1] === 1 ? encodedKid.slice(2) : encodedKid;
-  if (publicKey.length !== 32) throw new Error("share delivery authorization proof key is invalid");
-  const signatureBytes = fromB642(proof.signature);
-  const signedBytes = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_DOMAIN}${canonicalizeSignedObjectUnsigned(authorization)}`);
-  if (signatureBytes.length !== 64 || !import_ed255197.ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
-  return { authorization, proof };
-}
-function shareDeliveryTrustedKid(publicKey) {
-  if (publicKey.length !== 32) throw new Error("share delivery node key must be a raw 32-byte Ed25519 public key");
-  const prefixed = new Uint8Array(34);
-  prefixed.set([237, 1]);
-  prefixed.set(publicKey, 2);
-  const did = `did:key:${base58btc.encode(prefixed)}`;
-  return `${did}#${did.slice("did:key:".length)}`;
-}
-
 // src/delegations/share-delivery-v3.ts
-var import_ed255198 = require("@noble/curves/ed25519");
+var import_ed255197 = require("@noble/curves/ed25519");
 var import_sha2566 = require("@noble/hashes/sha256");
 var CREDENTIAL_INVITATION_REQUEST_DOMAIN = "xyz.tinycloud.credentials/invitation-request/v1\0";
 var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v0\0";
-var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
-var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
+var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
+var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
 function exactObject(value, keys, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
   const record = value;
@@ -6858,15 +6759,16 @@ function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   const contentSource = object(envelope.contentSource, "v3 content source");
   const envelopeSignature = object(envelope.signature, "v3 envelope signature");
   const target = object(envelope.target, "v3 target");
-  const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
-  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.audience !== expected.credentialsAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || signature.signerDid !== target.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  const binding = object(envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
+  const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
+  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.label !== expected.request.documentName || request.shareExpiresAt !== envelope.expiry || request.audience !== expected.deliveryAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || target.nodeAudience !== binding.nodeAudience || signature.signerDid !== binding.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
   const issuedAt = Date.parse(String(request.issuedAt));
   const expiresAt = Date.parse(String(request.expiresAt));
   if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 15 * 6e4) throw new Error("v3 share delivery authorization time is invalid");
   const admissionSignature = decodeBase64Url2(signature.value);
   const { signature: _signature, ...unsignedAdmission } = admission;
   const digest4 = (0, import_sha2566.sha256)(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
-  if (admissionSignature.length !== 64 || !import_ed255198.ed25519.verify(admissionSignature, digest4, didKeyBytes(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
+  if (admissionSignature.length !== 64 || !import_ed255197.ed25519.verify(admissionSignature, digest4, didKeyBytes(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
   return { request, admission };
 }