@tinycloud/sdk-core 3.6.1 → 3.7.0-beta.1

package/dist/delegations/index.cjs

@@ -54,6 +54,7 @@ __export(delegations_exports, {
   ShareAddressedDelegationRequestV2Schema: () => ShareAddressedDelegationRequestV2Schema,
   ShareAddressedDelegationResponseV2Schema: () => ShareAddressedDelegationResponseV2Schema,
   ShareConflict: () => ShareConflict,
+  ShareDeliveryRefusedError: () => ShareDeliveryRefusedError,
   ShareEnvelopeError: () => ShareEnvelopeError,
   ShareNativeResponseSchema: () => ShareNativeResponseSchema,
   ShareReceiveError: () => import_share_sdk2.ShareReceiveError,
@@ -103,6 +104,7 @@ __export(delegations_exports, {
   revokeShare: () => import_share_sdk.revokeShare,
   serializePortableDelegation: () => serializePortableDelegation,
   shareCapabilityAllows: () => shareCapabilityAllows,
+  shortDeliveryLinkBodyCid: () => shortDeliveryLinkBodyCid,
   showShare: () => import_share_sdk.showShare,
   signShareEnvelope: () => signShareEnvelope,
   toShareErrorInfo: () => import_share_sdk2.toShareErrorInfo,
@@ -110,10 +112,11 @@ __export(delegations_exports, {
   validateOwnerSharePolicyRegistration: () => validateOwnerSharePolicyRegistration,
   validateOwnerSharePolicyRegistrationBytes: () => validateOwnerSharePolicyRegistrationBytes,
   validateReceiveOptions: () => validateReceiveOptions,
-  validateShareDeliveryAuthorizationV3Bytes: () => validateShareDeliveryAuthorizationV3Bytes,
   validateSharingServiceConfig: () => validateSharingServiceConfig,
   verifyShareCid: () => verifyShareCid,
-  verifyShareEnvelope: () => verifyShareEnvelope
+  verifyShareDeliveryAuthorizationV3Bytes: () => verifyShareDeliveryAuthorizationV3Bytes,
+  verifyShareEnvelope: () => verifyShareEnvelope,
+  withoutShareLink: () => withoutShareLink
 });
 module.exports = __toCommonJS(delegations_exports);
 
@@ -6625,7 +6628,7 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
 var import_ed255197 = require("@noble/curves/ed25519");
 var import_sha2566 = require("@noble/hashes/sha256");
 var CREDENTIAL_INVITATION_REQUEST_DOMAIN = "xyz.tinycloud.credentials/invitation-request/v1\0";
-var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v0\0";
+var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v1\0";
 var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
 var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
 function exactObject(value, keys, label) {
@@ -6664,7 +6667,7 @@ function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   const request = exactObject(root.request, REQUEST_KEYS, "credential invitation request");
   const admission = exactObject(root.admission, ADMISSION_KEYS, "delivery admission");
   const signature = exactObject(admission.signature, ["suite", "signerDid", "value"], "delivery admission signature");
-  const envelope = object(expected.request.envelope, "v3 share envelope");
+  const envelope = object(expected.envelope, "v3 share envelope");
   const policy = object(envelope.policy, "v3 share policy");
   const requirement = object(policy.credentialRequirement, "v3 credential requirement");
   const credentialType = object(requirement.credentialType, "v3 credential type");
@@ -6673,16 +6676,42 @@ function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   const target = object(envelope.target, "v3 target");
   const binding = object(envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
   const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
-  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.label !== expected.request.documentName || request.shareExpiresAt !== envelope.expiry || request.audience !== expected.deliveryAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || target.nodeAudience !== binding.nodeAudience || signature.signerDid !== binding.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v1" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.envelopeRef || request.label !== expected.request.documentName || request.shareExpiresAt !== envelope.expiry || request.audience !== expected.deliveryAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || target.nodeAudience !== binding.nodeAudience || signature.signerDid !== binding.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
   const issuedAt = Date.parse(String(request.issuedAt));
   const expiresAt = Date.parse(String(request.expiresAt));
   if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 15 * 6e4) throw new Error("v3 share delivery authorization time is invalid");
   const admissionSignature = decodeBase64Url2(signature.value);
   const { signature: _signature, ...unsignedAdmission } = admission;
-  const digest4 = (0, import_sha2566.sha256)(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
+  const digest4 = admissionDigest(unsignedAdmission);
   if (admissionSignature.length !== 64 || !import_ed255197.ed25519.verify(admissionSignature, digest4, didKeyBytes(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
   return { request, admission };
 }
+function admissionDigest(unsignedAdmission) {
+  return (0, import_sha2566.sha256)(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
+}
+async function verifyShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
+  const verified = validateShareDeliveryAuthorizationV3Bytes(bytes2, expected);
+  const { signature, ...unsignedAdmission } = verified.admission;
+  (await import("@tinycloud/share-envelope/links")).assertDidKeySignature(signature.signerDid, admissionDigest(unsignedAdmission), signature.value);
+  return verified;
+}
+async function shortDeliveryLinkBodyCid(shareUrl, trustedOrigins) {
+  const links = await import("@tinycloud/share-envelope/links");
+  const cid2 = links.shortShareLinkCid(shareUrl, { trustedOrigins: trustedOrigins ?? links.DEFAULT_SHARE_ORIGINS });
+  if (cid2 === void 0) throw new Error("share delivery requires a short share link");
+  return cid2;
+}
+async function withoutShareLink(text, shareUrl) {
+  return (await import("@tinycloud/share-envelope/links")).redactLink(text, shareUrl);
+}
+var ShareDeliveryRefusedError = class extends Error {
+  constructor() {
+    super("share delivery authorization refused");
+    this.code = "delivery-authorization-invalid";
+    this.status = 400;
+    this.name = "ShareDeliveryRefusedError";
+  }
+};
 
 // src/delegations/sender-share-store.ts
 var MemorySenderShareRecordStorage = class {