@tinycloud/sdk-core 3.6.1 → 3.7.0-beta.1

package/dist/index.cjs

@@ -211,6 +211,7 @@ __export(index_exports, {
   ShareAddressedDelegationRequestV2Schema: () => ShareAddressedDelegationRequestV2Schema,
   ShareAddressedDelegationResponseV2Schema: () => ShareAddressedDelegationResponseV2Schema,
   ShareConflict: () => ShareConflict,
+  ShareDeliveryRefusedError: () => ShareDeliveryRefusedError,
   ShareEnvelopeError: () => ShareEnvelopeError,
   ShareNativeResponseSchema: () => ShareNativeResponseSchema,
   ShareRecipientClient: () => ShareRecipientClient,
@@ -461,6 +462,7 @@ __export(index_exports, {
   serviceError: () => import_sdk_services9.serviceError,
   sha256Base64Url: () => sha256Base64Url,
   shareCapabilityAllows: () => shareCapabilityAllows,
+  shortDeliveryLinkBodyCid: () => shortDeliveryLinkBodyCid,
   signCompactPolicyDescendant: () => signCompactPolicyDescendant,
   signCompactUcanAuthorization: () => signCompactUcanAuthorization,
   signCompactUcanRootAuthorization: () => signCompactUcanRootAuthorization,
@@ -499,7 +501,6 @@ __export(index_exports, {
   validatePolicyStatusSignedShape: () => validatePolicyStatusSignedShape,
   validatePolicyStatusUnsigned: () => validatePolicyStatusUnsigned,
   validatePolicyUnsigned: () => validatePolicyUnsigned,
-  validateShareDeliveryAuthorizationV3Bytes: () => validateShareDeliveryAuthorizationV3Bytes,
   validateUnifiedPolicyV2: () => validateUnifiedPolicyV2,
   validatedCapabilityOf: () => import_sdk_services9.validatedCapabilityOf,
   verifyDecryptResponse: () => import_sdk_services9.verifyDecryptResponse,
@@ -514,9 +515,11 @@ __export(index_exports, {
   verifyPolicyRootStatusCheckpointV3: () => verifyPolicyRootStatusCheckpointV3,
   verifyPolicyStatus: () => verifyPolicyStatus,
   verifyShareCid: () => verifyShareCid,
+  verifyShareDeliveryAuthorizationV3Bytes: () => verifyShareDeliveryAuthorizationV3Bytes,
   verifyShareEnvelope: () => verifyShareEnvelope,
   verifySignedObject: () => verifySignedObject,
-  verifyStorageReceipt: () => verifyStorageReceipt
+  verifyStorageReceipt: () => verifyStorageReceipt,
+  withoutShareLink: () => withoutShareLink
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -12280,7 +12283,7 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
 var import_ed255199 = require("@noble/curves/ed25519");
 var import_sha2567 = require("@noble/hashes/sha256");
 var CREDENTIAL_INVITATION_REQUEST_DOMAIN = "xyz.tinycloud.credentials/invitation-request/v1\0";
-var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v0\0";
+var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v1\0";
 var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
 var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
 function exactObject2(value, keys, label) {
@@ -12319,7 +12322,7 @@ function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   const request = exactObject2(root.request, REQUEST_KEYS, "credential invitation request");
   const admission = exactObject2(root.admission, ADMISSION_KEYS, "delivery admission");
   const signature = exactObject2(admission.signature, ["suite", "signerDid", "value"], "delivery admission signature");
-  const envelope = object3(expected.request.envelope, "v3 share envelope");
+  const envelope = object3(expected.envelope, "v3 share envelope");
   const policy = object3(envelope.policy, "v3 share policy");
   const requirement = object3(policy.credentialRequirement, "v3 credential requirement");
   const credentialType = object3(requirement.credentialType, "v3 credential type");
@@ -12328,16 +12331,42 @@ function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   const target = object3(envelope.target, "v3 target");
   const binding = object3(envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
   const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
-  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.label !== expected.request.documentName || request.shareExpiresAt !== envelope.expiry || request.audience !== expected.deliveryAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || target.nodeAudience !== binding.nodeAudience || signature.signerDid !== binding.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v1" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.envelopeRef || request.label !== expected.request.documentName || request.shareExpiresAt !== envelope.expiry || request.audience !== expected.deliveryAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || target.nodeAudience !== binding.nodeAudience || signature.signerDid !== binding.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
   const issuedAt = Date.parse(String(request.issuedAt));
   const expiresAt = Date.parse(String(request.expiresAt));
   if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 15 * 6e4) throw new Error("v3 share delivery authorization time is invalid");
   const admissionSignature = decodeBase64Url3(signature.value);
   const { signature: _signature, ...unsignedAdmission } = admission;
-  const digest4 = (0, import_sha2567.sha256)(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
+  const digest4 = admissionDigest(unsignedAdmission);
   if (admissionSignature.length !== 64 || !import_ed255199.ed25519.verify(admissionSignature, digest4, didKeyBytes2(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
   return { request, admission };
 }
+function admissionDigest(unsignedAdmission) {
+  return (0, import_sha2567.sha256)(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
+}
+async function verifyShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
+  const verified = validateShareDeliveryAuthorizationV3Bytes(bytes2, expected);
+  const { signature, ...unsignedAdmission } = verified.admission;
+  (await import("@tinycloud/share-envelope/links")).assertDidKeySignature(signature.signerDid, admissionDigest(unsignedAdmission), signature.value);
+  return verified;
+}
+async function shortDeliveryLinkBodyCid(shareUrl, trustedOrigins) {
+  const links = await import("@tinycloud/share-envelope/links");
+  const cid2 = links.shortShareLinkCid(shareUrl, { trustedOrigins: trustedOrigins ?? links.DEFAULT_SHARE_ORIGINS });
+  if (cid2 === void 0) throw new Error("share delivery requires a short share link");
+  return cid2;
+}
+async function withoutShareLink(text3, shareUrl) {
+  return (await import("@tinycloud/share-envelope/links")).redactLink(text3, shareUrl);
+}
+var ShareDeliveryRefusedError = class extends Error {
+  constructor() {
+    super("share delivery authorization refused");
+    this.code = "delivery-authorization-invalid";
+    this.status = 400;
+    this.name = "ShareDeliveryRefusedError";
+  }
+};
 
 // src/delegations/sender-share-store.ts
 var MemorySenderShareRecordStorage = class {