@tinycloud/sdk-services 2.2.1-beta.0 → 2.3.0-beta.5

package/dist/encryption/index.cjs

@@ -452,6 +452,7 @@ function canonicalHashHex(sha256, value) {
 // src/encryption/networkId.ts
 var URN_PREFIX = "urn:tinycloud:encryption:";
 var NETWORK_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+var PKH_EIP155_DID_RE = /^did:pkh:eip155:(\d+):(0x[a-fA-F0-9]{40})$/;
 var NetworkIdError = class extends Error {
   constructor(message) {
     super(message);
@@ -471,20 +472,20 @@ function parseNetworkId(networkId) {
   const lastColon = body.lastIndexOf(":");
   if (lastColon <= 0 || lastColon === body.length - 1) {
     throw new NetworkIdError(
-      `networkId missing principal or name segment (got ${JSON.stringify(networkId)})`
+      `networkId missing ownerDid or name segment (got ${JSON.stringify(networkId)})`
     );
   }
-  const principal = body.slice(0, lastColon);
+  const ownerDid = body.slice(0, lastColon);
   const name = body.slice(lastColon + 1);
-  if (!principal.startsWith("did:")) {
+  if (!ownerDid.startsWith("did:")) {
     throw new NetworkIdError(
-      `networkId principal must be a DID (got ${JSON.stringify(principal)})`
+      `networkId ownerDid must be a DID (got ${JSON.stringify(ownerDid)})`
     );
   }
-  const didParts = principal.split(":");
+  const didParts = ownerDid.split(":");
   if (didParts.length < 3 || didParts.some((p) => p.length === 0)) {
     throw new NetworkIdError(
-      `networkId principal is not a well-formed DID (got ${JSON.stringify(principal)})`
+      `networkId ownerDid is not a well-formed DID (got ${JSON.stringify(ownerDid)})`
     );
   }
   if (!NETWORK_NAME_RE.test(name)) {
@@ -492,18 +493,18 @@ function parseNetworkId(networkId) {
       `networkId name ${JSON.stringify(name)} must match ${NETWORK_NAME_RE.source}`
     );
   }
-  return { networkId, principal, name };
+  return { networkId, ownerDid, name };
 }
-function buildNetworkId(principal, name) {
-  if (typeof principal !== "string" || !principal.startsWith("did:")) {
-    throw new NetworkIdError("principal must be a DID");
+function buildNetworkId(ownerDid, name) {
+  if (typeof ownerDid !== "string" || !ownerDid.startsWith("did:")) {
+    throw new NetworkIdError("ownerDid must be a DID");
   }
   if (typeof name !== "string" || !NETWORK_NAME_RE.test(name)) {
     throw new NetworkIdError(
       `network name ${JSON.stringify(name)} must match ${NETWORK_NAME_RE.source}`
     );
   }
-  const networkId = `${URN_PREFIX}${principal}:${name}`;
+  const networkId = `${URN_PREFIX}${ownerDid}:${name}`;
   parseNetworkId(networkId);
   return networkId;
 }
@@ -518,6 +519,22 @@ function isNetworkId(networkId) {
     return false;
   }
 }
+function parsePkhOwnerDid(ownerDid) {
+  const match = ownerDid.match(PKH_EIP155_DID_RE);
+  if (!match) return null;
+  return {
+    chainId: match[1],
+    address: match[2].toLowerCase()
+  };
+}
+function ownerDidMatches(a, b) {
+  const aPkh = parsePkhOwnerDid(a);
+  const bPkh = parsePkhOwnerDid(b);
+  if (aPkh && bPkh) {
+    return aPkh.chainId === bPkh.chainId && aPkh.address === bPkh.address;
+  }
+  return a === b;
+}
 function networkDiscoveryKey(name) {
   if (!NETWORK_NAME_RE.test(name)) {
     throw new NetworkIdError(
@@ -580,27 +597,27 @@ function toError(error) {
 // src/encryption/discovery.ts
 async function discoverNetwork(input) {
   let networkId;
-  let principal;
+  let ownerDid;
   let name;
   try {
     if (input.identifier.startsWith("urn:tinycloud:encryption:")) {
       const parsed = parseNetworkId(input.identifier);
       networkId = parsed.networkId;
-      principal = parsed.principal;
+      ownerDid = parsed.ownerDid;
       name = parsed.name;
     } else {
-      if (input.principal === void 0) {
+      if (input.ownerDid === void 0) {
         return {
           ok: false,
           error: encryptionError({
             code: "INVALID_INPUT",
-            message: "discoverNetwork requires `principal` when identifier is a bare network name"
+            message: "discoverNetwork requires `ownerDid` when identifier is a bare network name"
           })
         };
       }
-      networkId = `urn:tinycloud:encryption:${input.principal}:${input.identifier}`;
+      networkId = `urn:tinycloud:encryption:${input.ownerDid}:${input.identifier}`;
       const parsed = parseNetworkId(networkId);
-      principal = parsed.principal;
+      ownerDid = parsed.ownerDid;
       name = parsed.name;
     }
   } catch (err2) {
@@ -619,7 +636,7 @@ async function discoverNetwork(input) {
     try {
       const descriptor = await input.node.fetchByNetworkId(networkId);
       if (descriptor !== null) {
-        const validated = validateDescriptor(descriptor, networkId, principal, name);
+        const validated = validateDescriptor(descriptor, networkId, ownerDid, name);
         if (!validated.ok) return validated;
         return { ok: true, data: { descriptor: validated.data, source: "node" } };
       }
@@ -629,11 +646,11 @@ async function discoverNetwork(input) {
   if (input.wellKnown !== void 0) {
     try {
       const descriptor = await input.wellKnown.fetchWellKnown(
-        principal,
+        ownerDid,
         networkDiscoveryKey(name)
       );
       if (descriptor !== null) {
-        const validated = validateDescriptor(descriptor, networkId, principal, name);
+        const validated = validateDescriptor(descriptor, networkId, ownerDid, name);
         if (!validated.ok) return validated;
         return {
           ok: true,
@@ -652,8 +669,20 @@ async function discoverNetwork(input) {
     })
   };
 }
-function validateDescriptor(descriptor, networkId, principal, name) {
-  if (descriptor.networkId !== networkId) {
+function validateDescriptor(descriptor, networkId, ownerDid, name) {
+  let descriptorNetwork;
+  try {
+    descriptorNetwork = parseNetworkId(descriptor.networkId);
+  } catch (err2) {
+    return {
+      ok: false,
+      error: encryptionError({
+        code: "INVALID_NETWORK_ID",
+        message: `descriptor networkId is malformed: ${err2 instanceof Error ? err2.message : String(err2)}`
+      })
+    };
+  }
+  if (descriptorNetwork.name !== name || !ownerDidMatches(descriptorNetwork.ownerDid, ownerDid)) {
     return {
       ok: false,
       error: encryptionError({
@@ -662,12 +691,13 @@ function validateDescriptor(descriptor, networkId, principal, name) {
       })
     };
   }
-  if (descriptor.principal !== principal) {
+  const descriptorOwnerDid = descriptorOwner(descriptor);
+  if (descriptorOwnerDid === void 0 || !ownerDidMatches(descriptorOwnerDid, ownerDid) || !ownerDidMatches(descriptorOwnerDid, descriptorNetwork.ownerDid)) {
     return {
       ok: false,
       error: encryptionError({
         code: "INVALID_NETWORK_ID",
-        message: "descriptor principal does not match networkId principal"
+        message: "descriptor ownerDid does not match networkId ownerDid"
       })
     };
   }
@@ -689,7 +719,20 @@ function validateDescriptor(descriptor, networkId, principal, name) {
       })
     };
   }
-  return { ok: true, data: descriptor };
+  return {
+    ok: true,
+    data: {
+      ...descriptor,
+      ownerDid: descriptorOwnerDid
+    }
+  };
+}
+function descriptorOwner(descriptor) {
+  if (typeof descriptor.ownerDid === "string" && descriptor.ownerDid.length > 0) {
+    return descriptor.ownerDid;
+  }
+  const legacyDescriptor = descriptor;
+  return typeof legacyDescriptor.principal === "string" && legacyDescriptor.principal.length > 0 ? legacyDescriptor.principal : void 0;
 }
 function ensureNetworkUsableForDecrypt(descriptor) {
   if (descriptor.state === "active" || descriptor.state === "rotating") {
@@ -1159,10 +1202,10 @@ var EncryptionService = class extends BaseService {
   get crypto() {
     return this._config.crypto;
   }
-  async discoverNetwork(identifier, principal) {
+  async discoverNetwork(identifier, ownerDid) {
     const result = await discoverNetwork({
       identifier,
-      ...principal !== void 0 ? { principal } : {},
+      ...ownerDid !== void 0 ? { ownerDid } : {},
       ...this._config.node !== void 0 ? { node: this._config.node } : {},
       ...this._config.wellKnown !== void 0 ? { wellKnown: this._config.wellKnown } : {}
     });