@tinycloud/sdk-services 3.8.0-beta.16 → 3.8.0-beta.9

package/dist/encryption/index.cjs

@@ -56,7 +56,6 @@ __export(encryption_exports, {
   isNetworkId: () => isNetworkId,
   networkDiscoveryKey: () => networkDiscoveryKey,
   openWrappedKey: () => openWrappedKey,
-  parseEncryptionResource: () => parseEncryptionResource,
   parseNetworkId: () => parseNetworkId,
   utf8Decode: () => utf8Decode,
   utf8Encode: () => utf8Encode,
@@ -202,26 +201,6 @@ function parseNetworkId(networkId) {
   }
   return { networkId, ownerDid, name };
 }
-function parseEncryptionResource(resource) {
-  const networkSeparator = resource.lastIndexOf(":");
-  const nameAndPath = resource.slice(networkSeparator + 1);
-  const pathSeparator = nameAndPath.indexOf("/");
-  const name = pathSeparator === -1 ? nameAndPath : nameAndPath.slice(0, pathSeparator);
-  const networkId = pathSeparator === -1 ? resource : `${resource.slice(0, networkSeparator + 1)}${name}`;
-  const parsed = parseNetworkId(networkId);
-  if (pathSeparator === -1) return parsed;
-  const keyPath = nameAndPath.slice(pathSeparator + 1);
-  const segments = keyPath.split("/");
-  const prefix = keyPath.endsWith("/");
-  if (keyPath.length === 0 || /[\u0000-\u001f\u007f\\]/.test(keyPath) || segments.some(
-    (segment, index) => segment === "." || segment === ".." || segment.length === 0 && !(prefix && index === segments.length - 1)
-  )) {
-    throw new NetworkIdError(
-      `encryption resource has an invalid keyPath (got ${JSON.stringify(resource)})`
-    );
-  }
-  return { ...parsed, keyPath };
-}
 function buildNetworkId(ownerDid, name) {
   if (typeof ownerDid !== "string" || !ownerDid.startsWith("did:")) {
     throw new NetworkIdError("ownerDid must be a DID");
@@ -934,12 +913,7 @@ function ensureNetworkUsableForDecrypt(descriptor) {
 
 // src/encryption/envelope.ts
 function encryptToNetwork(crypto, input) {
-  const parsedResource = parseEncryptionResource(
-    input.keyPath === void 0 ? input.networkId : `${input.networkId}/${input.keyPath}`
-  );
-  if (parsedResource.keyPath !== input.keyPath || input.keyPath?.endsWith("/")) {
-    throw new NetworkIdError("keyPath must name an exact encryption key");
-  }
+  parseNetworkId(input.networkId);
   const alg = input.alg ?? DEFAULT_ENCRYPTION_ALG;
   const keyVersion = input.keyVersion ?? DEFAULT_KEY_VERSION;
   const symmetricKey = crypto.randomBytes(32);
@@ -953,7 +927,6 @@ function encryptToNetwork(crypto, input) {
   const envelope = {
     v: ENVELOPE_VERSION,
     networkId: input.networkId,
-    ...input.keyPath !== void 0 ? { keyPath: input.keyPath } : {},
     alg,
     keyVersion,
     encryptedSymmetricKey,
@@ -985,24 +958,13 @@ function validateEnvelope(crypto, envelope) {
     };
   }
   try {
-    if (parseEncryptionResource(e.networkId).keyPath !== void 0) {
-      throw new Error("networkId must identify the network root");
-    }
-    if (e.keyPath !== void 0) {
-      if (typeof e.keyPath !== "string") {
-        throw new Error("keyPath must be a string");
-      }
-      const parsed = parseEncryptionResource(`${e.networkId}/${e.keyPath}`);
-      if (parsed.keyPath !== e.keyPath || e.keyPath.endsWith("/")) {
-        throw new Error("keyPath must name an exact encryption key");
-      }
-    }
+    parseNetworkId(e.networkId);
   } catch (err2) {
     return {
       ok: false,
       error: encryptionError({
         code: "INVALID_ENVELOPE",
-        message: `envelope encryption resource is malformed: ${err2 instanceof Error ? err2.message : String(err2)}`
+        message: `envelope.networkId is malformed: ${err2 instanceof Error ? err2.message : String(err2)}`
       })
     };
   }
@@ -1075,7 +1037,6 @@ function buildDecryptFacts(input) {
     type: DECRYPT_FACT_TYPE,
     targetNode: input.body.targetNode,
     networkId: input.body.networkId,
-    ...input.body.keyPath !== void 0 ? { keyPath: input.body.keyPath } : {},
     bodyHash,
     encryptedSymmetricKeyHash: input.encryptedSymmetricKeyHash,
     receiverPublicKeyHash,
@@ -1083,14 +1044,10 @@ function buildDecryptFacts(input) {
     keyVersion: input.body.keyVersion
   };
 }
-function buildDecryptAttenuation(networkId, keyPath) {
-  const resource = keyPath === void 0 ? networkId : `${networkId}/${keyPath}`;
-  const parsed = parseEncryptionResource(resource);
-  if (parsed.networkId !== networkId || parsed.keyPath !== keyPath || keyPath?.endsWith("/")) {
-    throw new NetworkIdError("keyPath must name an exact encryption key");
-  }
+function buildDecryptAttenuation(networkId) {
+  parseNetworkId(networkId);
   return {
-    [resource]: {
+    [networkId]: {
       [DECRYPT_ACTION]: {}
     }
   };
@@ -1150,15 +1107,6 @@ function checkDecryptInvocationInput(crypto, input) {
       })
     };
   }
-  if (input.facts.keyPath !== input.body.keyPath) {
-    return {
-      ok: false,
-      error: encryptionError({
-        code: "INVALID_INPUT",
-        message: "facts.keyPath must equal body.keyPath"
-      })
-    };
-  }
   if (input.facts.alg !== input.body.alg) {
     return {
       ok: false,
@@ -1196,9 +1144,7 @@ function checkDecryptInvocationInput(crypto, input) {
     };
   }
   try {
-    if (parseEncryptionResource(input.networkId).keyPath !== void 0) {
-      throw new NetworkIdError("networkId must identify the network root");
-    }
+    parseNetworkId(input.networkId);
   } catch (err2) {
     return {
       ok: false,
@@ -1208,22 +1154,6 @@ function checkDecryptInvocationInput(crypto, input) {
       })
     };
   }
-  try {
-    const resource = parseEncryptionResource(
-      input.body.keyPath === void 0 ? input.body.networkId : `${input.body.networkId}/${input.body.keyPath}`
-    );
-    if (resource.keyPath !== input.body.keyPath || input.body.keyPath?.endsWith("/")) {
-      throw new NetworkIdError("keyPath must name an exact encryption key");
-    }
-  } catch (err2) {
-    return {
-      ok: false,
-      error: encryptionError({
-        code: "INVALID_INPUT",
-        message: err2 instanceof Error ? err2.message : String(err2)
-      })
-    };
-  }
   const canonicalBody = canonicalize(
     input.body
   );
@@ -1464,7 +1394,6 @@ var EncryptionService = class extends BaseService {
         // that spelling in the envelope so a later response can be compared
         // byte-for-byte (notably for checksummed did:pkh principals).
         networkId: descriptor.networkId,
-        ...options?.keyPath !== void 0 ? { keyPath: options.keyPath } : {},
         networkPublicKey,
         plaintext,
         ...options?.aad !== void 0 ? { aad: options.aad } : {},
@@ -1524,7 +1453,6 @@ var EncryptionService = class extends BaseService {
         type: DECRYPT_FACT_TYPE,
         targetNode,
         networkId: envelope.networkId,
-        ...envelope.keyPath !== void 0 ? { keyPath: envelope.keyPath } : {},
         alg: envelope.alg,
         keyVersion: envelope.keyVersion,
         encryptedSymmetricKey: envelope.encryptedSymmetricKey,
@@ -1669,7 +1597,6 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   isNetworkId,
   networkDiscoveryKey,
   openWrappedKey,
-  parseEncryptionResource,
   parseNetworkId,
   utf8Decode,
   utf8Encode,