@tinycloud/share-sdk 1.0.0-beta.4 → 1.0.0-beta.5

package/dist/index.d.cts

@@ -587,7 +587,6 @@ interface AddressedSharePublishOptions {
     readonly onDeliveryMaterial?: (input: PublishedShareDeliveryMaterial) => void;
     readonly authority: AddressedPublishAuthority;
 }
-/** Canonical application-neutral Policy/v3 addressed publisher shared by browser and CLI. */
 declare function publishAddressedShare(options: AddressedSharePublishOptions): Promise<PublishedShare>;
 
 interface ShareCacheKey {

package/dist/index.d.ts

@@ -587,7 +587,6 @@ interface AddressedSharePublishOptions {
     readonly onDeliveryMaterial?: (input: PublishedShareDeliveryMaterial) => void;
     readonly authority: AddressedPublishAuthority;
 }
-/** Canonical application-neutral Policy/v3 addressed publisher shared by browser and CLI. */
 declare function publishAddressedShare(options: AddressedSharePublishOptions): Promise<PublishedShare>;
 
 interface ShareCacheKey {

package/dist/index.js

@@ -6650,10 +6650,23 @@ function publicationResult(input) {
   Object.defineProperty(result, "deliveryMaterial", { enumerable: false, value: input.deliveryMaterial });
   return result;
 }
+var EMAIL_DOMAIN_PROFILE = { id: "tinycloud.email-domain-proof/v1", version: 1 };
+var EMAIL_CREDENTIAL_TYPE = { id: "opencredentials.email/v1", version: 1 };
+var EMAIL_DOMAIN_DESCRIPTOR_DIGEST = "33X5mAkZZgApdD3xh_T-3KS5moop0J2Nloi2nqWsdWY";
+function assertEmailDomainPolicy(options, domain) {
+  if (!options.actions.every((action) => action === "read" || action === "list") || !options.policyActions.every((action) => action === "tinycloud.kv/get" || action === "tinycloud.kv/list" || action === "tinycloud.kv/metadata")) throw new TypeError("email-domain shares are view-only");
+  if (options.deliveryEmail !== void 0) throw new TypeError("email-domain shares are not emailed");
+  const commitment = options.credentialRequirement;
+  if (commitment === void 0) throw new TypeError("email-domain shares require a credential requirement");
+  if (canonicalize(commitment.profile) !== canonicalize(EMAIL_DOMAIN_PROFILE) || canonicalize(commitment.credentialType) !== canonicalize(EMAIL_CREDENTIAL_TYPE) || commitment.descriptorDigest !== EMAIL_DOMAIN_DESCRIPTOR_DIGEST) throw new TypeError("email-domain shares require the email-domain credential profile");
+  const expected = { type: "TinyCloudCredentialRequirement", version: 1, profile: EMAIL_DOMAIN_PROFILE, credentialType: EMAIL_CREDENTIAL_TYPE, claims: { emailDomain: domain }, maxAgeSeconds: 300 };
+  if (toBase64Url(sha2563(textEncoder.encode(canonicalize(expected)))) !== commitment.requirementDigest) throw new TypeError("credential requirement is not bound to the email domain");
+}
 async function publishAddressedShare(options) {
   assertSafeInput(options);
   const target = normalizeShareTarget(options.target);
   if (target.kind === "bearer") throw new TypeError("addressed target is required");
+  if (target.kind === "emailDomain") assertEmailDomainPolicy(options, target.domain);
   const expiry = rfc3339Seconds(options.expiresAt);
   const matcher = targetMatcher(target);
   const capabilities = sortCanonical([