@tinycloud/share-sdk 1.0.0-beta.5 → 1.0.0-beta.7

package/dist/index.cjs

@@ -41,6 +41,7 @@ __export(index_exports, {
   SharePublishError: () => SharePublishError,
   ShareReceiveError: () => ShareReceiveError,
   ShareRecipientClient: () => ShareRecipientClient,
+  addressedCredentialRequirement: () => addressedCredentialRequirement,
   authorizationMethodForTarget: () => authorizationMethodForTarget,
   authorizeShare: () => authorizeShare,
   canonicalOwnerSharePolicy: () => canonicalOwnerSharePolicy,
@@ -63,6 +64,7 @@ __export(index_exports, {
   openNativeShare: () => openNativeShare,
   parseAddressedEnvelope: () => parseAddressedEnvelope,
   parseNativeShareUrl: () => parseNativeShareUrl,
+  prepareAddressedShare: () => prepareAddressedShare,
   publishAddressedShare: () => publishAddressedShare,
   publishPolicyShare: () => publishPolicyShare,
   publishTargetShare: () => publishTargetShare,
@@ -5764,6 +5766,21 @@ function serialize(value) {
 function canonicalize(value) {
   return serialize(value);
 }
+var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function isCanonicalEmailDomain(value) {
+  if (value.length === 0 || value.length > 253) return false;
+  const labels = value.split(".");
+  return labels.length >= 2 && labels.every((label) => LABEL.test(label)) && !/^[0-9]+$/.test(labels.at(-1));
+}
+function canonicalMailbox(value) {
+  const email = value.trim().toLowerCase();
+  const at = email.indexOf("@");
+  if (at <= 0 || at !== email.lastIndexOf("@")) return void 0;
+  const local = email.slice(0, at);
+  const domain = email.slice(at + 1);
+  if (local.length > 64 || !/^[a-z0-9#$&'*+/=?^_`{|}~-]+(?:\.[a-z0-9#$&'*+/=?^_`{|}~-]+)*$/.test(local) || !isCanonicalEmailDomain(domain)) return void 0;
+  return Object.freeze({ email, domain });
+}
 async function signCompactUcanAuthorization(input) {
   if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 60) {
     throw new TypeError("compact invocation lifetime must be between one and 60 seconds");
@@ -6099,6 +6116,7 @@ function redactPublishedShare(result) {
       target: { ...result.metadata.target },
       resource: { ...result.metadata.resource },
       actions: [...result.metadata.actions],
+      ...result.metadata.expiryClamped === void 0 ? {} : { expiryClamped: result.metadata.expiryClamped },
       expiresAt: result.metadata.expiresAt,
       display: { ...result.metadata.display }
     }
@@ -6508,12 +6526,6 @@ var base58flickr2 = baseX2({
 });
 
 // src/targets.ts
-function validEmail(value) {
-  return /^[^@\s]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i.test(value);
-}
-function validDomain(value) {
-  return /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))+$/i.test(value);
-}
 function validRecipientDid(value) {
   if (value.length === 0 || value.length > 2048 || /[\u0000-\u0020\u007f]/.test(value)) return false;
   const parts = value.split(":");
@@ -6543,12 +6555,13 @@ function normalizeShareTarget(target) {
     return { kind: target.kind, did: target.did };
   }
   if (target.kind === "email") {
-    if (!validEmail(target.address)) throw new TypeError("recipient email is invalid");
-    const at = target.address.lastIndexOf("@");
-    return { kind: target.kind, address: `${target.address.slice(0, at)}@${target.address.slice(at + 1).toLowerCase()}` };
+    const mailbox = canonicalMailbox(target.address);
+    if (mailbox === void 0) throw new TypeError("recipient email is invalid");
+    return { kind: target.kind, address: mailbox.email };
   }
-  if (!validDomain(target.domain)) throw new TypeError("recipient email domain is invalid");
-  return { kind: target.kind, domain: target.domain.toLowerCase() };
+  const domain = target.domain.toLowerCase();
+  if (!isCanonicalEmailDomain(domain)) throw new TypeError("recipient email domain is invalid");
+  return { kind: target.kind, domain };
 }
 function targetAuthorizationMethod(target) {
   return authorizationMethodForTarget(target);
@@ -6611,6 +6624,7 @@ async function publishTargetShare(input) {
     ...input.actions === void 0 ? {} : { actions: input.actions },
     target,
     expiresAt,
+    expiryWasExplicit: input.expiryWasExplicit ?? input.expiresAt !== void 0,
     origin: input.origin,
     ...input.notify === void 0 ? {} : { notify: input.notify }
   });
@@ -6634,9 +6648,7 @@ function targetKind(target) {
 }
 function assertSafeInput(input) {
   if (!/^[A-Za-z0-9_-]{16,128}$/.test(input.shareId)) throw new TypeError("addressed share id is invalid");
-  if (input.filename.length === 0 || input.filename === "." || input.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(input.filename)) throw new TypeError("addressed filename is invalid");
   if (!Number.isSafeInteger(input.byteLength) || input.byteLength < 0 || input.byteLength > SHARE_CONTENT_LIMIT) throw new TypeError("addressed content length is invalid");
-  if (input.actions.length === 0 || input.policyActions.length === 0) throw new TypeError("addressed share actions are empty");
   if (!Number.isFinite(input.expiresAt.getTime()) || input.expiresAt.getTime() <= Date.now()) throw new TypeError("addressed share expiry must be in the future");
   if (input.artifact === "html" && (input.resource.kind !== "prefix" || !input.actions.includes("read") || !input.actions.includes("list"))) throw new TypeError("html artifacts require a readable prefix");
   if (input.contentSource.shareId !== input.shareId || input.contentSource.selector !== input.resource.kind) throw new TypeError("addressed content source is not bound to the share");
@@ -6729,23 +6741,55 @@ function publicationResult(input) {
   Object.defineProperty(result, "deliveryMaterial", { enumerable: false, value: input.deliveryMaterial });
   return result;
 }
+var EMAIL_PROFILE = { id: "tinycloud.email-proof/v1", version: 1 };
 var EMAIL_DOMAIN_PROFILE = { id: "tinycloud.email-domain-proof/v1", version: 1 };
 var EMAIL_CREDENTIAL_TYPE = { id: "opencredentials.email/v1", version: 1 };
+var EMAIL_DESCRIPTOR_DIGEST = "1tg-qphmKBVtNwzVg9xyz-xxqt_xtMXAsQyXw46m8S0";
 var EMAIL_DOMAIN_DESCRIPTOR_DIGEST = "33X5mAkZZgApdD3xh_T-3KS5moop0J2Nloi2nqWsdWY";
-function assertEmailDomainPolicy(options, domain) {
-  if (!options.actions.every((action) => action === "read" || action === "list") || !options.policyActions.every((action) => action === "tinycloud.kv/get" || action === "tinycloud.kv/list" || action === "tinycloud.kv/metadata")) throw new TypeError("email-domain shares are view-only");
-  if (options.deliveryEmail !== void 0) throw new TypeError("email-domain shares are not emailed");
-  const commitment = options.credentialRequirement;
-  if (commitment === void 0) throw new TypeError("email-domain shares require a credential requirement");
-  if (canonicalize(commitment.profile) !== canonicalize(EMAIL_DOMAIN_PROFILE) || canonicalize(commitment.credentialType) !== canonicalize(EMAIL_CREDENTIAL_TYPE) || commitment.descriptorDigest !== EMAIL_DOMAIN_DESCRIPTOR_DIGEST) throw new TypeError("email-domain shares require the email-domain credential profile");
-  const expected = { type: "TinyCloudCredentialRequirement", version: 1, profile: EMAIL_DOMAIN_PROFILE, credentialType: EMAIL_CREDENTIAL_TYPE, claims: { emailDomain: domain }, maxAgeSeconds: 300 };
-  if (toBase64Url((0, import_sha2562.sha256)(textEncoder.encode(canonicalize(expected)))) !== commitment.requirementDigest) throw new TypeError("credential requirement is not bound to the email domain");
+var EMAIL_CREDENTIAL_ISSUER_DID = "did:web:issuer.credentials.org";
+var EMAIL_CREDENTIAL_ISSUER_KID = `${EMAIL_CREDENTIAL_ISSUER_DID}#controller`;
+function mailboxCredentialCommitment(target) {
+  const profile = target.kind === "email" ? EMAIL_PROFILE : EMAIL_DOMAIN_PROFILE;
+  const requirement = target.kind === "email" ? { type: "TinyCloudCredentialRequirement", version: 1, profile, credentialType: EMAIL_CREDENTIAL_TYPE, claims: { email: target.address }, maxAgeSeconds: 3600 } : { type: "TinyCloudCredentialRequirement", version: 1, profile, credentialType: EMAIL_CREDENTIAL_TYPE, claims: { emailDomain: target.domain }, maxAgeSeconds: 300 };
+  return {
+    type: "TinyCloudPolicyCredentialRequirement",
+    version: 1,
+    requirementDigest: toBase64Url((0, import_sha2562.sha256)(textEncoder.encode(canonicalize(requirement)))),
+    descriptorDigest: target.kind === "email" ? EMAIL_DESCRIPTOR_DIGEST : EMAIL_DOMAIN_DESCRIPTOR_DIGEST,
+    issuerDid: EMAIL_CREDENTIAL_ISSUER_DID,
+    issuerKid: EMAIL_CREDENTIAL_ISSUER_KID,
+    profile,
+    credentialType: EMAIL_CREDENTIAL_TYPE
+  };
+}
+function addressedCredentialRequirement(target) {
+  const normalized = normalizeShareTarget(target);
+  if (normalized.kind !== "email" && normalized.kind !== "emailDomain") throw new TypeError("a mailbox target is required");
+  return mailboxCredentialCommitment(normalized);
+}
+function prepareAddressedShare(request) {
+  if (request.filename.length === 0 || request.filename === "." || request.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(request.filename)) throw new TypeError("addressed filename is invalid");
+  if (request.actions.length === 0 || request.policyActions.length === 0) throw new TypeError("addressed share actions are empty");
+  const target = normalizeShareTarget(request.target);
+  if (target.kind === "bearer") throw new TypeError("addressed target is required");
+  if (target.kind === "recipientDid") return { target };
+  if (target.kind === "emailDomain") {
+    if (!request.actions.every((action) => action === "read" || action === "list") || !request.policyActions.every((action) => action === "tinycloud.kv/get" || action === "tinycloud.kv/list" || action === "tinycloud.kv/metadata")) throw new TypeError("email-domain shares are view-only");
+    if (request.deliveryEmail !== void 0) throw new TypeError("email-domain shares are not emailed");
+  }
+  return { target, credentialRequirement: mailboxCredentialCommitment(target) };
+}
+function assertMailboxCommitment(commitment, target) {
+  const label = target.kind === "email" ? "email" : "email-domain";
+  if (commitment === void 0) throw new TypeError(`${label} shares require a credential requirement`);
+  const expected = mailboxCredentialCommitment(target);
+  if (canonicalize(commitment.profile) !== canonicalize(expected.profile) || canonicalize(commitment.credentialType) !== canonicalize(expected.credentialType) || commitment.descriptorDigest !== expected.descriptorDigest || commitment.issuerDid !== expected.issuerDid || commitment.issuerKid !== expected.issuerKid) throw new TypeError(`${label} shares require the ${label} credential profile`);
+  if (commitment.requirementDigest !== expected.requirementDigest) throw new TypeError(`credential requirement is not bound to the email ${target.kind === "email" ? "address" : "domain"}`);
 }
 async function publishAddressedShare(options) {
   assertSafeInput(options);
-  const target = normalizeShareTarget(options.target);
-  if (target.kind === "bearer") throw new TypeError("addressed target is required");
-  if (target.kind === "emailDomain") assertEmailDomainPolicy(options, target.domain);
+  const { target } = prepareAddressedShare(options);
+  if (target.kind !== "recipientDid") assertMailboxCommitment(options.credentialRequirement, target);
   const expiry = rfc3339Seconds(options.expiresAt);
   const matcher = targetMatcher(target);
   const capabilities = sortCanonical([
@@ -7856,17 +7900,20 @@ var ShareNotifyError = class extends Error {
 };
 function recipientMatchesShareRecord(record, recipient) {
   const matcher = record.recipientMatcher;
-  if (matcher.kind === "bearer" || matcher.kind === "recipientDid") return false;
-  if (matcher.kind === "exactEmail") return matcher.value === recipient;
-  const at = recipient.lastIndexOf("@");
-  return at > 0 && recipient.slice(at + 1).toLowerCase() === matcher.value;
+  const mailbox = canonicalMailbox(recipient);
+  if (mailbox === void 0) return false;
+  if (matcher.kind === "exactEmail") return canonicalMailbox(matcher.value)?.email === mailbox.email;
+  if (matcher.kind === "emailDomain") return mailbox.domain === matcher.value;
+  return false;
 }
 async function notifyShare(input) {
-  if (!input.shareId || !input.recipient || !input.recipient.includes("@")) throw new ShareNotifyError("recipient is invalid");
-  if (input.record !== void 0 && !recipientMatchesShareRecord(input.record, input.recipient)) {
+  const mailbox = canonicalMailbox(input.recipient);
+  if (!input.shareId || mailbox === void 0) throw new ShareNotifyError("recipient is invalid");
+  const recipient = mailbox.email;
+  if (input.record !== void 0 && !recipientMatchesShareRecord(input.record, recipient)) {
     throw new ShareNotifyError("recipient does not match the stored share target");
   }
-  const idempotencyKey = input.idempotencyKey ?? await defaultIdempotencyKey(input.shareId, input.recipient);
+  const idempotencyKey = input.idempotencyKey ?? await defaultIdempotencyKey(input.shareId, recipient);
   const attemptsLimit = input.maxAttempts ?? 3;
   if (!Number.isSafeInteger(attemptsLimit) || attemptsLimit < 1 || attemptsLimit > 8) throw new ShareNotifyError("maxAttempts is invalid");
   let attempts = 0;
@@ -7875,7 +7922,7 @@ async function notifyShare(input) {
     if (input.signal?.aborted) throw new ShareNotifyError("share delivery was cancelled");
     attempts += 1;
     try {
-      const state = await input.adapter.deliver({ shareId: input.shareId, recipient: input.recipient, idempotencyKey, ...input.record === void 0 ? {} : { record: input.record }, ...input.signal === void 0 ? {} : { signal: input.signal } });
+      const state = await input.adapter.deliver({ shareId: input.shareId, recipient, idempotencyKey, ...input.record === void 0 ? {} : { record: input.record }, ...input.signal === void 0 ? {} : { signal: input.signal } });
       return { protocol: "tinycloud-share", version: 1, shareId: input.shareId, state, idempotencyKey, attempts };
     } catch (error) {
       lastError = error;
@@ -8558,7 +8605,11 @@ function canonicalViewerUrl(viewerOrigin) {
 async function createNativeShare(sharing, input) {
   if (!input.path || input.path.startsWith("/") || input.path.endsWith("/") || input.path.includes("..") || input.path.includes("//")) throw new TypeError("native share path must be one canonical TinyCloud KV key");
   const generated = await sharing.generate({ path: input.path, actions: ["tinycloud.kv/get"], expiry: input.expiresAt });
-  if (generated.ok !== true) throw new Error(typeof generated.error?.message === "string" ? generated.error.message : "TinyCloud sharing service rejected delegation generation");
+  if (generated.ok !== true) {
+    const error = new Error(typeof generated.error?.message === "string" ? generated.error.message : "TinyCloud sharing service rejected delegation generation");
+    if (typeof generated.error?.code === "string") Object.assign(error, { code: generated.error.code });
+    throw error;
+  }
   if (typeof generated.data?.token !== "string" || typeof generated.data.delegation?.cid !== "string" || !(generated.data.expiresAt instanceof Date)) throw new Error("TinyCloud sharing service returned incomplete delegation metadata");
   const delegation = sharing.decodeLink(generated.data.token);
   if (typeof delegation.spaceId !== "string" || delegation.spaceId.length === 0 || typeof delegation.path !== "string" || delegation.path.length === 0) throw new Error("TinyCloud sharing service returned a non-canonical delegation authority");
@@ -8600,6 +8651,7 @@ async function openNativeShare(sharing, link) {
   SharePublishError,
   ShareReceiveError,
   ShareRecipientClient,
+  addressedCredentialRequirement,
   authorizationMethodForTarget,
   authorizeShare,
   canonicalOwnerSharePolicy,
@@ -8622,6 +8674,7 @@ async function openNativeShare(sharing, link) {
   openNativeShare,
   parseAddressedEnvelope,
   parseNativeShareUrl,
+  prepareAddressedShare,
   publishAddressedShare,
   publishPolicyShare,
   publishTargetShare,