@tinycloud/share-sdk 1.0.0-beta.7 → 1.0.0-beta.8

package/dist/index.cjs

@@ -45,6 +45,7 @@ __export(index_exports, {
   authorizationMethodForTarget: () => authorizationMethodForTarget,
   authorizeShare: () => authorizeShare,
   canonicalOwnerSharePolicy: () => canonicalOwnerSharePolicy,
+  canonicalShareFilename: () => canonicalShareFilename,
   canonicalize: () => canonicalize,
   checkBearerDelegation: () => checkBearerDelegation,
   claimShare: () => claimShare,
@@ -56,6 +57,7 @@ __export(index_exports, {
   createShareV2HolderBindingArtifact: () => createShareV2HolderBindingArtifact,
   deliverCredentialInvitation: () => deliverCredentialInvitation,
   fromBase64Url: () => fromBase64Url,
+  hasUnsafeFilenameCodePoint: () => hasUnsafeFilenameCodePoint,
   historyRecordForPublishedShare: () => historyRecordForPublishedShare,
   inspectShare: () => inspectShare,
   listShares: () => listShares,
@@ -85,6 +87,19 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/filename-policy.ts
+var UNSAFE_FILENAME_CODE_POINT = /[\p{Cc}\p{Cf}\p{Cs}\u2028\u2029]/u;
+function hasUnsafeFilenameCodePoint(value) {
+  return UNSAFE_FILENAME_CODE_POINT.test(value);
+}
+function canonicalShareFilename(value) {
+  const canonical = value.normalize("NFC");
+  if (canonical.length === 0 || canonical === "." || canonical === ".." || canonical.includes("/") || canonical.includes("\\") || hasUnsafeFilenameCodePoint(canonical)) {
+    throw new TypeError("share filename is unsafe");
+  }
+  return canonical;
+}
+
 // ../share-envelope/dist/index.js
 var import_sha2 = require("@noble/hashes/sha2");
 var import_ed25519 = require("@noble/curves/ed25519");
@@ -6566,8 +6581,17 @@ function normalizeShareTarget(target) {
 function targetAuthorizationMethod(target) {
   return authorizationMethodForTarget(target);
 }
+function publishFilename(value) {
+  try {
+    return canonicalShareFilename(value);
+  } catch {
+    throw new SharePublishError("invalid-argument", hasUnsafeFilenameCodePoint(value) ? "filename contains control or invisible characters" : "filename must be one safe path segment");
+  }
+}
 async function publishTargetShare(input) {
   const target = normalizeShareTarget(input.target);
+  const filename = publishFilename(input.filename);
+  const files = input.files?.map((file) => ({ ...file, filename: publishFilename(file.filename) }));
   if (input.targetAdapter === void 0) {
     if (target.kind === "bearer") throw new SharePublishError("authority-required", "native bearer publication requires an authenticated TinyCloud node");
     return {
@@ -6593,9 +6617,6 @@ async function publishTargetShare(input) {
     return bytes3;
   })();
   if (source.byteLength === 0) throw new SharePublishError("invalid-argument", "share content is empty");
-  if (!input.filename || input.filename === "." || input.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(input.filename)) {
-    throw new SharePublishError("invalid-argument", "filename must be one safe path segment");
-  }
   if (target.kind === "bearer" && input.allowBinary !== true) {
     try {
       new TextDecoder("utf-8", { fatal: true }).decode(source);
@@ -6603,10 +6624,10 @@ async function publishTargetShare(input) {
       throw new SharePublishError("invalid-argument", "Markdown input must be valid UTF-8");
     }
   }
-  const files = input.files === void 0 || input.files.length === 0 ? [{ bytes: source }] : input.files;
+  const publishFiles = files === void 0 || files.length === 0 ? [{ bytes: source }] : files;
   const limit = input.maxBytes ?? SHARE_CONTENT_LIMIT;
   let totalBytes = 0;
-  for (const file of files) {
+  for (const file of publishFiles) {
     totalBytes += file.bytes.byteLength;
     if (!Number.isSafeInteger(totalBytes) || totalBytes > limit) {
       throw new SharePublishError("max-bytes-exceeded", "share publication exceeds the combined byte limit");
@@ -6617,8 +6638,8 @@ async function publishTargetShare(input) {
   if (!Number.isFinite(expiresAt.getTime()) || expiresAt.getTime() <= nowMs) throw new SharePublishError("invalid-argument", "expiresAt must be a valid future time");
   return input.targetAdapter.publish({
     source,
-    filename: input.filename,
-    ...input.files === void 0 ? {} : { files: input.files },
+    filename,
+    ...files === void 0 ? {} : { files },
     ...input.mediaType === void 0 ? {} : { mediaType: input.mediaType },
     ...input.resourceKind === void 0 ? {} : { resourceKind: input.resourceKind },
     ...input.actions === void 0 ? {} : { actions: input.actions },
@@ -6768,7 +6789,11 @@ function addressedCredentialRequirement(target) {
   return mailboxCredentialCommitment(normalized);
 }
 function prepareAddressedShare(request) {
-  if (request.filename.length === 0 || request.filename === "." || request.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(request.filename)) throw new TypeError("addressed filename is invalid");
+  try {
+    canonicalShareFilename(request.filename);
+  } catch {
+    throw new TypeError("addressed filename is invalid");
+  }
   if (request.actions.length === 0 || request.policyActions.length === 0) throw new TypeError("addressed share actions are empty");
   const target = normalizeShareTarget(request.target);
   if (target.kind === "bearer") throw new TypeError("addressed target is required");
@@ -6786,9 +6811,10 @@ function assertMailboxCommitment(commitment, target) {
   if (canonicalize(commitment.profile) !== canonicalize(expected.profile) || canonicalize(commitment.credentialType) !== canonicalize(expected.credentialType) || commitment.descriptorDigest !== expected.descriptorDigest || commitment.issuerDid !== expected.issuerDid || commitment.issuerKid !== expected.issuerKid) throw new TypeError(`${label} shares require the ${label} credential profile`);
   if (commitment.requirementDigest !== expected.requirementDigest) throw new TypeError(`credential requirement is not bound to the email ${target.kind === "email" ? "address" : "domain"}`);
 }
-async function publishAddressedShare(options) {
-  assertSafeInput(options);
-  const { target } = prepareAddressedShare(options);
+async function publishAddressedShare(input) {
+  assertSafeInput(input);
+  const { target } = prepareAddressedShare(input);
+  const options = { ...input, filename: canonicalShareFilename(input.filename) };
   if (target.kind !== "recipientDid") assertMailboxCommitment(options.credentialRequirement, target);
   const expiry = rfc3339Seconds(options.expiresAt);
   const matcher = targetMatcher(target);
@@ -8655,6 +8681,7 @@ async function openNativeShare(sharing, link) {
   authorizationMethodForTarget,
   authorizeShare,
   canonicalOwnerSharePolicy,
+  canonicalShareFilename,
   canonicalize,
   checkBearerDelegation,
   claimShare,
@@ -8666,6 +8693,7 @@ async function openNativeShare(sharing, link) {
   createShareV2HolderBindingArtifact,
   deliverCredentialInvitation,
   fromBase64Url,
+  hasUnsafeFilenameCodePoint,
   historyRecordForPublishedShare,
   inspectShare,
   listShares,