@tinycloud/share-sdk 1.0.0-beta.7 → 1.0.0-beta.9

package/dist/index.cjs

@@ -45,6 +45,7 @@ __export(index_exports, {
   authorizationMethodForTarget: () => authorizationMethodForTarget,
   authorizeShare: () => authorizeShare,
   canonicalOwnerSharePolicy: () => canonicalOwnerSharePolicy,
+  canonicalShareFilename: () => canonicalShareFilename,
   canonicalize: () => canonicalize,
   checkBearerDelegation: () => checkBearerDelegation,
   claimShare: () => claimShare,
@@ -56,6 +57,7 @@ __export(index_exports, {
   createShareV2HolderBindingArtifact: () => createShareV2HolderBindingArtifact,
   deliverCredentialInvitation: () => deliverCredentialInvitation,
   fromBase64Url: () => fromBase64Url,
+  hasUnsafeFilenameCodePoint: () => hasUnsafeFilenameCodePoint,
   historyRecordForPublishedShare: () => historyRecordForPublishedShare,
   inspectShare: () => inspectShare,
   listShares: () => listShares,
@@ -85,6 +87,19 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/filename-policy.ts
+var UNSAFE_FILENAME_CODE_POINT = /[\p{Cc}\p{Cf}\p{Cs}\u2028\u2029]/u;
+function hasUnsafeFilenameCodePoint(value) {
+  return UNSAFE_FILENAME_CODE_POINT.test(value);
+}
+function canonicalShareFilename(value) {
+  const canonical = value.normalize("NFC");
+  if (canonical.length === 0 || canonical === "." || canonical === ".." || canonical.includes("/") || canonical.includes("\\") || hasUnsafeFilenameCodePoint(canonical)) {
+    throw new TypeError("share filename is unsafe");
+  }
+  return canonical;
+}
+
 // ../share-envelope/dist/index.js
 var import_sha2 = require("@noble/hashes/sha2");
 var import_ed25519 = require("@noble/curves/ed25519");
@@ -6566,8 +6581,17 @@ function normalizeShareTarget(target) {
 function targetAuthorizationMethod(target) {
   return authorizationMethodForTarget(target);
 }
+function publishFilename(value) {
+  try {
+    return canonicalShareFilename(value);
+  } catch {
+    throw new SharePublishError("invalid-argument", hasUnsafeFilenameCodePoint(value) ? "filename contains control or invisible characters" : "filename must be one safe path segment");
+  }
+}
 async function publishTargetShare(input) {
   const target = normalizeShareTarget(input.target);
+  const filename = publishFilename(input.filename);
+  const files = input.files?.map((file) => ({ ...file, filename: publishFilename(file.filename) }));
   if (input.targetAdapter === void 0) {
     if (target.kind === "bearer") throw new SharePublishError("authority-required", "native bearer publication requires an authenticated TinyCloud node");
     return {
@@ -6593,9 +6617,6 @@ async function publishTargetShare(input) {
     return bytes3;
   })();
   if (source.byteLength === 0) throw new SharePublishError("invalid-argument", "share content is empty");
-  if (!input.filename || input.filename === "." || input.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(input.filename)) {
-    throw new SharePublishError("invalid-argument", "filename must be one safe path segment");
-  }
   if (target.kind === "bearer" && input.allowBinary !== true) {
     try {
       new TextDecoder("utf-8", { fatal: true }).decode(source);
@@ -6603,10 +6624,10 @@ async function publishTargetShare(input) {
       throw new SharePublishError("invalid-argument", "Markdown input must be valid UTF-8");
     }
   }
-  const files = input.files === void 0 || input.files.length === 0 ? [{ bytes: source }] : input.files;
+  const publishFiles = files === void 0 || files.length === 0 ? [{ bytes: source }] : files;
   const limit = input.maxBytes ?? SHARE_CONTENT_LIMIT;
   let totalBytes = 0;
-  for (const file of files) {
+  for (const file of publishFiles) {
     totalBytes += file.bytes.byteLength;
     if (!Number.isSafeInteger(totalBytes) || totalBytes > limit) {
       throw new SharePublishError("max-bytes-exceeded", "share publication exceeds the combined byte limit");
@@ -6617,8 +6638,8 @@ async function publishTargetShare(input) {
   if (!Number.isFinite(expiresAt.getTime()) || expiresAt.getTime() <= nowMs) throw new SharePublishError("invalid-argument", "expiresAt must be a valid future time");
   return input.targetAdapter.publish({
     source,
-    filename: input.filename,
-    ...input.files === void 0 ? {} : { files: input.files },
+    filename,
+    ...files === void 0 ? {} : { files },
     ...input.mediaType === void 0 ? {} : { mediaType: input.mediaType },
     ...input.resourceKind === void 0 ? {} : { resourceKind: input.resourceKind },
     ...input.actions === void 0 ? {} : { actions: input.actions },
@@ -6646,6 +6667,7 @@ function targetMatcher(target) {
 function targetKind(target) {
   return target.kind;
 }
+var OWNER_SHARE_ACTIONS = /* @__PURE__ */ new Set(["tinycloud.kv/get", "tinycloud.kv/list", "tinycloud.kv/metadata", "tinycloud.kv/put"]);
 function assertSafeInput(input) {
   if (!/^[A-Za-z0-9_-]{16,128}$/.test(input.shareId)) throw new TypeError("addressed share id is invalid");
   if (!Number.isSafeInteger(input.byteLength) || input.byteLength < 0 || input.byteLength > SHARE_CONTENT_LIMIT) throw new TypeError("addressed content length is invalid");
@@ -6768,14 +6790,18 @@ function addressedCredentialRequirement(target) {
   return mailboxCredentialCommitment(normalized);
 }
 function prepareAddressedShare(request) {
-  if (request.filename.length === 0 || request.filename === "." || request.filename === ".." || /[/\\\u0000-\u001f\u007f]/.test(request.filename)) throw new TypeError("addressed filename is invalid");
+  try {
+    canonicalShareFilename(request.filename);
+  } catch {
+    throw new TypeError("addressed filename is invalid");
+  }
   if (request.actions.length === 0 || request.policyActions.length === 0) throw new TypeError("addressed share actions are empty");
+  if (request.policyActions.some((action) => !OWNER_SHARE_ACTIONS.has(action))) throw new TypeError("addressed share action is not supported");
   const target = normalizeShareTarget(request.target);
   if (target.kind === "bearer") throw new TypeError("addressed target is required");
   if (target.kind === "recipientDid") return { target };
-  if (target.kind === "emailDomain") {
-    if (!request.actions.every((action) => action === "read" || action === "list") || !request.policyActions.every((action) => action === "tinycloud.kv/get" || action === "tinycloud.kv/list" || action === "tinycloud.kv/metadata")) throw new TypeError("email-domain shares are view-only");
-    if (request.deliveryEmail !== void 0) throw new TypeError("email-domain shares are not emailed");
+  if (target.kind === "emailDomain" && request.deliveryEmail !== void 0 && (request.deliveryEmail !== request.deliveryEmail.toLowerCase() || !request.deliveryEmail.endsWith(`@${target.domain}`))) {
+    throw new TypeError("email-domain delivery address must be a lowercase mailbox at the domain");
   }
   return { target, credentialRequirement: mailboxCredentialCommitment(target) };
 }
@@ -6786,9 +6812,10 @@ function assertMailboxCommitment(commitment, target) {
   if (canonicalize(commitment.profile) !== canonicalize(expected.profile) || canonicalize(commitment.credentialType) !== canonicalize(expected.credentialType) || commitment.descriptorDigest !== expected.descriptorDigest || commitment.issuerDid !== expected.issuerDid || commitment.issuerKid !== expected.issuerKid) throw new TypeError(`${label} shares require the ${label} credential profile`);
   if (commitment.requirementDigest !== expected.requirementDigest) throw new TypeError(`credential requirement is not bound to the email ${target.kind === "email" ? "address" : "domain"}`);
 }
-async function publishAddressedShare(options) {
-  assertSafeInput(options);
-  const { target } = prepareAddressedShare(options);
+async function publishAddressedShare(input) {
+  assertSafeInput(input);
+  const { target } = prepareAddressedShare(input);
+  const options = { ...input, filename: canonicalShareFilename(input.filename) };
   if (target.kind !== "recipientDid") assertMailboxCommitment(options.credentialRequirement, target);
   const expiry = rfc3339Seconds(options.expiresAt);
   const matcher = targetMatcher(target);
@@ -8283,9 +8310,28 @@ function verifyV3PolicyAuthorization(input) {
   const binding = object3(input.envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
   const policy = object3(input.envelope.policy, "v3 policy");
   const now = Math.floor(Date.now() / 1e3);
-  if (!legacyShape && !v4Shape || POLICY_SESSION_DIGEST_FACT_KEYS.some((key) => !LOWER_SHA256_HEX.test(fact[key])) || v4Shape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)) || compact.payload.aud !== input.holderDid || compact.payload.iss.split("#", 1)[0] !== fact.nodeAudience || fact.profile !== "policy-session-ucan/v1" || fact.ownerDid !== policy.ownerDid || fact.policyId !== policy.policyId || fact.policyCid !== input.envelope.policyCid || fact.contentSourceDigestHex !== input.envelope.contentSourceDigestHex || fact.enforcerDid !== binding.enforcerDid || fact.nodeAudience !== binding.nodeAudience || fact.recipientDid !== input.holderDid || fact.policyDelegationCid !== input.envelope.policyRoot.cid || fact.enforcementDelegationCid !== input.envelope.enforcementRoot.cid || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || compact.payload.prf.length !== 2 || compact.payload.prf[0] !== input.envelope.policyRoot.cid || compact.payload.prf[1] !== input.envelope.enforcementRoot.cid || compact.payload.nbf > now || compact.payload.exp <= now || compact.payload.exp - compact.payload.nbf > 60 || canonicalize(compact.payload.att) !== canonicalize(policyAttenuationForV3(input.envelope))) throw new Error("v3 policy delegation signed binding mismatch");
+  if (!legacyShape && !v4Shape || POLICY_SESSION_DIGEST_FACT_KEYS.some((key) => !LOWER_SHA256_HEX.test(fact[key])) || v4Shape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)) || compact.payload.aud !== input.holderDid || compact.payload.iss.split("#", 1)[0] !== fact.nodeAudience || fact.profile !== "policy-session-ucan/v1" || fact.ownerDid !== policy.ownerDid || fact.policyId !== policy.policyId || fact.policyCid !== input.envelope.policyCid || fact.contentSourceDigestHex !== input.envelope.contentSourceDigestHex || fact.enforcerDid !== binding.enforcerDid || fact.nodeAudience !== binding.nodeAudience || fact.recipientDid !== input.holderDid || fact.policyDelegationCid !== input.envelope.policyRoot.cid || fact.enforcementDelegationCid !== input.envelope.enforcementRoot.cid || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || compact.payload.prf.length !== 2 || compact.payload.prf[0] !== input.envelope.policyRoot.cid || compact.payload.prf[1] !== input.envelope.enforcementRoot.cid || compact.payload.nbf > now || compact.payload.exp <= now || !(compact.payload.exp * 1e3 <= Date.parse(input.envelope.expiry)) || canonicalize(compact.payload.att) !== canonicalize(policyAttenuationForV3(input.envelope))) throw new Error("v3 policy delegation signed binding mismatch");
   return compact;
 }
+function verifyV3PolicyDescendants(session, descendants, holderDid) {
+  let parent = session;
+  for (const link of descendants) {
+    const child = verifyCompactUcanAuthorization(link.authorization, link.cid);
+    const { remainingRedelegationDepth: parentDepth, ...parentFacts } = parent.payload.fct[0];
+    const { remainingRedelegationDepth: depth, ...facts } = child.payload.fct[0];
+    if (child.payload.iss.split("#", 1)[0] !== parent.payload.aud || child.payload.prf.length !== 1 || child.payload.prf[0] !== parent.cid || child.payload.nbf <= parent.payload.nbf || child.payload.exp >= parent.payload.exp || typeof parentDepth !== "number" || parentDepth <= 0 || depth !== parentDepth - 1 || canonicalize(facts) !== canonicalize(parentFacts) || canonicalize(child.payload.att) !== canonicalize(parent.payload.att)) throw new Error("v3 policy descendant does not extend its parent");
+    parent = child;
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  if (parent.payload.aud !== holderDid) throw new Error("v3 policy delegation chain does not end at this holder");
+  if (parent.payload.nbf > now || parent.payload.exp <= now) throw new Error("v3 policy delegation chain is not currently valid");
+  return parent;
+}
+function requestedSessionExpiry(expiry) {
+  const seconds = Math.floor(Date.parse(expiry) / 1e3);
+  if (!Number.isFinite(seconds) || seconds <= Math.floor(Date.now() / 1e3) + 60) return void 0;
+  return new Date(seconds * 1e3).toISOString().replace(/\.\d{3}Z$/, "Z");
+}
 function hex3(value) {
   return [...value].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
@@ -8338,14 +8384,17 @@ var ShareRecipientClient = class {
     this.signer = options.sign;
     if (options.policyAuthorization !== void 0) {
       if (options.envelope.version !== 3) throw new Error("policy delegation fast path requires a v3 envelope");
-      const compact = verifyV3PolicyAuthorization({ ...options.policyAuthorization, envelope: options.envelope, holderDid: options.holderDid });
+      const { authorization, cid: cid2, descendants = [] } = options.policyAuthorization;
+      const sessionHolder = descendants.length === 0 ? options.holderDid : verifyCompactUcanAuthorization(authorization, cid2).payload.aud;
+      const compact = verifyV3PolicyAuthorization({ authorization, cid: cid2, envelope: options.envelope, holderDid: sessionHolder });
+      const leaf = verifyV3PolicyDescendants(compact, descendants, options.holderDid);
       const nodeAudience = compact.payload.fct[0].nodeAudience;
-      this.v3Authorization = options.policyAuthorization.authorization;
+      this.v3Authorization = leaf.authorization;
       this.v3NodeAudience = nodeAudience;
       this.nativeSigner = options.sign;
       this.session = {
-        sessionId: options.policyAuthorization.cid,
-        expiresAt: new Date(compact.payload.exp * 1e3).toISOString(),
+        sessionId: leaf.cid,
+        expiresAt: new Date(leaf.payload.exp * 1e3).toISOString(),
         actions: options.envelope.actions,
         resource: options.envelope.resource
       };
@@ -8415,13 +8464,17 @@ var ShareRecipientClient = class {
       throw new Error(accountless ? "v4 ceremony requires a verified credential and requirement" : "v3 ceremony requires a claim");
     }
     this.options.onStage?.("policy-admission");
-    const delegationResponse = await this.fetchFn(new URL("/policy/v3/delegations", this.options.nodeOrigin), {
+    const mintBody = accountless ? { policyCid: envelope.policyCid, challengeId: challenge.challengeId, nonce: challenge.nonce, requirement: material.requirement, credential: material.credentialEnvelope, presentation: material.presentation } : { policyCid: envelope.policyCid, challengeId: challenge.challengeId, nonce: challenge.nonce, claim: material.claim, presentation: material.presentation };
+    const mint = (body) => this.fetchFn(new URL("/policy/v3/delegations", this.options.nodeOrigin), {
       method: "POST",
       redirect: "error",
       headers: { accept: "application/json", "content-type": "application/json" },
-      body: JSON.stringify(accountless ? { policyCid: envelope.policyCid, challengeId: challenge.challengeId, nonce: challenge.nonce, requirement: material.requirement, credential: material.credentialEnvelope, presentation: material.presentation } : { policyCid: envelope.policyCid, challengeId: challenge.challengeId, nonce: challenge.nonce, claim: material.claim, presentation: material.presentation }),
+      body: JSON.stringify(body),
       ...this.options.signal === void 0 ? {} : { signal: this.options.signal }
     });
+    const requestedExpiresAt = requestedSessionExpiry(envelope.expiry);
+    let delegationResponse = await mint(requestedExpiresAt === void 0 ? mintBody : { ...mintBody, requestedExpiresAt });
+    if (requestedExpiresAt !== void 0 && delegationResponse.status === 422) delegationResponse = await mint(mintBody);
     if (!delegationResponse.ok) throw new Error(`v3 policy delegation rejected (${delegationResponse.status})`);
     const delegation = object3(await delegationResponse.json(), "v3 policy delegation");
     if (delegation.admitted !== true || typeof delegation.sessionCid !== "string" || typeof delegation.authorization !== "string") throw new Error("v3 policy delegation response is not admitted");
@@ -8655,6 +8708,7 @@ async function openNativeShare(sharing, link) {
   authorizationMethodForTarget,
   authorizeShare,
   canonicalOwnerSharePolicy,
+  canonicalShareFilename,
   canonicalize,
   checkBearerDelegation,
   claimShare,
@@ -8666,6 +8720,7 @@ async function openNativeShare(sharing, link) {
   createShareV2HolderBindingArtifact,
   deliverCredentialInvitation,
   fromBase64Url,
+  hasUnsafeFilenameCodePoint,
   historyRecordForPublishedShare,
   inspectShare,
   listShares,