@tinycloud/share-sdk 1.2.0-beta.4 → 1.2.0-beta.6

package/dist/share-root.cjs

@@ -42,6 +42,8 @@ __export(share_root_entry_exports, {
   ownerRootCacaoCid: () => ownerRootCacaoCid,
   perShareNetworkIdFor: () => perShareNetworkIdFor,
   planShareControlBatches: () => planShareControlBatches,
+  publishRootBearerLink: () => publishRootBearerLink,
+  revokeRootBearerLink: () => revokeRootBearerLink,
   revokeShareGrant: () => revokeShareGrant,
   runShareControlBatch: () => runShareControlBatch,
   signShareKeyDelegation: () => signShareKeyDelegation
@@ -5356,6 +5358,20 @@ var v3TargetSchema = external_exports.object({
   nodeAudience: external_exports.string().min(1),
   spaceId: external_exports.string().refine(isCanonicalPathSegment, { message: "expected a canonical space id" })
 }).strict();
+var ARTIFACT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{2,62}$/;
+var artifactPinSchema = external_exports.object({
+  v: external_exports.literal(1),
+  artifactId: external_exports.string().regex(ARTIFACT_ID_PATTERN),
+  version: external_exports.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+  /** SHA-256 (lowercase hex) of the exact `manifest.json` bytes. The manifest itself stays an owner-side record. */
+  manifestSha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  /** An addressed share reads one exact file, so exactly one entry: the stored bytes (ciphertext) it will fetch. */
+  files: external_exports.array(external_exports.object({
+    path: external_exports.string().min(1).max(255),
+    sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+    bytes: external_exports.number().int().nonnegative()
+  }).strict()).length(1)
+}).strict();
 var unsignedShareEnvelopeV3BaseSchema = external_exports.object({
   version: external_exports.literal(3),
   shareId: external_exports.string().min(1),
@@ -5375,7 +5391,13 @@ var unsignedShareEnvelopeV3BaseSchema = external_exports.object({
   expiry: external_exports.string().datetime({ offset: true }),
   display: displaySchema,
   encrypted: external_exports.literal(true),
-  metadata: contentMetadataSchema
+  metadata: contentMetadataSchema,
+  /**
+   * TC-1428: an owner-signed statement that this share reads one write-once artifact version. Additive: absent on
+   * every other share, and covered by the envelope signature because the signature spans the whole unsigned object.
+   * The shape is checked here; its binding to the content source is `verifyArtifactShare` in share-sdk.
+   */
+  artifactPin: artifactPinSchema.optional()
 }).strict();
 function validateV3Invariants(value, ctx) {
   const actions = [...value.actions];
@@ -6956,6 +6978,35 @@ var ShareRoot = class _ShareRoot {
   covers(expiresAt, now = this.#now()) {
     return this.#key !== void 0 && now < this.expiresAt.getTime() && expiresAt.getTime() <= this.expiresAt.getTime();
   }
+  /**
+   * Sign a 60-second `POST /revoke` invocation, by the share key, for one
+   * delegation this root issued (a bearer link). Zero approvals. The Node
+   * authorizes it because the share key is that delegation's delegator. The
+   * root itself is never revoked this way: only the owner does that.
+   */
+  async signLinkRevocation(input) {
+    const key = this.#activeKey();
+    if (typeof input.delegationCid !== "string" || !/^b[a-z2-7]+$/.test(input.delegationCid)) throw new ShareRootError("invalid-request", "delegation CID is invalid");
+    if (input.delegationCid === this.cid) throw new ShareRootError("invalid-request", "the share key does not revoke its own root; the owner does");
+    try {
+      ed25519PublicKeyFromDidKey(input.nodeDid);
+    } catch {
+      throw new ShareRootError("invalid-request", "node DID must be an Ed25519 did:key");
+    }
+    const now = seconds(this.#now());
+    const revocation = await signCompactUcanAuthorization({
+      issuerDid: key.did,
+      audienceDid: input.nodeDid,
+      attenuation: { [`urn:cid:${input.delegationCid}`]: { "tinycloud.delegation/revoke": [{}] } },
+      facts: [{}],
+      proofs: [],
+      notBefore: now,
+      expiresAt: now + 60,
+      nonce: `urn:uuid:${crypto.randomUUID()}`,
+      sign: (bytes2) => key.sign(bytes2)
+    });
+    return revocation.authorization;
+  }
   /**
    * Sign a bearer link: `kv/get` on one exact key under the prefix, to the
    * link's own key, with this root as its only proof. It never outlives the
@@ -7029,6 +7080,8 @@ async function ensureShareRoot(input) {
 
 // src/artifact.ts
 var import_sha2563 = require("@noble/hashes/sha256");
+
+// src/artifact-core.ts
 function parseArtifactVersionPath(path) {
   const match = /^artifacts\/([a-z0-9][a-z0-9_-]{2,62})\/versions\/([1-9][0-9]{0,14})\/([^/]+)$/.exec(path);
   if (match === null) return void 0;
@@ -7736,6 +7789,69 @@ async function runShareControlBatch(input) {
     key.clear();
   }
 }
+
+// src/share-root-link.ts
+var import_ed255196 = require("@noble/curves/ed25519");
+
+// src/native.ts
+var NATIVE_SHARE_FRAGMENT_PARAMETER = "tc1";
+function canonicalViewerUrl(viewerOrigin) {
+  const url = new URL(viewerOrigin);
+  if (url.protocol !== "https:" || url.origin !== viewerOrigin || url.pathname !== "/" || url.search || url.hash) throw new TypeError("viewer origin must be a canonical HTTPS origin");
+  url.pathname = "/viewer";
+  return url;
+}
+
+// src/share-root-link.ts
+async function publishRootBearerLink(input) {
+  const fetchFn = input.fetch ?? ((url, init) => globalThis.fetch(url, init));
+  const viewerUrl = canonicalViewerUrl(input.viewerOrigin);
+  const secret = import_ed255196.ed25519.utils.randomPrivateKey();
+  try {
+    const publicKey = import_ed255196.ed25519.getPublicKey(secret);
+    const linkDid = didKeyFromEd25519PublicKey(publicKey);
+    const link = await input.root.signBearerLink({ linkDid, path: input.path, expiresAt: input.expiresAt });
+    const response = await fetchFn(new URL("/delegate", input.root.nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: link.delegation.authorization } });
+    if (!response.ok) throw new ShareRootError("node-refused", `the Node refused the link delegation: HTTP ${response.status} ${(await response.text()).slice(0, 120)}`, { rootCid: input.root.cid });
+    const createdAt = /* @__PURE__ */ new Date();
+    const shareData = {
+      key: { kty: "OKP", crv: "Ed25519", x: toBase64Url(publicKey), d: toBase64Url(secret) },
+      keyDid: `${linkDid}#${linkDid.slice("did:key:".length)}`,
+      delegation: {
+        cid: link.delegation.cid,
+        delegateDID: linkDid,
+        delegatorDID: input.root.keyDid,
+        spaceId: input.root.spaceId,
+        path: input.path,
+        actions: ["tinycloud.kv/get"],
+        expiry: link.expiresAt,
+        isRevoked: false,
+        allowSubDelegation: true,
+        createdAt,
+        parentCid: input.root.cid,
+        authHeader: link.delegation.authorization
+      },
+      path: input.path,
+      host: input.root.nodeOrigin,
+      spaceId: input.root.spaceId,
+      version: 1
+    };
+    const token = `tc1:${toBase64Url(new TextEncoder().encode(JSON.stringify(shareData)))}`;
+    viewerUrl.hash = `${NATIVE_SHARE_FRAGMENT_PARAMETER}=${encodeURIComponent(token)}`;
+    return { url: viewerUrl.toString(), delegationCid: link.delegation.cid, rootCid: input.root.cid, spaceId: input.root.spaceId, path: input.path, expiresAt: link.expiresAt };
+  } finally {
+    secret.fill(0);
+  }
+}
+async function revokeRootBearerLink(input) {
+  const fetchFn = input.fetch ?? ((url, init) => globalThis.fetch(url, init));
+  const nodeDid = await nodeDidOf(input.root.nodeOrigin, fetchFn);
+  const authorization = await input.root.signLinkRevocation({ delegationCid: input.delegationCid, nodeDid });
+  const response = await fetchFn(new URL("/revoke", input.root.nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: authorization } });
+  if (!response.ok) throw new ShareRootError("node-refused", `the Node refused the link revocation: HTTP ${response.status} ${(await response.text()).slice(0, 120)}`, { rootCid: input.root.cid });
+  if (!await isRevokeReceiptFor(response, input.delegationCid)) throw new ShareRootError("invalid-request", "link revocation receipt does not confirm this delegation");
+  return { revoked: true, cid: input.delegationCid };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AGENT_SHARE_ROOT_MAX_LIFETIME_MS,
@@ -7760,6 +7876,8 @@ async function runShareControlBatch(input) {
   ownerRootCacaoCid,
   perShareNetworkIdFor,
   planShareControlBatches,
+  publishRootBearerLink,
+  revokeRootBearerLink,
   revokeShareGrant,
   runShareControlBatch,
   signShareKeyDelegation