@tinycloud/share-sdk 1.2.0-beta.5 → 1.2.0-beta.6

package/dist/share-root.cjs

@@ -42,6 +42,8 @@ __export(share_root_entry_exports, {
   ownerRootCacaoCid: () => ownerRootCacaoCid,
   perShareNetworkIdFor: () => perShareNetworkIdFor,
   planShareControlBatches: () => planShareControlBatches,
+  publishRootBearerLink: () => publishRootBearerLink,
+  revokeRootBearerLink: () => revokeRootBearerLink,
   revokeShareGrant: () => revokeShareGrant,
   runShareControlBatch: () => runShareControlBatch,
   signShareKeyDelegation: () => signShareKeyDelegation
@@ -6976,6 +6978,35 @@ var ShareRoot = class _ShareRoot {
   covers(expiresAt, now = this.#now()) {
     return this.#key !== void 0 && now < this.expiresAt.getTime() && expiresAt.getTime() <= this.expiresAt.getTime();
   }
+  /**
+   * Sign a 60-second `POST /revoke` invocation, by the share key, for one
+   * delegation this root issued (a bearer link). Zero approvals. The Node
+   * authorizes it because the share key is that delegation's delegator. The
+   * root itself is never revoked this way: only the owner does that.
+   */
+  async signLinkRevocation(input) {
+    const key = this.#activeKey();
+    if (typeof input.delegationCid !== "string" || !/^b[a-z2-7]+$/.test(input.delegationCid)) throw new ShareRootError("invalid-request", "delegation CID is invalid");
+    if (input.delegationCid === this.cid) throw new ShareRootError("invalid-request", "the share key does not revoke its own root; the owner does");
+    try {
+      ed25519PublicKeyFromDidKey(input.nodeDid);
+    } catch {
+      throw new ShareRootError("invalid-request", "node DID must be an Ed25519 did:key");
+    }
+    const now = seconds(this.#now());
+    const revocation = await signCompactUcanAuthorization({
+      issuerDid: key.did,
+      audienceDid: input.nodeDid,
+      attenuation: { [`urn:cid:${input.delegationCid}`]: { "tinycloud.delegation/revoke": [{}] } },
+      facts: [{}],
+      proofs: [],
+      notBefore: now,
+      expiresAt: now + 60,
+      nonce: `urn:uuid:${crypto.randomUUID()}`,
+      sign: (bytes2) => key.sign(bytes2)
+    });
+    return revocation.authorization;
+  }
   /**
    * Sign a bearer link: `kv/get` on one exact key under the prefix, to the
    * link's own key, with this root as its only proof. It never outlives the
@@ -7758,6 +7789,69 @@ async function runShareControlBatch(input) {
     key.clear();
   }
 }
+
+// src/share-root-link.ts
+var import_ed255196 = require("@noble/curves/ed25519");
+
+// src/native.ts
+var NATIVE_SHARE_FRAGMENT_PARAMETER = "tc1";
+function canonicalViewerUrl(viewerOrigin) {
+  const url = new URL(viewerOrigin);
+  if (url.protocol !== "https:" || url.origin !== viewerOrigin || url.pathname !== "/" || url.search || url.hash) throw new TypeError("viewer origin must be a canonical HTTPS origin");
+  url.pathname = "/viewer";
+  return url;
+}
+
+// src/share-root-link.ts
+async function publishRootBearerLink(input) {
+  const fetchFn = input.fetch ?? ((url, init) => globalThis.fetch(url, init));
+  const viewerUrl = canonicalViewerUrl(input.viewerOrigin);
+  const secret = import_ed255196.ed25519.utils.randomPrivateKey();
+  try {
+    const publicKey = import_ed255196.ed25519.getPublicKey(secret);
+    const linkDid = didKeyFromEd25519PublicKey(publicKey);
+    const link = await input.root.signBearerLink({ linkDid, path: input.path, expiresAt: input.expiresAt });
+    const response = await fetchFn(new URL("/delegate", input.root.nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: link.delegation.authorization } });
+    if (!response.ok) throw new ShareRootError("node-refused", `the Node refused the link delegation: HTTP ${response.status} ${(await response.text()).slice(0, 120)}`, { rootCid: input.root.cid });
+    const createdAt = /* @__PURE__ */ new Date();
+    const shareData = {
+      key: { kty: "OKP", crv: "Ed25519", x: toBase64Url(publicKey), d: toBase64Url(secret) },
+      keyDid: `${linkDid}#${linkDid.slice("did:key:".length)}`,
+      delegation: {
+        cid: link.delegation.cid,
+        delegateDID: linkDid,
+        delegatorDID: input.root.keyDid,
+        spaceId: input.root.spaceId,
+        path: input.path,
+        actions: ["tinycloud.kv/get"],
+        expiry: link.expiresAt,
+        isRevoked: false,
+        allowSubDelegation: true,
+        createdAt,
+        parentCid: input.root.cid,
+        authHeader: link.delegation.authorization
+      },
+      path: input.path,
+      host: input.root.nodeOrigin,
+      spaceId: input.root.spaceId,
+      version: 1
+    };
+    const token = `tc1:${toBase64Url(new TextEncoder().encode(JSON.stringify(shareData)))}`;
+    viewerUrl.hash = `${NATIVE_SHARE_FRAGMENT_PARAMETER}=${encodeURIComponent(token)}`;
+    return { url: viewerUrl.toString(), delegationCid: link.delegation.cid, rootCid: input.root.cid, spaceId: input.root.spaceId, path: input.path, expiresAt: link.expiresAt };
+  } finally {
+    secret.fill(0);
+  }
+}
+async function revokeRootBearerLink(input) {
+  const fetchFn = input.fetch ?? ((url, init) => globalThis.fetch(url, init));
+  const nodeDid = await nodeDidOf(input.root.nodeOrigin, fetchFn);
+  const authorization = await input.root.signLinkRevocation({ delegationCid: input.delegationCid, nodeDid });
+  const response = await fetchFn(new URL("/revoke", input.root.nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: authorization } });
+  if (!response.ok) throw new ShareRootError("node-refused", `the Node refused the link revocation: HTTP ${response.status} ${(await response.text()).slice(0, 120)}`, { rootCid: input.root.cid });
+  if (!await isRevokeReceiptFor(response, input.delegationCid)) throw new ShareRootError("invalid-request", "link revocation receipt does not confirm this delegation");
+  return { revoked: true, cid: input.delegationCid };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AGENT_SHARE_ROOT_MAX_LIFETIME_MS,
@@ -7782,6 +7876,8 @@ async function runShareControlBatch(input) {
   ownerRootCacaoCid,
   perShareNetworkIdFor,
   planShareControlBatches,
+  publishRootBearerLink,
+  revokeRootBearerLink,
   revokeShareGrant,
   runShareControlBatch,
   signShareKeyDelegation