@tinycloud/share-sdk 1.3.0-beta.0 → 1.4.0-beta.0

package/README.md

@@ -3,3 +3,9 @@
 ## Subpath exports
 
 - `@tinycloud/share-sdk/web-recipient`: `inspectShare`, `ShareRecipientClient`, and the `ShareMetadata` type. The browser recipient surface, imported without the package root barrel. Its contents are fixed to these three names.
+
+The web-recipient subpath is its own build entry, built with splitting: false, so it ships its own copies of inspectShare and ShareRecipientClient. Use the subpath's exports together, and check results by their fields rather than by class identity.
+
+The credential witness answers browser requests only for the origins it is configured with.
+
+openerOrigin and completionOrigin must be https origins (openerOrigin defaults to the page's own origin): web-sdk credential acquisition rejects anything else, and the witness enforces the same rule.

package/dist/{addressed-publish-Db-6rqkA.d.cts → addressed-publish-BP6nsgRq.d.cts}

@@ -1,5 +1,5 @@
 import { UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1, ArtifactPin } from '@tinycloud/share-envelope';
-import { d as SharePublishTarget, c as PublishedShare, e as SharePublishOptions, O as OwnerShareAction, P as PublishedShareDeliveryMaterial } from './owner-policy-CRFeEC98.cjs';
+import { d as SharePublishTarget, c as PublishedShare, e as SharePublishOptions, O as OwnerShareAction, P as PublishedShareDeliveryMaterial, f as SharePublishError } from './owner-policy-aPmXIR3e.cjs';
 import { S as ShareAuthorizationRequired, a as ShareAuthorizationMethod } from './authorization-CmP1skO8.cjs';
 
 type ShareTarget = SharePublishTarget;
@@ -112,6 +112,8 @@ interface AddressedPublishAuthority {
 interface AddressedSharePublishOptions {
     readonly shareId: string;
     readonly shareOrigin: string;
+    /** The links API origin written into the signed header as its audience. Defaults to `https://api.tinycloud.xyz`. */
+    readonly apiOrigin?: string;
     readonly nodeOrigin: string;
     readonly nodeAudience: string;
     readonly enforcerDid: string;
@@ -163,5 +165,59 @@ interface PreparedAddressedShare {
 declare function prepareAddressedShare(request: AddressedShareRequest): PreparedAddressedShare;
 /** Canonical application-neutral Policy/v3 addressed publisher shared by browser and CLI. */
 declare function publishAddressedShare(input: AddressedSharePublishOptions): Promise<PublishedShare>;
+/** The text a share gets when its sealed envelope cannot fit in a link. */
+declare const ADDRESSED_SHARE_TOO_LARGE_MESSAGE = "This share is too large to send as a link, so nothing was shared. Use a shorter path or fewer folders.";
+/** What a publish has written by the time its sealed envelope is measured. */
+interface AddressedShareWrites {
+    readonly policyCid: string;
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+}
+/**
+ * Thrown by `publishAddressedShare` when the sealed envelope, measured after
+ * the policy registration, is over `MAX_LINK_BODY_BYTES`. The size bound makes
+ * this unreachable for a correct caller; if it happens, `written` names what
+ * the publish registered so the caller can remove it. No link was built.
+ */
+declare class AddressedShareOverLimitError extends SharePublishError {
+    readonly written: AddressedShareWrites;
+    constructor(written: AddressedShareWrites);
+}
+/** What a sender knows before any write; see {@link addressedShareBodyUpperBound}. */
+interface AddressedShareBoundInput extends AddressedShareRequest {
+    readonly shareId: string;
+    readonly ownerDid: string;
+    readonly nodeOrigin: string;
+    readonly nodeAudience: string;
+    readonly enforcerDid: string;
+    readonly spaceId: string;
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+    };
+    /** Where the content will be stored: a path, or the id and stored file name of an artifact (whose version number the publish assigns). */
+    readonly storage: {
+        readonly path: string;
+    } | {
+        readonly artifactId: string;
+        readonly storageName: string;
+    };
+    /** The owner's encryption network for the space. */
+    readonly encryptionNetwork: string;
+    readonly mediaType: string;
+    readonly byteLength: number;
+    readonly artifact?: "html";
+    readonly expiresAt: Date;
+}
+/**
+ * The largest sealed envelope a share can have, in bytes, computed before any
+ * write (upload, registration, registry or KV write): the same envelope the
+ * publish builds, with every value a write returns at its maximum encoded
+ * length (see `sealedBodyUpperBound`). Compare it with `MAX_LINK_BODY_BYTES`.
+ * For an artifact share the version, the manifest digest and the stored size
+ * are taken at their largest.
+ */
+declare function addressedShareBodyUpperBound(input: AddressedShareBoundInput): Promise<number>;
+/** Refuses (`SharePublishError`, code `max-bytes-exceeded`, {@link ADDRESSED_SHARE_TOO_LARGE_MESSAGE}) a share whose largest sealed envelope is over `MAX_LINK_BODY_BYTES`. Call it before any write. */
+declare function assertAddressedShareFits(input: AddressedShareBoundInput): Promise<void>;
 
-export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareTarget as S, type TargetPublishOutcome as T, type AddressedOwnerRootReceipt as a, type AddressedPublishAuthority as b, type TargetPublishInput as c, type AddressedPolicyRegistrationInput as d, type AddressedPolicyRegistrationReceipt as e, type AddressedSharePublishOptions as f, type AddressedShareRequest as g, type TargetPublishAdapter as h, addressedCredentialRequirement as i, publishAddressedShare as j, publishTargetShare as k, normalizeShareTarget as n, prepareAddressedShare as p, targetAuthorizationMethod as t };
+export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareTarget as S, type TargetPublishOutcome as T, type AddressedOwnerRootReceipt as a, type AddressedPublishAuthority as b, type TargetPublishInput as c, ADDRESSED_SHARE_TOO_LARGE_MESSAGE as d, type AddressedPolicyRegistrationInput as e, type AddressedPolicyRegistrationReceipt as f, type AddressedShareBoundInput as g, AddressedShareOverLimitError as h, type AddressedSharePublishOptions as i, type AddressedShareRequest as j, type AddressedShareWrites as k, type TargetPublishAdapter as l, addressedCredentialRequirement as m, addressedShareBodyUpperBound as n, assertAddressedShareFits as o, normalizeShareTarget as p, prepareAddressedShare as q, publishAddressedShare as r, publishTargetShare as s, targetAuthorizationMethod as t };

package/dist/{addressed-publish-CAdGCqiX.d.ts → addressed-publish-CpkwV-Au.d.ts}

@@ -1,5 +1,5 @@
 import { UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1, ArtifactPin } from '@tinycloud/share-envelope';
-import { d as SharePublishTarget, c as PublishedShare, e as SharePublishOptions, O as OwnerShareAction, P as PublishedShareDeliveryMaterial } from './owner-policy-CRFeEC98.js';
+import { d as SharePublishTarget, c as PublishedShare, e as SharePublishOptions, O as OwnerShareAction, P as PublishedShareDeliveryMaterial, f as SharePublishError } from './owner-policy-aPmXIR3e.js';
 import { S as ShareAuthorizationRequired, a as ShareAuthorizationMethod } from './authorization-CmP1skO8.js';
 
 type ShareTarget = SharePublishTarget;
@@ -112,6 +112,8 @@ interface AddressedPublishAuthority {
 interface AddressedSharePublishOptions {
     readonly shareId: string;
     readonly shareOrigin: string;
+    /** The links API origin written into the signed header as its audience. Defaults to `https://api.tinycloud.xyz`. */
+    readonly apiOrigin?: string;
     readonly nodeOrigin: string;
     readonly nodeAudience: string;
     readonly enforcerDid: string;
@@ -163,5 +165,59 @@ interface PreparedAddressedShare {
 declare function prepareAddressedShare(request: AddressedShareRequest): PreparedAddressedShare;
 /** Canonical application-neutral Policy/v3 addressed publisher shared by browser and CLI. */
 declare function publishAddressedShare(input: AddressedSharePublishOptions): Promise<PublishedShare>;
+/** The text a share gets when its sealed envelope cannot fit in a link. */
+declare const ADDRESSED_SHARE_TOO_LARGE_MESSAGE = "This share is too large to send as a link, so nothing was shared. Use a shorter path or fewer folders.";
+/** What a publish has written by the time its sealed envelope is measured. */
+interface AddressedShareWrites {
+    readonly policyCid: string;
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+}
+/**
+ * Thrown by `publishAddressedShare` when the sealed envelope, measured after
+ * the policy registration, is over `MAX_LINK_BODY_BYTES`. The size bound makes
+ * this unreachable for a correct caller; if it happens, `written` names what
+ * the publish registered so the caller can remove it. No link was built.
+ */
+declare class AddressedShareOverLimitError extends SharePublishError {
+    readonly written: AddressedShareWrites;
+    constructor(written: AddressedShareWrites);
+}
+/** What a sender knows before any write; see {@link addressedShareBodyUpperBound}. */
+interface AddressedShareBoundInput extends AddressedShareRequest {
+    readonly shareId: string;
+    readonly ownerDid: string;
+    readonly nodeOrigin: string;
+    readonly nodeAudience: string;
+    readonly enforcerDid: string;
+    readonly spaceId: string;
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+    };
+    /** Where the content will be stored: a path, or the id and stored file name of an artifact (whose version number the publish assigns). */
+    readonly storage: {
+        readonly path: string;
+    } | {
+        readonly artifactId: string;
+        readonly storageName: string;
+    };
+    /** The owner's encryption network for the space. */
+    readonly encryptionNetwork: string;
+    readonly mediaType: string;
+    readonly byteLength: number;
+    readonly artifact?: "html";
+    readonly expiresAt: Date;
+}
+/**
+ * The largest sealed envelope a share can have, in bytes, computed before any
+ * write (upload, registration, registry or KV write): the same envelope the
+ * publish builds, with every value a write returns at its maximum encoded
+ * length (see `sealedBodyUpperBound`). Compare it with `MAX_LINK_BODY_BYTES`.
+ * For an artifact share the version, the manifest digest and the stored size
+ * are taken at their largest.
+ */
+declare function addressedShareBodyUpperBound(input: AddressedShareBoundInput): Promise<number>;
+/** Refuses (`SharePublishError`, code `max-bytes-exceeded`, {@link ADDRESSED_SHARE_TOO_LARGE_MESSAGE}) a share whose largest sealed envelope is over `MAX_LINK_BODY_BYTES`. Call it before any write. */
+declare function assertAddressedShareFits(input: AddressedShareBoundInput): Promise<void>;
 
-export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareTarget as S, type TargetPublishOutcome as T, type AddressedOwnerRootReceipt as a, type AddressedPublishAuthority as b, type TargetPublishInput as c, type AddressedPolicyRegistrationInput as d, type AddressedPolicyRegistrationReceipt as e, type AddressedSharePublishOptions as f, type AddressedShareRequest as g, type TargetPublishAdapter as h, addressedCredentialRequirement as i, publishAddressedShare as j, publishTargetShare as k, normalizeShareTarget as n, prepareAddressedShare as p, targetAuthorizationMethod as t };
+export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareTarget as S, type TargetPublishOutcome as T, type AddressedOwnerRootReceipt as a, type AddressedPublishAuthority as b, type TargetPublishInput as c, ADDRESSED_SHARE_TOO_LARGE_MESSAGE as d, type AddressedPolicyRegistrationInput as e, type AddressedPolicyRegistrationReceipt as f, type AddressedShareBoundInput as g, AddressedShareOverLimitError as h, type AddressedSharePublishOptions as i, type AddressedShareRequest as j, type AddressedShareWrites as k, type TargetPublishAdapter as l, addressedCredentialRequirement as m, addressedShareBodyUpperBound as n, assertAddressedShareFits as o, normalizeShareTarget as p, prepareAddressedShare as q, publishAddressedShare as r, publishTargetShare as s, targetAuthorizationMethod as t };

package/dist/artifact.cjs

@@ -4955,7 +4955,8 @@ function isCanonicalRawCid(cidString) {
   } catch {
     return false;
   }
-  return cid.version === 1 && cid.code === code && cid.multihash.code === SHA256_CODE && cid.toString() === cidString;
+  return cid.version === 1 && cid.code === code && cid.multihash.code === SHA256_CODE && // `toString` of a parsed CID gives back the string it was parsed from; a fresh CID is encoded again.
+  CID.createV1(cid.code, cid.multihash).toString() === cidString;
 }
 var base64 = rfc4648({
   prefix: "m",
@@ -5460,7 +5461,6 @@ function serialize(value) {
 function canonicalize(value) {
   return serialize(value);
 }
-var MAX_INLINE_BYTES = 256 * 1024;
 
 // src/artifact.ts
 var import_sha2562 = require("@noble/hashes/sha256");