@tinycloud/share-sdk 1.3.0 → 1.4.0

package/dist/{web-recipient-entry-D9IJEyRA.d.cts → web-recipient-entry-CiUzdSQs.d.cts}

@@ -27,9 +27,17 @@ interface ShareErrorInfo {
     };
 }
 declare function toShareErrorInfo(error: unknown): ShareErrorInfo;
-/** Policy/v3 links seal their authorization metadata in a fragment; no blob fetch adapter exists. */
+/**
+ * A Policy/v3 link is a `v=4` link: a short link whose sealed envelope the links
+ * API serves, or a full link that carries it. The key and body CID stay in the
+ * fragment and are never sent.
+ */
 interface ShareFetchOptions {
+    /** The trusted viewer origin. Defaults to the link's own origin. */
     readonly expectedOrigin?: string;
+    /** The links API origin a short link is read from. A link never names it. Defaults to `https://api.tinycloud.xyz`. */
+    readonly apiOrigin?: string;
+    readonly fetch?: typeof globalThis.fetch;
     readonly signal?: AbortSignal;
     readonly now?: () => number;
     readonly maxSealedBlobBytes?: number;

package/dist/{web-recipient-entry-CKA_vCi5.d.ts → web-recipient-entry-DVyTQBl0.d.ts}

@@ -27,9 +27,17 @@ interface ShareErrorInfo {
     };
 }
 declare function toShareErrorInfo(error: unknown): ShareErrorInfo;
-/** Policy/v3 links seal their authorization metadata in a fragment; no blob fetch adapter exists. */
+/**
+ * A Policy/v3 link is a `v=4` link: a short link whose sealed envelope the links
+ * API serves, or a full link that carries it. The key and body CID stay in the
+ * fragment and are never sent.
+ */
 interface ShareFetchOptions {
+    /** The trusted viewer origin. Defaults to the link's own origin. */
     readonly expectedOrigin?: string;
+    /** The links API origin a short link is read from. A link never names it. Defaults to `https://api.tinycloud.xyz`. */
+    readonly apiOrigin?: string;
+    readonly fetch?: typeof globalThis.fetch;
     readonly signal?: AbortSignal;
     readonly now?: () => number;
     readonly maxSealedBlobBytes?: number;

package/dist/web-recipient.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from2, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/web-recipient-entry.ts
@@ -4942,7 +4952,8 @@ function isCanonicalRawCid(cidString) {
   } catch {
     return false;
   }
-  return cid.version === 1 && cid.code === code && cid.multihash.code === SHA256_CODE && cid.toString() === cidString;
+  return cid.version === 1 && cid.code === code && cid.multihash.code === SHA256_CODE && // `toString` of a parsed CID gives back the string it was parsed from; a fresh CID is encoded again.
+  CID.createV1(cid.code, cid.multihash).toString() === cidString;
 }
 var base64 = rfc4648({
   prefix: "m",
@@ -5399,51 +5410,7 @@ function validateV3Invariants(value, ctx) {
 var unsignedShareEnvelopeV3Schema = unsignedShareEnvelopeV3BaseSchema.superRefine(validateV3Invariants);
 var shareEnvelopeV3Schema = unsignedShareEnvelopeV3BaseSchema.extend({ signature: signatureSchema }).strict().superRefine(validateV3Invariants);
 var ENVELOPE_AAD_LABEL = "tinycloud-share-envelope-v1";
-var SEALED_BLOB_VERSION = 1;
 var AAD = utf8Bytes(ENVELOPE_AAD_LABEL);
-var KEY_LENGTH = 32;
-var NONCE_LENGTH = 12;
-var TAG_LENGTH = 16;
-var HEADER_LENGTH = 1;
-function assertKey(key32) {
-  if (key32.length !== KEY_LENGTH) {
-    throw new TypeError(`key must be ${KEY_LENGTH} bytes, got ${key32.length}`);
-  }
-}
-async function importAesKey(key32, usage) {
-  assertKey(key32);
-  return globalThis.crypto.subtle.importKey(
-    "raw",
-    key32,
-    "AES-GCM",
-    false,
-    [usage]
-  );
-}
-async function open(blob, key32) {
-  if (blob.length < HEADER_LENGTH + NONCE_LENGTH + TAG_LENGTH) {
-    throw new TypeError(`sealed blob too short: ${blob.length} bytes`);
-  }
-  if (blob[0] !== SEALED_BLOB_VERSION) {
-    throw new TypeError(`unknown sealed blob version: ${blob[0]}`);
-  }
-  const nonce = blob.subarray(HEADER_LENGTH, HEADER_LENGTH + NONCE_LENGTH);
-  const ciphertext = blob.subarray(HEADER_LENGTH + NONCE_LENGTH);
-  return decryptEnvelope(nonce, ciphertext, key32);
-}
-async function decryptEnvelope(nonce, ciphertext, key32) {
-  if (nonce.length !== NONCE_LENGTH) {
-    throw new TypeError(`nonce must be ${NONCE_LENGTH} bytes, got ${nonce.length}`);
-  }
-  const key = await importAesKey(key32, "decrypt");
-  return new Uint8Array(
-    await globalThis.crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: nonce, additionalData: AAD },
-      key,
-      ciphertext
-    )
-  );
-}
 function isPlainRecord(value) {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
@@ -5675,56 +5642,6 @@ function base32Lower(bytes) {
   if (bits > 0) output += alphabet[buffer << 5 - bits & 31];
   return output;
 }
-var KEY_LENGTH2 = 32;
-var MAX_INLINE_BYTES = 256 * 1024;
-function assertCanonicalCid(cidString) {
-  const cid = CID.parse(cidString);
-  if (cid.version !== 1 || cid.code !== code || cid.multihash.code !== 18 || // sha2-256 (0x12) only, at the link layer too
-  cid.toString() !== cidString) {
-    throw new TypeError(`not a canonical CIDv1 raw sha2-256 base32 CID: ${cidString}`);
-  }
-}
-async function parseSealedInlineShareUrl(url, options = {}) {
-  const parsed = new URL(url);
-  if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") throw new TypeError("sealed inline share URL must be canonical HTTPS without userinfo");
-  if (!isCanonicalHttpsOrigin(parsed.origin) || options.expectedOrigin !== void 0 && parsed.origin !== options.expectedOrigin) throw new TypeError("sealed inline share URL origin is not trusted");
-  if (parsed.pathname !== "/s/inline" || parsed.search !== "") throw new TypeError("not a Node sealed-inline share URL");
-  if (url !== `${parsed.origin}/s/inline${parsed.hash}`) throw new TypeError("sealed inline share URL is not lexically canonical");
-  const prefix = "#v=2&p=";
-  if (!parsed.hash.startsWith(prefix)) throw new TypeError("sealed inline URL is missing its canonical fragment");
-  const encoded = parsed.hash.slice(prefix.length);
-  if (encoded.length === 0 || parsed.hash !== `${prefix}${encoded}`) throw new TypeError("sealed inline URL fragment is not canonical");
-  let payloadBytes;
-  try {
-    payloadBytes = fromBase64Url(encoded);
-  } catch {
-    throw new TypeError("sealed inline payload is not canonical base64url");
-  }
-  if (payloadBytes.byteLength === 0 || payloadBytes.byteLength > MAX_INLINE_BYTES * 2) throw new TypeError("sealed inline payload is too large");
-  const payloadText = new TextDecoder("utf-8", { fatal: true }).decode(payloadBytes);
-  let value;
-  try {
-    value = JSON.parse(payloadText);
-  } catch {
-    throw new TypeError("sealed inline payload is not valid JSON");
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value) || canonicalize(value) !== payloadText) throw new TypeError("sealed inline payload is not canonical JSON");
-  const record = value;
-  if (Object.keys(record).length !== 4 || record.v !== 2 || typeof record.c !== "string" || typeof record.cid !== "string" || typeof record.k !== "string") throw new TypeError("sealed inline payload has invalid fields");
-  let ciphertext;
-  let key32;
-  try {
-    ciphertext = fromBase64Url(record.c);
-    key32 = fromBase64Url(record.k);
-  } catch {
-    throw new TypeError("sealed inline payload has invalid base64url material");
-  }
-  if (ciphertext.byteLength === 0 || ciphertext.byteLength > MAX_INLINE_BYTES) throw new TypeError("sealed inline ciphertext is outside the allowed size");
-  if (key32.byteLength !== KEY_LENGTH2) throw new TypeError("sealed inline key must be 32 bytes");
-  assertCanonicalCid(record.cid);
-  if (await computeCid(ciphertext) !== record.cid) throw new TypeError("sealed inline ciphertext does not match its CID");
-  return { kind: "inline", ciphertextCid: record.cid, ciphertext, key32 };
-}
 
 // src/artifact-core.ts
 var ARTIFACT_ROOT = "artifacts";
@@ -5839,26 +5756,80 @@ function metadataFor(envelope, origin) {
     ...envelope.artifactPin === void 0 ? {} : { artifact: { id: envelope.artifactPin.artifactId, version: envelope.artifactPin.version } }
   };
 }
+function receiveErrorFor(error) {
+  switch (error.code) {
+    case "origin_not_trusted":
+      return new ShareReceiveError("origin-mismatch", "share link origin is not trusted");
+    case "body_over_cap":
+    case "response_too_large":
+      return new ShareReceiveError("max-bytes-exceeded", "sealed policy envelope exceeds the size limit");
+    case "body_hash_mismatch":
+    case "link_cid_mismatch":
+      return new ShareReceiveError("cid-mismatch", "sealed envelope bytes do not match the link CID");
+    case "body_open_failed":
+      return new ShareReceiveError("decrypt-failed", "share envelope could not be opened");
+    case "gone":
+    case "expired":
+      return new ShareReceiveError("expired", "share link has expired, was deleted, or never existed");
+    case "bad_signature":
+    case "issuer_binding_mismatch":
+      return new ShareReceiveError("signature-invalid", "share link signature is invalid");
+    case "service_refused":
+    case "service_unavailable":
+    case "invalid_response":
+      return new ShareReceiveError("fetch-failed", "share link could not be fetched");
+    case "not_a_url":
+    case "not_https":
+    case "userinfo":
+    case "not_canonical":
+    case "query_present":
+    case "removed_version":
+    case "path_grammar":
+    case "fragment_grammar":
+    case "key_noncanonical":
+    case "cid_grammar":
+    case "record_encoding":
+    case "record_json":
+    case "record_not_canonical":
+    case "type_path_mismatch":
+    case "full_non_share":
+      return new ShareReceiveError("invalid-link", "share link format is invalid");
+    default:
+      return new ShareReceiveError("envelope-invalid", "share envelope is invalid");
+  }
+}
 async function resolvePolicyShare(link, options) {
   options.signal?.throwIfAborted();
   let url;
-  let parsed;
   try {
     url = new URL(link);
-    parsed = await parseSealedInlineShareUrl(link, { ...options.expectedOrigin === void 0 ? {} : { expectedOrigin: options.expectedOrigin } });
   } catch {
     throw new ShareReceiveError("invalid-link", "share link format is invalid");
   }
+  const links = await import("@tinycloud/share-envelope/links");
+  let resolved;
+  try {
+    resolved = await links.resolveLink(link, {
+      trustedOrigins: [options.expectedOrigin ?? url.origin],
+      apiOrigin: options.apiOrigin ?? links.DEFAULT_LINKS_API_ORIGIN,
+      ...options.fetch === void 0 ? {} : { fetch: options.fetch },
+      ...options.signal === void 0 ? {} : { signal: options.signal },
+      now: options.now?.() ?? Date.now()
+    });
+  } catch (error) {
+    options.signal?.throwIfAborted();
+    throw error instanceof links.LinkError ? receiveErrorFor(error) : error;
+  }
+  if (resolved.type !== "share") throw new ShareReceiveError("invalid-link", "share link is not a share");
   const limit = options.maxSealedBlobBytes ?? DEFAULT_MAX_SEALED_BLOB_BYTES;
-  if (!Number.isSafeInteger(limit) || limit <= 0 || parsed.ciphertext.byteLength > limit) throw new ShareReceiveError("max-bytes-exceeded", "sealed policy envelope exceeds the configured byte limit");
-  if (await computeCid(parsed.ciphertext) !== parsed.ciphertextCid) throw new ShareReceiveError("cid-mismatch", "sealed envelope bytes do not match the link CID");
+  if (!Number.isSafeInteger(limit) || limit <= 0 || resolved.body.byteLength > limit) throw new ShareReceiveError("max-bytes-exceeded", "sealed policy envelope exceeds the configured byte limit");
+  const cid = resolved.header.bodyCid;
   options.signal?.throwIfAborted();
   let envelope;
   try {
-    const encoded = new TextDecoder("utf-8", { fatal: true }).decode(await open(parsed.ciphertext, parsed.key32));
-    const value = JSON.parse(encoded);
-    if (canonicalize(value) !== encoded) throw new Error("non-canonical envelope");
-    envelope = shareEnvelopeV3Schema.parse(value);
+    const encoded = new TextDecoder("utf-8", { fatal: true }).decode(resolved.plaintext);
+    if (canonicalize(resolved.value) !== encoded) throw new Error("non-canonical envelope");
+    envelope = shareEnvelopeV3Schema.parse(resolved.value);
   } catch {
     throw new ShareReceiveError("envelope-invalid", "share envelope is invalid");
   }
@@ -5877,8 +5848,8 @@ async function resolvePolicyShare(link, options) {
   const expiry = Date.parse(envelope.expiry);
   if (!Number.isFinite(expiry)) throw new ShareReceiveError("envelope-invalid", "share expiry is invalid");
   if (expiry <= (options.now?.() ?? Date.now())) throw new ShareReceiveError("expired", "share has expired", { expiresAt: envelope.expiry });
-  options.onResolvedAddressedEnvelope?.(envelope, parsed.ciphertextCid);
-  return { envelope, origin: url.origin, cid: parsed.ciphertextCid };
+  options.onResolvedAddressedEnvelope?.(envelope, cid);
+  return { envelope, origin: url.origin, cid };
 }
 async function inspectShare(link, options = {}) {
   const resolved = await resolvePolicyShare(link, options);