@tinycloud/share-sdk 1.4.1-beta.1 → 1.4.1-beta.2

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-export { D as DEFAULT_MAX_CONTENT_BLOB_BYTES, a as DEFAULT_MAX_SEALED_BLOB_BYTES, S as SHARE_RESULT_VERSION, b as ShareErrorCode, c as ShareErrorInfo, d as ShareFetchOptions, e as ShareInspection, f as ShareMetadata, g as ShareNodeTrust, h as SharePolicyAuthority, i as SharePolicyChallenge, j as SharePolicyDelegationLink, k as SharePolicyEvidence, l as SharePolicySession, m as SharePresentationMaterial, n as ShareReceiveAuthorizationRequired, o as ShareReceiveError, p as ShareReceiveOutcome, q as ShareReceiveResult, r as ShareRecipientClient, s as ShareRecipientClientOptions, t as createAddressedAuthorization, u as inspectShare, v as receiveShare, w as toShareErrorInfo } from './web-recipient-entry-Cy1fXl_5.cjs';
+export { D as DEFAULT_MAX_CONTENT_BLOB_BYTES, a as DEFAULT_MAX_SEALED_BLOB_BYTES, S as SHARE_RESULT_VERSION, b as ShareErrorCode, c as ShareErrorInfo, d as ShareFetchOptions, e as ShareInspection, f as ShareMetadata, g as ShareNodeTrust, h as SharePolicyAuthority, i as SharePolicyChallenge, j as SharePolicyDelegationLink, k as SharePolicyEvidence, l as SharePolicySession, m as SharePresentationMaterial, n as ShareReceiveAuthorizationRequired, o as ShareReceiveError, p as ShareReceiveOutcome, q as ShareReceiveResult, r as ShareRecipientClient, s as ShareRecipientClientOptions, t as createAddressedAuthorization, u as inspectShare, v as receiveShare, w as toShareErrorInfo } from './web-recipient-entry-Bn3yRB7g.cjs';
 export { C as CreateOwnerDelegationParams, h as DEFAULT_SHARE_LIFETIME_MS, D as DelegatedShareKey, M as MAX_CONTENT_BYTES, i as OWNER_SHARE_REGISTRATION_DOMAIN, j as OwnerDelegationPermission, g as OwnerDelegationReceipt, O as OwnerShareAction, k as OwnerShareDecryption, a as OwnerShareMatcher, l as OwnerSharePolicyRegistration, b as OwnerSharePolicyRegistrationReceipt, m as OwnerSharePolicyV2, c as PublishedShare, P as PublishedShareDeliveryMaterial, n as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, o as SHARE_CONTENT_LIMIT, p as SHARE_PUBLISH_RESULT_VERSION, f as SharePublishError, q as SharePublishErrorCode, e as SharePublishOptions, d as SharePublishTarget, S as SignedDelegation, r as canonicalOwnerSharePolicy, s as computeOwnerShareRegistrationCid, t as createDelegatedShareKey, u as createPolicyEnforcementDelegation, v as redactPublishedShare, w as restoreDelegatedShareKey, x as validateOwnerSharePolicyRegistration, y as validateOwnerSharePolicyRegistrationBytes } from './owner-policy-aPmXIR3e.cjs';
 import { ShareEnvelopeV2, ArtifactPin, UnsignedShareEnvelopeV3, ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 export { CheckBearerDelegationOptions, DelegationCheckResult, canonicalize, checkBearerDelegation, fromBase64Url, requiredResourceUri, resourceUriCovers, toBase64Url } from '@tinycloud/share-envelope';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { D as DEFAULT_MAX_CONTENT_BLOB_BYTES, a as DEFAULT_MAX_SEALED_BLOB_BYTES, S as SHARE_RESULT_VERSION, b as ShareErrorCode, c as ShareErrorInfo, d as ShareFetchOptions, e as ShareInspection, f as ShareMetadata, g as ShareNodeTrust, h as SharePolicyAuthority, i as SharePolicyChallenge, j as SharePolicyDelegationLink, k as SharePolicyEvidence, l as SharePolicySession, m as SharePresentationMaterial, n as ShareReceiveAuthorizationRequired, o as ShareReceiveError, p as ShareReceiveOutcome, q as ShareReceiveResult, r as ShareRecipientClient, s as ShareRecipientClientOptions, t as createAddressedAuthorization, u as inspectShare, v as receiveShare, w as toShareErrorInfo } from './web-recipient-entry-CPntAP0H.js';
+export { D as DEFAULT_MAX_CONTENT_BLOB_BYTES, a as DEFAULT_MAX_SEALED_BLOB_BYTES, S as SHARE_RESULT_VERSION, b as ShareErrorCode, c as ShareErrorInfo, d as ShareFetchOptions, e as ShareInspection, f as ShareMetadata, g as ShareNodeTrust, h as SharePolicyAuthority, i as SharePolicyChallenge, j as SharePolicyDelegationLink, k as SharePolicyEvidence, l as SharePolicySession, m as SharePresentationMaterial, n as ShareReceiveAuthorizationRequired, o as ShareReceiveError, p as ShareReceiveOutcome, q as ShareReceiveResult, r as ShareRecipientClient, s as ShareRecipientClientOptions, t as createAddressedAuthorization, u as inspectShare, v as receiveShare, w as toShareErrorInfo } from './web-recipient-entry-CTFoIH8l.js';
 export { C as CreateOwnerDelegationParams, h as DEFAULT_SHARE_LIFETIME_MS, D as DelegatedShareKey, M as MAX_CONTENT_BYTES, i as OWNER_SHARE_REGISTRATION_DOMAIN, j as OwnerDelegationPermission, g as OwnerDelegationReceipt, O as OwnerShareAction, k as OwnerShareDecryption, a as OwnerShareMatcher, l as OwnerSharePolicyRegistration, b as OwnerSharePolicyRegistrationReceipt, m as OwnerSharePolicyV2, c as PublishedShare, P as PublishedShareDeliveryMaterial, n as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, o as SHARE_CONTENT_LIMIT, p as SHARE_PUBLISH_RESULT_VERSION, f as SharePublishError, q as SharePublishErrorCode, e as SharePublishOptions, d as SharePublishTarget, S as SignedDelegation, r as canonicalOwnerSharePolicy, s as computeOwnerShareRegistrationCid, t as createDelegatedShareKey, u as createPolicyEnforcementDelegation, v as redactPublishedShare, w as restoreDelegatedShareKey, x as validateOwnerSharePolicyRegistration, y as validateOwnerSharePolicyRegistrationBytes } from './owner-policy-aPmXIR3e.js';
 import { ShareEnvelopeV2, ArtifactPin, UnsignedShareEnvelopeV3, ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 export { CheckBearerDelegationOptions, DelegationCheckResult, canonicalize, checkBearerDelegation, fromBase64Url, requiredResourceUri, resourceUriCovers, toBase64Url } from '@tinycloud/share-envelope';

package/dist/index.js

@@ -8710,41 +8710,18 @@ function bytes2(value, label) {
   if (decoded.length !== 64 || toBase64Url(decoded) !== value) throw new Error(`${label} is invalid`);
   return decoded;
 }
-var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 function toBase64(bytes3) {
-  let out = "";
-  for (let i = 0; i < bytes3.length; i += 3) {
-    const b0 = bytes3[i];
-    const b1 = i + 1 < bytes3.length ? bytes3[i + 1] : 0;
-    const b2 = i + 2 < bytes3.length ? bytes3[i + 2] : 0;
-    out += BASE64_ALPHABET[b0 >> 2 & 63];
-    out += BASE64_ALPHABET[(b0 << 4 | b1 >> 4) & 63];
-    out += i + 1 < bytes3.length ? BASE64_ALPHABET[(b1 << 2 | b2 >> 6) & 63] : "=";
-    out += i + 2 < bytes3.length ? BASE64_ALPHABET[b2 & 63] : "=";
-  }
-  return out;
+  return toBase64Url(bytes3).replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(bytes3.length / 3) * 4, "=");
 }
 function fromBase64(value, label) {
   if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
     throw new Error(`${label} is invalid`);
   }
-  const padding = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
-  const out = new Uint8Array(value.length / 4 * 3 - padding);
-  let outIdx = 0;
-  for (let i = 0; i < value.length; i += 4) {
-    const v0 = BASE64_ALPHABET.indexOf(value[i]);
-    const v1 = BASE64_ALPHABET.indexOf(value[i + 1]);
-    const v2 = value[i + 2] === "=" ? 0 : BASE64_ALPHABET.indexOf(value[i + 2]);
-    const v3 = value[i + 3] === "=" ? 0 : BASE64_ALPHABET.indexOf(value[i + 3]);
-    const b0 = v0 << 2 | v1 >> 4;
-    const b1 = (v1 & 15) << 4 | v2 >> 2;
-    const b2 = (v2 & 3) << 6 | v3;
-    if (outIdx < out.length) out[outIdx++] = b0;
-    if (outIdx < out.length) out[outIdx++] = b1;
-    if (outIdx < out.length) out[outIdx++] = b2;
-  }
-  if (toBase64(out) !== value) throw new Error(`${label} is invalid`);
-  return out;
+  try {
+    return fromBase64Url(value.replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_"));
+  } catch {
+    throw new Error(`${label} is invalid`);
+  }
 }
 async function digestBytes2(value) {
   return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", value)));
@@ -8861,16 +8838,16 @@ function matchesInitialCiphertextDigest(bytes3, expected) {
 function canonicalHashHex(value) {
   return hex3(sha2566(new TextEncoder().encode(canonicalize(value))));
 }
-async function aesGcmDecrypt(key, blob) {
+async function aesGcmDecrypt(key, blob, aad) {
   if (key.length !== 32 || blob.length < 28) throw new Error("encrypted content is malformed");
   const cryptoKey = await crypto.subtle.importKey("raw", key, "AES-GCM", false, ["decrypt"]);
-  return new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv: blob.slice(0, 12) }, cryptoKey, blob.slice(12)));
+  return new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv: blob.slice(0, 12), ...aad && { additionalData: aad } }, cryptoKey, blob.slice(12)));
 }
-async function aesGcmEncrypt(key, plaintext) {
+async function aesGcmEncrypt(key, plaintext, aad) {
   if (key.length !== 32) throw new Error("encrypted content key is malformed");
   const nonce = crypto.getRandomValues(new Uint8Array(12));
   const cryptoKey = await crypto.subtle.importKey("raw", key, "AES-GCM", false, ["encrypt"]);
-  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce }, cryptoKey, plaintext));
+  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce, ...aad && { additionalData: aad } }, cryptoKey, plaintext));
   const output = new Uint8Array(nonce.length + ciphertext.length);
   output.set(nonce);
   output.set(ciphertext, nonce.length);
@@ -8885,8 +8862,9 @@ function parseV3InlineEncryptedEnvelope(bytes3, expected) {
   }
   if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("encrypted content envelope is malformed");
   const record = value;
-  const allowed = ["v", "networkId", "keyPath", "alg", "keyVersion", "encryptedSymmetricKey", "encryptedSymmetricKeyHash", "ciphertext", "metadata"];
-  if (Object.keys(record).some((key) => !allowed.includes(key)) || record.v !== 1 || record.networkId !== expected.encryptionNetwork || record.keyPath !== expected.contentSource.encryptionKeyPath || record.keyPath !== void 0 && record.keyPath !== `share/${expected.shareId}` || record.alg !== "x25519-aes256gcm/v1" || record.keyVersion !== expected.contentSource.keyVersion || typeof record.encryptedSymmetricKey !== "string" || typeof record.encryptedSymmetricKeyHash !== "string" || record.encryptedSymmetricKeyHash !== expected.contentSource.encryptedSymmetricKeyDigestHex || record.encryptedSymmetricKeyHash !== canonicalHashHex(record.encryptedSymmetricKey) || typeof record.ciphertext !== "string" || record.metadata !== void 0 && (record.metadata === null || typeof record.metadata !== "object" || Array.isArray(record.metadata) || Object.values(record.metadata).some((entry) => typeof entry !== "string"))) {
+  const allowed = ["v", "networkId", "keyPath", "alg", "keyVersion", "encryptedSymmetricKey", "encryptedSymmetricKeyHash", "ciphertext", "aad", "metadata"];
+  const source = expected.contentSource;
+  if (Object.keys(record).some((key) => !allowed.includes(key)) || record.v !== (source.encryptionKeyPath === void 0 ? 1 : 2) || record.networkId !== source.encryptionNetwork || record.networkId !== expected.encryptionNetwork || record.keyPath !== source.encryptionKeyPath || record.keyPath !== void 0 && record.keyPath !== `share/${expected.shareId}` || record.alg !== "x25519-aes256gcm/v1" || record.keyVersion !== source.keyVersion || typeof record.encryptedSymmetricKey !== "string" || typeof record.encryptedSymmetricKeyHash !== "string" || hex3(sha2566(fromBase64(record.encryptedSymmetricKey, "v3 encrypted symmetric key"))) !== source.encryptedSymmetricKeyDigestHex || record.encryptedSymmetricKeyHash !== canonicalHashHex(record.encryptedSymmetricKey) || typeof record.ciphertext !== "string" || record.aad !== void 0 && typeof record.aad !== "string" || record.metadata !== void 0 && (record.metadata === null || typeof record.metadata !== "object" || Array.isArray(record.metadata) || Object.values(record.metadata).some((entry) => typeof entry !== "string"))) {
     throw new Error("encrypted content envelope binding is invalid");
   }
   return record;
@@ -9007,7 +8985,7 @@ var ShareRecipientClient = class {
     this.session = { sessionId: delegation.sessionCid, expiresAt: new Date(compact.payload.exp * 1e3).toISOString(), actions: envelope.actions, resource: envelope.resource };
     return this.session;
   }
-  /** Decrypt a v3 KV value through a fresh recipient-signed decrypt invocation. */
+  /** Decrypt unscoped v1 or path-bound v2 content, independently checking canonical and registered raw-key digests. */
   async decryptV3Content(bytes3) {
     const envelope = this.options.envelope;
     const signer = this.nativeSigner ?? this.signer;
@@ -9015,6 +8993,9 @@ var ShareRecipientClient = class {
     assertArtifactBinding(artifactBindingView(envelope));
     if (!matchesInitialCiphertextDigest(bytes3, envelope.contentSource.initialCiphertextDigestHex)) throw new Error("v3 owner KV ciphertext digest mismatch");
     const encrypted = parseV3InlineEncryptedEnvelope(bytes3, envelope);
+    const ciphertext = fromBase64(encrypted.ciphertext, "v3 encrypted content");
+    if (ciphertext.length < 28) throw new Error("encrypted content is malformed");
+    const aad = encrypted.aad === void 0 ? void 0 : fromBase64(encrypted.aad, "v3 encrypted content AAD");
     const receiverPrivateKey = crypto.getRandomValues(new Uint8Array(32));
     const receiverPublicKey = toBase64(x25519.getPublicKey(receiverPrivateKey));
     const receiverPublicKeyHash = canonicalHashHex(receiverPublicKey);
@@ -9051,7 +9032,7 @@ var ShareRecipientClient = class {
       const symmetricKey = await aesGcmDecrypt(shared, wrapped.slice(33));
       shared.fill(0);
       if (symmetricKey.length !== 32) throw new Error("v3 content key is malformed");
-      const plaintext = await aesGcmDecrypt(symmetricKey, fromBase64(encrypted.ciphertext, "v3 encrypted content"));
+      const plaintext = await aesGcmDecrypt(symmetricKey, ciphertext, aad);
       this.v3ContentKey?.fill(0);
       this.v3ContentKey = symmetricKey;
       this.v3ContentEnvelope = encrypted;
@@ -9063,7 +9044,9 @@ var ShareRecipientClient = class {
   /** Re-encrypt edited v3 content with the admitted content key. */
   async encryptV3Content(bytes3, mediaType) {
     if (this.options.envelope.version !== 3 || this.v3ContentKey === void 0 || this.v3ContentEnvelope === void 0) throw new Error("v3 content must be decrypted before it can be saved");
-    return new TextEncoder().encode(canonicalize({ ...this.v3ContentEnvelope, ciphertext: toBase64Url(await aesGcmEncrypt(this.v3ContentKey, bytes3)), metadata: { ...this.v3ContentEnvelope.metadata ?? {}, contentType: mediaType } }));
+    const envelope = this.v3ContentEnvelope;
+    const aad = envelope.aad === void 0 ? void 0 : fromBase64(envelope.aad, "v3 encrypted content AAD");
+    return new TextEncoder().encode(canonicalize({ ...envelope, ciphertext: toBase64(await aesGcmEncrypt(this.v3ContentKey, bytes3, aad)), metadata: { ...envelope.metadata ?? {}, contentType: mediaType } }));
   }
   async resumeWithProof(envelope, resumeToken, proof) {
     void envelope;