@tinycloud/share-sdk 1.4.2-beta.2 → 1.4.3-beta.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +42 -0
- package/dist/addressed-publish-BPFFqD5s.d.cts +380 -0
- package/dist/addressed-publish-DorqWQJ8.d.ts +380 -0
- package/dist/index.cjs +265 -27
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +2 -2
- package/dist/index.d.ts +2 -2
- package/dist/index.js +254 -26
- package/dist/index.js.map +1 -1
- package/dist/share-root.d.cts +1 -1
- package/dist/share-root.d.ts +1 -1
- package/package.json +2 -2
- package/dist/addressed-publish-BcvisG4a.d.cts +0 -230
- package/dist/addressed-publish-CwTTn9Jn.d.ts +0 -230
package/dist/share-root.d.cts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { CompactUcanAuthorization, UnifiedContentSource } from '@tinycloud/share-envelope';
|
|
2
|
-
import { A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, b as AddressedPublishAuthority } from './addressed-publish-
|
|
2
|
+
import { A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, b as AddressedPublishAuthority } from './addressed-publish-BPFFqD5s.cjs';
|
|
3
3
|
import { C as CreateOwnerDelegationParams, g as OwnerDelegationReceipt, D as DelegatedShareKey } from './owner-policy-aPmXIR3e.cjs';
|
|
4
4
|
import './authorization-CmP1skO8.cjs';
|
|
5
5
|
|
package/dist/share-root.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { CompactUcanAuthorization, UnifiedContentSource } from '@tinycloud/share-envelope';
|
|
2
|
-
import { A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, b as AddressedPublishAuthority } from './addressed-publish-
|
|
2
|
+
import { A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, b as AddressedPublishAuthority } from './addressed-publish-DorqWQJ8.js';
|
|
3
3
|
import { C as CreateOwnerDelegationParams, g as OwnerDelegationReceipt, D as DelegatedShareKey } from './owner-policy-aPmXIR3e.js';
|
|
4
4
|
import './authorization-CmP1skO8.js';
|
|
5
5
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@tinycloud/share-sdk",
|
|
3
|
-
"version": "1.4.
|
|
3
|
+
"version": "1.4.3-beta.0",
|
|
4
4
|
"description": "Canonical headless TinyCloud Share operations for browser and Node.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.cjs",
|
|
@@ -60,7 +60,7 @@
|
|
|
60
60
|
"dependencies": {
|
|
61
61
|
"@noble/curves": "^1.9.2",
|
|
62
62
|
"@noble/hashes": "^1.8.0",
|
|
63
|
-
"@tinycloud/share-envelope": "1.4.1
|
|
63
|
+
"@tinycloud/share-envelope": "1.4.1",
|
|
64
64
|
"multiformats": "^13.3.6"
|
|
65
65
|
},
|
|
66
66
|
"devDependencies": {
|
|
@@ -1,230 +0,0 @@
|
|
|
1
|
-
import { UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1, ArtifactPin } from '@tinycloud/share-envelope';
|
|
2
|
-
import { d as SharePublishTarget, c as PublishedShare, e as SharePublishOptions, O as OwnerShareAction, P as PublishedShareDeliveryMaterial, f as SharePublishError } from './owner-policy-aPmXIR3e.cjs';
|
|
3
|
-
import { S as ShareAuthorizationRequired, a as ShareAuthorizationMethod } from './authorization-CmP1skO8.cjs';
|
|
4
|
-
|
|
5
|
-
type ShareTarget = SharePublishTarget;
|
|
6
|
-
interface TargetPublishInput {
|
|
7
|
-
readonly source: Uint8Array;
|
|
8
|
-
readonly filename: string;
|
|
9
|
-
readonly mediaType?: string;
|
|
10
|
-
/** Additional files for a prefix resource; source remains the first file for compatibility. */
|
|
11
|
-
readonly files?: readonly {
|
|
12
|
-
readonly bytes: Uint8Array;
|
|
13
|
-
readonly filename: string;
|
|
14
|
-
readonly mediaType?: string;
|
|
15
|
-
}[];
|
|
16
|
-
readonly target: ShareTarget;
|
|
17
|
-
readonly expiresAt: Date;
|
|
18
|
-
readonly expiryWasExplicit?: boolean;
|
|
19
|
-
readonly origin: string;
|
|
20
|
-
readonly resourceKind?: "exact" | "prefix";
|
|
21
|
-
readonly actions?: readonly ("read" | "list" | "edit")[];
|
|
22
|
-
readonly notify?: boolean;
|
|
23
|
-
readonly credentialDescriptor?: unknown;
|
|
24
|
-
readonly issuerDid?: string;
|
|
25
|
-
readonly issuerKid?: string;
|
|
26
|
-
/** Publish as the next write-once version of this artifact and pin the share to it (TC-1428). */
|
|
27
|
-
readonly artifact?: {
|
|
28
|
-
readonly id: string;
|
|
29
|
-
readonly note?: string;
|
|
30
|
-
};
|
|
31
|
-
}
|
|
32
|
-
type TargetPublishOutcome = PublishedShare | ShareAuthorizationRequired;
|
|
33
|
-
interface TargetPublishAdapter {
|
|
34
|
-
publish(input: TargetPublishInput): Promise<TargetPublishOutcome>;
|
|
35
|
-
}
|
|
36
|
-
declare function normalizeShareTarget(target: ShareTarget): ShareTarget;
|
|
37
|
-
declare function targetAuthorizationMethod(target: ShareTarget): ShareAuthorizationMethod | undefined;
|
|
38
|
-
/** Route every share through the authenticated TinyCloud authority adapter. */
|
|
39
|
-
declare function publishTargetShare(input: SharePublishOptions & {
|
|
40
|
-
readonly target: ShareTarget;
|
|
41
|
-
readonly notify?: boolean;
|
|
42
|
-
readonly targetAdapter?: TargetPublishAdapter;
|
|
43
|
-
readonly files?: readonly {
|
|
44
|
-
readonly bytes: Uint8Array;
|
|
45
|
-
readonly filename: string;
|
|
46
|
-
readonly mediaType?: string;
|
|
47
|
-
}[];
|
|
48
|
-
readonly resourceKind?: "exact" | "prefix";
|
|
49
|
-
readonly actions?: readonly ("read" | "list" | "edit")[];
|
|
50
|
-
readonly credentialDescriptor?: unknown;
|
|
51
|
-
readonly issuerDid?: string;
|
|
52
|
-
readonly issuerKid?: string;
|
|
53
|
-
}): Promise<TargetPublishOutcome>;
|
|
54
|
-
|
|
55
|
-
interface AddressedOwnerRootInput {
|
|
56
|
-
readonly ownerDid: string;
|
|
57
|
-
readonly role: "policy-authority" | "policy-enforcement";
|
|
58
|
-
readonly audienceDid: string;
|
|
59
|
-
readonly policyId: string;
|
|
60
|
-
readonly policyDigestHex: string;
|
|
61
|
-
readonly policyCid: string;
|
|
62
|
-
readonly contentSourceDigestHex: string;
|
|
63
|
-
readonly capabilityCeilingHashHex: string;
|
|
64
|
-
readonly nativeProjectionHashHex: string;
|
|
65
|
-
readonly notBefore: Date;
|
|
66
|
-
readonly expiresAt: Date;
|
|
67
|
-
readonly nodeAudience: string;
|
|
68
|
-
readonly capabilities: readonly UnifiedPolicyCapability[];
|
|
69
|
-
}
|
|
70
|
-
interface AddressedOwnerRootReceipt {
|
|
71
|
-
readonly cid: string;
|
|
72
|
-
readonly delegationHeader: {
|
|
73
|
-
readonly Authorization: string;
|
|
74
|
-
};
|
|
75
|
-
}
|
|
76
|
-
interface AddressedPolicyRegistrationInput {
|
|
77
|
-
readonly policyCid: string;
|
|
78
|
-
readonly policy: Readonly<Record<string, unknown>>;
|
|
79
|
-
readonly policyRoot: {
|
|
80
|
-
readonly cid: string;
|
|
81
|
-
readonly authorization: string;
|
|
82
|
-
};
|
|
83
|
-
readonly enforcementRoot: {
|
|
84
|
-
readonly cid: string;
|
|
85
|
-
readonly authorization: string;
|
|
86
|
-
};
|
|
87
|
-
readonly contentSourceDigestHex: string;
|
|
88
|
-
readonly nativeProjectionHashHex: string;
|
|
89
|
-
readonly rootExpiresAt: string;
|
|
90
|
-
readonly enforcerDid: string;
|
|
91
|
-
readonly expectedNodeAudience: string;
|
|
92
|
-
}
|
|
93
|
-
interface AddressedPolicyRegistrationReceipt {
|
|
94
|
-
readonly policyCid: string;
|
|
95
|
-
readonly policyRootCid: string;
|
|
96
|
-
readonly enforcementRootCid: string;
|
|
97
|
-
readonly attestedEnforcerBinding: {
|
|
98
|
-
readonly schema: "xyz.tinycloud.policy/attested-enforcer/v2";
|
|
99
|
-
readonly enforcerDid: string;
|
|
100
|
-
readonly nodeAudience: string;
|
|
101
|
-
readonly attestationBindingDigestHex: string;
|
|
102
|
-
readonly issuedAt: string;
|
|
103
|
-
readonly expiresAt: string;
|
|
104
|
-
readonly signature: {
|
|
105
|
-
readonly suite: "Ed25519";
|
|
106
|
-
readonly signerDid: string;
|
|
107
|
-
readonly value: string;
|
|
108
|
-
};
|
|
109
|
-
};
|
|
110
|
-
}
|
|
111
|
-
/** App-neutral owner authority. Node SDK owns all Policy/v3 transport. */
|
|
112
|
-
interface AddressedPublishAuthority {
|
|
113
|
-
readonly ownerDid: string;
|
|
114
|
-
createOwnerRoot(input: AddressedOwnerRootInput): Promise<AddressedOwnerRootReceipt>;
|
|
115
|
-
sign(bytes: Uint8Array): Promise<Uint8Array>;
|
|
116
|
-
registerPolicy(input: AddressedPolicyRegistrationInput): Promise<AddressedPolicyRegistrationReceipt>;
|
|
117
|
-
}
|
|
118
|
-
interface AddressedSharePublishOptions {
|
|
119
|
-
readonly shareId: string;
|
|
120
|
-
readonly shareOrigin: string;
|
|
121
|
-
/** The links API origin written into the signed header as its audience. Defaults to `https://api.tinycloud.xyz`. */
|
|
122
|
-
readonly apiOrigin?: string;
|
|
123
|
-
readonly nodeOrigin: string;
|
|
124
|
-
readonly nodeAudience: string;
|
|
125
|
-
readonly enforcerDid: string;
|
|
126
|
-
readonly spaceId: string;
|
|
127
|
-
readonly target: Exclude<ShareTarget, {
|
|
128
|
-
readonly kind: "bearer";
|
|
129
|
-
}>;
|
|
130
|
-
readonly resource: {
|
|
131
|
-
readonly kind: "exact" | "prefix";
|
|
132
|
-
readonly path: string;
|
|
133
|
-
};
|
|
134
|
-
readonly actions: readonly ShareAction[];
|
|
135
|
-
readonly policyActions: readonly OwnerShareAction[];
|
|
136
|
-
readonly contentSource: UnifiedContentSource;
|
|
137
|
-
readonly credentialRequirement?: PolicyCredentialRequirementV1;
|
|
138
|
-
readonly filename: string;
|
|
139
|
-
readonly mediaType: string;
|
|
140
|
-
readonly byteLength: number;
|
|
141
|
-
readonly artifact?: "html";
|
|
142
|
-
/** TC-1428: pins the share to one write-once artifact version; signed with the envelope. Required when the content source is under `artifacts/`. */
|
|
143
|
-
readonly artifactPin?: ArtifactPin;
|
|
144
|
-
readonly deliveryEmail?: string;
|
|
145
|
-
readonly expiresAt: Date;
|
|
146
|
-
/** Sender-history material required by Node's Policy/v3 delivery authorization. */
|
|
147
|
-
readonly onDeliveryMaterial?: (input: PublishedShareDeliveryMaterial) => void;
|
|
148
|
-
readonly authority: AddressedPublishAuthority;
|
|
149
|
-
}
|
|
150
|
-
type MailboxTarget = Extract<ShareTarget, {
|
|
151
|
-
readonly kind: "email" | "emailDomain";
|
|
152
|
-
}>;
|
|
153
|
-
/** The Policy/v2 credential commitment a share addressed to `target` must carry. */
|
|
154
|
-
declare function addressedCredentialRequirement(target: MailboxTarget): PolicyCredentialRequirementV1;
|
|
155
|
-
/** Facts every addressed-share check needs, available before any side effect. */
|
|
156
|
-
type AddressedShareRequest = Pick<AddressedSharePublishOptions, "target" | "actions" | "policyActions" | "filename" | "deliveryEmail">;
|
|
157
|
-
interface PreparedAddressedShare {
|
|
158
|
-
/** The canonical target the envelope's recipient matcher will carry. */
|
|
159
|
-
readonly target: Exclude<ShareTarget, {
|
|
160
|
-
readonly kind: "bearer";
|
|
161
|
-
}>;
|
|
162
|
-
/** Present for mailbox targets: the Policy/v2 commitment to pass to `publishAddressedShare`. */
|
|
163
|
-
readonly credentialRequirement?: PolicyCredentialRequirementV1;
|
|
164
|
-
}
|
|
165
|
-
/**
|
|
166
|
-
* Runs every argument and target check of `publishAddressedShare` that does
|
|
167
|
-
* not depend on stored content, and derives the credential commitment. It has
|
|
168
|
-
* no side effects, so senders call it before uploading content or publishing
|
|
169
|
-
* a location record; a refused share then leaves nothing behind.
|
|
170
|
-
*/
|
|
171
|
-
declare function prepareAddressedShare(request: AddressedShareRequest): PreparedAddressedShare;
|
|
172
|
-
/** Canonical application-neutral Policy/v3 addressed publisher shared by browser and CLI. */
|
|
173
|
-
declare function publishAddressedShare(input: AddressedSharePublishOptions): Promise<PublishedShare>;
|
|
174
|
-
/** The text a share gets when its sealed envelope cannot fit in a link. */
|
|
175
|
-
declare const ADDRESSED_SHARE_TOO_LARGE_MESSAGE = "This share is too large to send as a link, so nothing was shared. Use a shorter path or fewer folders.";
|
|
176
|
-
/** What a publish has written by the time its sealed envelope is measured. */
|
|
177
|
-
interface AddressedShareWrites {
|
|
178
|
-
readonly policyCid: string;
|
|
179
|
-
readonly policyRootCid: string;
|
|
180
|
-
readonly enforcementRootCid: string;
|
|
181
|
-
}
|
|
182
|
-
/**
|
|
183
|
-
* Thrown by `publishAddressedShare` when the sealed envelope, measured after
|
|
184
|
-
* the policy registration, is over `MAX_LINK_BODY_BYTES`. The size bound makes
|
|
185
|
-
* this unreachable for a correct caller; if it happens, `written` names what
|
|
186
|
-
* the publish registered so the caller can remove it. No link was built.
|
|
187
|
-
*/
|
|
188
|
-
declare class AddressedShareOverLimitError extends SharePublishError {
|
|
189
|
-
readonly written: AddressedShareWrites;
|
|
190
|
-
constructor(written: AddressedShareWrites);
|
|
191
|
-
}
|
|
192
|
-
/** What a sender knows before any write; see {@link addressedShareBodyUpperBound}. */
|
|
193
|
-
interface AddressedShareBoundInput extends AddressedShareRequest {
|
|
194
|
-
readonly shareId: string;
|
|
195
|
-
readonly ownerDid: string;
|
|
196
|
-
readonly nodeOrigin: string;
|
|
197
|
-
readonly nodeAudience: string;
|
|
198
|
-
readonly enforcerDid: string;
|
|
199
|
-
readonly spaceId: string;
|
|
200
|
-
readonly resource: {
|
|
201
|
-
readonly kind: "exact" | "prefix";
|
|
202
|
-
};
|
|
203
|
-
/** Where the content will be stored: a path, or the id and stored file name of an artifact (whose version number the publish assigns). */
|
|
204
|
-
readonly storage: {
|
|
205
|
-
readonly path: string;
|
|
206
|
-
} | {
|
|
207
|
-
readonly artifactId: string;
|
|
208
|
-
readonly storageName: string;
|
|
209
|
-
};
|
|
210
|
-
/** The owner's encryption network for the space. */
|
|
211
|
-
readonly encryptionNetwork: string;
|
|
212
|
-
readonly encryptionKeyPath?: string;
|
|
213
|
-
readonly mediaType: string;
|
|
214
|
-
readonly byteLength: number;
|
|
215
|
-
readonly artifact?: "html";
|
|
216
|
-
readonly expiresAt: Date;
|
|
217
|
-
}
|
|
218
|
-
/**
|
|
219
|
-
* The largest sealed envelope a share can have, in bytes, computed before any
|
|
220
|
-
* write (upload, registration, registry or KV write): the same envelope the
|
|
221
|
-
* publish builds, with every value a write returns at its maximum encoded
|
|
222
|
-
* length (see `sealedBodyUpperBound`). Compare it with `MAX_LINK_BODY_BYTES`.
|
|
223
|
-
* For an artifact share the version, the manifest digest and the stored size
|
|
224
|
-
* are taken at their largest.
|
|
225
|
-
*/
|
|
226
|
-
declare function addressedShareBodyUpperBound(input: AddressedShareBoundInput): Promise<number>;
|
|
227
|
-
/** Refuses (`SharePublishError`, code `max-bytes-exceeded`, {@link ADDRESSED_SHARE_TOO_LARGE_MESSAGE}) a share whose largest sealed envelope is over `MAX_LINK_BODY_BYTES`. Call it before any write. */
|
|
228
|
-
declare function assertAddressedShareFits(input: AddressedShareBoundInput): Promise<void>;
|
|
229
|
-
|
|
230
|
-
export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareTarget as S, type TargetPublishOutcome as T, type AddressedOwnerRootReceipt as a, type AddressedPublishAuthority as b, type TargetPublishInput as c, ADDRESSED_SHARE_TOO_LARGE_MESSAGE as d, type AddressedPolicyRegistrationInput as e, type AddressedPolicyRegistrationReceipt as f, type AddressedShareBoundInput as g, AddressedShareOverLimitError as h, type AddressedSharePublishOptions as i, type AddressedShareRequest as j, type AddressedShareWrites as k, type TargetPublishAdapter as l, addressedCredentialRequirement as m, addressedShareBodyUpperBound as n, assertAddressedShareFits as o, normalizeShareTarget as p, prepareAddressedShare as q, publishAddressedShare as r, publishTargetShare as s, targetAuthorizationMethod as t };
|
|
@@ -1,230 +0,0 @@
|
|
|
1
|
-
import { UnifiedPolicyCapability, ShareAction, UnifiedContentSource, PolicyCredentialRequirementV1, ArtifactPin } from '@tinycloud/share-envelope';
|
|
2
|
-
import { d as SharePublishTarget, c as PublishedShare, e as SharePublishOptions, O as OwnerShareAction, P as PublishedShareDeliveryMaterial, f as SharePublishError } from './owner-policy-aPmXIR3e.js';
|
|
3
|
-
import { S as ShareAuthorizationRequired, a as ShareAuthorizationMethod } from './authorization-CmP1skO8.js';
|
|
4
|
-
|
|
5
|
-
type ShareTarget = SharePublishTarget;
|
|
6
|
-
interface TargetPublishInput {
|
|
7
|
-
readonly source: Uint8Array;
|
|
8
|
-
readonly filename: string;
|
|
9
|
-
readonly mediaType?: string;
|
|
10
|
-
/** Additional files for a prefix resource; source remains the first file for compatibility. */
|
|
11
|
-
readonly files?: readonly {
|
|
12
|
-
readonly bytes: Uint8Array;
|
|
13
|
-
readonly filename: string;
|
|
14
|
-
readonly mediaType?: string;
|
|
15
|
-
}[];
|
|
16
|
-
readonly target: ShareTarget;
|
|
17
|
-
readonly expiresAt: Date;
|
|
18
|
-
readonly expiryWasExplicit?: boolean;
|
|
19
|
-
readonly origin: string;
|
|
20
|
-
readonly resourceKind?: "exact" | "prefix";
|
|
21
|
-
readonly actions?: readonly ("read" | "list" | "edit")[];
|
|
22
|
-
readonly notify?: boolean;
|
|
23
|
-
readonly credentialDescriptor?: unknown;
|
|
24
|
-
readonly issuerDid?: string;
|
|
25
|
-
readonly issuerKid?: string;
|
|
26
|
-
/** Publish as the next write-once version of this artifact and pin the share to it (TC-1428). */
|
|
27
|
-
readonly artifact?: {
|
|
28
|
-
readonly id: string;
|
|
29
|
-
readonly note?: string;
|
|
30
|
-
};
|
|
31
|
-
}
|
|
32
|
-
type TargetPublishOutcome = PublishedShare | ShareAuthorizationRequired;
|
|
33
|
-
interface TargetPublishAdapter {
|
|
34
|
-
publish(input: TargetPublishInput): Promise<TargetPublishOutcome>;
|
|
35
|
-
}
|
|
36
|
-
declare function normalizeShareTarget(target: ShareTarget): ShareTarget;
|
|
37
|
-
declare function targetAuthorizationMethod(target: ShareTarget): ShareAuthorizationMethod | undefined;
|
|
38
|
-
/** Route every share through the authenticated TinyCloud authority adapter. */
|
|
39
|
-
declare function publishTargetShare(input: SharePublishOptions & {
|
|
40
|
-
readonly target: ShareTarget;
|
|
41
|
-
readonly notify?: boolean;
|
|
42
|
-
readonly targetAdapter?: TargetPublishAdapter;
|
|
43
|
-
readonly files?: readonly {
|
|
44
|
-
readonly bytes: Uint8Array;
|
|
45
|
-
readonly filename: string;
|
|
46
|
-
readonly mediaType?: string;
|
|
47
|
-
}[];
|
|
48
|
-
readonly resourceKind?: "exact" | "prefix";
|
|
49
|
-
readonly actions?: readonly ("read" | "list" | "edit")[];
|
|
50
|
-
readonly credentialDescriptor?: unknown;
|
|
51
|
-
readonly issuerDid?: string;
|
|
52
|
-
readonly issuerKid?: string;
|
|
53
|
-
}): Promise<TargetPublishOutcome>;
|
|
54
|
-
|
|
55
|
-
interface AddressedOwnerRootInput {
|
|
56
|
-
readonly ownerDid: string;
|
|
57
|
-
readonly role: "policy-authority" | "policy-enforcement";
|
|
58
|
-
readonly audienceDid: string;
|
|
59
|
-
readonly policyId: string;
|
|
60
|
-
readonly policyDigestHex: string;
|
|
61
|
-
readonly policyCid: string;
|
|
62
|
-
readonly contentSourceDigestHex: string;
|
|
63
|
-
readonly capabilityCeilingHashHex: string;
|
|
64
|
-
readonly nativeProjectionHashHex: string;
|
|
65
|
-
readonly notBefore: Date;
|
|
66
|
-
readonly expiresAt: Date;
|
|
67
|
-
readonly nodeAudience: string;
|
|
68
|
-
readonly capabilities: readonly UnifiedPolicyCapability[];
|
|
69
|
-
}
|
|
70
|
-
interface AddressedOwnerRootReceipt {
|
|
71
|
-
readonly cid: string;
|
|
72
|
-
readonly delegationHeader: {
|
|
73
|
-
readonly Authorization: string;
|
|
74
|
-
};
|
|
75
|
-
}
|
|
76
|
-
interface AddressedPolicyRegistrationInput {
|
|
77
|
-
readonly policyCid: string;
|
|
78
|
-
readonly policy: Readonly<Record<string, unknown>>;
|
|
79
|
-
readonly policyRoot: {
|
|
80
|
-
readonly cid: string;
|
|
81
|
-
readonly authorization: string;
|
|
82
|
-
};
|
|
83
|
-
readonly enforcementRoot: {
|
|
84
|
-
readonly cid: string;
|
|
85
|
-
readonly authorization: string;
|
|
86
|
-
};
|
|
87
|
-
readonly contentSourceDigestHex: string;
|
|
88
|
-
readonly nativeProjectionHashHex: string;
|
|
89
|
-
readonly rootExpiresAt: string;
|
|
90
|
-
readonly enforcerDid: string;
|
|
91
|
-
readonly expectedNodeAudience: string;
|
|
92
|
-
}
|
|
93
|
-
interface AddressedPolicyRegistrationReceipt {
|
|
94
|
-
readonly policyCid: string;
|
|
95
|
-
readonly policyRootCid: string;
|
|
96
|
-
readonly enforcementRootCid: string;
|
|
97
|
-
readonly attestedEnforcerBinding: {
|
|
98
|
-
readonly schema: "xyz.tinycloud.policy/attested-enforcer/v2";
|
|
99
|
-
readonly enforcerDid: string;
|
|
100
|
-
readonly nodeAudience: string;
|
|
101
|
-
readonly attestationBindingDigestHex: string;
|
|
102
|
-
readonly issuedAt: string;
|
|
103
|
-
readonly expiresAt: string;
|
|
104
|
-
readonly signature: {
|
|
105
|
-
readonly suite: "Ed25519";
|
|
106
|
-
readonly signerDid: string;
|
|
107
|
-
readonly value: string;
|
|
108
|
-
};
|
|
109
|
-
};
|
|
110
|
-
}
|
|
111
|
-
/** App-neutral owner authority. Node SDK owns all Policy/v3 transport. */
|
|
112
|
-
interface AddressedPublishAuthority {
|
|
113
|
-
readonly ownerDid: string;
|
|
114
|
-
createOwnerRoot(input: AddressedOwnerRootInput): Promise<AddressedOwnerRootReceipt>;
|
|
115
|
-
sign(bytes: Uint8Array): Promise<Uint8Array>;
|
|
116
|
-
registerPolicy(input: AddressedPolicyRegistrationInput): Promise<AddressedPolicyRegistrationReceipt>;
|
|
117
|
-
}
|
|
118
|
-
interface AddressedSharePublishOptions {
|
|
119
|
-
readonly shareId: string;
|
|
120
|
-
readonly shareOrigin: string;
|
|
121
|
-
/** The links API origin written into the signed header as its audience. Defaults to `https://api.tinycloud.xyz`. */
|
|
122
|
-
readonly apiOrigin?: string;
|
|
123
|
-
readonly nodeOrigin: string;
|
|
124
|
-
readonly nodeAudience: string;
|
|
125
|
-
readonly enforcerDid: string;
|
|
126
|
-
readonly spaceId: string;
|
|
127
|
-
readonly target: Exclude<ShareTarget, {
|
|
128
|
-
readonly kind: "bearer";
|
|
129
|
-
}>;
|
|
130
|
-
readonly resource: {
|
|
131
|
-
readonly kind: "exact" | "prefix";
|
|
132
|
-
readonly path: string;
|
|
133
|
-
};
|
|
134
|
-
readonly actions: readonly ShareAction[];
|
|
135
|
-
readonly policyActions: readonly OwnerShareAction[];
|
|
136
|
-
readonly contentSource: UnifiedContentSource;
|
|
137
|
-
readonly credentialRequirement?: PolicyCredentialRequirementV1;
|
|
138
|
-
readonly filename: string;
|
|
139
|
-
readonly mediaType: string;
|
|
140
|
-
readonly byteLength: number;
|
|
141
|
-
readonly artifact?: "html";
|
|
142
|
-
/** TC-1428: pins the share to one write-once artifact version; signed with the envelope. Required when the content source is under `artifacts/`. */
|
|
143
|
-
readonly artifactPin?: ArtifactPin;
|
|
144
|
-
readonly deliveryEmail?: string;
|
|
145
|
-
readonly expiresAt: Date;
|
|
146
|
-
/** Sender-history material required by Node's Policy/v3 delivery authorization. */
|
|
147
|
-
readonly onDeliveryMaterial?: (input: PublishedShareDeliveryMaterial) => void;
|
|
148
|
-
readonly authority: AddressedPublishAuthority;
|
|
149
|
-
}
|
|
150
|
-
type MailboxTarget = Extract<ShareTarget, {
|
|
151
|
-
readonly kind: "email" | "emailDomain";
|
|
152
|
-
}>;
|
|
153
|
-
/** The Policy/v2 credential commitment a share addressed to `target` must carry. */
|
|
154
|
-
declare function addressedCredentialRequirement(target: MailboxTarget): PolicyCredentialRequirementV1;
|
|
155
|
-
/** Facts every addressed-share check needs, available before any side effect. */
|
|
156
|
-
type AddressedShareRequest = Pick<AddressedSharePublishOptions, "target" | "actions" | "policyActions" | "filename" | "deliveryEmail">;
|
|
157
|
-
interface PreparedAddressedShare {
|
|
158
|
-
/** The canonical target the envelope's recipient matcher will carry. */
|
|
159
|
-
readonly target: Exclude<ShareTarget, {
|
|
160
|
-
readonly kind: "bearer";
|
|
161
|
-
}>;
|
|
162
|
-
/** Present for mailbox targets: the Policy/v2 commitment to pass to `publishAddressedShare`. */
|
|
163
|
-
readonly credentialRequirement?: PolicyCredentialRequirementV1;
|
|
164
|
-
}
|
|
165
|
-
/**
|
|
166
|
-
* Runs every argument and target check of `publishAddressedShare` that does
|
|
167
|
-
* not depend on stored content, and derives the credential commitment. It has
|
|
168
|
-
* no side effects, so senders call it before uploading content or publishing
|
|
169
|
-
* a location record; a refused share then leaves nothing behind.
|
|
170
|
-
*/
|
|
171
|
-
declare function prepareAddressedShare(request: AddressedShareRequest): PreparedAddressedShare;
|
|
172
|
-
/** Canonical application-neutral Policy/v3 addressed publisher shared by browser and CLI. */
|
|
173
|
-
declare function publishAddressedShare(input: AddressedSharePublishOptions): Promise<PublishedShare>;
|
|
174
|
-
/** The text a share gets when its sealed envelope cannot fit in a link. */
|
|
175
|
-
declare const ADDRESSED_SHARE_TOO_LARGE_MESSAGE = "This share is too large to send as a link, so nothing was shared. Use a shorter path or fewer folders.";
|
|
176
|
-
/** What a publish has written by the time its sealed envelope is measured. */
|
|
177
|
-
interface AddressedShareWrites {
|
|
178
|
-
readonly policyCid: string;
|
|
179
|
-
readonly policyRootCid: string;
|
|
180
|
-
readonly enforcementRootCid: string;
|
|
181
|
-
}
|
|
182
|
-
/**
|
|
183
|
-
* Thrown by `publishAddressedShare` when the sealed envelope, measured after
|
|
184
|
-
* the policy registration, is over `MAX_LINK_BODY_BYTES`. The size bound makes
|
|
185
|
-
* this unreachable for a correct caller; if it happens, `written` names what
|
|
186
|
-
* the publish registered so the caller can remove it. No link was built.
|
|
187
|
-
*/
|
|
188
|
-
declare class AddressedShareOverLimitError extends SharePublishError {
|
|
189
|
-
readonly written: AddressedShareWrites;
|
|
190
|
-
constructor(written: AddressedShareWrites);
|
|
191
|
-
}
|
|
192
|
-
/** What a sender knows before any write; see {@link addressedShareBodyUpperBound}. */
|
|
193
|
-
interface AddressedShareBoundInput extends AddressedShareRequest {
|
|
194
|
-
readonly shareId: string;
|
|
195
|
-
readonly ownerDid: string;
|
|
196
|
-
readonly nodeOrigin: string;
|
|
197
|
-
readonly nodeAudience: string;
|
|
198
|
-
readonly enforcerDid: string;
|
|
199
|
-
readonly spaceId: string;
|
|
200
|
-
readonly resource: {
|
|
201
|
-
readonly kind: "exact" | "prefix";
|
|
202
|
-
};
|
|
203
|
-
/** Where the content will be stored: a path, or the id and stored file name of an artifact (whose version number the publish assigns). */
|
|
204
|
-
readonly storage: {
|
|
205
|
-
readonly path: string;
|
|
206
|
-
} | {
|
|
207
|
-
readonly artifactId: string;
|
|
208
|
-
readonly storageName: string;
|
|
209
|
-
};
|
|
210
|
-
/** The owner's encryption network for the space. */
|
|
211
|
-
readonly encryptionNetwork: string;
|
|
212
|
-
readonly encryptionKeyPath?: string;
|
|
213
|
-
readonly mediaType: string;
|
|
214
|
-
readonly byteLength: number;
|
|
215
|
-
readonly artifact?: "html";
|
|
216
|
-
readonly expiresAt: Date;
|
|
217
|
-
}
|
|
218
|
-
/**
|
|
219
|
-
* The largest sealed envelope a share can have, in bytes, computed before any
|
|
220
|
-
* write (upload, registration, registry or KV write): the same envelope the
|
|
221
|
-
* publish builds, with every value a write returns at its maximum encoded
|
|
222
|
-
* length (see `sealedBodyUpperBound`). Compare it with `MAX_LINK_BODY_BYTES`.
|
|
223
|
-
* For an artifact share the version, the manifest digest and the stored size
|
|
224
|
-
* are taken at their largest.
|
|
225
|
-
*/
|
|
226
|
-
declare function addressedShareBodyUpperBound(input: AddressedShareBoundInput): Promise<number>;
|
|
227
|
-
/** Refuses (`SharePublishError`, code `max-bytes-exceeded`, {@link ADDRESSED_SHARE_TOO_LARGE_MESSAGE}) a share whose largest sealed envelope is over `MAX_LINK_BODY_BYTES`. Call it before any write. */
|
|
228
|
-
declare function assertAddressedShareFits(input: AddressedShareBoundInput): Promise<void>;
|
|
229
|
-
|
|
230
|
-
export { type AddressedOwnerRootInput as A, type PreparedAddressedShare as P, type ShareTarget as S, type TargetPublishOutcome as T, type AddressedOwnerRootReceipt as a, type AddressedPublishAuthority as b, type TargetPublishInput as c, ADDRESSED_SHARE_TOO_LARGE_MESSAGE as d, type AddressedPolicyRegistrationInput as e, type AddressedPolicyRegistrationReceipt as f, type AddressedShareBoundInput as g, AddressedShareOverLimitError as h, type AddressedSharePublishOptions as i, type AddressedShareRequest as j, type AddressedShareWrites as k, type TargetPublishAdapter as l, addressedCredentialRequirement as m, addressedShareBodyUpperBound as n, assertAddressedShareFits as o, normalizeShareTarget as p, prepareAddressedShare as q, publishAddressedShare as r, publishTargetShare as s, targetAuthorizationMethod as t };
|