@tinycloud/share-sdk 1.4.4 → 1.5.0-beta.1

package/dist/index.d.cts

@@ -2,8 +2,8 @@ export { D as DEFAULT_MAX_CONTENT_BLOB_BYTES, a as DEFAULT_MAX_SEALED_BLOB_BYTES
 export { C as CreateOwnerDelegationParams, h as DEFAULT_SHARE_LIFETIME_MS, D as DelegatedShareKey, M as MAX_CONTENT_BYTES, i as OWNER_SHARE_REGISTRATION_DOMAIN, j as OwnerDelegationPermission, g as OwnerDelegationReceipt, O as OwnerShareAction, k as OwnerShareDecryption, a as OwnerShareMatcher, l as OwnerSharePolicyRegistration, b as OwnerSharePolicyRegistrationReceipt, m as OwnerSharePolicyV2, c as PublishedShare, P as PublishedShareDeliveryMaterial, n as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, o as SHARE_CONTENT_LIMIT, p as SHARE_PUBLISH_RESULT_VERSION, f as SharePublishError, q as SharePublishErrorCode, e as SharePublishOptions, d as SharePublishTarget, S as SignedDelegation, r as canonicalOwnerSharePolicy, s as computeOwnerShareRegistrationCid, t as createDelegatedShareKey, u as createPolicyEnforcementDelegation, v as redactPublishedShare, w as restoreDelegatedShareKey, x as validateOwnerSharePolicyRegistration, y as validateOwnerSharePolicyRegistrationBytes } from './owner-policy-aPmXIR3e.cjs';
 import { ShareEnvelopeV2, ArtifactPin, UnsignedShareEnvelopeV3, ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 export { CheckBearerDelegationOptions, DelegationCheckResult, canonicalize, checkBearerDelegation, fromBase64Url, requiredResourceUri, resourceUriCovers, toBase64Url } from '@tinycloud/share-envelope';
-import { T as TargetPublishOutcome, c as TargetPublishInput, S as ShareTarget } from './addressed-publish-BPFFqD5s.cjs';
-export { d as ADDRESSED_SHARE_TOO_LARGE_MESSAGE, e as AddressedContentSourceError, f as AddressedContentSourceErrorCode, A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, g as AddressedPolicyRegistrationInput, h as AddressedPolicyRegistrationReceipt, b as AddressedPublishAuthority, i as AddressedShareBoundInput, j as AddressedShareKeyClient, k as AddressedShareOverLimitError, l as AddressedSharePublishOptions, m as AddressedShareRequest, n as AddressedShareWrites, E as EncryptedAddressedContent, P as PathBoundContentSource, o as PathBoundEnvelope, p as PathBoundPermissionEntry, q as PathBoundSharePlan, r as PreparedAddressedShare, s as TargetPublishAdapter, t as addressedCredentialRequirement, u as addressedShareBodyUpperBound, v as assertAddressedShareFits, w as assertPathBoundContentSource, x as bindPathBoundContentSource, y as defaultEncryptionNetworkForOwner, z as encryptAddressedShareContent, B as normalizeShareTarget, C as pathBoundKeyPath, D as pathBoundSessionPermissions, F as pathBoundStoredBytes, G as planPathBoundShare, H as prepareAddressedShare, I as publishAddressedShare, J as publishTargetShare, K as targetAuthorizationMethod, L as wrappedKeyDigestHex } from './addressed-publish-BPFFqD5s.cjs';
+import { T as TargetPublishOutcome, c as TargetPublishInput, S as ShareTarget } from './addressed-publish-qp_bEVYu.cjs';
+export { d as ADDRESSED_SHARE_TOO_LARGE_MESSAGE, e as AddressedContentSourceError, f as AddressedContentSourceErrorCode, A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, g as AddressedPolicyRegistrationInput, h as AddressedPolicyRegistrationReceipt, b as AddressedPublishAuthority, i as AddressedShareBoundInput, j as AddressedShareKeyClient, k as AddressedShareOverLimitError, l as AddressedSharePublishOptions, m as AddressedShareRequest, n as AddressedShareWrites, E as EncryptedAddressedContent, P as PathBoundContentSource, o as PathBoundEnvelope, p as PathBoundPermissionEntry, q as PathBoundSharePlan, r as PreparedAddressedShare, s as TargetPublishAdapter, t as addressedCredentialRequirement, u as addressedShareBodyUpperBound, v as assertAddressedShareFits, w as assertPathBoundContentSource, x as bindPathBoundContentSource, y as defaultEncryptionNetworkForOwner, z as encryptAddressedShareContent, B as normalizeShareTarget, C as pathBoundKeyPath, D as pathBoundSessionPermissions, F as pathBoundStoredBytes, G as planPathBoundShare, H as prepareAddressedShare, I as publishAddressedShare, J as publishTargetShare, K as targetAuthorizationMethod, L as wrappedKeyDigestHex } from './addressed-publish-qp_bEVYu.cjs';
 import { S as SenderShareRecord, a as SenderShareRecordStorage } from './history-Bg25JIsi.cjs';
 export { E as EncryptedSenderShareHistory, b as EncryptedShareHistoryStorage, M as MemoryEncryptedShareHistoryStorage, c as MemorySenderShareKeyStorage, d as MemorySenderShareRecordStorage, e as SenderShareKeyStorage, f as SenderShareRecordProofs, g as SenderShareRevocationScope, h as SenderShareStore, i as historyRecordForPublishedShare } from './history-Bg25JIsi.cjs';
 import { b as ShareAuthorizationResult, c as ShareAuthorizationAdapter } from './authorization-CmP1skO8.cjs';

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { D as DEFAULT_MAX_CONTENT_BLOB_BYTES, a as DEFAULT_MAX_SEALED_BLOB_BYTES
 export { C as CreateOwnerDelegationParams, h as DEFAULT_SHARE_LIFETIME_MS, D as DelegatedShareKey, M as MAX_CONTENT_BYTES, i as OWNER_SHARE_REGISTRATION_DOMAIN, j as OwnerDelegationPermission, g as OwnerDelegationReceipt, O as OwnerShareAction, k as OwnerShareDecryption, a as OwnerShareMatcher, l as OwnerSharePolicyRegistration, b as OwnerSharePolicyRegistrationReceipt, m as OwnerSharePolicyV2, c as PublishedShare, P as PublishedShareDeliveryMaterial, n as PublishedShareMetadata, R as RegisterOwnerSharePolicyParams, o as SHARE_CONTENT_LIMIT, p as SHARE_PUBLISH_RESULT_VERSION, f as SharePublishError, q as SharePublishErrorCode, e as SharePublishOptions, d as SharePublishTarget, S as SignedDelegation, r as canonicalOwnerSharePolicy, s as computeOwnerShareRegistrationCid, t as createDelegatedShareKey, u as createPolicyEnforcementDelegation, v as redactPublishedShare, w as restoreDelegatedShareKey, x as validateOwnerSharePolicyRegistration, y as validateOwnerSharePolicyRegistrationBytes } from './owner-policy-aPmXIR3e.js';
 import { ShareEnvelopeV2, ArtifactPin, UnsignedShareEnvelopeV3, ShareEnvelopeV3 } from '@tinycloud/share-envelope';
 export { CheckBearerDelegationOptions, DelegationCheckResult, canonicalize, checkBearerDelegation, fromBase64Url, requiredResourceUri, resourceUriCovers, toBase64Url } from '@tinycloud/share-envelope';
-import { T as TargetPublishOutcome, c as TargetPublishInput, S as ShareTarget } from './addressed-publish-DorqWQJ8.js';
-export { d as ADDRESSED_SHARE_TOO_LARGE_MESSAGE, e as AddressedContentSourceError, f as AddressedContentSourceErrorCode, A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, g as AddressedPolicyRegistrationInput, h as AddressedPolicyRegistrationReceipt, b as AddressedPublishAuthority, i as AddressedShareBoundInput, j as AddressedShareKeyClient, k as AddressedShareOverLimitError, l as AddressedSharePublishOptions, m as AddressedShareRequest, n as AddressedShareWrites, E as EncryptedAddressedContent, P as PathBoundContentSource, o as PathBoundEnvelope, p as PathBoundPermissionEntry, q as PathBoundSharePlan, r as PreparedAddressedShare, s as TargetPublishAdapter, t as addressedCredentialRequirement, u as addressedShareBodyUpperBound, v as assertAddressedShareFits, w as assertPathBoundContentSource, x as bindPathBoundContentSource, y as defaultEncryptionNetworkForOwner, z as encryptAddressedShareContent, B as normalizeShareTarget, C as pathBoundKeyPath, D as pathBoundSessionPermissions, F as pathBoundStoredBytes, G as planPathBoundShare, H as prepareAddressedShare, I as publishAddressedShare, J as publishTargetShare, K as targetAuthorizationMethod, L as wrappedKeyDigestHex } from './addressed-publish-DorqWQJ8.js';
+import { T as TargetPublishOutcome, c as TargetPublishInput, S as ShareTarget } from './addressed-publish-D4IWNXuw.js';
+export { d as ADDRESSED_SHARE_TOO_LARGE_MESSAGE, e as AddressedContentSourceError, f as AddressedContentSourceErrorCode, A as AddressedOwnerRootInput, a as AddressedOwnerRootReceipt, g as AddressedPolicyRegistrationInput, h as AddressedPolicyRegistrationReceipt, b as AddressedPublishAuthority, i as AddressedShareBoundInput, j as AddressedShareKeyClient, k as AddressedShareOverLimitError, l as AddressedSharePublishOptions, m as AddressedShareRequest, n as AddressedShareWrites, E as EncryptedAddressedContent, P as PathBoundContentSource, o as PathBoundEnvelope, p as PathBoundPermissionEntry, q as PathBoundSharePlan, r as PreparedAddressedShare, s as TargetPublishAdapter, t as addressedCredentialRequirement, u as addressedShareBodyUpperBound, v as assertAddressedShareFits, w as assertPathBoundContentSource, x as bindPathBoundContentSource, y as defaultEncryptionNetworkForOwner, z as encryptAddressedShareContent, B as normalizeShareTarget, C as pathBoundKeyPath, D as pathBoundSessionPermissions, F as pathBoundStoredBytes, G as planPathBoundShare, H as prepareAddressedShare, I as publishAddressedShare, J as publishTargetShare, K as targetAuthorizationMethod, L as wrappedKeyDigestHex } from './addressed-publish-D4IWNXuw.js';
 import { S as SenderShareRecord, a as SenderShareRecordStorage } from './history-kwJxrZgq.js';
 export { E as EncryptedSenderShareHistory, b as EncryptedShareHistoryStorage, M as MemoryEncryptedShareHistoryStorage, c as MemorySenderShareKeyStorage, d as MemorySenderShareRecordStorage, e as SenderShareKeyStorage, f as SenderShareRecordProofs, g as SenderShareRevocationScope, h as SenderShareStore, i as historyRecordForPublishedShare } from './history-kwJxrZgq.js';
 import { b as ShareAuthorizationResult, c as ShareAuthorizationAdapter } from './authorization-CmP1skO8.js';

package/dist/index.js

@@ -5761,6 +5761,7 @@ function canonicalMailbox(value) {
   if (local.length > 64 || !/^[a-z0-9#$&'*+/=?^_`{|}~-]+(?:\.[a-z0-9#$&'*+/=?^_`{|}~-]+)*$/.test(local) || !isCanonicalEmailDomain(domain)) return void 0;
   return Object.freeze({ email, domain });
 }
+var POLICY_ROOT_MAX_LIFETIME_SECONDS = 31 * 24 * 60 * 60;
 async function signCompactUcanAuthorization(input) {
   if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 60) {
     throw new TypeError("compact invocation lifetime must be between one and 60 seconds");
@@ -6520,7 +6521,7 @@ function canonicalKeyHashHex(encryptedSymmetricKey) {
 }
 function pathBoundSessionPermissions(input) {
   const encryptionNetwork = assertNetwork(input.encryptionNetwork);
-  return [{ service: "tinycloud.encryption", path: `${encryptionNetwork}/share/`, actions: ["tinycloud.encryption/decrypt", "tinycloud.encryption/key.create"] }];
+  return [{ service: "tinycloud.encryption", path: `${encryptionNetwork}/share/`, actions: ["tinycloud.encryption/decrypt"] }];
 }
 function planPathBoundShare(input) {
   const keyPath = pathBoundKeyPath(input.shareId);
@@ -6531,9 +6532,7 @@ function planPathBoundShare(input) {
     encryptionNetwork,
     keyPath,
     keyResource,
-    requiredPermissions: [{ service: "tinycloud.encryption", path: keyResource, actions: ["tinycloud.encryption/key.create"] }],
-    sessionPermissions: pathBoundSessionPermissions({ encryptionNetwork }),
-    registrationPermissions: [{ service: "tinycloud.encryption", path: `${encryptionNetwork}/share/`, actions: ["tinycloud.encryption/decrypt"] }],
+    registrationPermissions: pathBoundSessionPermissions({ encryptionNetwork }),
     encryptOptions: (extra) => ({ networkId: encryptionNetwork, ...extra?.metadata === void 0 ? {} : { metadata: { ...extra.metadata } } })
   };
 }
@@ -6587,34 +6586,11 @@ function bindPathBoundContentSource(input) {
     initialCiphertextDigestHex: hex2(sha2563(expected))
   };
 }
-function isUnauthorized(error) {
-  const value = error;
-  return value !== null && typeof value === "object" && (value.status === 401 || value.status === 403 || value.code === "PERMISSION_DENIED" || value.code === "AUTH_UNAUTHORIZED");
-}
 async function encryptAddressedShareContent(input) {
   const { plan, keys } = input;
   const byteLength = input.plaintext.byteLength;
-  let receipt;
-  try {
-    receipt = await keys.createKey(plan.keyPath, { networkId: plan.encryptionNetwork });
-  } catch (error) {
-    if (isUnauthorized(error)) {
-      const status = error.status;
-      throw new AddressedContentSourceError(
-        "key-not-authorized",
-        `the owner session does not hold tinycloud.encryption/key.create on ${plan.keyResource} (the node answers "Unauthorized Action: ${plan.keyResource} / tinycloud.encryption/key.create"); hold it either at sign-in (put plan.sessionPermissions in the manifest: key.create on ${plan.encryptionNetwork}/share/) or per share (requestPermissions(plan.requiredPermissions)) before creating the key` + (status === 403 ? "; if the owner signs in through OpenKey, the request must come from a first-party TinyCloud origin" : "")
-      );
-    }
-    throw error;
-  }
-  if (receipt.networkId !== plan.encryptionNetwork || receipt.keyPath !== plan.keyPath || receipt.state !== void 0 && receipt.state !== "active") {
-    throw new AddressedContentSourceError("key-receipt-mismatch", "the created key does not match this share");
-  }
   const envelope = await keys.encrypt(plan.keyPath, input.plaintext, plan.encryptOptions(input.metadata === void 0 ? void 0 : { metadata: input.metadata }));
   assertEnvelope(plan, envelope);
-  if (receipt.keyVersion !== void 0 && envelope.keyVersion !== receipt.keyVersion) {
-    throw new AddressedContentSourceError("key-receipt-mismatch", "the envelope key version does not match the created key");
-  }
   const storedBytes = pathBoundStoredBytes(envelope);
   return { envelope, storedBytes, byteLength };
 }