@tinycloud/cli 1.3.0-beta.49 → 1.3.0-beta.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/cli",
-  "version": "1.3.0-beta.49",
+  "version": "1.3.0-beta.50",
   "description": "TinyCloud CLI - manage data, delegations, and nodes from the terminal",
   "author": "TinyCloud, Inc.",
   "license": "EGPL",
@@ -33,21 +33,22 @@
     "sync:courier-skill": "rm -rf skills/courier && cp -R ../courier/skills/courier skills/courier"
   },
   "dependencies": {
-    "@tinycloud/share-sdk": "1.2.0-beta.6",
+    "@tinycloud/share-sdk": "1.2.0-beta.7",
     "@tinycloud/share-envelope": "1.2.0-beta.0",
-    "@tinycloud/node-sdk": "3.3.0-beta.37",
+    "@tinycloud/node-sdk": "3.3.0-beta.38",
     "@tinycloud/node-sdk-wasm": "1.7.8-beta.0",
-    "@tinycloud/sdk-core": "3.3.0-beta.37",
+    "@tinycloud/sdk-core": "3.3.0-beta.38",
     "@tinycloud/sdk-services": "3.3.0-beta.25",
-    "@tinycloud/operations": "0.7.0-beta.36",
+    "@tinycloud/operations": "0.7.0-beta.37",
     "chalk": "^5.3.0",
     "commander": "^14.0.0",
+    "jsdom": "26.1.0",
     "open": "^11.0.0",
     "ora": "^9.3.0",
     "siwe": "^3.0.0"
   },
   "devDependencies": {
-    "@tinycloud/courier": "0.2.0-beta.43",
+    "@tinycloud/courier": "0.2.0-beta.45",
     "@tinycloud/replica": "0.3.0-beta.10",
     "@types/node": "^20",
     "tsup": "^8.0.0",

package/skills/tc-cli/REFERENCE.md

@@ -365,6 +365,7 @@ Publishing needs the publishing scope on a dedicated profile (`tinycloud --profi
 "$TC" share publish ./note.md --to domain:example.com                 # addressed: any verified address at the domain
 "$TC" share publish ./note.md --to domain:example.com --notify --notify-to alice@example.com  # invite one matching mailbox; node 1.17.3+
 cat note.md | "$TC" share publish - --name note.md
+"$TC" share publish ./site/ --json                                    # folder with index.html -> one self-contained page, bearer link
 
 printf '%s' "$SHARE_URL" | "$TC" share inspect - --json               # verify, print safe metadata
 printf '%s' "$SHARE_URL" | "$TC" share receive - --stdout             # bearer link: verified bytes
@@ -430,6 +431,7 @@ An artifact is a file an agent publishes for a person to open in the Share viewe
 |------|------|----------------------|
 | Markdown | `report.md` | Renders GFM (tables, task lists, fenced code), sanitized; data: images only |
 | HTML | `page.html`, one self-contained file | Runs it in an isolated sandbox with no network: inline all CSS, scripts and images (`data:` URIs); links to other URLs and external scripts, fonts and stylesheets do not load |
+| HTML folder | `./site/` with a top-level `index.html`, bearer links only | Not a separate kind: `share publish ./site/` inlines the folder's CSS, scripts, images and fonts into one self-contained page at publish time and publishes that single `.html` (named `site.html`, or `--name`). The page can use only what the folder holds: external URLs, frames, forms, `<base>`, module scripts and links to other pages are refused with a typed error naming the file and reference (`UNSUPPORTED_HTML`, `HTML_RESOURCE_MISSING`, `UNSAFE_PATH`, `UNSUPPORTED_FOLDER_ENTRY`, `MAX_BYTES_EXCEEDED`). Symbolic links and names starting with `.` are never read. An `@import`ed stylesheet can only hold rules: if it uses `url()` the folder is refused, so put images and fonts in the page's own stylesheet or `<style>`. `manifest.json` and `knowledge/**` stay out of the page and are not published. Addressed and `--prefix` folder publishing is not available (refused with `MAX_BYTES_EXCEEDED`, exit 7, saying so) |
 | JSX | `App.jsx` / `App.tsx` with a default-export component | Compiles and renders it in the same kind of sandbox once the viewer release that adds JSX rendering is live; until then the file is shown as source text with a Download action |
 
 JSX: `export default function App() { ... }`, no `ReactDOM.render`, no CSS file. Imports resolve only from this library set: `react` (19), `react-dom/client`, `lucide-react`, `recharts`, `d3`, `mermaid` (11), plus Tailwind utility classes. Any other import fails with an error panel listing the set; bundle other code into the file or publish a self-contained HTML page. Fetching data is not possible (no network): embed the data in the file.

package/skills/tc-cli/SKILL.md

@@ -96,8 +96,11 @@ Exit code 5 from `knowledge list|read` means the grant does not cover that app;
 ```bash
 "$TC" --profile publisher share publish ./note.md --json
 "$TC" --profile publisher share publish ./note.md --to email:alice@example.com --notify --json
+"$TC" --profile publisher share publish ./site/ --json   # a folder with a top-level index.html -> one self-contained page
 ```
 
+A folder (a top-level `index.html` plus the CSS, scripts, images and fonts it uses) is inlined into one self-contained `.html` and published as an anyone-with-the-link share named `<folder>.html` (or `--name`). Use only files in the folder: external URLs, frames, forms, `<base>`, module scripts and links to other pages are refused, with an error that names the file and the reference (`UNSUPPORTED_HTML`, `HTML_RESOURCE_MISSING`, `UNSAFE_PATH`, `UNSUPPORTED_FOLDER_ENTRY`, `MAX_BYTES_EXCEEDED`), and nothing is published. Symbolic links are refused, entries starting with `.` are skipped, and `manifest.json` and `knowledge/` are not inlined or published. Folders cannot be shared to an address or with `--prefix`; publish a single file for those.
+
 Without `--to`, publish creates a bearer link: anyone holding the complete URL can read it until it expires or `tinycloud share revoke <id>` revokes it. `--to email:`, `--to did:` and `--to domain:` create addressed links that only the named recipient can open after proving who they are. Keep complete URLs, including the `#` fragment, out of logs. `--notify` requires `read`; domain invitations also require `--notify-to <email>` at the exact domain, a matching sender/owner DID and node 1.17.3+. Session-only publishers can notify their own domain policies. Standalone `tinycloud share notify <id> --to <email>` refuses records without `read` and domain delivery on unsupported nodes before sending. It retries within 5 minutes of publication; after that it reports a non-retryable `partial-failure` (exit 9), and the sender must publish a new share to invite again. A confirmed repeat reports `already-delivered`; a failed history confirmation warns without hiding a successful delivery. Human publish prints only the URL; with `--notify --json`, the redacted publication JSON also contains `notification` with delivery status and attempts. The default lifetime is seven days, clamped to the verified session expiry; JSON output reports `expiryClamped`. Explicit `--expires` values beyond the session end fail instead of being silently shortened. See [REFERENCE.md](REFERENCE.md) for inspect, receive, list, show and revoke.
 
 To show a person a document, page or small app, publish it as an artifact: a Markdown file, one self-contained HTML file, or a JSX component with a default export. Use `--to anyone` (the default) with `--artifact new --json`, then get the link with `tinycloud share show <id> --reveal-link`; `--json` output never contains the link. Revoke with `tinycloud share revoke <id>`. `--to anyone --action edit` is refused. See [REFERENCE.md](REFERENCE.md#artifacts) for the file kinds, the JSX library set and the `--tc-*` style tokens.