@tinycloud/cli 1.3.1 → 1.3.2-beta.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/cli",
-  "version": "1.3.1",
+  "version": "1.3.2-beta.0",
   "description": "TinyCloud CLI - manage data, delegations, and nodes from the terminal",
   "author": "TinyCloud, Inc.",
   "license": "EGPL",
@@ -33,13 +33,13 @@
     "sync:courier-skill": "rm -rf skills/courier && cp -R ../courier/skills/courier skills/courier"
   },
   "dependencies": {
-    "@tinycloud/share-sdk": "1.2.0",
-    "@tinycloud/share-envelope": "1.2.0",
-    "@tinycloud/node-sdk": "3.3.0",
+    "@tinycloud/share-sdk": "1.2.1-beta.0",
+    "@tinycloud/share-envelope": "1.2.1-beta.0",
+    "@tinycloud/node-sdk": "3.3.1-beta.0",
     "@tinycloud/node-sdk-wasm": "1.7.8",
-    "@tinycloud/sdk-core": "3.3.0",
+    "@tinycloud/sdk-core": "3.3.1-beta.0",
     "@tinycloud/sdk-services": "3.3.0",
-    "@tinycloud/operations": "0.7.0",
+    "@tinycloud/operations": "0.7.1-beta.0",
     "chalk": "^5.3.0",
     "commander": "^14.0.0",
     "jsdom": "26.1.0",
@@ -48,7 +48,7 @@
     "siwe": "^3.0.0"
   },
   "devDependencies": {
-    "@tinycloud/courier": "0.2.0",
+    "@tinycloud/courier": "0.2.1-beta.0",
     "@tinycloud/replica": "0.3.0",
     "@types/node": "^20",
     "tsup": "^8.0.0",

package/skills/tc-cli/REFERENCE.md

@@ -392,6 +392,8 @@ Versions are kept by default and count against the owner's storage. The node doe
 
 **Bearer vs addressed.** A bearer link (default, `--to anyone`) is `/viewer#tc1=<TinyCloud delegation>`: anyone holding the complete URL can read the file until it expires, and revocation cannot recall copies already received. Addressed links (`--to email:`, `--to did:`, `--to domain:`) are `/s/inline#v=2&p=<sealed Policy/v3 envelope>`: the content is encrypted and only the named recipient can open it after proving their email or DID in Share. `tinycloud share receive` returns the bytes of a bearer link; for an addressed link it exits 6 with `CLAIM_REQUIRED` because the recipient claims it in Share. `--notify` requires the `read` action: exact-email targets invite the matched mailbox; domain targets need `--notify-to` naming one canonical mailbox at that exact domain and a node reporting version 1.17.3 or later. The CLI refuses unsupported domain invitations before uploading or registering a share. A session-only publisher can deliver its own domain policy when the invoking DID matches its signed owner DID; a different sender DID cannot. `tinycloud share notify <id> --to <mailbox>` can address another mailbox in a domain share under the same node and sender-DID requirements; it refuses stored shares without `read` or on an unsupported node before sending.
 
+**Short links (addressed shares).** `share publish` prints an addressed share as a short link, `https://share.tinycloud.xyz/s/<id>#v=3&k=<key>&c=<cid>`. Share's short-link service stores only the sealed envelope bytes under `<id>`. The read key `k` and the CID `c` of those bytes stay in the fragment, so the service never receives the key, and `share receive`/`share inspect` refuse bytes that do not hash to `c`. `--long-link` prints the self-contained `/s/inline#v=2&p=…` link instead. If the short-link service is unavailable, publishing still succeeds: the CLI prints the long link, warns on stderr that it is long, and `--json` adds `shortLinkError` (`rate-limited`, `capacity`, `rejected`, `unavailable`, `invalid-response`, `too-large` or `token-store-failed`). That includes a refused or timed-out connection: each short-link request gives up after 10 seconds. Every publish first reads Share's public configuration from the same host, so if that host is unreachable altogether the publish stops before anything is shared, with `SHARE_SERVICE_UNAVAILABLE` (exit 4). The short link's delete token is kept in the owner's `default` space at `xyz.tinycloud.share/shares/<shareId>/.short-link.json`, the same key the Share web composer uses, so either client can revoke a share the other published. `share show <id> --reveal-link` prints the same short link, and `share revoke` deletes the stored envelope after the node confirms the revocation; a failed delete only warns, and the envelope expires with the share. Sender history and the `--notify` invitation still carry the long link. Bearer links are unchanged.
+
 The fragment after `#` is the read key. Browsers never send it to a server; `--notify` gives the link to TinyCloud only to email your recipients. Keep complete URLs out of logs. Human publish output is exactly one URL. JSON publish output never contains the link: it retains the redacted publication fields (including the share id) and adds `notification` (the `ShareNotifyResult`, including `state`, `attempts`, and optional failure `reason`) when `--notify` was requested. To get the complete link after a `--json` publish, run `tinycloud share show <id> --reveal-link`, ideally writing it straight to a private file. Inspect never prints plaintext or secret-bearing fields. Receive uses a sanitized single-segment filename and refuses overwrite unless `--force`. `revoke` asks the owner node to revoke the share (an addressed share's Policy/v3 root, or a bearer link's delegation) and reports `revoked` only when the node confirms it; receiving the link then fails; for a bearer link, `tinycloud share receive` reports `SHARE_REVOKED` (exit 4, "This share link has been revoked by its sender."). Revoking an already revoked share keeps its original `revokedAt`. A bearer revoke that cannot proceed revokes nothing: `SHARE_ISSUER_KEY_UNAVAILABLE` (exit 5) when this profile cannot sign for the link, `SHARE_LINK_UNAVAILABLE` (exit 4) when the stored link is missing or does not match the record, and `SHARE_REVOKE_REJECTED` (exit 4, with the node's reason) when the node refuses. `SHARE_REVOKE_UNCONFIRMED` (exit 1) means the node answered without confirming: the link may already be revoked, history is not marked revoked, and you should check whether the link still opens before retrying. Pre-cutover blob-backed and plaintext `?tc2` links are not accepted.
 
 **Publish history status.** `share publish --json` reports the sender-history write as `history`: `{"recorded": true}` when the share was saved, or `{"recorded": false, "reason": "<CODE>"}` when it was not. `HISTORY_UNREADABLE` means the existing history file cannot be decrypted or parsed with the current session key. `HISTORY_READ_FAILED` means the filesystem refused or failed to read that file. `HISTORY_WRITE_FAILED` means a filesystem or permission error during the write. `HISTORY_UNAVAILABLE` covers every other failure, including a profile-lock timeout. The exit status is 0 in all four cases, so do not retry the publish on this result: a retry creates a duplicate share. The stderr warning names the reason and the share id and CID to keep. It never includes the link, the key, or ciphertext. When `--notify` delivers but the delivery confirmation cannot be saved, `history.recorded` stays `true` (the share itself was saved) and the warning names the reason, the share id, and the CID.