@tinycloud/cli 1.3.7-beta.0 → 1.4.0-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/cli",
-  "version": "1.3.7-beta.0",
+  "version": "1.4.0-beta.1",
   "description": "TinyCloud CLI - manage data, delegations, and nodes from the terminal",
   "author": "TinyCloud, Inc.",
   "license": "EGPL",
@@ -33,13 +33,13 @@
     "sync:courier-skill": "rm -rf skills/courier && cp -R ../courier/skills/courier skills/courier"
   },
   "dependencies": {
-    "@tinycloud/share-sdk": "1.3.0",
-    "@tinycloud/share-envelope": "1.2.1",
-    "@tinycloud/node-sdk": "3.6.2-beta.0",
+    "@tinycloud/share-sdk": "1.4.0-beta.0",
+    "@tinycloud/share-envelope": "1.3.0-beta.0",
+    "@tinycloud/node-sdk": "3.7.0-beta.1",
     "@tinycloud/node-sdk-wasm": "1.7.8",
-    "@tinycloud/sdk-core": "3.6.1",
+    "@tinycloud/sdk-core": "3.7.0-beta.1",
     "@tinycloud/sdk-services": "3.6.1",
-    "@tinycloud/operations": "0.7.6-beta.0",
+    "@tinycloud/operations": "0.7.6-beta.1",
     "chalk": "^5.3.0",
     "commander": "^14.0.0",
     "jsdom": "26.1.0",
@@ -48,7 +48,7 @@
     "siwe": "^3.0.0"
   },
   "devDependencies": {
-    "@tinycloud/courier": "0.3.2-beta.0",
+    "@tinycloud/courier": "0.3.2-beta.1",
     "@tinycloud/replica": "0.3.4-beta.0",
     "@types/node": "^20",
     "tsup": "^8.0.0",

package/skills/tc-cli/REFERENCE.md

@@ -5,7 +5,7 @@ This release has **Commander coverage tracked, not complete parity**:
 
 - 4 migrated registration(s).
 - 1 partially migrated registration(s).
-- 131 legacy registration(s) remain Commander-owned.
+- 132 legacy registration(s) remain Commander-owned.
 
 - `auth import [source]` → `tinycloud.auth.import@1` (partial; legacy inputs: v1 delegation artifact, v1 permission artifact without command, bare portable delegation, stored delegation wrapper, cross-user delegation persisted with activated=false).
 - `secrets get <name>` → `tinycloud.secrets.get@1` (migrated).
@@ -392,9 +392,9 @@ Versions are kept by default and count against the owner's storage. The node doe
 
 **Pin (addressed artifact shares).** The signed envelope of an addressed artifact share carries `artifactPin`: artifact id, version, the sha256 of that version's `manifest.json`, and the sha256 and size of the one stored (encrypted) file the share reads. The owner's signature covers it. The recipient refuses the share unless the pin matches what the share reads, and refuses the fetched bytes unless they hash to the pinned digest. A share that reads `artifacts/` without a valid pin is refused, and a pinned share never carries `put`. The owner is the trusted signer: the node has no write-once ACL, so the owner (or anyone holding the owner's session) can still overwrite a version file afterwards. Recipients then fail closed on the digest mismatch; they cannot tell that apart from a node serving altered bytes. Bearer artifact shares carry no envelope, so they have no pin and no digest yet: they are limited to the one version file by their delegation only, and an owner overwrite of that file reaches bearer recipients undetected. A viewer built before this field exists rejects the envelope (its schema is strict) instead of showing unverified content.
 
-**Bearer vs addressed.** A bearer link (default, `--to anyone`) is `/viewer#tc1=<TinyCloud delegation>`: anyone holding the complete URL can read the file until it expires, and revocation cannot recall copies already received. Addressed links (`--to email:`, `--to did:`, `--to domain:`) are `/s/inline#v=2&p=<sealed Policy/v3 envelope>`: the content is encrypted and only the named recipient can open it after proving their email or DID in Share. `tinycloud share receive` returns the bytes of a bearer link; for an addressed link it exits 6 with `CLAIM_REQUIRED` because the recipient claims it in Share. `--notify` requires the `read` action: exact-email targets invite the matched mailbox; domain targets need `--notify-to` naming one canonical mailbox at that exact domain and a node reporting version 1.17.3 or later. The CLI refuses unsupported domain invitations before uploading or registering a share. A session-only publisher can deliver its own domain policy when the invoking DID matches its signed owner DID; a different sender DID cannot. `tinycloud share notify <id> --to <mailbox>` can address another mailbox in a domain share under the same node and sender-DID requirements; it refuses stored shares without `read` or on an unsupported node before sending.
+**Bearer vs addressed.** A bearer link (default, `--to anyone`) is `/viewer#tc1=<TinyCloud delegation>`: anyone holding the complete URL can read the file until it expires, and revocation cannot recall copies already received. Addressed links (`--to email:`, `--to did:`, `--to domain:`) are `v=4` links, short (`/s/<id>#v=4&k=<key>&c=<cid>`) or full (`/s/full#v=4&k=<key>&r=<signed record>`): the content is encrypted and only the named recipient can open it after proving their email or DID in Share. `tinycloud share receive` returns the bytes of a bearer link; for an addressed link it exits 6 with `CLAIM_REQUIRED` because the recipient claims it in Share. `--notify` requires the `read` action: exact-email targets invite the matched mailbox; domain targets need `--notify-to` naming one canonical mailbox at that exact domain and a node reporting version 1.17.3 or later. The CLI refuses unsupported domain invitations before uploading or registering a share. A session-only publisher can deliver its own domain policy when the invoking DID matches its signed owner DID; a different sender DID cannot. `tinycloud share notify <id> --to <mailbox>` can address another mailbox in a domain share under the same node and sender-DID requirements; it refuses stored shares without `read` or on an unsupported node before sending. An invitation email carries only a short link. Until the services that send invitation emails accept short links, `--notify` and `share notify` stop before publishing or sending anything and say so.
 
-**Short links (addressed shares).** `share publish` prints an addressed share as a short link, `https://share.tinycloud.xyz/s/<id>#v=3&k=<key>&c=<cid>`. Share's short-link service stores only the sealed envelope bytes under `<id>`. The read key `k` and the CID `c` of those bytes stay in the fragment, so the service never receives the key, and `share receive`/`share inspect` refuse bytes that do not hash to `c`. `--long-link` prints the self-contained `/s/inline#v=2&p=…` link instead. If the short-link service is unavailable, publishing still succeeds: the CLI prints the long link, warns on stderr that it is long, and `--json` adds `shortLinkError` (`rate-limited`, `capacity`, `rejected`, `unavailable`, `invalid-response`, `too-large` or `token-store-failed`). That includes a refused or timed-out connection: each short-link request gives up after 10 seconds. Every publish first reads Share's public configuration from the same host, so if that host is unreachable altogether the publish stops before anything is shared, with `SHARE_SERVICE_UNAVAILABLE` (exit 4). The short link's delete token is kept in the owner's `default` space at `xyz.tinycloud.share/shares/<shareId>/.short-link.json`, the same key the Share web composer uses, so either client can revoke a share the other published. `share show <id> --reveal-link` prints the same short link, and `share revoke` deletes the stored envelope after the node confirms the revocation; a failed delete only warns, and the envelope expires with the share. Sender history and the `--notify` invitation still carry the long link. Bearer links are unchanged.
+**Links (addressed shares).** `share publish` chooses the link from the share's lifetime. A share that lasts 120 seconds to 30 days gets a short link, `https://share.tinycloud.xyz/s/<id>#v=4&k=<key>&c=<cid>`: the links API at `api.tinycloud.xyz` stores the sealed envelope and a header signed by the publishing profile's key (its `did:key`), and the read key `k` and the CID `c` of the stored bytes stay in the fragment, so the API never receives the key. `share receive` and `share inspect` read both link forms and refuse bytes that do not match the link. A share that lasts longer than 30 days, or less than 120 seconds, gets the full link, which carries the signed record itself; past 30 days the CLI also prints a warning on stderr (`https://tinycloud.xyz/delegations?from=link-expiry`) and `--json` adds `linkNotice` with the same text. `--full-link` always prints the full link. If the links API refuses the request or cannot be reached (each request gives up after 10 seconds), publishing still succeeds: the CLI prints the full link and a notice on stderr, and `--json` adds `linkNotice`. Every publish first reads Share's public configuration from the same host, so if that host is unreachable altogether the publish stops before anything is shared, with `SHARE_SERVICE_UNAVAILABLE` (exit 4). A link carries at most 64 KiB of sealed envelope. The CLI measures the largest the envelope can be before it writes anything (the location record, the upload, the policy registration); a share over the limit stops with `MAX_BYTES_EXCEEDED` (exit 7), "This share is too large to send as a link, so nothing was shared. Use a shorter path or fewer folders.", and no link of either form is made. Sender history keeps the link text the publish printed. `share show <id> --reveal-link` prints it. `share unlink <id>` deletes the share's short link now, with a request signed by the publishing key; it answers `deleted`, or `absent` when the link is already gone (a link expires with the share, or at 30 days). `share unlink` does not revoke the share, and `share revoke <id>` does not delete the link: a revoked share's link stops working because the share does, and the link expires on its own. Bearer links are unchanged. Old `.short-link.json` records in the owner's space are no longer read or written and are left in place.
 
 The fragment after `#` is the read key. Browsers never send it to a server; `--notify` gives the link to TinyCloud only to email your recipients. Keep complete URLs out of logs. Human publish output is exactly one URL. JSON publish output never contains the link: it retains the redacted publication fields (including the share id) and adds `notification` (the `ShareNotifyResult`, including `state`, `attempts`, and optional failure `reason`) when `--notify` was requested. To get the complete link after a `--json` publish, run `tinycloud share show <id> --reveal-link`, ideally writing it straight to a private file. Inspect never prints plaintext or secret-bearing fields. Receive uses a sanitized single-segment filename and refuses overwrite unless `--force`. `revoke` asks the owner node to revoke the share (an addressed share's Policy/v3 root, or a bearer link's delegation) and reports `revoked` only when the node confirms it; receiving the link then fails; for a bearer link, `tinycloud share receive` reports `SHARE_REVOKED` (exit 4, "This share link has been revoked by its sender."). Revoking an already revoked share keeps its original `revokedAt`. A bearer revoke that cannot proceed revokes nothing: `SHARE_ISSUER_KEY_UNAVAILABLE` (exit 5) when this profile cannot sign for the link, `SHARE_LINK_UNAVAILABLE` (exit 4) when the stored link is missing or does not match the record, and `SHARE_REVOKE_REJECTED` (exit 4, with the node's reason) when the node refuses. `SHARE_REVOKE_UNCONFIRMED` (exit 1) means the node answered without confirming: the link may already be revoked, history is not marked revoked, and you should check whether the link still opens before retrying. Pre-cutover blob-backed and plaintext `?tc2` links are not accepted.
 

package/skills/tc-cli/SKILL.md

@@ -115,7 +115,7 @@ Knowledge files whose bytes differ from the pinned version are left as the owner
 
 A folder (a top-level `index.html` plus the CSS, scripts, images and fonts it uses) is inlined into one self-contained `.html` and published as an anyone-with-the-link share named `<folder>.html` (or `--name`). Use only files in the folder: external URLs, frames, forms, `<base>`, module scripts and links to other pages are refused, with an error that names the file and the reference (`UNSUPPORTED_HTML`, `HTML_RESOURCE_MISSING`, `UNSAFE_PATH`, `UNSUPPORTED_FOLDER_ENTRY`, `MAX_BYTES_EXCEEDED`), and nothing is published. Symbolic links are refused, entries starting with `.` are skipped, and `manifest.json` and `knowledge/` are not inlined or published. Folders cannot be shared to an address or with `--prefix`; publish a single file for those.
 
-Without `--to`, publish creates a bearer link: anyone holding the complete URL can read it until it expires or `tinycloud share revoke <id>` revokes it. `--to email:`, `--to did:` and `--to domain:` create addressed links that only the named recipient can open after proving who they are. Keep complete URLs, including the `#` fragment, out of logs. `--notify` requires `read`; domain invitations also require `--notify-to <email>` at the exact domain, a matching sender/owner DID and node 1.17.3+. Session-only publishers can notify their own domain policies. Standalone `tinycloud share notify <id> --to <email>` refuses records without `read` and domain delivery on unsupported nodes before sending. It retries within 5 minutes of publication; after that it reports a non-retryable `partial-failure` (exit 9), and the sender must publish a new share to invite again. A confirmed repeat reports `already-delivered`; a failed history confirmation warns without hiding a successful delivery. Human publish prints only the URL; with `--notify --json`, the redacted publication JSON also contains `notification` with delivery status and attempts. The default lifetime is seven days, clamped to the verified session expiry; JSON output reports `expiryClamped`. Explicit `--expires` values beyond the session end fail instead of being silently shortened. See [REFERENCE.md](REFERENCE.md) for inspect, receive, list, show and revoke.
+Without `--to`, publish creates a bearer link: anyone holding the complete URL can read it until it expires or `tinycloud share revoke <id>` revokes it. `--to email:`, `--to did:` and `--to domain:` create addressed links that only the named recipient can open after proving who they are. An addressed share of 120 seconds to 30 days gets a short link; any other addressed share, or `--full-link`, gets the full link (past 30 days with a warning on stderr and `linkNotice` in JSON), and the same full link with a notice if the links API cannot be reached. `tinycloud share unlink <id>` deletes a short link now; `tinycloud share revoke <id>` revokes the share and leaves the link to expire. A share too large to send as a link stops with `MAX_BYTES_EXCEEDED` before anything is shared. To send a share again, run `tinycloud share publish` again for the same file and recipients, or `tinycloud share notify <id>` while the short link is live. Keep complete URLs, including the `#` fragment, out of logs. `--notify` requires `read`; domain invitations also require `--notify-to <email>` at the exact domain, a matching sender/owner DID and node 1.17.3+. Invitation emails carry only a short link, and until the services that send them accept one `--notify` and `share notify` stop with `UNAVAILABLE` before sending anything. Session-only publishers can notify their own domain policies. Standalone `tinycloud share notify <id> --to <email>` refuses records without `read` and domain delivery on unsupported nodes before sending. It retries within 5 minutes of publication; after that it reports a non-retryable `partial-failure` (exit 9), and the sender must publish a new share to invite again. A confirmed repeat reports `already-delivered`; a failed history confirmation warns without hiding a successful delivery. Human publish prints only the URL; with `--notify --json`, the redacted publication JSON also contains `notification` with delivery status and attempts. The default lifetime is seven days, clamped to the verified session expiry; JSON output reports `expiryClamped`. Explicit `--expires` values beyond the session end fail; they are never shortened. See [REFERENCE.md](REFERENCE.md) for inspect, receive, list, show, unlink and revoke.
 
 To show a person a document, page or small app, publish it as an artifact: a Markdown file, one self-contained HTML file, or a JSX component with a default export. Use `--to anyone` (the default) with `--artifact new --json`, then get the link with `tinycloud share show <id> --reveal-link`; `--json` output never contains the link. Revoke with `tinycloud share revoke <id>`. `--to anyone --action edit` is refused. See [REFERENCE.md](REFERENCE.md#artifacts) for the file kinds, the JSX library set and the `--tc-*` style tokens.