@tinycloud/node-sdk 2.11.0-beta.5 → 2.11.0-beta.7

package/dist/{core-ool1expK.d.cts → core-Bkptd8qZ.d.cts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -1102,6 +1102,7 @@ declare class TinyCloudNode {
      * {@link currentTinyCloudSession} as a fallback for `auth.tinyCloudSession`.
      */
     private _restoredTcSession?;
+    private _activeServiceSession?;
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -1470,6 +1471,16 @@ declare class TinyCloudNode {
      * rehydration set by {@link restoreSession} (session-only mode).
      */
     private currentTinyCloudSession;
+    /**
+     * Mint a multi-capability invocation through the established session key.
+     * Callers receive only the signed headers; session key material remains
+     * owned by the session manager and is never part of the caller contract.
+     */
+    invokeAny(entries: Parameters<InvokeAnyFunction$1>[1], facts?: Parameters<InvokeAnyFunction$1>[2]): ReturnType<InvokeAnyFunction$1>;
+    /** Sign protocol bytes with the established in-memory session key. */
+    signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    /** Bind a session-signed invocation to the canonical service audience. */
+    bindInvocationAudience(authorization: string, audience: string): Promise<string>;
     /**
      * Connect a wallet to upgrade from session-only mode to wallet mode.
      *
@@ -1597,6 +1608,7 @@ declare class TinyCloudNode {
         readonly recipientEmail: string;
         readonly shareUrl: string;
         readonly documentName: string;
+        readonly idempotencyKey: string;
         readonly expiresAt: string;
         /** The enrolled receipt key from the node trust bundle. */
         readonly nodeProof: {

package/dist/{core-ool1expK.d.ts → core-Bkptd8qZ.d.ts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -1102,6 +1102,7 @@ declare class TinyCloudNode {
      * {@link currentTinyCloudSession} as a fallback for `auth.tinyCloudSession`.
      */
     private _restoredTcSession?;
+    private _activeServiceSession?;
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -1470,6 +1471,16 @@ declare class TinyCloudNode {
      * rehydration set by {@link restoreSession} (session-only mode).
      */
     private currentTinyCloudSession;
+    /**
+     * Mint a multi-capability invocation through the established session key.
+     * Callers receive only the signed headers; session key material remains
+     * owned by the session manager and is never part of the caller contract.
+     */
+    invokeAny(entries: Parameters<InvokeAnyFunction$1>[1], facts?: Parameters<InvokeAnyFunction$1>[2]): ReturnType<InvokeAnyFunction$1>;
+    /** Sign protocol bytes with the established in-memory session key. */
+    signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    /** Bind a session-signed invocation to the canonical service audience. */
+    bindInvocationAudience(authorization: string, audience: string): Promise<string>;
     /**
      * Connect a wallet to upgrade from session-only mode to wallet mode.
      *
@@ -1597,6 +1608,7 @@ declare class TinyCloudNode {
         readonly recipientEmail: string;
         readonly shareUrl: string;
         readonly documentName: string;
+        readonly idempotencyKey: string;
         readonly expiresAt: string;
         /** The enrolled receipt key from the node trust bundle. */
         readonly nodeProof: {

package/dist/core.cjs

@@ -2020,7 +2020,9 @@ function base64UrlDecode(value) {
   return new Uint8Array(bytes);
 }
 async function signJwtInputWithJwk(signingInput, jwk) {
-  const bytes = new TextEncoder().encode(signingInput);
+  return signBytesWithJwk(new TextEncoder().encode(signingInput), jwk);
+}
+async function signBytesWithJwk(bytes, jwk) {
   try {
     const subtle = globalThis.crypto?.subtle;
     if (!subtle) {
@@ -3364,6 +3366,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._delegationManager = stagedGraph.delegationManager;
     this._spaceService = stagedGraph.spaceService;
     this._serviceGraph = stagedGraph.graph;
+    this._activeServiceSession = serviceSession;
     this._baseSecrets = /* @__PURE__ */ new Map();
     this._secrets = /* @__PURE__ */ new Map();
     this._publicKV = void 0;
@@ -3681,6 +3684,28 @@ var _TinyCloudNode = class _TinyCloudNode {
   currentTinyCloudSession() {
     return this.auth?.tinyCloudSession ?? this._restoredTcSession;
   }
+  /**
+   * Mint a multi-capability invocation through the established session key.
+   * Callers receive only the signed headers; session key material remains
+   * owned by the session manager and is never part of the caller contract.
+   */
+  invokeAny(entries, facts) {
+    const session = this.currentTinyCloudSession() ?? this._activeServiceSession;
+    if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
+    return this._serviceGraph.invokeAny(session, entries, facts);
+  }
+  /** Sign protocol bytes with the established in-memory session key. */
+  async signSessionBytes(bytes) {
+    const session = this.currentTinyCloudSession() ?? this._activeServiceSession;
+    if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
+    return signBytesWithJwk(bytes, session.jwk);
+  }
+  /** Bind a session-signed invocation to the canonical service audience. */
+  async bindInvocationAudience(authorization, audience) {
+    const session = this.currentTinyCloudSession() ?? this._activeServiceSession;
+    if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
+    return rewriteInvocationAudience(authorization, audience, session.jwk);
+  }
   /**
    * Connect a wallet to upgrade from session-only mode to wallet mode.
    *
@@ -4528,6 +4553,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       shareUrl: input.shareUrl,
       documentName: input.documentName,
       jti: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
+      idempotencyKey: input.idempotencyKey,
       expiresAt: input.expiresAt
     };
     const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, import_sdk_core8.canonicalizeEncryptionJson)(body)))));