@tinycloud/node-sdk 3.0.0-beta.7 → 3.0.0-beta.9

package/dist/{core-WJQ9KiSD.d.cts → core-BTuD37zN.d.cts}

@@ -1,4 +1,5 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ShareDeliveryAuthorizationReceipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -955,39 +956,6 @@ declare class DelegatedAccess {
     get restorable(): RestorableSession;
 }
 
-/**
- * TinyCloudNode - High-level API for Node.js users.
- *
- * Each user has their own TinyCloudNode instance with their own key.
- * This class provides a simplified interface for:
- * - Signing in and managing sessions
- * - Key-value storage operations on own space
- * - Creating and using delegations
- *
- * @example
- * ```typescript
- * const alice = new TinyCloudNode({
- *   privateKey: process.env.ALICE_PRIVATE_KEY,
- *   host: "https://node.tinycloud.xyz",
- *   prefix: "myapp",
- * });
- *
- * await alice.signIn();
- * await alice.kv.put("greeting", "Hello, world!");
- *
- * // Delegate access to Bob
- * const delegation = await alice.createDelegation({
- *   path: "shared/",
- *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
- *   delegateDID: bob.did,
- * });
- *
- * // Bob uses the delegation
- * const access = await bob.useDelegation(delegation);
- * const data = await access.kv.get("shared/data");
- * ```
- */
-
 declare const BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
 declare const BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
 declare const ACCEPTED_MARKER_VERSIONS: readonly number[];
@@ -1382,6 +1350,13 @@ declare class TinyCloudNode {
     get manifest(): Manifest | Manifest[] | undefined;
     get capabilityRequest(): ComposedManifestRequest | undefined;
     get hosts(): string[];
+    /** The registry-resolved Node endpoint and the identity returned by that exact Node. */
+    activeNodeIdentity(): Promise<{
+        readonly origin: string;
+        readonly nodeDid: string;
+    }>;
+    /** Publish the active owner Node as a session-signed registry record. */
+    publishActiveNodeLocation(registryUrl: string, fetchFn?: typeof fetch): Promise<_tinycloud_sdk_core.LocationRecord>;
     /**
      * Get the primary identity DID for this user.
      * - If wallet connected and signed in: returns PKH DID (did:pkh:eip155:{chainId}:{address})
@@ -1813,45 +1788,16 @@ declare class TinyCloudNode {
     createOwnerDelegation(params: CreateOwnerDelegationParams, assertActive?: () => void): Promise<OwnerDelegationReceipt>;
     /** Register a signed policy and sibling roots with this Node's Policy/v3 runtime. */
     registerPolicy(params: Omit<RegisterPolicyV3Input, "nodeOrigin" | "fetch">): Promise<RegisterPolicyV3Receipt>;
-    /** @deprecated Policy/v2 delivery transport is retired. Use authorizeShareDeliveryV3. */
-    authorizeShareDelivery(input: {
-        readonly envelopeCid: string;
-        readonly shareCid: string;
-        readonly shareId: string;
-        readonly registrationCid: string;
-        readonly policyCid: string;
-        readonly delegationCid: string;
-        readonly enforcementDelegationCid: string;
-        readonly resourcePath: string;
-        readonly recipientEmail: string;
-        readonly shareUrl: string;
-        readonly documentName: string;
-        readonly idempotencyKey: string;
-        readonly expiresAt: string;
-        /** The enrolled receipt key from the node trust bundle. */
-        readonly nodeProof: {
-            readonly kid: string;
-            readonly publicKey: Uint8Array;
-        };
-        /** The trusted OpenCredentials witness origin from the same trust bundle as `nodeProof`. */
-        readonly credentialsAudience: string;
-    }): Promise<ShareDeliveryAuthorizationReceipt>;
     /** Authorize one short-lived v3 delivery against the signed v3 envelope and registered roots. */
     authorizeShareDeliveryV3(input: {
         readonly envelope: Record<string, CanonicalJson | undefined>;
-        readonly sealedEnvelope: string;
-        readonly envelopeKey: string;
         readonly shareCid: string;
         readonly resourcePath: string;
         readonly recipientEmail: string;
         readonly shareUrl: string;
         readonly documentName: string;
         readonly expiresAt: string;
-        readonly nodeProof: {
-            readonly kid: string;
-            readonly publicKey: Uint8Array;
-        };
-        readonly credentialsAudience: string;
+        readonly deliveryAudience: string;
     }): Promise<ShareDeliveryAuthorizationV3Receipt>;
     private createRootDelegationForSharing;
     /**

package/dist/{core-WJQ9KiSD.d.ts → core-BTuD37zN.d.ts}

@@ -1,4 +1,5 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ShareDeliveryAuthorizationReceipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -955,39 +956,6 @@ declare class DelegatedAccess {
     get restorable(): RestorableSession;
 }
 
-/**
- * TinyCloudNode - High-level API for Node.js users.
- *
- * Each user has their own TinyCloudNode instance with their own key.
- * This class provides a simplified interface for:
- * - Signing in and managing sessions
- * - Key-value storage operations on own space
- * - Creating and using delegations
- *
- * @example
- * ```typescript
- * const alice = new TinyCloudNode({
- *   privateKey: process.env.ALICE_PRIVATE_KEY,
- *   host: "https://node.tinycloud.xyz",
- *   prefix: "myapp",
- * });
- *
- * await alice.signIn();
- * await alice.kv.put("greeting", "Hello, world!");
- *
- * // Delegate access to Bob
- * const delegation = await alice.createDelegation({
- *   path: "shared/",
- *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
- *   delegateDID: bob.did,
- * });
- *
- * // Bob uses the delegation
- * const access = await bob.useDelegation(delegation);
- * const data = await access.kv.get("shared/data");
- * ```
- */
-
 declare const BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
 declare const BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
 declare const ACCEPTED_MARKER_VERSIONS: readonly number[];
@@ -1382,6 +1350,13 @@ declare class TinyCloudNode {
     get manifest(): Manifest | Manifest[] | undefined;
     get capabilityRequest(): ComposedManifestRequest | undefined;
     get hosts(): string[];
+    /** The registry-resolved Node endpoint and the identity returned by that exact Node. */
+    activeNodeIdentity(): Promise<{
+        readonly origin: string;
+        readonly nodeDid: string;
+    }>;
+    /** Publish the active owner Node as a session-signed registry record. */
+    publishActiveNodeLocation(registryUrl: string, fetchFn?: typeof fetch): Promise<_tinycloud_sdk_core.LocationRecord>;
     /**
      * Get the primary identity DID for this user.
      * - If wallet connected and signed in: returns PKH DID (did:pkh:eip155:{chainId}:{address})
@@ -1813,45 +1788,16 @@ declare class TinyCloudNode {
     createOwnerDelegation(params: CreateOwnerDelegationParams, assertActive?: () => void): Promise<OwnerDelegationReceipt>;
     /** Register a signed policy and sibling roots with this Node's Policy/v3 runtime. */
     registerPolicy(params: Omit<RegisterPolicyV3Input, "nodeOrigin" | "fetch">): Promise<RegisterPolicyV3Receipt>;
-    /** @deprecated Policy/v2 delivery transport is retired. Use authorizeShareDeliveryV3. */
-    authorizeShareDelivery(input: {
-        readonly envelopeCid: string;
-        readonly shareCid: string;
-        readonly shareId: string;
-        readonly registrationCid: string;
-        readonly policyCid: string;
-        readonly delegationCid: string;
-        readonly enforcementDelegationCid: string;
-        readonly resourcePath: string;
-        readonly recipientEmail: string;
-        readonly shareUrl: string;
-        readonly documentName: string;
-        readonly idempotencyKey: string;
-        readonly expiresAt: string;
-        /** The enrolled receipt key from the node trust bundle. */
-        readonly nodeProof: {
-            readonly kid: string;
-            readonly publicKey: Uint8Array;
-        };
-        /** The trusted OpenCredentials witness origin from the same trust bundle as `nodeProof`. */
-        readonly credentialsAudience: string;
-    }): Promise<ShareDeliveryAuthorizationReceipt>;
     /** Authorize one short-lived v3 delivery against the signed v3 envelope and registered roots. */
     authorizeShareDeliveryV3(input: {
         readonly envelope: Record<string, CanonicalJson | undefined>;
-        readonly sealedEnvelope: string;
-        readonly envelopeKey: string;
         readonly shareCid: string;
         readonly resourcePath: string;
         readonly recipientEmail: string;
         readonly shareUrl: string;
         readonly documentName: string;
         readonly expiresAt: string;
-        readonly nodeProof: {
-            readonly kid: string;
-            readonly publicKey: Uint8Array;
-        };
-        readonly credentialsAudience: string;
+        readonly deliveryAudience: string;
     }): Promise<ShareDeliveryAuthorizationV3Receipt>;
     private createRootDelegationForSharing;
     /**

package/dist/core.cjs

@@ -115,6 +115,7 @@ __export(core_exports, {
   parseCanonicalNetworkId: () => import_sdk_core11.parseCanonicalNetworkId,
   parseExpiry: () => import_sdk_core12.parseExpiry,
   parsePkhDid: () => import_sdk_core11.parsePkhDid,
+  parseSecretCatalogKey: () => import_sdk_core16.parseSecretCatalogKey,
   parseSpaceUri: () => import_sdk_core19.parseSpaceUri,
   pkhDid: () => import_sdk_core11.pkhDid,
   principalDid: () => import_sdk_core11.principalDid,
@@ -2081,6 +2082,11 @@ var NodeSecretsService = class {
     if (!permission.ok) return permission;
     return options === void 0 ? this.service.list() : this.service.list(options);
   }
+  async listAll() {
+    const permission = await this.ensurePermission("", void 0, "list");
+    if (!permission.ok) return permission;
+    return this.service.listAll();
+  }
   get service() {
     return this.config.getService();
   }
@@ -2142,7 +2148,11 @@ var NodeSecretsService = class {
       (entry) => manifests.some((candidate) => {
         const resolved = (0, import_sdk_core7.resolveManifest)(candidate);
         return resolved.resources.some(
-          (resource) => resource.service === entry.service && spaceMatches(resource.space, entry.space, this.config.resolveSpace) && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
+          (resource) => resource.service === entry.service && spaceMatches(
+            resource.space,
+            entry.space,
+            this.config.resolveSpace
+          ) && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
         );
       })
     );
@@ -2837,6 +2847,29 @@ var _TinyCloudNode = class _TinyCloudNode {
     const authHosts = this.auth?.hosts ?? [];
     return authHosts.length > 0 ? authHosts : [this.config.host];
   }
+  /** The registry-resolved Node endpoint and the identity returned by that exact Node. */
+  async activeNodeIdentity() {
+    const host = this.hosts[0];
+    if (host === void 0) throw new Error("TinyCloud node host has not been resolved");
+    const parsed = new URL(host);
+    if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && (parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost")) || parsed.origin !== host) {
+      throw new Error("TinyCloud node host is not a canonical origin");
+    }
+    const nodeDid = await this.fetchNodeId();
+    if (!nodeDid.startsWith("did:key:z")) throw new Error("TinyCloud node identity is not a did:key");
+    return Object.freeze({ origin: parsed.origin, nodeDid });
+  }
+  /** Publish the active owner Node as a session-signed registry record. */
+  async publishActiveNodeLocation(registryUrl, fetchFn = globalThis.fetch.bind(globalThis)) {
+    const node = await this.activeNodeIdentity();
+    return (0, import_sdk_core8.publishLocationRecord)({
+      registryUrl,
+      subject: this.credentialHolderDid,
+      nodeOrigin: node.origin,
+      signer: { type: "did:key", signBytes: (bytes) => this.signSessionBytes(bytes) },
+      fetch: fetchFn
+    });
+  }
   /**
    * Get the primary identity DID for this user.
    * - If wallet connected and signed in: returns PKH DID (did:pkh:eip155:{chainId}:{address})
@@ -5193,11 +5226,6 @@ var _TinyCloudNode = class _TinyCloudNode {
       fetch: globalThis.fetch.bind(globalThis)
     });
   }
-  /** @deprecated Policy/v2 delivery transport is retired. Use authorizeShareDeliveryV3. */
-  async authorizeShareDelivery(input) {
-    void input;
-    throw new Error("Policy/v2 share delivery is retired; use authorizeShareDeliveryV3");
-  }
   /** Authorize one short-lived v3 delivery against the signed v3 envelope and registered roots. */
   async authorizeShareDeliveryV3(input) {
     const session = this.currentTinyCloudSession();
@@ -5205,8 +5233,6 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session || !serviceSession) throw new Error("Share delivery requires an authenticated session");
     const body = {
       envelope: input.envelope,
-      sealedEnvelope: input.sealedEnvelope,
-      envelopeKey: input.envelopeKey,
       shareCid: input.shareCid,
       recipientEmail: input.recipientEmail,
       shareUrl: input.shareUrl,
@@ -5226,9 +5252,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const verified = (0, import_sdk_core8.validateShareDeliveryAuthorizationV3Bytes)(new Uint8Array(await response.arrayBuffer()), {
       request,
       senderKeyDid: this.credentialHolderDid,
-      credentialsAudience: input.credentialsAudience
+      deliveryAudience: input.deliveryAudience
     });
-    void input.nodeProof;
     const requestDigest = new Uint8Array(await crypto.subtle.digest(
       "SHA-256",
       new TextEncoder().encode(`${import_sdk_core8.CREDENTIAL_INVITATION_REQUEST_DOMAIN}${(0, import_sdk_core8.canonicalizeEncryptionJson)(verified.request)}`)
@@ -7790,6 +7815,7 @@ var import_sdk_core21 = require("@tinycloud/sdk-core");
   parseCanonicalNetworkId,
   parseExpiry,
   parsePkhDid,
+  parseSecretCatalogKey,
   parseSpaceUri,
   pkhDid,
   principalDid,