@tinycloud/node-sdk 3.7.0-beta.3 → 3.7.0

package/dist/encryption-keys.cjs

@@ -0,0 +1,74 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/encryption-keys.ts
+var encryption_keys_exports = {};
+__export(encryption_keys_exports, {
+  NamedKeyClient: () => import_named_keys2.NamedKeyClient,
+  NamedKeyError: () => import_named_keys2.NamedKeyError,
+  buildKeyAdminFacts: () => import_named_keys2.buildKeyAdminFacts,
+  buildKeyDescribeFacts: () => import_named_keys2.buildKeyDescribeFacts,
+  createNamedKeyClient: () => createNamedKeyClient
+});
+module.exports = __toCommonJS(encryption_keys_exports);
+var import_named_keys = require("@tinycloud/sdk-services/encryption/named-keys");
+var import_named_keys2 = require("@tinycloud/sdk-services/encryption/named-keys");
+function createNamedKeyClient(node, options = {}) {
+  const internals = node;
+  for (const hook of ["signRawNetworkAuthorization", "createEncryptionCrypto"]) {
+    if (typeof internals[hook] !== "function") {
+      throw new import_named_keys.NamedKeyError(
+        "NODE_HOOK_MISSING",
+        `TinyCloudNode.${hook} is not available; named keys cannot sign invocations`
+      );
+    }
+  }
+  const signer = internals;
+  const host = node.hosts[0];
+  if (host === void 0) throw new Error("TinyCloud node host has not been resolved");
+  const config = {
+    host,
+    crypto: signer.createEncryptionCrypto(),
+    fetch: options.fetch ?? globalThis.fetch.bind(globalThis),
+    defaultNetworkId: () => options.networkId ?? node.getDefaultEncryptionNetworkId(),
+    signInvocation: (input) => signer.signRawNetworkAuthorization({
+      targetNode: input.targetNode,
+      networkId: input.resource,
+      action: input.action,
+      facts: input.facts
+    }),
+    decryptRoot: (envelope) => {
+      const delegationCid = node.session?.delegationCid;
+      if (delegationCid === void 0) {
+        return Promise.reject(new Error("Not signed in. Call signIn() first."));
+      }
+      return node.encryption.decryptEnvelope(envelope, { proofs: [delegationCid] });
+    }
+  };
+  return new import_named_keys.NamedKeyClient(config);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  NamedKeyClient,
+  NamedKeyError,
+  buildKeyAdminFacts,
+  buildKeyDescribeFacts,
+  createNamedKeyClient
+});
+//# sourceMappingURL=encryption-keys.cjs.map

package/dist/encryption-keys.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/encryption-keys.ts"],"sourcesContent":["/**\n * Named encryption keys for a signed-in {@link TinyCloudNode}.\n *\n * Lives on its own subpath (`@tinycloud/node-sdk/encryption-keys`) so the\n * default root bundle does not carry it. Everything is dark unless the node's\n * `/info` `features` lists `encryption-named-keys-v1`; see the client in\n * `@tinycloud/sdk-services/encryption/named-keys` for the rules.\n *\n * The client signs through the node's existing raw-resource invocation path\n * (the same one network admin and decrypt use) and reuses its encryption\n * crypto, so both are reached through a narrow structural view of the node.\n */\n\nimport {\n  NamedKeyClient,\n  NamedKeyError,\n  type NamedKeyClientConfig,\n} from \"@tinycloud/sdk-services/encryption/named-keys\";\nimport type { EncryptionCrypto } from \"@tinycloud/sdk-services\";\nimport type { TinyCloudNode } from \"./TinyCloudNode\";\n\nexport {\n  NamedKeyClient,\n  NamedKeyError,\n  buildKeyAdminFacts,\n  buildKeyDescribeFacts,\n  type DecryptManyResult,\n  type KeyCallOptions,\n  type KeyDescriptor,\n  type KeyEncryptOptions,\n  type NamedKeyEnvelope,\n  type NamedKeyErrorCode,\n  type PublicKeyDescriptor,\n} from \"@tinycloud/sdk-services/encryption/named-keys\";\n\ninterface NodeSigningInternals {\n  signRawNetworkAuthorization(input: {\n    targetNode: string;\n    networkId: string;\n    action: string;\n    facts: object;\n  }): Promise<{ authorization: string; invocationCid: string }>;\n  createEncryptionCrypto(): EncryptionCrypto;\n}\n\nexport interface CreateNamedKeyClientOptions {\n  /** Network used when a call does not name one. Defaults to the node's default network. */\n  networkId?: string;\n  /** Override `fetch` (tests). */\n  fetch?: typeof fetch;\n}\n\n/**\n * Build a named-key client bound to a signed-in node.\n *\n * `signInvocation` passes the EXACT key URN as the invocation's single\n * resource (the signer's `networkId` argument is the capability `with`); the\n * real network id travels in the facts.\n */\nexport function createNamedKeyClient(\n  node: TinyCloudNode,\n  options: CreateNamedKeyClientOptions = {},\n): NamedKeyClient {\n  const internals = node as unknown as Partial<NodeSigningInternals>;\n  for (const hook of [\"signRawNetworkAuthorization\", \"createEncryptionCrypto\"] as const) {\n    if (typeof internals[hook] !== \"function\") {\n      throw new NamedKeyError(\n        \"NODE_HOOK_MISSING\",\n        `TinyCloudNode.${hook} is not available; named keys cannot sign invocations`,\n      );\n    }\n  }\n  const signer = internals as NodeSigningInternals;\n  const host = node.hosts[0];\n  if (host === undefined) throw new Error(\"TinyCloud node host has not been resolved\");\n  const config: NamedKeyClientConfig = {\n    host,\n    crypto: signer.createEncryptionCrypto(),\n    fetch: options.fetch ?? globalThis.fetch.bind(globalThis),\n    defaultNetworkId: () => options.networkId ?? node.getDefaultEncryptionNetworkId(),\n    signInvocation: (input) =>\n      signer.signRawNetworkAuthorization({\n        targetNode: input.targetNode,\n        networkId: input.resource,\n        action: input.action,\n        facts: input.facts,\n      }),\n    decryptRoot: (envelope) => {\n      const delegationCid = node.session?.delegationCid;\n      if (delegationCid === undefined) {\n        return Promise.reject(new Error(\"Not signed in. Call signIn() first.\"));\n      }\n      return node.encryption.decryptEnvelope(envelope, { proofs: [delegationCid] });\n    },\n  };\n  return new NamedKeyClient(config);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,wBAIO;AAIP,IAAAA,qBAYO;AA0BA,SAAS,qBACd,MACA,UAAuC,CAAC,GACxB;AAChB,QAAM,YAAY;AAClB,aAAW,QAAQ,CAAC,+BAA+B,wBAAwB,GAAY;AACrF,QAAI,OAAO,UAAU,IAAI,MAAM,YAAY;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,iBAAiB,IAAI;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS;AACf,QAAM,OAAO,KAAK,MAAM,CAAC;AACzB,MAAI,SAAS,OAAW,OAAM,IAAI,MAAM,2CAA2C;AACnF,QAAM,SAA+B;AAAA,IACnC;AAAA,IACA,QAAQ,OAAO,uBAAuB;AAAA,IACtC,OAAO,QAAQ,SAAS,WAAW,MAAM,KAAK,UAAU;AAAA,IACxD,kBAAkB,MAAM,QAAQ,aAAa,KAAK,8BAA8B;AAAA,IAChF,gBAAgB,CAAC,UACf,OAAO,4BAA4B;AAAA,MACjC,YAAY,MAAM;AAAA,MAClB,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,IACf,CAAC;AAAA,IACH,aAAa,CAAC,aAAa;AACzB,YAAM,gBAAgB,KAAK,SAAS;AACpC,UAAI,kBAAkB,QAAW;AAC/B,eAAO,QAAQ,OAAO,IAAI,MAAM,qCAAqC,CAAC;AAAA,MACxE;AACA,aAAO,KAAK,WAAW,gBAAgB,UAAU,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO,IAAI,iCAAe,MAAM;AAClC;","names":["import_named_keys"]}

package/dist/encryption-keys.d.cts

@@ -0,0 +1,38 @@
+import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
+export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
+import { T as TinyCloudNode } from './TinyCloudNode-DD7qjyLU.cjs';
+import '@tinycloud/sdk-core';
+import '@tinycloud/sdk-services/kv/replication';
+import '@tinycloud/sdk-services';
+import 'events';
+import './delegation-0LKZkmP2.cjs';
+
+/**
+ * Named encryption keys for a signed-in {@link TinyCloudNode}.
+ *
+ * Lives on its own subpath (`@tinycloud/node-sdk/encryption-keys`) so the
+ * default root bundle does not carry it. Everything is dark unless the node's
+ * `/info` `features` lists `encryption-named-keys-v1`; see the client in
+ * `@tinycloud/sdk-services/encryption/named-keys` for the rules.
+ *
+ * The client signs through the node's existing raw-resource invocation path
+ * (the same one network admin and decrypt use) and reuses its encryption
+ * crypto, so both are reached through a narrow structural view of the node.
+ */
+
+interface CreateNamedKeyClientOptions {
+    /** Network used when a call does not name one. Defaults to the node's default network. */
+    networkId?: string;
+    /** Override `fetch` (tests). */
+    fetch?: typeof fetch;
+}
+/**
+ * Build a named-key client bound to a signed-in node.
+ *
+ * `signInvocation` passes the EXACT key URN as the invocation's single
+ * resource (the signer's `networkId` argument is the capability `with`); the
+ * real network id travels in the facts.
+ */
+declare function createNamedKeyClient(node: TinyCloudNode, options?: CreateNamedKeyClientOptions): NamedKeyClient;
+
+export { type CreateNamedKeyClientOptions, createNamedKeyClient };

package/dist/encryption-keys.d.ts

@@ -0,0 +1,38 @@
+import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
+export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
+import { T as TinyCloudNode } from './TinyCloudNode-Cw00iiSP.js';
+import '@tinycloud/sdk-core';
+import '@tinycloud/sdk-services/kv/replication';
+import '@tinycloud/sdk-services';
+import 'events';
+import './delegation-0LKZkmP2.js';
+
+/**
+ * Named encryption keys for a signed-in {@link TinyCloudNode}.
+ *
+ * Lives on its own subpath (`@tinycloud/node-sdk/encryption-keys`) so the
+ * default root bundle does not carry it. Everything is dark unless the node's
+ * `/info` `features` lists `encryption-named-keys-v1`; see the client in
+ * `@tinycloud/sdk-services/encryption/named-keys` for the rules.
+ *
+ * The client signs through the node's existing raw-resource invocation path
+ * (the same one network admin and decrypt use) and reuses its encryption
+ * crypto, so both are reached through a narrow structural view of the node.
+ */
+
+interface CreateNamedKeyClientOptions {
+    /** Network used when a call does not name one. Defaults to the node's default network. */
+    networkId?: string;
+    /** Override `fetch` (tests). */
+    fetch?: typeof fetch;
+}
+/**
+ * Build a named-key client bound to a signed-in node.
+ *
+ * `signInvocation` passes the EXACT key URN as the invocation's single
+ * resource (the signer's `networkId` argument is the capability `with`); the
+ * real network id travels in the facts.
+ */
+declare function createNamedKeyClient(node: TinyCloudNode, options?: CreateNamedKeyClientOptions): NamedKeyClient;
+
+export { type CreateNamedKeyClientOptions, createNamedKeyClient };

package/dist/encryption-keys.js

@@ -0,0 +1,53 @@
+// src/encryption-keys.ts
+import {
+  NamedKeyClient,
+  NamedKeyError
+} from "@tinycloud/sdk-services/encryption/named-keys";
+import {
+  NamedKeyClient as NamedKeyClient2,
+  NamedKeyError as NamedKeyError2,
+  buildKeyAdminFacts,
+  buildKeyDescribeFacts
+} from "@tinycloud/sdk-services/encryption/named-keys";
+function createNamedKeyClient(node, options = {}) {
+  const internals = node;
+  for (const hook of ["signRawNetworkAuthorization", "createEncryptionCrypto"]) {
+    if (typeof internals[hook] !== "function") {
+      throw new NamedKeyError(
+        "NODE_HOOK_MISSING",
+        `TinyCloudNode.${hook} is not available; named keys cannot sign invocations`
+      );
+    }
+  }
+  const signer = internals;
+  const host = node.hosts[0];
+  if (host === void 0) throw new Error("TinyCloud node host has not been resolved");
+  const config = {
+    host,
+    crypto: signer.createEncryptionCrypto(),
+    fetch: options.fetch ?? globalThis.fetch.bind(globalThis),
+    defaultNetworkId: () => options.networkId ?? node.getDefaultEncryptionNetworkId(),
+    signInvocation: (input) => signer.signRawNetworkAuthorization({
+      targetNode: input.targetNode,
+      networkId: input.resource,
+      action: input.action,
+      facts: input.facts
+    }),
+    decryptRoot: (envelope) => {
+      const delegationCid = node.session?.delegationCid;
+      if (delegationCid === void 0) {
+        return Promise.reject(new Error("Not signed in. Call signIn() first."));
+      }
+      return node.encryption.decryptEnvelope(envelope, { proofs: [delegationCid] });
+    }
+  };
+  return new NamedKeyClient(config);
+}
+export {
+  NamedKeyClient2 as NamedKeyClient,
+  NamedKeyError2 as NamedKeyError,
+  buildKeyAdminFacts,
+  buildKeyDescribeFacts,
+  createNamedKeyClient
+};
+//# sourceMappingURL=encryption-keys.js.map

package/dist/encryption-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/encryption-keys.ts"],"sourcesContent":["/**\n * Named encryption keys for a signed-in {@link TinyCloudNode}.\n *\n * Lives on its own subpath (`@tinycloud/node-sdk/encryption-keys`) so the\n * default root bundle does not carry it. Everything is dark unless the node's\n * `/info` `features` lists `encryption-named-keys-v1`; see the client in\n * `@tinycloud/sdk-services/encryption/named-keys` for the rules.\n *\n * The client signs through the node's existing raw-resource invocation path\n * (the same one network admin and decrypt use) and reuses its encryption\n * crypto, so both are reached through a narrow structural view of the node.\n */\n\nimport {\n  NamedKeyClient,\n  NamedKeyError,\n  type NamedKeyClientConfig,\n} from \"@tinycloud/sdk-services/encryption/named-keys\";\nimport type { EncryptionCrypto } from \"@tinycloud/sdk-services\";\nimport type { TinyCloudNode } from \"./TinyCloudNode\";\n\nexport {\n  NamedKeyClient,\n  NamedKeyError,\n  buildKeyAdminFacts,\n  buildKeyDescribeFacts,\n  type DecryptManyResult,\n  type KeyCallOptions,\n  type KeyDescriptor,\n  type KeyEncryptOptions,\n  type NamedKeyEnvelope,\n  type NamedKeyErrorCode,\n  type PublicKeyDescriptor,\n} from \"@tinycloud/sdk-services/encryption/named-keys\";\n\ninterface NodeSigningInternals {\n  signRawNetworkAuthorization(input: {\n    targetNode: string;\n    networkId: string;\n    action: string;\n    facts: object;\n  }): Promise<{ authorization: string; invocationCid: string }>;\n  createEncryptionCrypto(): EncryptionCrypto;\n}\n\nexport interface CreateNamedKeyClientOptions {\n  /** Network used when a call does not name one. Defaults to the node's default network. */\n  networkId?: string;\n  /** Override `fetch` (tests). */\n  fetch?: typeof fetch;\n}\n\n/**\n * Build a named-key client bound to a signed-in node.\n *\n * `signInvocation` passes the EXACT key URN as the invocation's single\n * resource (the signer's `networkId` argument is the capability `with`); the\n * real network id travels in the facts.\n */\nexport function createNamedKeyClient(\n  node: TinyCloudNode,\n  options: CreateNamedKeyClientOptions = {},\n): NamedKeyClient {\n  const internals = node as unknown as Partial<NodeSigningInternals>;\n  for (const hook of [\"signRawNetworkAuthorization\", \"createEncryptionCrypto\"] as const) {\n    if (typeof internals[hook] !== \"function\") {\n      throw new NamedKeyError(\n        \"NODE_HOOK_MISSING\",\n        `TinyCloudNode.${hook} is not available; named keys cannot sign invocations`,\n      );\n    }\n  }\n  const signer = internals as NodeSigningInternals;\n  const host = node.hosts[0];\n  if (host === undefined) throw new Error(\"TinyCloud node host has not been resolved\");\n  const config: NamedKeyClientConfig = {\n    host,\n    crypto: signer.createEncryptionCrypto(),\n    fetch: options.fetch ?? globalThis.fetch.bind(globalThis),\n    defaultNetworkId: () => options.networkId ?? node.getDefaultEncryptionNetworkId(),\n    signInvocation: (input) =>\n      signer.signRawNetworkAuthorization({\n        targetNode: input.targetNode,\n        networkId: input.resource,\n        action: input.action,\n        facts: input.facts,\n      }),\n    decryptRoot: (envelope) => {\n      const delegationCid = node.session?.delegationCid;\n      if (delegationCid === undefined) {\n        return Promise.reject(new Error(\"Not signed in. Call signIn() first.\"));\n      }\n      return node.encryption.decryptEnvelope(envelope, { proofs: [delegationCid] });\n    },\n  };\n  return new NamedKeyClient(config);\n}\n"],"mappings":";AAaA;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAIP;AAAA,EACE,kBAAAA;AAAA,EACA,iBAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAQK;AA0BA,SAAS,qBACd,MACA,UAAuC,CAAC,GACxB;AAChB,QAAM,YAAY;AAClB,aAAW,QAAQ,CAAC,+BAA+B,wBAAwB,GAAY;AACrF,QAAI,OAAO,UAAU,IAAI,MAAM,YAAY;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,iBAAiB,IAAI;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS;AACf,QAAM,OAAO,KAAK,MAAM,CAAC;AACzB,MAAI,SAAS,OAAW,OAAM,IAAI,MAAM,2CAA2C;AACnF,QAAM,SAA+B;AAAA,IACnC;AAAA,IACA,QAAQ,OAAO,uBAAuB;AAAA,IACtC,OAAO,QAAQ,SAAS,WAAW,MAAM,KAAK,UAAU;AAAA,IACxD,kBAAkB,MAAM,QAAQ,aAAa,KAAK,8BAA8B;AAAA,IAChF,gBAAgB,CAAC,UACf,OAAO,4BAA4B;AAAA,MACjC,YAAY,MAAM;AAAA,MAClB,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,IACf,CAAC;AAAA,IACH,aAAa,CAAC,aAAa;AACzB,YAAM,gBAAgB,KAAK,SAAS;AACpC,UAAI,kBAAkB,QAAW;AAC/B,eAAO,QAAQ,OAAO,IAAI,MAAM,qCAAqC,CAAC;AAAA,MACxE;AACA,aAAO,KAAK,WAAW,gBAAgB,UAAU,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO,IAAI,eAAe,MAAM;AAClC;","names":["NamedKeyClient","NamedKeyError"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/node-sdk",
-  "version": "3.7.0-beta.3",
+  "version": "3.7.0",
   "description": "TinyCloud SDK for Node.js with configurable authorization strategies",
   "author": "TinyCloud, Inc.",
   "license": "EGPL",
@@ -19,6 +19,16 @@
       "import": "./dist/core.js",
       "require": "./dist/core.cjs"
     },
+    "./encryption-keys": {
+      "import": {
+        "types": "./dist/encryption-keys.d.ts",
+        "default": "./dist/encryption-keys.js"
+      },
+      "require": {
+        "types": "./dist/encryption-keys.d.cts",
+        "default": "./dist/encryption-keys.cjs"
+      }
+    },
     "./credential-pending-store": {
       "types": "./dist/credential-pending-store.d.ts",
       "import": "./dist/credential-pending-store.js",
@@ -79,9 +89,9 @@
     "test:integration": "echo 'Integration tests live in tests/node-sdk workspace'"
   },
   "dependencies": {
-    "@tinycloud/replica": "0.3.4-beta.2",
-    "@tinycloud/sdk-services": "3.7.0-beta.3",
-    "@tinycloud/sdk-core": "3.7.0-beta.3",
+    "@tinycloud/replica": "0.3.4",
+    "@tinycloud/sdk-services": "3.7.0",
+    "@tinycloud/sdk-core": "3.7.0",
     "@tinycloud/node-sdk-wasm": "1.7.8",
     "siwe": "^3.0.0"
   },