@tinycloud/sdk-services 1.6.0 → 2.0.1

package/dist/vault/SignatureCache.js

@@ -0,0 +1,167 @@
+/**
+ * Caches vault signatures in IndexedDB, encrypted with a
+ * non-extractable CryptoKey. Browser-only — no-ops in Node.
+ */
+const DB_NAME = "tinycloud-vault-cache";
+const DB_VERSION = 1;
+const STORE_NAME = "signatures";
+const WRAP_KEY_ID = "__wrap_key__";
+/** Check whether we're in a browser with IndexedDB + SubtleCrypto support. */
+function isBrowser() {
+    try {
+        return (typeof indexedDB !== "undefined" &&
+            typeof crypto !== "undefined" &&
+            typeof crypto.subtle !== "undefined");
+    }
+    catch {
+        return false;
+    }
+}
+/** Open (or create) the IndexedDB database. */
+function openDB() {
+    return new Promise((resolve, reject) => {
+        const request = indexedDB.open(DB_NAME, DB_VERSION);
+        request.onupgradeneeded = () => {
+            const db = request.result;
+            if (!db.objectStoreNames.contains(STORE_NAME)) {
+                db.createObjectStore(STORE_NAME);
+            }
+        };
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+    });
+}
+/** Generic IDB get helper. */
+function idbGet(db, key) {
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE_NAME, "readonly");
+        const store = tx.objectStore(STORE_NAME);
+        const req = store.get(key);
+        req.onsuccess = () => resolve(req.result);
+        req.onerror = () => reject(req.error);
+    });
+}
+/** Generic IDB put helper. */
+function idbPut(db, key, value) {
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE_NAME, "readwrite");
+        const store = tx.objectStore(STORE_NAME);
+        const req = store.put(value, key);
+        req.onsuccess = () => resolve();
+        req.onerror = () => reject(req.error);
+    });
+}
+/** Generic IDB delete helper. */
+function idbDelete(db, key) {
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE_NAME, "readwrite");
+        const store = tx.objectStore(STORE_NAME);
+        const req = store.delete(key);
+        req.onsuccess = () => resolve();
+        req.onerror = () => reject(req.error);
+    });
+}
+/** List all keys in the store. */
+function idbKeys(db) {
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE_NAME, "readonly");
+        const store = tx.objectStore(STORE_NAME);
+        const req = store.getAllKeys();
+        req.onsuccess = () => resolve(req.result.filter((k) => typeof k === "string"));
+        req.onerror = () => reject(req.error);
+    });
+}
+/**
+ * Get or create the non-extractable AES-GCM wrapping key.
+ * The key is stored directly in IndexedDB (structured-clone preserves CryptoKey).
+ */
+async function getWrapKey(db) {
+    const existing = await idbGet(db, WRAP_KEY_ID);
+    if (existing)
+        return existing;
+    const key = await crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, // non-extractable
+    ["encrypt", "decrypt"]);
+    await idbPut(db, WRAP_KEY_ID, key);
+    return key;
+}
+/** Encrypt signature bytes with the wrap key. */
+async function encryptSig(wrapKey, sigBytes) {
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, wrapKey, sigBytes));
+    return { iv, ciphertext };
+}
+/** Decrypt an encrypted entry back to signature bytes. */
+async function decryptSig(wrapKey, entry) {
+    const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: entry.iv }, wrapKey, entry.ciphertext);
+    return new Uint8Array(plaintext);
+}
+/** Cache key for a given spaceId. */
+function cacheKey(spaceId) {
+    return `sig:${spaceId}`;
+}
+// ============================================================================
+// Public API
+// ============================================================================
+/**
+ * Load a cached signature for the given spaceId.
+ * Returns null on cache miss or in non-browser environments.
+ */
+export async function loadCachedSignature(spaceId) {
+    if (!isBrowser())
+        return null;
+    try {
+        const db = await openDB();
+        const entry = await idbGet(db, cacheKey(spaceId));
+        if (!entry)
+            return null;
+        const wrapKey = await getWrapKey(db);
+        return await decryptSig(wrapKey, entry);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Cache a signature for the given spaceId.
+ * No-ops in non-browser environments.
+ */
+export async function cacheSignature(spaceId, sigBytes) {
+    if (!isBrowser())
+        return;
+    try {
+        const db = await openDB();
+        const wrapKey = await getWrapKey(db);
+        const encrypted = await encryptSig(wrapKey, sigBytes);
+        await idbPut(db, cacheKey(spaceId), encrypted);
+    }
+    catch {
+        // Best-effort — swallow errors
+    }
+}
+/**
+ * Clear cached signature(s).
+ * If spaceId is provided, clears only that entry; otherwise clears all.
+ */
+export async function clearSignatureCache(spaceId) {
+    if (!isBrowser())
+        return;
+    try {
+        const db = await openDB();
+        if (spaceId) {
+            await idbDelete(db, cacheKey(spaceId));
+        }
+        else {
+            // Clear all sig entries but keep the wrap key
+            const keys = await idbKeys(db);
+            for (const k of keys) {
+                if (k.startsWith("sig:")) {
+                    await idbDelete(db, k);
+                }
+            }
+        }
+    }
+    catch {
+        // Best-effort
+    }
+}
+//# sourceMappingURL=SignatureCache.js.map

package/dist/vault/SignatureCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignatureCache.js","sourceRoot":"","sources":["../../src/vault/SignatureCache.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAsCH,MAAM,OAAO,GAAG,uBAAuB,CAAC;AACxC,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,WAAW,GAAG,cAAc,CAAC;AAEnC,8EAA8E;AAC9E,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,OAAO,CACL,OAAO,SAAS,KAAK,WAAW;YAChC,OAAO,MAAM,KAAK,WAAW;YAC7B,OAAO,MAAM,CAAC,MAAM,KAAK,WAAW,CACrC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,SAAS,MAAM;IACb,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACpD,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;YAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8BAA8B;AAC9B,SAAS,MAAM,CAAI,EAAe,EAAE,GAAW;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAuB,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8BAA8B;AAC9B,SAAS,MAAM,CAAC,EAAe,EAAE,GAAW,EAAE,KAAc;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClC,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAChC,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iCAAiC;AACjC,SAAS,SAAS,CAAC,EAAe,EAAE,GAAW;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAChC,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kCAAkC;AAClC,SAAS,OAAO,CAAC,EAAe;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CACnB,OAAO,CAAE,GAAG,CAAC,MAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAa,CAAC,CAAC;QAC1F,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAOD;;;GAGG;AACH,KAAK,UAAU,UAAU,CAAC,EAAe;IACvC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAY,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACzC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EAAE,kBAAkB;IACzB,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACF,MAAM,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iDAAiD;AACjD,KAAK,UAAU,UAAU,CACvB,OAAkB,EAClB,QAAoB;IAEpB,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CACxE,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;AAC5B,CAAC;AAED,0DAA0D;AAC1D,KAAK,UAAU,UAAU,CACvB,OAAkB,EAClB,KAAqB;IAErB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EACjC,OAAO,EACP,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,qCAAqC;AACrC,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,OAAO,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe;IAEf,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAiB,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC;QACrC,OAAO,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,QAAoB;IAEpB,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB;IAEhB,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,8CAA8C;YAC9C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzB,MAAM,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC"}

package/dist/vault/index.d.ts

@@ -5,6 +5,7 @@
  */
 export type { IDataVaultService } from "./IDataVaultService";
 export { DataVaultService, type VaultCrypto } from "./DataVaultService";
-export { VaultAction, VaultHeaders, type DataVaultConfig, type VaultPutOptions, type VaultGetOptions, type VaultListOptions, type VaultGrantOptions, type VaultEntry, type VaultError, type VaultActionType, } from "./types";
+export { VaultHeaders, VaultPublicSpaceKVActions, VaultVersionConfig, CURRENT_VAULT_VERSION, type DataVaultConfig, type VaultPutOptions, type VaultGetOptions, type VaultListOptions, type VaultGrantOptions, type VaultEntry, type VaultError, } from "./types";
 export { createVaultCrypto, type WasmVaultFunctions } from "./createVaultCrypto";
+export { clearSignatureCache } from "./SignatureCache";
 //# sourceMappingURL=index.d.ts.map

package/dist/vault/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGxE,OAAO,EACL,WAAW,EACX,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGxE,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/vault/index.js

@@ -6,6 +6,7 @@
 // Implementation
 export { DataVaultService } from "./DataVaultService";
 // Types
-export { VaultAction, VaultHeaders, } from "./types";
+export { VaultHeaders, VaultPublicSpaceKVActions, VaultVersionConfig, CURRENT_VAULT_VERSION, } from "./types";
 export { createVaultCrypto } from "./createVaultCrypto";
+export { clearSignatureCache } from "./SignatureCache";
 //# sourceMappingURL=index.js.map

package/dist/vault/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,iBAAiB;AACjB,OAAO,EAAE,gBAAgB,EAAoB,MAAM,oBAAoB,CAAC;AAExE,QAAQ;AACR,OAAO,EACL,WAAW,EACX,YAAY,GASb,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,iBAAiB;AACjB,OAAO,EAAE,gBAAgB,EAAoB,MAAM,oBAAoB,CAAC;AAExE,QAAQ;AACR,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GAQtB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAC;AAEjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/vault/types.d.ts

@@ -117,19 +117,16 @@ export type VaultError = VaultErrorInput & {
     service: "vault";
     message: string;
 };
-/**
- * Vault action types for UCAN invocations.
- */
-export declare const VaultAction: {
-    readonly PUT: "tinycloud.vault/put";
-    readonly GET: "tinycloud.vault/get";
-    readonly LIST: "tinycloud.vault/list";
-    readonly DELETE: "tinycloud.vault/del";
-    readonly HEAD: "tinycloud.vault/metadata";
-    readonly GRANT: "tinycloud.vault/grant";
-    readonly REVOKE: "tinycloud.vault/revoke";
+/** KV actions the vault needs on the public space for key publishing. */
+export declare const VaultPublicSpaceKVActions: readonly ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/metadata"];
+/** Version-keyed signing message configuration for vault key derivation. */
+export declare const VaultVersionConfig: {
+    readonly "1": {
+        readonly masterMessage: (spaceId: string) => string;
+        readonly identityMessage: "tinycloud-encryption-identity-v1";
+    };
 };
-export type VaultActionType = (typeof VaultAction)[keyof typeof VaultAction];
+export declare const CURRENT_VAULT_VERSION: "1";
 /** Metadata header keys used in vault envelopes */
 export declare const VaultHeaders: {
     readonly VERSION: "x-vault-version";

package/dist/vault/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,UAAU,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,OAAO;IAC1C,wEAAwE;IACxE,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,CAAC,CAAC;IACtC,yDAAyD;IACzD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oFAAoF;IACpF,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,IAAI,CAAC,EAAE;gBAAE,IAAI,EAAE,CAAC,CAAA;aAAE,CAAC;YAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACtI;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC;IACT,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;CAQd,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAE7E,mDAAmD;AACnD,eAAO,MAAM,YAAY;;;;;;;;;CASf,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,UAAU,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,OAAO;IAC1C,wEAAwE;IACxE,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,CAAC,CAAC;IACtC,yDAAyD;IACzD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oFAAoF;IACpF,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,IAAI,CAAC,EAAE;gBAAE,IAAI,EAAE,CAAC,CAAA;aAAE,CAAC;YAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACtI;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC;IACT,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAGjF,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,4EAI5B,CAAC;AAEX,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB;;0CAEF,MAAM;;;CAGzB,CAAC;AAEX,eAAO,MAAM,qBAAqB,EAAG,GAAY,CAAC;AAElD,mDAAmD;AACnD,eAAO,MAAM,YAAY;;;;;;;;;CASf,CAAC"}

package/dist/vault/types.js

@@ -3,18 +3,20 @@
  *
  * Type definitions for the Data Vault (encrypted KV) service operations.
  */
-/**
- * Vault action types for UCAN invocations.
- */
-export const VaultAction = {
-    PUT: "tinycloud.vault/put",
-    GET: "tinycloud.vault/get",
-    LIST: "tinycloud.vault/list",
-    DELETE: "tinycloud.vault/del",
-    HEAD: "tinycloud.vault/metadata",
-    GRANT: "tinycloud.vault/grant",
-    REVOKE: "tinycloud.vault/revoke",
+/** KV actions the vault needs on the public space for key publishing. */
+export const VaultPublicSpaceKVActions = [
+    "tinycloud.kv/get",
+    "tinycloud.kv/put",
+    "tinycloud.kv/metadata",
+];
+/** Version-keyed signing message configuration for vault key derivation. */
+export const VaultVersionConfig = {
+    "1": {
+        masterMessage: (spaceId) => `tinycloud-vault-master-v1:${spaceId}`,
+        identityMessage: "tinycloud-encryption-identity-v1",
+    },
 };
+export const CURRENT_VAULT_VERSION = "1";
 /** Metadata header keys used in vault envelopes */
 export const VaultHeaders = {
     VERSION: "x-vault-version",

package/dist/vault/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwFH;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,GAAG,EAAE,qBAAqB;IAC1B,GAAG,EAAE,qBAAqB;IAC1B,IAAI,EAAE,sBAAsB;IAC5B,MAAM,EAAE,qBAAqB;IAC7B,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,uBAAuB;IAC9B,MAAM,EAAE,wBAAwB;CACxB,CAAC;AAIX,mDAAmD;AACnD,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,OAAO,EAAE,iBAAiB;IAC1B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,YAAY,EAAE,sBAAsB;IACpC,GAAG,EAAE,aAAa;IAClB,YAAY,EAAE,sBAAsB;IACpC,aAAa,EAAE,uBAAuB;IACtC,OAAO,EAAE,iBAAiB;CAClB,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/vault/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyFH,yEAAyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;CACf,CAAC;AAEX,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,GAAG,EAAE;QACH,aAAa,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,6BAA6B,OAAO,EAAE;QAC1E,eAAe,EAAE,kCAAkC;KACpD;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAY,CAAC;AAElD,mDAAmD;AACnD,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,OAAO,EAAE,iBAAiB;IAC1B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,YAAY,EAAE,sBAAsB;IACpC,GAAG,EAAE,aAAa;IAClB,YAAY,EAAE,sBAAsB;IACpC,aAAa,EAAE,uBAAuB;IACtC,OAAO,EAAE,iBAAiB;CAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/sdk-services",
-  "version": "1.6.0",
+  "version": "2.0.1",
   "description": "TinyCloud SDK Services - Platform-agnostic service implementations",
   "author": "TinyCloud, Inc.",
   "license": "EGPL",