@tinycloud/sdk-services 3.12.0-beta.4 → 3.12.0-beta.8

package/dist/{types-XE4tyBLH.d.ts → types-Ceti5xVp.d.ts}

@@ -1,18 +1,44 @@
-import { F as FetchFunction, P as PermissionHint } from './types-DjAP8dve.js';
+import { F as FetchFunction, e as FetchResponse, S as ServiceSession, P as PermissionHint } from './types-DjAP8dve.js';
 
 type ResourceAccess = "read" | "write" | "host" | "encryption";
 interface ResourceDestination {
     readonly url: string;
     readonly nodeDid?: string;
 }
+interface ResourceNodeInfo {
+    readonly nodeId: string;
+    readonly features?: unknown;
+}
 interface ResourceRoutingConfig {
     resolveResource(resource: string, access: ResourceAccess): Promise<readonly ResourceDestination[]>;
     bindAudience(authorization: string, nodeDid: string): Promise<string>;
     /** Defaults to the raw transport's public node identity checks. */
-    verifyDestination?(target: ResourceDestination): Promise<void>;
+    verifyDestination?(target: ResourceDestination): Promise<void | ResourceNodeInfo>;
+}
+/** An identity-checked destination bound to one live resource-routing decision. */
+interface ResourceTransportTarget {
+    readonly url: string;
+    readonly nodeDid: string;
+    readonly fetch: FetchFunction;
+    readonly nodeInfo: ResourceNodeInfo;
+    bindAudience(authorization: string): Promise<string>;
+}
+interface ResourceTransportOptions {
+    /** CID-only controls are node-local and must not choose among several destinations. */
+    readonly nodeLocal?: boolean;
+    /** An existing node-bound authority must match the resolved destination. */
+    readonly nodeDid?: string;
+    /** A verified imported grant activates its resources independently, not atomically. */
+    readonly independentResources?: boolean;
+    /** Captured, verified share-session key for its own locally created invocations. */
+    readonly invocationSession?: ServiceSession;
 }
+type ResourceTransport = (resources: readonly {
+    resource: string;
+    access: ResourceAccess;
+}[], send: (target: ResourceTransportTarget) => Promise<FetchResponse>, options?: ResourceTransportOptions) => Promise<FetchResponse>;
 /** Compare both public node identity surfaces before sending a capability. */
-declare function verifyResourceDestination(target: ResourceDestination, fetchFn: FetchFunction): Promise<void>;
+declare function verifyResourceDestination(target: ResourceDestination, fetchFn: FetchFunction): Promise<ResourceNodeInfo | undefined>;
 declare class NodeNotRespondingError extends Error {
     readonly hosts: readonly string[];
     readonly cause?: unknown | undefined;
@@ -54,6 +80,15 @@ interface RoutingFailure {
 }
 /** Preserve routing failures through service-specific Result/error adapters. */
 declare function routingFailure(error: unknown): RoutingFailure | undefined;
+/** Extract the signed resource without inferring an account for node-local names. */
+declare function routingResourceOf(uri: string): string;
+/** Share target selection and read/write outcomes with resource-specific adapters. */
+declare function routeResourceRequest(resources: readonly {
+    resource: string;
+    access: ResourceAccess;
+}[], routing: Pick<ResourceRoutingConfig, "resolveResource">, send: (target: ResourceDestination) => Promise<FetchResponse>, options?: ResourceTransportOptions): Promise<FetchResponse>;
+/** Route only locally generated data invocations through a captured share session. */
+declare function createResourceTransportInvocationFetch(transport: ResourceTransport, session: ServiceSession): FetchFunction;
 /** Route signed /invoke traffic. Non-invocation endpoints retain their own resource-specific adapters. */
 declare function createResourceRoutingFetch(fetchFn: FetchFunction, routing: ResourceRoutingConfig): FetchFunction;
 
@@ -387,4 +422,4 @@ declare function encryptionError(input: EncryptionErrorInput): EncryptionError;
 /** Re-export for ergonomic typing of canonical payloads. */
 type CanonicalJson = Json;
 
-export { canonicalize as A, type BuildDecryptInvocationInput as B, type CanonicalJson as C, type DecryptCapabilityProof as D, type EncryptionCrypto as E, createResourceRoutingFetch as F, encryptionError as G, hexDecode as H, type InlineEncryptedEnvelope as I, type Json as J, hexEncode as K, routingFailure as L, utf8Decode as M, type NetworkDescriptor as N, utf8Encode as O, PartialNodeWriteError as P, verifyResourceDestination as Q, type RoutingFailure as R, type BuiltDecryptInvocation as a, DECRYPT_ACTION as b, DECRYPT_FACT_TYPE as c, DECRYPT_RESULT_TYPE as d, DEFAULT_ENCRYPTION_ALG as e, DEFAULT_KEY_VERSION as f, type DecryptInvocationFact as g, type DecryptInvocationSigner as h, type DecryptRequestBody as i, type DecryptResponseBody as j, ENCRYPTION_SERVICE as k, ENCRYPTION_SERVICE_SHORT as l, ENVELOPE_VERSION as m, type EncryptionError as n, type EncryptionErrorInput as o, NodeIdentityMismatchError as p, NodeNotRespondingError as q, type ReceiverKeyPair as r, type ReceiverKeySigner as s, type ResourceAccess as t, type ResourceDestination as u, ResourceNotRoutedError as v, type ResourceRoutingConfig as w, base64Decode as x, base64Encode as y, canonicalHashHex as z };
+export { type ResourceTransportTarget as A, type BuildDecryptInvocationInput as B, type CanonicalJson as C, type DecryptCapabilityProof as D, type EncryptionCrypto as E, base64Decode as F, base64Encode as G, canonicalHashHex as H, type InlineEncryptedEnvelope as I, type Json as J, canonicalize as K, createResourceRoutingFetch as L, createResourceTransportInvocationFetch as M, type NetworkDescriptor as N, encryptionError as O, PartialNodeWriteError as P, hexDecode as Q, type RoutingFailure as R, hexEncode as S, routeResourceRequest as T, routingFailure as U, routingResourceOf as V, utf8Decode as W, utf8Encode as X, verifyResourceDestination as Y, type BuiltDecryptInvocation as a, DECRYPT_ACTION as b, DECRYPT_FACT_TYPE as c, DECRYPT_RESULT_TYPE as d, DEFAULT_ENCRYPTION_ALG as e, DEFAULT_KEY_VERSION as f, type DecryptInvocationFact as g, type DecryptInvocationSigner as h, type DecryptRequestBody as i, type DecryptResponseBody as j, ENCRYPTION_SERVICE as k, ENCRYPTION_SERVICE_SHORT as l, ENVELOPE_VERSION as m, type EncryptionError as n, type EncryptionErrorInput as o, NodeIdentityMismatchError as p, NodeNotRespondingError as q, type ReceiverKeyPair as r, type ReceiverKeySigner as s, type ResourceAccess as t, type ResourceDestination as u, type ResourceNodeInfo as v, ResourceNotRoutedError as w, type ResourceRoutingConfig as x, type ResourceTransport as y, type ResourceTransportOptions as z };

package/dist/{types-cWtQmCCw.d.cts → types-CoZ0vXo8.d.cts}

@@ -1,18 +1,44 @@
-import { F as FetchFunction, P as PermissionHint } from './types-DjAP8dve.cjs';
+import { F as FetchFunction, e as FetchResponse, S as ServiceSession, P as PermissionHint } from './types-DjAP8dve.cjs';
 
 type ResourceAccess = "read" | "write" | "host" | "encryption";
 interface ResourceDestination {
     readonly url: string;
     readonly nodeDid?: string;
 }
+interface ResourceNodeInfo {
+    readonly nodeId: string;
+    readonly features?: unknown;
+}
 interface ResourceRoutingConfig {
     resolveResource(resource: string, access: ResourceAccess): Promise<readonly ResourceDestination[]>;
     bindAudience(authorization: string, nodeDid: string): Promise<string>;
     /** Defaults to the raw transport's public node identity checks. */
-    verifyDestination?(target: ResourceDestination): Promise<void>;
+    verifyDestination?(target: ResourceDestination): Promise<void | ResourceNodeInfo>;
+}
+/** An identity-checked destination bound to one live resource-routing decision. */
+interface ResourceTransportTarget {
+    readonly url: string;
+    readonly nodeDid: string;
+    readonly fetch: FetchFunction;
+    readonly nodeInfo: ResourceNodeInfo;
+    bindAudience(authorization: string): Promise<string>;
+}
+interface ResourceTransportOptions {
+    /** CID-only controls are node-local and must not choose among several destinations. */
+    readonly nodeLocal?: boolean;
+    /** An existing node-bound authority must match the resolved destination. */
+    readonly nodeDid?: string;
+    /** A verified imported grant activates its resources independently, not atomically. */
+    readonly independentResources?: boolean;
+    /** Captured, verified share-session key for its own locally created invocations. */
+    readonly invocationSession?: ServiceSession;
 }
+type ResourceTransport = (resources: readonly {
+    resource: string;
+    access: ResourceAccess;
+}[], send: (target: ResourceTransportTarget) => Promise<FetchResponse>, options?: ResourceTransportOptions) => Promise<FetchResponse>;
 /** Compare both public node identity surfaces before sending a capability. */
-declare function verifyResourceDestination(target: ResourceDestination, fetchFn: FetchFunction): Promise<void>;
+declare function verifyResourceDestination(target: ResourceDestination, fetchFn: FetchFunction): Promise<ResourceNodeInfo | undefined>;
 declare class NodeNotRespondingError extends Error {
     readonly hosts: readonly string[];
     readonly cause?: unknown | undefined;
@@ -54,6 +80,15 @@ interface RoutingFailure {
 }
 /** Preserve routing failures through service-specific Result/error adapters. */
 declare function routingFailure(error: unknown): RoutingFailure | undefined;
+/** Extract the signed resource without inferring an account for node-local names. */
+declare function routingResourceOf(uri: string): string;
+/** Share target selection and read/write outcomes with resource-specific adapters. */
+declare function routeResourceRequest(resources: readonly {
+    resource: string;
+    access: ResourceAccess;
+}[], routing: Pick<ResourceRoutingConfig, "resolveResource">, send: (target: ResourceDestination) => Promise<FetchResponse>, options?: ResourceTransportOptions): Promise<FetchResponse>;
+/** Route only locally generated data invocations through a captured share session. */
+declare function createResourceTransportInvocationFetch(transport: ResourceTransport, session: ServiceSession): FetchFunction;
 /** Route signed /invoke traffic. Non-invocation endpoints retain their own resource-specific adapters. */
 declare function createResourceRoutingFetch(fetchFn: FetchFunction, routing: ResourceRoutingConfig): FetchFunction;
 
@@ -387,4 +422,4 @@ declare function encryptionError(input: EncryptionErrorInput): EncryptionError;
 /** Re-export for ergonomic typing of canonical payloads. */
 type CanonicalJson = Json;
 
-export { canonicalize as A, type BuildDecryptInvocationInput as B, type CanonicalJson as C, type DecryptCapabilityProof as D, type EncryptionCrypto as E, createResourceRoutingFetch as F, encryptionError as G, hexDecode as H, type InlineEncryptedEnvelope as I, type Json as J, hexEncode as K, routingFailure as L, utf8Decode as M, type NetworkDescriptor as N, utf8Encode as O, PartialNodeWriteError as P, verifyResourceDestination as Q, type RoutingFailure as R, type BuiltDecryptInvocation as a, DECRYPT_ACTION as b, DECRYPT_FACT_TYPE as c, DECRYPT_RESULT_TYPE as d, DEFAULT_ENCRYPTION_ALG as e, DEFAULT_KEY_VERSION as f, type DecryptInvocationFact as g, type DecryptInvocationSigner as h, type DecryptRequestBody as i, type DecryptResponseBody as j, ENCRYPTION_SERVICE as k, ENCRYPTION_SERVICE_SHORT as l, ENVELOPE_VERSION as m, type EncryptionError as n, type EncryptionErrorInput as o, NodeIdentityMismatchError as p, NodeNotRespondingError as q, type ReceiverKeyPair as r, type ReceiverKeySigner as s, type ResourceAccess as t, type ResourceDestination as u, ResourceNotRoutedError as v, type ResourceRoutingConfig as w, base64Decode as x, base64Encode as y, canonicalHashHex as z };
+export { type ResourceTransportTarget as A, type BuildDecryptInvocationInput as B, type CanonicalJson as C, type DecryptCapabilityProof as D, type EncryptionCrypto as E, base64Decode as F, base64Encode as G, canonicalHashHex as H, type InlineEncryptedEnvelope as I, type Json as J, canonicalize as K, createResourceRoutingFetch as L, createResourceTransportInvocationFetch as M, type NetworkDescriptor as N, encryptionError as O, PartialNodeWriteError as P, hexDecode as Q, type RoutingFailure as R, hexEncode as S, routeResourceRequest as T, routingFailure as U, routingResourceOf as V, utf8Decode as W, utf8Encode as X, verifyResourceDestination as Y, type BuiltDecryptInvocation as a, DECRYPT_ACTION as b, DECRYPT_FACT_TYPE as c, DECRYPT_RESULT_TYPE as d, DEFAULT_ENCRYPTION_ALG as e, DEFAULT_KEY_VERSION as f, type DecryptInvocationFact as g, type DecryptInvocationSigner as h, type DecryptRequestBody as i, type DecryptResponseBody as j, ENCRYPTION_SERVICE as k, ENCRYPTION_SERVICE_SHORT as l, ENVELOPE_VERSION as m, type EncryptionError as n, type EncryptionErrorInput as o, NodeIdentityMismatchError as p, NodeNotRespondingError as q, type ReceiverKeyPair as r, type ReceiverKeySigner as s, type ResourceAccess as t, type ResourceDestination as u, type ResourceNodeInfo as v, ResourceNotRoutedError as w, type ResourceRoutingConfig as x, type ResourceTransport as y, type ResourceTransportOptions as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/sdk-services",
-  "version": "3.12.0-beta.4",
+  "version": "3.12.0-beta.8",
   "description": "TinyCloud SDK Services - Platform-agnostic service implementations",
   "author": "TinyCloud, Inc.",
   "license": "EGPL",