@tinycloud/web-sdk 2.1.0-beta.0 → 2.1.0-beta.2

package/dist/modules/Storage/tinycloud/types.schema.d.ts

@@ -34,8 +34,8 @@ export declare const SessionConfigSchema: z.ZodObject<{
     jwk: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
     domain?: string;
-    spaceId?: string;
     actions?: Record<string, Record<string, string[]>>;
+    spaceId?: string;
     address?: string;
     chainId?: number;
     issuedAt?: string;
@@ -45,8 +45,8 @@ export declare const SessionConfigSchema: z.ZodObject<{
     jwk?: Record<string, unknown>;
 }, {
     domain?: string;
-    spaceId?: string;
     actions?: Record<string, Record<string, string[]>>;
+    spaceId?: string;
     address?: string;
     chainId?: number;
     issuedAt?: string;

package/dist/modules/requestPermissionsCore.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Pure core of the `TinyCloudWeb.requestPermissions` escalation flow.
+ *
+ * Exposed as a standalone function so unit tests can exercise the
+ * control flow (validation → modal → compose → signOut → signIn) without
+ * instantiating the full `TinyCloudWeb` class (which wants a real WASM
+ * binding and browser wallet signer).
+ *
+ * Not re-exported from the package entry point — test surface only.
+ *
+ * @packageDocumentation
+ */
+import type { ClientSession, Manifest, PermissionEntry } from "@tinycloud/sdk-core";
+export interface RequestPermissionsCoreDeps {
+    /** Current stored manifest. Must be defined — caller validates first. */
+    manifest: Manifest;
+    /**
+     * Show the permission request modal. Resolves with `{ approved }`
+     * once the user interacts. In tests this is a stub; in production it
+     * is `ModalManager.showPermissionRequestModal`.
+     */
+    showModal: (opts: {
+        appName: string;
+        appIcon?: string;
+        additional: PermissionEntry[];
+    }) => Promise<{
+        approved: boolean;
+    }>;
+    /**
+     * Tear down the SDK-side session state. Wallet stays connected.
+     */
+    signOut: () => Promise<void>;
+    /**
+     * Run a fresh sign-in with the composed manifest already stored on
+     * the caller. Returns the new client session on success.
+     */
+    signIn: () => Promise<ClientSession>;
+    /**
+     * Write-through hook so the caller can update its stored manifest
+     * before the new sign-in runs. Called once, with the composed manifest,
+     * only on the approve path.
+     */
+    writeManifest: (next: Manifest) => void;
+}
+export interface RequestPermissionsCoreResult {
+    approved: boolean;
+    session?: ClientSession;
+}
+/**
+ * Validate the additional permissions array and throw with a clear
+ * message if empty. Exported so the caller (`TinyCloudWeb`) can share
+ * the same error text.
+ */
+export declare function validateAdditionalPermissions(additional: PermissionEntry[]): void;
+/**
+ * Core escalation flow. See the TinyCloudWeb.requestPermissions JSDoc
+ * for the full spec-level description — this function is the plumbing.
+ */
+export declare function requestPermissionsCore(additional: PermissionEntry[], deps: RequestPermissionsCoreDeps): Promise<RequestPermissionsCoreResult>;
+//# sourceMappingURL=requestPermissionsCore.d.ts.map

package/dist/modules/requestPermissionsCore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestPermissionsCore.d.ts","sourceRoot":"","sources":["../../src/modules/requestPermissionsCore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,QAAQ,EACR,eAAe,EAChB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;OAIG;IACH,SAAS,EAAE,CAAC,IAAI,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,eAAe,EAAE,CAAC;KAC/B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrC;;OAEG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IACrC;;;;OAIG;IACH,aAAa,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,eAAe,EAAE,GAC5B,IAAI,CAMN;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,eAAe,EAAE,EAC7B,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,4BAA4B,CAAC,CA2BvC"}

package/dist/modules/tcw.d.ts

@@ -9,7 +9,8 @@
  *
  * @packageDocumentation
  */
-import { IKVService, ISQLService, IDuckDbService, IDataVaultService, ISpaceService, ISpace, ISharingService, ICapabilityKeyRegistry, IHooksService, DelegationManager, Delegation, CreateDelegationParams, Result, DelegationError, ClientSession, Extension, ISpaceCreationHandler } from "@tinycloud/sdk-core";
+import { type DelegateToOptions, type DelegateToResult } from "@tinycloud/node-sdk/core";
+import { IKVService, ISQLService, IDuckDbService, IDataVaultService, ISpaceService, ISpace, ISharingService, ICapabilityKeyRegistry, IHooksService, DelegationManager, Delegation, CreateDelegationParams, Result, DelegationError, ClientSession, Extension, ISpaceCreationHandler, type Manifest, type PermissionEntry } from "@tinycloud/sdk-core";
 import type { providers } from "ethers";
 import { RPCProviders, ClientConfig } from "../providers";
 import type { NotificationConfig } from "../notifications/types";
@@ -43,6 +44,31 @@ export interface Config extends ClientConfig {
     domain?: string;
     /** Shorthand for passing a Web3 provider */
     provider?: any;
+    /**
+     * App manifest used for sign-in and escalation flows. When set,
+     * the SIWE recap issued at sign-in covers the union of the app's
+     * own permissions and every manifest-declared delegation's
+     * permissions — which is what enables
+     * `tcw.delegateTo(manifestDeclaredDid, permissions)` to run via
+     * the session-key UCAN path (no wallet prompt).
+     *
+     * When provided, {@link TinyCloudWeb.requestPermissions} uses the
+     * manifest's `name` and `icon` to title the permission modal and
+     * composes escalation requests against the manifest's existing
+     * permission set. The manifest is forwarded into the underlying
+     * {@link TinyCloudNode} so `signIn()` drives its SIWE recap from
+     * it directly.
+     */
+    manifest?: Manifest;
+}
+/**
+ * Result of {@link TinyCloudWeb.requestPermissions}. Populated with the
+ * fresh session on approve; empty on decline so callers can branch on
+ * `approved` without dereferencing a stale session.
+ */
+export interface RequestPermissionsResult {
+    approved: boolean;
+    session?: ClientSession;
 }
 /**
  * Result of receiving a share link.
@@ -70,6 +96,26 @@ export declare class TinyCloudWeb {
     private _initPromise;
     /** User config */
     private config;
+    /**
+     * App manifest stored from config (or updated via `setManifest`).
+     *
+     * `requestPermissions` reads this for the modal title/icon and for
+     * composing an expanded manifest on approve. `_init` forwards this
+     * value into the underlying {@link TinyCloudNode} so `signIn()`
+     * drives its SIWE recap from the manifest. `setManifest` mirrors
+     * any post-construction updates onto the node so the next sign-in
+     * picks them up.
+     */
+    private _manifest?;
+    /**
+     * Test hook — override the modal shower and sign-in function used by
+     * {@link requestPermissions}. Not part of the public API. Tests set
+     * these via `(tcw as any)._testHooks = { ... }` so they can exercise
+     * the escalation control flow without a real DOM or wallet.
+     *
+     * @internal
+     */
+    private _testHooks?;
     constructor(config?: Config);
     /**
      * Async initialization: ensure WASM is ready, then create TinyCloudNode.
@@ -125,6 +171,53 @@ export declare class TinyCloudWeb {
         disableSubDelegation?: boolean;
         expiryMs?: number;
     }): Promise<PortableDelegation>;
+    /**
+     * Issue a delegation using the capability-chain flow (spec:
+     * `.claude/specs/capability-chain.md`). When the requested permissions
+     * are a subset of the current session's recap, no wallet prompt is
+     * shown — the delegation is signed by the session key via WASM. When
+     * they are not, this throws `PermissionNotInManifestError` so callers
+     * can trigger an escalation flow via {@link requestPermissions}.
+     *
+     * Pass `{ forceWalletSign: true }` to bypass the derivability check and
+     * always use the wallet-signed SIWE path.
+     *
+     * Current limitation: exactly one {@link PermissionEntry} per call.
+     */
+    delegateTo: (did: string, permissions: PermissionEntry[], options?: DelegateToOptions) => Promise<DelegateToResult>;
+    /**
+     * Get the stored manifest (if any). Returns a shallow clone so callers
+     * can't accidentally mutate our internal state.
+     */
+    getManifest(): Manifest | undefined;
+    /**
+     * Install or replace the stored manifest. Used by apps that compose
+     * their manifest at runtime (e.g. after fetching a backend's advertised
+     * permissions) and by the escalation flow inside
+     * {@link requestPermissions}.
+     *
+     * The manifest is forwarded to the underlying TinyCloudNode so the
+     * next `signIn()` picks it up. If the node has not been constructed
+     * yet (pre-init), the manifest is stored locally and forwarded
+     * later inside `_init`.
+     */
+    setManifest(manifest: Manifest): void;
+    /**
+     * Request additional permissions on top of the currently-signed
+     * session. Shows a confirmation modal; on approve, signs out the
+     * current session (without disconnecting the wallet) and runs a fresh
+     * `signIn` with the composed manifest. On decline, returns
+     * `{ approved: false }` with no state changes.
+     *
+     * Spec: `.claude/specs/capability-chain.md` §requestPermissions.
+     *
+     * On approve, this composes the expanded manifest, signs out the
+     * current session, and calls `signIn()` — which now drives its
+     * SIWE recap from `this._manifest` directly, so the fresh session
+     * is signed with the expanded capability set in a single wallet
+     * prompt.
+     */
+    requestPermissions(additional: PermissionEntry[]): Promise<RequestPermissionsResult>;
     useDelegation(delegation: PortableDelegation): Promise<DelegatedAccess>;
     createSubDelegation(parentDelegation: PortableDelegation, params: {
         path: string;

package/dist/modules/tcw.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tcw.d.ts","sourceRoot":"","sources":["../../src/modules/tcw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,UAAU,EACV,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,MAAM,EACN,eAAe,EACf,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,sBAAsB,EACtB,MAAM,EACN,eAAe,EAEf,aAAa,EACb,SAAS,EAKT,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,EAAE,YAAY,EAAE,YAAY,EAA8B,MAAM,cAAc,CAAC;AAKtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEpF,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,QAAQ,CAAC,EAAE,GAAG,CAAC;KAChB;CACF;AAID;;;;GAIG;AACH,MAAM,WAAW,MAAO,SAAQ,YAAY;IAC1C,6DAA6D;IAC7D,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B,8DAA8D;IAC9D,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,kEAAkE;IAClE,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAE7C,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,GAAG,CAAC;CAChB;AAyCD;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,IAAI,EAAE,CAAC,CAAC;IACR,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,YAAY;IACvB,4BAA4B;IACrB,QAAQ,EAAG,SAAS,CAAC,YAAY,CAAC;IAEzC,8BAA8B;IAC9B,OAAc,YAAY,sBAAgB;IAE1C,yDAAyD;IACzD,OAAO,CAAC,KAAK,CAA8B;IAE3C,mCAAmC;IACnC,OAAO,CAAC,mBAAmB,CAA6B;IAExD,4BAA4B;IAC5B,OAAO,CAAC,YAAY,CAAsB;IAE1C,4BAA4B;IAC5B,OAAO,CAAC,YAAY,CAAC,CAAsB;IAE3C,uDAAuD;IACvD,OAAO,CAAC,YAAY,CAAgB;IAEpC,kBAAkB;IAClB,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,GAAE,MAAW;IAoB/B;;;OAGG;YACW,KAAK;IA4BnB;;;OAGG;YACW,UAAU;IAOxB;;;;OAIG;IACH,OAAO,KAAK,IAAI,GAQf;IAED;;;OAGG;WACU,MAAM,CAAC,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAU/D,IAAI,EAAE,IAAI,UAAU,CAAyB;IAC7C,IAAI,GAAG,IAAI,WAAW,CAA0B;IAChD,IAAI,MAAM,IAAI,cAAc,CAA6B;IACzD,IAAI,KAAK,IAAI,aAAa,CAA4B;IACtD,IAAI,KAAK,IAAI,iBAAiB,CAA4B;IAC1D,IAAI,MAAM,IAAI,aAAa,CAA6B;IACxD,IAAI,OAAO,IAAI,eAAe,CAA8B;IAC5D,IAAI,WAAW,IAAI,iBAAiB,CAAwC;IAC5E,IAAI,kBAAkB,IAAI,sBAAsB,CAAyC;IACzF,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAAgC;IAEjE,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAChC,IAAI,QAAQ,IAAI,MAAM,CAAuC;IAM7D,MAAM,QAAa,OAAO,CAAC,aAAa,CAAC,CAavC;IAEF,OAAO,QAAa,OAAO,CAAC,IAAI,CAAC,CAE/B;IAEF,OAAO,QAAO,aAAa,GAAG,SAAS,CAYrC;IAEF,OAAO,QAAO,MAAM,GAAG,SAAS,CAAwB;IACxD,OAAO,QAAO,MAAM,GAAG,SAAS,CAAiC;IAEjE,IAAI,GAAG,IAAI,MAAM,CAA0B;IAC3C,IAAI,UAAU,IAAI,MAAM,CAAiC;IACzD,IAAI,aAAa,IAAI,OAAO,CAAoC;IAChE,IAAI,iBAAiB,IAAI,OAAO,CAA4C;IAM5E,MAAM,CAAC,UAAU,EAAE,SAAS,GAAG,IAAI;IAInC,OAAO,IAAI,IAAI;IAIf,aAAa,CACX,QAAQ,EAAE,SAAS,CAAC,gBAAgB,GAAG,SAAS,CAAC,YAAY,EAC7D,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GACjC,IAAI;IAcD,gBAAgB,CAAC,MAAM,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAKzB,aAAa,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC;IAKvE,mBAAmB,CACvB,gBAAgB,EAAE,kBAAkB,EACpC,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC,kBAAkB,CAAC;IAKxB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAKtF,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAKrE,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,eAAe,CAAC,CAAC;IAKjE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAS9F;;;OAGG;WACiB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC1C,IAAI,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;CA4H3D"}
+{"version":3,"file":"tcw.d.ts","sourceRoot":"","sources":["../../src/modules/tcw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,UAAU,EACV,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,MAAM,EACN,eAAe,EACf,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,sBAAsB,EACtB,MAAM,EACN,eAAe,EAEf,aAAa,EACb,SAAS,EAKT,qBAAqB,EACrB,KAAK,QAAQ,EACb,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAM7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,EAAE,YAAY,EAAE,YAAY,EAA8B,MAAM,cAAc,CAAC;AAKtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEpF,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,QAAQ,CAAC,EAAE,GAAG,CAAC;KAChB;CACF;AAID;;;;GAIG;AACH,MAAM,WAAW,MAAO,SAAQ,YAAY;IAC1C,6DAA6D;IAC7D,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B,8DAA8D;IAC9D,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,kEAAkE;IAClE,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAE7C,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,GAAG,CAAC;IAEf;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAyCD;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,IAAI,EAAE,CAAC,CAAC;IACR,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,YAAY;IACvB,4BAA4B;IACrB,QAAQ,EAAG,SAAS,CAAC,YAAY,CAAC;IAEzC,8BAA8B;IAC9B,OAAc,YAAY,sBAAgB;IAE1C,yDAAyD;IACzD,OAAO,CAAC,KAAK,CAA8B;IAE3C,mCAAmC;IACnC,OAAO,CAAC,mBAAmB,CAA6B;IAExD,4BAA4B;IAC5B,OAAO,CAAC,YAAY,CAAsB;IAE1C,4BAA4B;IAC5B,OAAO,CAAC,YAAY,CAAC,CAAsB;IAE3C,uDAAuD;IACvD,OAAO,CAAC,YAAY,CAAgB;IAEpC,kBAAkB;IAClB,OAAO,CAAC,MAAM,CAAS;IAEvB;;;;;;;;;OASG;IACH,OAAO,CAAC,SAAS,CAAC,CAAW;IAE7B;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU,CAAC,CAQjB;gBAEU,MAAM,GAAE,MAAW;IAqB/B;;;OAGG;YACW,KAAK;IAkCnB;;;OAGG;YACW,UAAU;IAOxB;;;;OAIG;IACH,OAAO,KAAK,IAAI,GAQf;IAED;;;OAGG;WACU,MAAM,CAAC,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAU/D,IAAI,EAAE,IAAI,UAAU,CAAyB;IAC7C,IAAI,GAAG,IAAI,WAAW,CAA0B;IAChD,IAAI,MAAM,IAAI,cAAc,CAA6B;IACzD,IAAI,KAAK,IAAI,aAAa,CAA4B;IACtD,IAAI,KAAK,IAAI,iBAAiB,CAA4B;IAC1D,IAAI,MAAM,IAAI,aAAa,CAA6B;IACxD,IAAI,OAAO,IAAI,eAAe,CAA8B;IAC5D,IAAI,WAAW,IAAI,iBAAiB,CAAwC;IAC5E,IAAI,kBAAkB,IAAI,sBAAsB,CAAyC;IACzF,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAAgC;IAEjE,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAChC,IAAI,QAAQ,IAAI,MAAM,CAAuC;IAM7D,MAAM,QAAa,OAAO,CAAC,aAAa,CAAC,CAavC;IAEF,OAAO,QAAa,OAAO,CAAC,IAAI,CAAC,CAE/B;IAEF,OAAO,QAAO,aAAa,GAAG,SAAS,CAYrC;IAEF,OAAO,QAAO,MAAM,GAAG,SAAS,CAAwB;IACxD,OAAO,QAAO,MAAM,GAAG,SAAS,CAAiC;IAEjE,IAAI,GAAG,IAAI,MAAM,CAA0B;IAC3C,IAAI,UAAU,IAAI,MAAM,CAAiC;IACzD,IAAI,aAAa,IAAI,OAAO,CAAoC;IAChE,IAAI,iBAAiB,IAAI,OAAO,CAA4C;IAM5E,MAAM,CAAC,UAAU,EAAE,SAAS,GAAG,IAAI;IAInC,OAAO,IAAI,IAAI;IAIf,aAAa,CACX,QAAQ,EAAE,SAAS,CAAC,gBAAgB,GAAG,SAAS,CAAC,YAAY,EAC7D,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GACjC,IAAI;IAcD,gBAAgB,CAAC,MAAM,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK/B;;;;;;;;;;;;OAYG;IACH,UAAU,QACH,MAAM,eACE,eAAe,EAAE,YACpB,iBAAiB,KAC1B,OAAO,CAAC,gBAAgB,CAAC,CAG1B;IAEF;;;OAGG;IACH,WAAW,IAAI,QAAQ,GAAG,SAAS;IAKnC;;;;;;;;;;OAUG;IACH,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAUrC;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CACtB,UAAU,EAAE,eAAe,EAAE,GAC5B,OAAO,CAAC,wBAAwB,CAAC;IAsC9B,aAAa,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC;IAKvE,mBAAmB,CACvB,gBAAgB,EAAE,kBAAkB,EACpC,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC,kBAAkB,CAAC;IAKxB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAKtF,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAKrE,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,eAAe,CAAC,CAAC;IAKjE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAS9F;;;OAGG;WACiB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC1C,IAAI,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;CA4H3D"}

package/dist/notifications/ModalManager.d.ts

@@ -1,5 +1,6 @@
 import { type SpaceCreationModalOptions, type SpaceCreationResult } from './SpaceCreationModal';
 import { type NodeSelectionModalOptions, type NodeSelectionResult } from './NodeSelectionModal';
+import { type PermissionRequestModalOptions, type PermissionRequestResult } from './PermissionRequestModal';
 export declare class ModalManager {
     private static instance;
     private activeModal;
@@ -7,9 +8,11 @@ export declare class ModalManager {
     static getInstance(): ModalManager;
     showSpaceCreationModal(options: SpaceCreationModalOptions): Promise<SpaceCreationResult>;
     showNodeSelectionModal(options: NodeSelectionModalOptions): Promise<NodeSelectionResult>;
+    showPermissionRequestModal(options: PermissionRequestModalOptions): Promise<PermissionRequestResult>;
     closeActiveModal(): void;
     hasActiveModal(): boolean;
 }
 export declare const showSpaceCreationModal: (options: SpaceCreationModalOptions) => Promise<SpaceCreationResult>;
 export declare const showNodeSelectionModal: (options: NodeSelectionModalOptions) => Promise<NodeSelectionResult>;
+export declare const showPermissionRequestModal: (options: PermissionRequestModalOptions) => Promise<PermissionRequestResult>;
 //# sourceMappingURL=ModalManager.d.ts.map

package/dist/notifications/ModalManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ModalManager.d.ts","sourceRoot":"","sources":["../../src/notifications/ModalManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACrH,OAAO,EAA+B,KAAK,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE7H,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAe;IACtC,OAAO,CAAC,WAAW,CAAkE;IAErF,OAAO;WAEO,WAAW,IAAI,YAAY;IAOlC,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAuBxF,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAuBxF,gBAAgB,IAAI,IAAI;IAOxB,cAAc,IAAI,OAAO;CAGjC;AAGD,eAAO,MAAM,sBAAsB,YAAa,yBAAyB,KAAG,OAAO,CAAC,mBAAmB,CAEtG,CAAC;AAEF,eAAO,MAAM,sBAAsB,YAAa,yBAAyB,KAAG,OAAO,CAAC,mBAAmB,CAEtG,CAAC"}
+{"version":3,"file":"ModalManager.d.ts","sourceRoot":"","sources":["../../src/notifications/ModalManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACrH,OAAO,EAA+B,KAAK,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC7H,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAElC,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAe;IACtC,OAAO,CAAC,WAAW,CAIH;IAEhB,OAAO;WAEO,WAAW,IAAI,YAAY;IAOlC,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAuBxF,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAuBxF,0BAA0B,CAC/B,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,uBAAuB,CAAC;IAmB5B,gBAAgB,IAAI,IAAI;IAOxB,cAAc,IAAI,OAAO;CAGjC;AAGD,eAAO,MAAM,sBAAsB,YAAa,yBAAyB,KAAG,OAAO,CAAC,mBAAmB,CAEtG,CAAC;AAEF,eAAO,MAAM,sBAAsB,YAAa,yBAAyB,KAAG,OAAO,CAAC,mBAAmB,CAEtG,CAAC;AAEF,eAAO,MAAM,0BAA0B,YAC5B,6BAA6B,KACrC,OAAO,CAAC,uBAAuB,CAEjC,CAAC"}

package/dist/notifications/PermissionRequestModal.d.ts

@@ -0,0 +1,50 @@
+/**
+ * PermissionRequestModal
+ *
+ * Web Component that shows the user a list of additional capabilities an
+ * app wants to request on top of the currently-signed session. Used by
+ * `TinyCloudWeb.requestPermissions` as the confirmation step before we
+ * tear down the current session and run a fresh signIn with an expanded
+ * manifest.
+ *
+ * Matches the `SpaceCreationModal` pattern: a Web Component with a shadow
+ * DOM, returning a completion promise via `getCompletionPromise()`. The
+ * DOM lifecycle (append / remove) is managed by `ModalManager`.
+ *
+ * Canonical spec: `.claude/specs/capability-chain.md`.
+ */
+import type { PermissionEntry } from "@tinycloud/sdk-core";
+export interface PermissionRequestModalOptions {
+    /** Display name of the app requesting permissions (from the manifest). */
+    appName: string;
+    /** Optional app icon URL (from the manifest). */
+    appIcon?: string;
+    /** The additional permissions the app wants on top of its current session. */
+    additional: PermissionEntry[];
+    /** Called when the user clicks Decline or dismisses the modal. */
+    onDismiss?: () => void;
+}
+export interface PermissionRequestResult {
+    /** True when the user clicked Approve, false when they declined or dismissed. */
+    approved: boolean;
+}
+export declare class TinyCloudPermissionRequestModal extends HTMLElement {
+    private options;
+    private isVisible;
+    private resolveResult;
+    private completionPromise;
+    constructor(options: PermissionRequestModalOptions);
+    getCompletionPromise(): Promise<PermissionRequestResult>;
+    connectedCallback(): void;
+    disconnectedCallback(): void;
+    private render;
+    private renderEntry;
+    private getModalStyles;
+    private setupEventListeners;
+    private handleKeyDown;
+    private handleApprove;
+    private show;
+    private hide;
+    private dismiss;
+}
+//# sourceMappingURL=PermissionRequestModal.d.ts.map

package/dist/notifications/PermissionRequestModal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionRequestModal.d.ts","sourceRoot":"","sources":["../../src/notifications/PermissionRequestModal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,WAAW,6BAA6B;IAC5C,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,qBAAa,+BAAgC,SAAQ,WAAW;IAC9D,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,aAAa,CACd;IACP,OAAO,CAAC,iBAAiB,CAAmC;gBAEhD,OAAO,EAAE,6BAA6B;IAW3C,oBAAoB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAI/D,iBAAiB;IAKjB,oBAAoB;IAIpB,OAAO,CAAC,MAAM;IAqDd,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,cAAc;IAuItB,OAAO,CAAC,mBAAmB;IAmB3B,OAAO,CAAC,aAAa,CAInB;IAEF,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,IAAI;IASZ,OAAO,CAAC,IAAI;IAWZ,OAAO,CAAC,OAAO;CAKhB"}

package/dist/notifications/types.schema.d.ts

@@ -53,10 +53,10 @@ export declare const ToastSchema: z.ZodObject<{
     }>>;
     timestamp: z.ZodNumber;
 }, "strip", z.ZodTypeAny, {
-    type?: "error" | "success" | "warning" | "info" | "loading";
+    type?: "error" | "loading" | "success" | "warning" | "info";
+    title?: string;
     description?: string;
     id?: string;
-    title?: string;
     duration?: number;
     action?: {
         label?: string;
@@ -64,10 +64,10 @@ export declare const ToastSchema: z.ZodObject<{
     };
     timestamp?: number;
 }, {
-    type?: "error" | "success" | "warning" | "info" | "loading";
+    type?: "error" | "loading" | "success" | "warning" | "info";
+    title?: string;
     description?: string;
     id?: string;
-    title?: string;
     duration?: number;
     action?: {
         label?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/web-sdk",
-  "version": "2.1.0-beta.0",
+  "version": "2.1.0-beta.2",
   "description": "A set of tools and utilities to help you build your app with TinyCloud.",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -38,9 +38,9 @@
     "@metamask/detect-provider": "^1.2.0",
     "@multiformats/multiaddr": "^13.0.1",
     "@multiformats/multiaddr-to-uri": "^12.0.0",
-    "@tinycloud/node-sdk": "2.1.0-beta.0",
-    "@tinycloud/sdk-core": "2.1.0-beta.0",
-    "@tinycloud/web-sdk-wasm": "1.7.1",
+    "@tinycloud/node-sdk": "2.1.0-beta.2",
+    "@tinycloud/sdk-core": "2.1.0-beta.2",
+    "@tinycloud/web-sdk-wasm": "1.7.2-beta.2",
     "axios": "^1.7.9",
     "ethers": "^5.7.2",
     "lodash.merge": "^4.6.2",