@tinycloud/web-sdk 3.0.0-beta.0 → 3.0.0-beta.10

package/dist/manage-key-session.d.ts

@@ -0,0 +1,25 @@
+import { type CanonicalTinyCloudIdentity, type ClientSession, type OpenKeyManageKeySigningStrategyOptions } from "@tinycloud/sdk-core";
+import { TinyCloudWeb, type Config } from "./modules/tcw";
+/** Configuration for one OAuth-bound canonical TinyCloud sign-in. */
+export interface EstablishManageKeySessionOptions {
+    /** The canonical identity claim returned with a consented OAuth token. */
+    identity: CanonicalTinyCloudIdentity | unknown;
+    /** OAuth bearer signer configuration. No browser session credentials are used. */
+    signer: Omit<OpenKeyManageKeySigningStrategyOptions, "identity">;
+    /** TinyCloud client configuration, including the app's requested capabilities. */
+    tinycloud: Omit<Config, "provider" | "signStrategy" | "autoBootstrapAccount">;
+}
+/** Result of a completed TinyCloud sign-in using the OAuth canonical key. */
+export interface EstablishManageKeySessionResult {
+    client: TinyCloudWeb;
+    identity: CanonicalTinyCloudIdentity;
+    /** The verified TinyCloud session produced by the public SDK sign-in flow. */
+    session: ClientSession;
+}
+/**
+ * Sign in through the public TinyCloud web SDK using a consented OAuth
+ * canonical key. The identity is token-bound; callers cannot select another
+ * address or key ID, and the signer makes cookie-free requests only.
+ */
+export declare function establishManageKeySession(options: EstablishManageKeySessionOptions): Promise<EstablishManageKeySessionResult>;
+//# sourceMappingURL=manage-key-session.d.ts.map

package/dist/modules/Storage/tinycloud/types.schema.d.ts

@@ -38,22 +38,22 @@ export declare const SessionConfigSchema: z.ZodObject<{
     spaceId?: string;
     address?: string;
     chainId?: number;
+    jwk?: Record<string, unknown>;
     issuedAt?: string;
     notBefore?: string;
     expirationTime?: string;
     parents?: string[];
-    jwk?: Record<string, unknown>;
 }, {
     domain?: string;
     actions?: Record<string, Record<string, string[]>>;
     spaceId?: string;
     address?: string;
     chainId?: number;
+    jwk?: Record<string, unknown>;
     issuedAt?: string;
     notBefore?: string;
     expirationTime?: string;
     parents?: string[];
-    jwk?: Record<string, unknown>;
 }>;
 export type SessionConfig = z.infer<typeof SessionConfigSchema>;
 /**

package/dist/modules/WebSecretsService.d.ts

@@ -26,6 +26,7 @@ export declare class WebSecretsService implements ISecretsService {
     put(name: string, value: string, options?: SecretScopeOptions): ReturnType<ISecretsService["put"]>;
     delete(name: string, options?: SecretScopeOptions): ReturnType<ISecretsService["delete"]>;
     list(options?: SecretScopeOptions): ReturnType<ISecretsService["list"]>;
+    listAll(): ReturnType<ISecretsService["listAll"]>;
     private get service();
     private ensureMutationPermission;
     private restoreUnlockAfterEscalation;

package/dist/modules/tcw.d.ts

@@ -9,13 +9,14 @@
  *
  * @packageDocumentation
  */
-import { TinyCloudNode, type BootstrapWarning, type DelegateToOptions, type DelegateToResult, type ISessionStorage, type SignStrategy, type ValidatedRuntimeDelegation, type UnifiedOwnerRootInput, type UnifiedOwnerRootReceipt } from "@tinycloud/node-sdk/core";
-import { IKVService, ISQLService, IDuckDbService, IDataVaultService, ISecretsService, ISpaceService, ISpace, ISharingService, ICapabilityKeyRegistry, IHooksService, IEncryptionService, DelegationManager, Delegation, DelegationRevocationReceipt, CreateDelegationParams, Result, DelegationError, ClientSession, Extension, type TelemetryConfig, ISpaceCreationHandler, type Manifest, type ComposedManifestRequest, type AccountService, type ResolvedDelegate, type PermissionEntry, type NetworkDescriptor, type CreateOwnerDelegationParams, type OwnerDelegationReceipt, type RegisterOwnerSharePolicyParams, type OwnerSharePolicyRegistrationReceipt, type LocalNodeIdentityStore, SignInOptions } from "@tinycloud/sdk-core";
+import { TinyCloudNode, type BootstrapWarning, type DelegateToOptions, type DelegateToResult, type ISessionStorage, type SignStrategy, type ValidatedRuntimeDelegation, type UnifiedOwnerRootInput, type UnifiedOwnerRootReceipt, type RegisterPolicyV3Input, type RegisterPolicyV3Receipt } from "@tinycloud/node-sdk/core";
+import { IKVService, ISQLService, IDuckDbService, IDataVaultService, ISecretsService, ISpaceService, ISpace, ISharingService, ICapabilityKeyRegistry, IHooksService, IEncryptionService, DelegationManager, Delegation, DelegationRevocationReceipt, CreateDelegationParams, Result, DelegationError, ClientSession, Extension, type TelemetryConfig, ISpaceCreationHandler, type Manifest, type ComposedManifestRequest, type AccountService, type ResolvedDelegate, type PermissionEntry, type NetworkDescriptor, type CreateOwnerDelegationParams, type OwnerDelegationReceipt, type LocalNodeIdentityStore, SignInOptions } from "@tinycloud/sdk-core";
 import { type BrowserProvider, type BrowserWalletProvider } from "../adapters/browserProvider";
 import { RPCProviders, ClientConfig } from "../providers";
 import type { NotificationConfig } from "../notifications/types";
 import type { PortableDelegation, DelegatedAccess } from "@tinycloud/node-sdk/core";
 import { CredentialsService } from "../credentials";
+import { ShareReceiverService, type ShareReceiverServiceOptions } from "../share";
 declare global {
     interface Window {
         ethereum?: any;
@@ -109,6 +110,8 @@ export interface Config extends ClientConfig {
     includeAccountRegistryPermissions?: boolean;
     /** Default-off service telemetry. */
     telemetry?: TelemetryConfig;
+    /** Accountless share receiver transport and session-custody configuration. */
+    shareReceiver?: ShareReceiverServiceOptions;
 }
 /**
  * Result of {@link TinyCloudWeb.requestPermissions}. On approve, `session`
@@ -134,6 +137,8 @@ export interface ShareReceiveResult<T = unknown> {
     delegation: Delegation;
     path: string;
     spaceId: string;
+    /** Owner Node named by the link; that node independently verifies the accompanying delegation. */
+    host: string;
 }
 export declare class TinyCloudWeb {
     /** The connected wallet's raw EIP-1193 provider. */
@@ -154,6 +159,7 @@ export declare class TinyCloudWeb {
     private _sessionRestoreStatus;
     private _secrets;
     private _credentialsService?;
+    private _shareReceiverService?;
     /** Promise that resolves when WASM + node are ready */
     private _initPromise;
     /** User config */
@@ -229,9 +235,18 @@ export declare class TinyCloudWeb {
     get accountSpaceId(): string | undefined;
     get account(): AccountService;
     get hosts(): string[];
+    /** Registry-resolved owner Node identity used to bind native share targets. */
+    activeNodeIdentity(): Promise<{
+        readonly origin: string;
+        readonly nodeDid: string;
+    }>;
+    /** Publish the active owner Node as a session-signed registry record. */
+    publishActiveNodeLocation(registryUrl: string, fetchFn?: typeof fetch): Promise<import("@tinycloud/sdk-core").LocationRecord>;
     get sessionRestoreStatus(): SessionRestoreStatus;
     /** Holder-bound OpenCredentials issuance using the active TinyCloud session. */
     get credentials(): CredentialsService;
+    /** First-class signed-in or accountless share receiving. */
+    get share(): ShareReceiverService;
     space(nameOrUri: string): ISpace;
     get kvPrefix(): string;
     getEncryptionNetwork(nameOrNetworkId?: string): Promise<NetworkDescriptor | null>;
@@ -304,10 +319,10 @@ export declare class TinyCloudWeb {
     createOwnerDelegation(params: CreateOwnerDelegationParams extends infer PermissionShape ? PermissionShape extends CreateOwnerDelegationParams ? Omit<PermissionShape, "spaceId"> & {
         readonly spaceId?: string;
     } : never : never): Promise<OwnerDelegationReceipt>;
-    /** Register an owner-bound addressed sharing policy through TinyCloud Node. */
-    registerOwnerSharePolicy(params: RegisterOwnerSharePolicyParams): Promise<OwnerSharePolicyRegistrationReceipt>;
-    /** Authorize a short-lived, one-use v2 delivery using the authenticated invocation chain. */
-    authorizeShareDelivery(input: Parameters<TinyCloudNode["authorizeShareDelivery"]>[0]): ReturnType<TinyCloudNode["authorizeShareDelivery"]>;
+    /** Register signed policy material through the Node-owned Policy/v3 runtime. */
+    registerPolicy(params: Omit<RegisterPolicyV3Input, "nodeOrigin" | "fetch">): Promise<RegisterPolicyV3Receipt>;
+    /** Authorize a short-lived, one-use v3 delivery against the signed envelope and roots. */
+    authorizeShareDeliveryV3(input: Parameters<TinyCloudNode["authorizeShareDeliveryV3"]>[0]): ReturnType<TinyCloudNode["authorizeShareDeliveryV3"]>;
     /**
      * Issue a delegation using the capability-chain flow (spec:
      * `.claude/specs/capability-chain.md`). When the requested permissions
@@ -378,9 +393,11 @@ export declare class TinyCloudWeb {
     listDelegations(): Promise<Result<Delegation[], DelegationError>>;
     checkPermission(path: string, action: string): Promise<Result<boolean, DelegationError>>;
     /**
-     * Receive and retrieve data from a v2 share link.
+     * Receive and retrieve data from a native TinyCloud bearer delegation.
      * Static method — no auth required. Uses browser WASM.
      */
-    static receiveShare<T = unknown>(link: string, key?: string): Promise<Result<ShareReceiveResult<T>, DelegationError>>;
+    static receiveShare<T = unknown>(link: string, key?: string, options?: {
+        readonly binary?: boolean;
+    }): Promise<Result<ShareReceiveResult<T>, DelegationError>>;
 }
 //# sourceMappingURL=tcw.d.ts.map

package/dist/notifications/types.schema.d.ts

@@ -54,8 +54,8 @@ export declare const ToastSchema: z.ZodObject<{
     timestamp: z.ZodNumber;
 }, "strip", z.ZodTypeAny, {
     description?: string;
-    id?: string;
     type?: "error" | "success" | "warning" | "info" | "loading";
+    id?: string;
     title?: string;
     duration?: number;
     action?: {
@@ -65,8 +65,8 @@ export declare const ToastSchema: z.ZodObject<{
     timestamp?: number;
 }, {
     description?: string;
-    id?: string;
     type?: "error" | "success" | "warning" | "info" | "loading";
+    id?: string;
     title?: string;
     duration?: number;
     action?: {

package/dist/share/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./receiver-credentials";
+export * from "./receiver-session";
+export { ShareReceiverService, validateShareReceiverServiceTrust, type ShareReceiverServiceOptions, } from "./service";
+export * from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/share/receiver-credentials.d.ts

@@ -0,0 +1,21 @@
+import { type CredentialRequirement, type StoredCredentialRecord, type VerifiedCredential } from "@tinycloud/sdk-core";
+import type { ReceiverCredentialCustody } from "../credentials";
+import type { ReceiverSessionStorage } from "./receiver-session";
+export declare class SessionReceiverCredentialCustody implements ReceiverCredentialCustody {
+    private readonly storage;
+    constructor(storage?: ReceiverSessionStorage);
+    find(input: {
+        readonly requirement: CredentialRequirement;
+        readonly requirementDigest: string;
+        readonly holderDid: string;
+        readonly now?: Date;
+    }): Promise<StoredCredentialRecord | undefined>;
+    store(input: {
+        readonly verified: VerifiedCredential;
+        readonly requirement: CredentialRequirement;
+        readonly requirementDigest: string;
+        readonly holderDid: string;
+        readonly now?: Date;
+    }): Promise<StoredCredentialRecord>;
+}
+//# sourceMappingURL=receiver-credentials.d.ts.map

package/dist/share/receiver-session.d.ts

@@ -0,0 +1,22 @@
+export declare const SHARE_RECEIVER_SESSION_STORAGE_KEY = "tinycloud.share.receiver-session.v1";
+export interface ShareReceiverSessionRecordV1 {
+    readonly type: "TinyCloudShareReceiverSession";
+    readonly version: 1;
+    readonly origin: string;
+    readonly holderDid: string;
+    readonly jwk: JsonWebKey;
+    readonly createdAt: string;
+}
+export interface ReceiverSessionStorage {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+export interface ShareReceiverSession {
+    readonly holderDid: string;
+    readonly origin: string;
+    readonly createdAt: string;
+    sign(bytes: Uint8Array): Promise<Uint8Array>;
+}
+export declare function createOrRestoreShareReceiverSession(originValue: string, storage?: ReceiverSessionStorage): Promise<ShareReceiverSession>;
+//# sourceMappingURL=receiver-session.d.ts.map

package/dist/share/service.d.ts

@@ -0,0 +1,47 @@
+import { type ShareMetadata } from "@tinycloud/share-sdk";
+import { type ShareEnvelopeV3 } from "@tinycloud/share-envelope";
+import { CredentialsService } from "../credentials";
+import { type ReceiverSessionStorage } from "./receiver-session";
+import type { ReceivedShare, ShareImportAccountClient, ShareImportOptions, ShareImportResult, ShareReceiveOptions, ShareReceivedContent, ShareReceiverClient, ShareReceiverIdentity } from "./types";
+export interface ShareReceiverServiceOptions {
+    readonly origin?: string;
+    readonly sessionStorage?: ReceiverSessionStorage;
+    readonly credentialDiscoveryUrl?: string;
+    /** Out-of-band Share application origin allowed to supply invitation URLs. */
+    readonly expectedShareOrigin: string;
+    /** Registry containing the share owner's signed TinyCloud location record. */
+    readonly registryOrigin: string;
+    readonly fetch?: typeof fetch;
+}
+export declare function validateShareReceiverServiceTrust(envelope: Pick<ShareEnvelopeV3, "target" | "attestedEnforcerBinding">): void;
+/** @internal */
+export declare function validateShareReceiverExpectedOrigin(shareUrl: string, expectedOrigin: string): string;
+/** @internal */
+export declare function selectShareReceiverAccountSession(client: ShareReceiverClient, requestedIdentity: ShareReceiveOptions["identity"]): Promise<ReturnType<ShareReceiverClient["session"]>>;
+/** @internal */
+export declare class ReceivedShareImpl implements ReceivedShare {
+    readonly identity: ShareReceiverIdentity;
+    readonly metadata: ShareMetadata;
+    private readonly envelope;
+    private readonly credentials;
+    private readonly sign;
+    private readonly options;
+    private readonly fetchFn;
+    private readonly credentialDiscoveryUrl;
+    private content?;
+    private getPromise?;
+    constructor(identity: ShareReceiverIdentity, metadata: ShareMetadata, envelope: ShareEnvelopeV3, credentials: CredentialsService, sign: (bytes: Uint8Array) => Promise<Uint8Array>, options: ShareReceiveOptions, fetchFn: typeof fetch, credentialDiscoveryUrl: string);
+    get shareId(): string;
+    get(): Promise<ShareReceivedContent>;
+    private load;
+    importInto(accountClient: ShareImportAccountClient, options: ShareImportOptions): Promise<ShareImportResult>;
+}
+export declare class ShareReceiverService {
+    private readonly client;
+    private readonly fetchFn;
+    private readonly storage;
+    private readonly config;
+    constructor(client: ShareReceiverClient, config: ShareReceiverServiceOptions | undefined);
+    receive(shareUrl: string, options: ShareReceiveOptions): Promise<ReceivedShare>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/share/types.d.ts

@@ -0,0 +1,89 @@
+import type { ClientSession, IKVService } from "@tinycloud/sdk-core";
+import type { ShareMetadata } from "@tinycloud/share-sdk";
+import type { CredentialsService } from "../credentials";
+export type ShareReceiverIdentity = {
+    readonly kind: "account";
+    readonly holderDid: string;
+} | {
+    readonly kind: "receiver";
+    readonly holderDid: string;
+    readonly custody: "session";
+    readonly origin: string;
+};
+export type ShareReceiveProgress = {
+    readonly state: "identity-selection";
+    readonly status: "started" | "completed";
+    readonly identity?: ShareReceiverIdentity;
+} | {
+    readonly state: "credential-acquisition";
+    readonly status: "started" | "completed";
+} | {
+    readonly state: "policy-admission";
+    readonly status: "started" | "completed";
+} | {
+    readonly state: "delegation-import";
+    readonly status: "started" | "completed";
+} | {
+    readonly state: "invocation";
+    readonly status: "started" | "completed";
+} | {
+    readonly state: "decryption";
+    readonly status: "started" | "completed";
+} | {
+    readonly state: "ready";
+    readonly status: "completed";
+} | {
+    readonly state: "import";
+    readonly status: "started" | "completed";
+};
+export interface ShareReceiveOptions {
+    readonly identity: "auto" | "account" | "receiver";
+    readonly interaction: {
+        readonly kind: "inline";
+        readonly mountTarget: Element | string;
+    };
+    readonly signal?: AbortSignal;
+    readonly onProgress?: (event: ShareReceiveProgress) => void;
+}
+export interface ShareReceivedContent {
+    readonly bytes: Uint8Array;
+    readonly filename: string;
+    readonly mediaType: string;
+    readonly senderDid: string;
+    readonly shareId: string;
+    readonly byteDigest: string;
+    readonly receivedAt: string;
+}
+export interface ShareImportOptions {
+    readonly namespace: "files-for-you";
+    readonly filename?: string;
+    readonly signal?: AbortSignal;
+}
+export interface ShareImportResult {
+    readonly status: "imported" | "existing";
+    readonly path: string;
+    readonly byteDigest: string;
+}
+export interface ShareImportAccountClient {
+    session(): ClientSession | undefined;
+    ensureOwnedSpaceHosted(name: string): Promise<string>;
+    kvForSpace(spaceId: string): IKVService;
+}
+export interface ReceivedShare {
+    readonly identity: ShareReceiverIdentity;
+    readonly metadata: ShareMetadata;
+    readonly shareId: string;
+    get(): Promise<ShareReceivedContent>;
+    importInto(accountClient: ShareImportAccountClient, options: ShareImportOptions): Promise<ShareImportResult>;
+}
+export interface ShareReceiverClient extends ShareImportAccountClient {
+    readonly credentialHolderDid: string;
+    readonly credentialHolderKid: string;
+    readonly credentials: CredentialsService;
+    restoreSession(): Promise<{
+        readonly status: string;
+        readonly session?: ClientSession;
+    }>;
+    signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+}
+//# sourceMappingURL=types.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/web-sdk",
-  "version": "3.0.0-beta.0",
+  "version": "3.0.0-beta.10",
   "description": "A set of tools and utilities to help you build your app with TinyCloud.",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -43,8 +43,10 @@
   "dependencies": {
     "@multiformats/multiaddr": "^13.0.1",
     "@multiformats/multiaddr-to-uri": "^12.0.0",
-    "@tinycloud/node-sdk": "3.0.0-beta.0",
-    "@tinycloud/sdk-core": "3.0.0-beta.0",
+    "@tinycloud/node-sdk": "3.0.0-beta.10",
+    "@tinycloud/sdk-core": "3.0.0-beta.10",
+    "@tinycloud/share-envelope": "1.0.0-beta.4",
+    "@tinycloud/share-sdk": "1.0.0-beta.4",
     "@tinycloud/web-sdk-wasm": "1.7.6",
     "axios": "^1.7.9",
     "viem": "^2.45.0",