@tinycloud/web-sdk 3.8.0-beta.8 → 3.8.0

package/dist/modules/Storage/tinycloud/types.schema.d.ts

@@ -36,10 +36,10 @@ export declare const SessionConfigSchema: z.ZodObject<{
     domain?: string;
     actions?: Record<string, Record<string, string[]>>;
     spaceId?: string;
+    jwk?: Record<string, unknown>;
     address?: string;
     chainId?: number;
     issuedAt?: string;
-    jwk?: Record<string, unknown>;
     notBefore?: string;
     expirationTime?: string;
     parents?: string[];
@@ -47,10 +47,10 @@ export declare const SessionConfigSchema: z.ZodObject<{
     domain?: string;
     actions?: Record<string, Record<string, string[]>>;
     spaceId?: string;
+    jwk?: Record<string, unknown>;
     address?: string;
     chainId?: number;
     issuedAt?: string;
-    jwk?: Record<string, unknown>;
     notBefore?: string;
     expirationTime?: string;
     parents?: string[];

package/dist/modules/requestPermissionsCore.d.ts

@@ -10,11 +10,13 @@
  *
  * @packageDocumentation
  */
-import type { Manifest, PermissionEntry } from "@tinycloud/sdk-core";
+import { type Manifest, type PermissionEntry } from "@tinycloud/sdk-core";
 import type { PortableDelegation } from "@tinycloud/node-sdk/core";
 export interface RequestPermissionsCoreDeps {
     /** Current stored manifest. Must be defined — caller validates first. */
     manifest: Manifest;
+    /** Authenticated owner from the current node, never from a requested resource. */
+    ownerDid?: string;
     /**
      * Show the permission request modal. Resolves with `{ approved }`
      * once the user interacts. In tests this is a stub; in production it
@@ -49,6 +51,11 @@ export interface RequestPermissionsOptions {
  * the same error text.
  */
 export declare function validateAdditionalPermissions(additional: PermissionEntry[]): void;
+/**
+ * Normalize only encryption key creation here. Other runtime entries retain
+ * their existing Web consent representation; the node validates them.
+ */
+export declare function normalizeRuntimeKeyCreatePermissions(additional: PermissionEntry[], ownerDid?: string): PermissionEntry[];
 /**
  * Core escalation flow. See the TinyCloudWeb.requestPermissions JSDoc
  * for the full spec-level description — this function is the plumbing.

package/dist/modules/runtimeGrantPersistence.d.ts

@@ -0,0 +1,41 @@
+import type { PortableDelegation } from "@tinycloud/node-sdk/core";
+export interface RuntimeGrantStore {
+    loadRuntimeGrants(address: string): Promise<PortableDelegation[]>;
+    saveRuntimeGrants(address: string, grants: readonly PortableDelegation[]): Promise<void>;
+}
+/** How long a restore waits for stored grants to be activated before it carries on without them. */
+export declare const RESTORE_GRANT_BUDGET_MS = 4000;
+interface Resource {
+    readonly service: string;
+    readonly space: string;
+    readonly path: string;
+    readonly actions: readonly string[];
+    readonly caveats?: readonly unknown[] | undefined;
+}
+/**
+ * True when `resources` are exactly one tab's entry for this owner: that service, the resolved space, that path,
+ * exactly those actions, no caveats. A grant that carries anything more (an app's larger grant) is not a panel grant.
+ */
+export declare function isPanelResourceSet(resources: readonly Resource[], owner: {
+    readonly address: string;
+    readonly chainId: number;
+}): boolean;
+/** True when `grant` is exactly a panel grant of the session owned by `address`. */
+export declare function isPanelGrant(grant: PortableDelegation, address: string): boolean;
+/**
+ * Stores the panel's own grants among `grants` for `address`, replacing a stored grant with the same cid. Other
+ * delegations (an app's larger grant that already covered the request) are never stored.
+ */
+export declare function rememberRuntimeGrants(store: RuntimeGrantStore, address: string, grants: readonly PortableDelegation[]): Promise<void>;
+/**
+ * Activates each stored grant through `use` (the SDK's validated activation). A grant refused for good is removed from
+ * storage; the others stay, including one whose activation failed for a transient reason. Waits at most `budgetMs`;
+ * activations still running then finish in the background. Never throws. `isCurrent` false (signed out meanwhile)
+ * stops any write to storage.
+ */
+export declare function reuseRuntimeGrants(store: RuntimeGrantStore, address: string, use: (grant: PortableDelegation) => Promise<unknown>, options?: {
+    readonly budgetMs?: number;
+    readonly isCurrent?: () => boolean;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=runtimeGrantPersistence.d.ts.map

package/dist/modules/tcw.d.ts

@@ -9,7 +9,7 @@
  *
  * @packageDocumentation
  */
-import { TinyCloudNode, TinyCloudNodeConfig, type BootstrapWarning, type DelegateToOptions, type DelegateToResult, type ISessionStorage, type SignStrategy, type ValidatedRuntimeDelegation, type UnifiedOwnerRootInput, type UnifiedOwnerRootReceipt, type RegisterPolicyV3Input, type RegisterPolicyV3Receipt } from "@tinycloud/node-sdk/core";
+import { TinyCloudNode, TinyCloudNodeConfig, type OpenKeyAuthorizeTinyCloud, type BootstrapWarning, type DelegateToOptions, type DelegateToResult, type ISessionStorage, type SignStrategy, type ValidatedRuntimeDelegation, type UnifiedOwnerRootInput, type UnifiedOwnerRootReceipt, type RegisterPolicyV3Input, type RegisterPolicyV3Receipt } from "@tinycloud/node-sdk/core";
 import { type LocalCopyPurgeFailedEvent } from "./replica-wiring";
 import { IKVService, ISQLService, IDuckDbService, IDataVaultService, ISecretsService, ISpaceService, ISpace, ISharingService, ICapabilityKeyRegistry, IHooksService, IEncryptionService, DelegationManager, Delegation, DelegationRevocationReceipt, Result, DelegationError, ClientSession, Extension, type TelemetryConfig, type RetryPolicy, ISpaceCreationHandler, type Manifest, type ComposedManifestRequest, type AccountService, type ResolvedDelegate, type PermissionEntry, type NetworkDescriptor, type CreateOwnerDelegationParams, type OwnerDelegationReceipt, type LocalNodeIdentityStore, type OnNodeNotFound, type RegistryPolicy, type RegistrySequenceStore, SignInOptions, type StorageFullEvent, type IStorageService } from "@tinycloud/sdk-core";
 import { type RequestPermissionsOptions } from "./requestPermissionsCore";
@@ -31,6 +31,11 @@ declare global {
  * Extends ClientConfig with browser-specific options.
  */
 export interface Config extends ClientConfig {
+    /** OpenKey authorize-sign client. Requires @openkey/sdk >=0.12.2; popup is the default mode. */
+    openkey?: {
+        client: OpenKeyAuthorizeTinyCloud;
+        mode?: "iframe" | "popup" | "redirect";
+    };
     /** Notifications. `throwErrors` rethrows each error's raw message asynchronously, once per burst of identical errors (200 ms window). It applies unless `ui: false` or `ui.toasts: false`, which turn off toasts and throws together, as the old `popups: false` did; `ui.button: false` leaves throws on. Toast placement and visibility are set through `ui`. */
     notifications?: NotificationConfig;
     /** Optional prefix for KV service keys */
@@ -170,6 +175,10 @@ export interface ShareReceiveResult<T = unknown> {
     host: string;
 }
 export declare class TinyCloudWeb {
+    private openkeySignInInFlight;
+    private prepareSignInToken;
+    private preparedSignIn?;
+    private invalidatePreparedSignIn;
     /** The connected wallet's raw EIP-1193 provider. */
     provider: BrowserProvider;
     /** The normalized EIP-1193 provider used by the SDK. */
@@ -348,7 +357,15 @@ export declare class TinyCloudWeb {
     restoreSession(address?: string): Promise<SessionRestoreResult>;
     clearPersistedSession(address?: string): Promise<void>;
     private configuredManifestPermissions;
+    /**
+     * Prepare an OpenKey SIWE before showing an approval button. Call after
+     * OpenKey connect(), then call signIn() from the button's click handler.
+     * A prepared request is single-use and valid for five minutes; call this
+     * method again if the approval button remains visible longer.
+     */
+    prepareSignIn(): Promise<void>;
     signIn: (options?: SignInOptions) => Promise<ClientSession>;
+    private performSignIn;
     /**
      * Sign out: end the session on this instance and clear the persisted
      * session. Afterwards accessors return `undefined` and service calls remain
@@ -446,6 +463,8 @@ export declare class TinyCloudWeb {
      * On approve, this does not mutate the manifest or force a new sign-in.
      * The underlying node creates a secondary delegation to the current
      * session key and records it in the invocation permission map.
+     * Exact current-owner `default/share/<id>` key creation is bound to this
+     * live signed session across consent. Native shells cannot request it.
      *
      * `options.expiryMs` sets the requested lifetime of the issued step-up
      * delegation, in milliseconds. Omitted, the node's default applies. The
@@ -456,6 +475,14 @@ export declare class TinyCloudWeb {
      * `expiryMs` does not apply to them.
      */
     requestPermissions(additional: PermissionEntry[], options?: RequestPermissionsOptions): Promise<RequestPermissionsResult>;
+    /** True when the panel may ask for a permission: a manifest, a page signer and a live session exist. */
+    private canRequestPanelPermissions;
+    /**
+     * The panel's request for one tab's entry. A grant is kept with the stored session record so it survives a reload;
+     * the entry is not stored when the user signed out while the prompt was open.
+     */
+    private requestPanelPermissions;
+    private runtimeGrantStore;
     getRuntimePermissionDelegations(permissions?: PermissionEntry[]): readonly PortableDelegation[];
     useRuntimeDelegation(delegation: PortableDelegation): Promise<void>;
     useDelegation(delegation: PortableDelegation): Promise<DelegatedAccess>;