lumiverse-spindle-types 0.1.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lumiverse-spindle-types",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "types": "./src/index.ts",
   "keywords": [
     "lumiverse",

package/src/api.ts

@@ -245,6 +245,7 @@ export type WorkerToHost =
       error?: string;
     }
   | { type: "tool_invocation_result"; requestId: string; result?: string; error?: string }
+  | { type: "create_oauth_state"; requestId: string }
   | { type: "log"; level: "info" | "warn" | "error"; message: string };
 
 // ─── Host → Worker messages ──────────────────────────────────────────────

package/src/dom.ts

@@ -182,6 +182,10 @@ export interface SpindleFrontendContext {
   };
   permissions: {
     getGranted(): Promise<string[]>;
+    /** Request that the given permissions be granted. Returns the updated granted list.
+     *  Privileged permissions (e.g. cors_proxy) require admin/owner approval.
+     *  The extension may be restarted after permissions are applied. */
+    request(permissions: string[]): Promise<string[]>;
   };
   sendToBackend(payload: unknown): void;
   onBackendMessage(handler: (payload: unknown) => void): () => void;

package/src/spindle-api.ts

@@ -265,6 +265,8 @@ export interface SpindleAPI {
     onCallback(handler: (params: Record<string, string>) => Promise<{ html?: string } | void>): () => void;
     /** Get the relative callback URL path for this extension */
     getCallbackUrl(): string;
+    /** Create a platform-managed OAuth state nonce for CSRF protection */
+    createState(): Promise<string>;
   };
 
   /** This extension's manifest */