Release Next v3.0.0-next.2

@cloudpdf/contract@3.0.0-next.2

Minor Changes

• #730 by @bobsingor – Adds the share-grant contract: standing, revocable authorization decisions that let a document be embedded with no backend.

  • Defines shares.create, shares.list, shares.get, shares.update, and shares.delete under /v1/tenants/:tenantId/shares, governed by the new shares.manage tenant scope.
  • Defines shares.exchange at POST /v1/share-sessions, the contract's only unauthenticated operation: the grant row is the authorization, so a public share token trades for a short-lived document session JWT. The registry test now pins that surface, making any future credential-less operation an explicit decision.
  • Adds an optional origins allowlist to document-token issuance, so a minted token can be restricted to named web origins.
  • Adds tenants.usage for per-tenant usage facts, plus tenants.suspend and tenants.resume for operator-controlled tenant suspension.
  • Reports tenant status on tenant records and regenerates openapi.json, which now carries 44 operations.

• #734 by @bobsingor – Adds the integrity-pinned init → transfer → commit document upload protocol,
  including presigned PUT and policy-controlled multipart proxy transfer modes.

@cloudpdf/engine@3.0.0-next.2

Minor Changes

• #730 by @bobsingor – Adds share-session support, the client half of the no-backend embed flow.
  • Adds exchangeShareToken, which trades a public share token for a short-lived document session, and ShareExchangeError, whose code names the outcome (SharePasswordRequired, OriginNotAllowed, ShareExpired, NotFound).
  • Adds shareSessionSource, a caching token source that re-exchanges shortly before expiry and shares one in-flight exchange between concurrent callers. Because the transport resolves its token source on every request and on stream reconnect, renewal needs no timers and no listeners.
  • Requires no change to open(): an exchanged session is an ordinary document-scoped JWT, so a share source feeds open({ kind: 'token' }) unchanged, and each open keeps its own credential.

@cloudpdf/sdk@3.0.0-next.2

Minor Changes

• #734 by @bobsingor – Adds the generated TypeScript SDK and its high-level uploads.create workflow.
  It hashes browser and Node.js upload sources, negotiates presigned or proxy
  transfer, uploads the bytes, and commits only after integrity verification.

@cloudpdf/server@3.0.0-next.2

Minor Changes

• #730 by @bobsingor – Implements share grants, origin locking, per-tenant usage, and tenant suspension.

  • Stores share grants whose row id is the public share token, carrying document capabilities, an optional origin allowlist, an optional scrypt-hashed passphrase, a session TTL, and an optional expiry. Editing or deleting a grant retargets every embedded copy of its token at the next exchange.
  • Serves the public POST /v1/share-sessions exchange, which validates origin, passphrase, expiry, disablement, and tenant suspension before minting a document session JWT. Unknown, revoked, disabled, and suspended grants answer alike so the existence of a grant is never disclosed, and the route carries its own per-IP and per-grant limiters rather than the authentication-failure budget.
  • Enforces an optional origins claim on document tokens for every request that arrives with a browser Origin header, covering both share sessions and backend-minted tokens. Requests without the header are governed by the token itself.
  • Adds CORS through CLOUDPDF_CORS_ORIGINS (* to reflect, or a comma-separated allowlist), which browser-direct deployments need. Bearer tokens remain the security boundary; per-credential origin locks carry the origin policy a server-wide list cannot express.
  • Records per-tenant usage facts for views, uploads, and stored bytes, readable at GET /v1/tenants/:tenantId/usage. A view is a share exchange or an authorized /v1/access grant, counted once across the two. These counters hold no limits and are separate from license metering.
  • Adds tenants.suspend and tenants.resume, which fail every tenant JWT, document JWT, and share exchange closed while leaving the root API token free to inspect, resume, or delete the tenant.
  • Mounts token revocation from the CLI through CLOUDPDF_ENABLE_REVOCATION.
  • Records share and suspension lifecycle events in the security-event trail, and adds matching SQLite and PostgreSQL migrations plus origin, passphrase, and end-to-end share coverage.

• #734 by @bobsingor – Adds integrity-pinned uploads with presigned storage transfer preferred and a
  policy-controlled multipart proxy fallback.

  Hardens filesystem-backed storage against path traversal, storage-root deletion,
  and recursive deletion through symbolic links.

@cloudpdf/viewer@3.0.0-next.2

Minor Changes

• #730 by @bobsingor – Accepts public share tokens, so a viewer can be embedded with a dashboard-generated snippet and no backend.
  • Adds the shareToken and sharePassword options for opening a single shared document.
  • Adds a cloud { kind: 'share' } document source for documents, so a multi-tab viewer can mix share tokens, document tokens, and document ids. Each entry exchanges and renews independently, and revoking one share leaves the others untouched. The source is lowered to an ordinary token source before the engine-agnostic viewer core sees it.
  • Re-exports exchangeShareToken, shareSessionSource, and ShareExchangeError so CDN-only consumers can build custom flows, such as prompting for a passphrase before mounting.

@cloudpdf/viewer-react@3.0.0-next.2

Minor Changes

• #730 by @bobsingor – Accepts public share tokens on CloudPDFViewer, inherited from the cloud vocabulary it already shares with the snippet.
  • Adds the shareToken and sharePassword props for rendering a shared document without a backend.
  • Accepts cloud { kind: 'share' } entries in documents, so a multi-tab viewer can mix share tokens, document tokens, and document ids.

@embedpdf/core-acrojs@3.0.0-next.2

@embedpdf/core-annotation@3.0.0-next.2

@embedpdf/core-geometry@3.0.0-next.2

@embedpdf/core-js-sandbox@3.0.0-next.2

@embedpdf/core@3.0.0-next.2

@embedpdf/core-stage@3.0.0-next.2

@embedpdf/core-ui@3.0.0-next.2

@embedpdf/engine-core@3.0.0-next.2

@embedpdf/engine@3.0.0-next.2

@embedpdf/engine-runtime@3.0.0-next.2

@embedpdf/engine-runtime-darwin-arm64@3.0.0-next.2

@embedpdf/engine-runtime-darwin-x64@3.0.0-next.2

@embedpdf/engine-runtime-linux-arm64@3.0.0-next.2

@embedpdf/engine-runtime-linux-x64@3.0.0-next.2

@embedpdf/engine-runtime-linuxmusl-arm64@3.0.0-next.2

@embedpdf/engine-runtime-linuxmusl-x64@3.0.0-next.2

@embedpdf/engine-runtime-wasm32@3.0.0-next.2

@embedpdf/engine-runtime-win32-arm64@3.0.0-next.2

@embedpdf/engine-runtime-win32-x64@3.0.0-next.2

@embedpdf/engine-services@3.0.0-next.2

@embedpdf/angular@3.0.0-next.2

@embedpdf/react@3.0.0-next.2

@embedpdf/web@3.0.0-next.2

@embedpdf/plugin-annotation@3.0.0-next.2

@embedpdf/plugin-commands@3.0.0-next.2

@embedpdf/plugin-form@3.0.0-next.2

@embedpdf/plugin-i18n@3.0.0-next.2

@embedpdf/plugin-interaction@3.0.0-next.2

@embedpdf/plugin-link@3.0.0-next.2

@embedpdf/plugin-metadata@3.0.0-next.2

@embedpdf/plugin-page-edit@3.0.0-next.2

@embedpdf/plugin-redaction@3.0.0-next.2

@embedpdf/plugin-render@3.0.0-next.2

@embedpdf/plugin-search@3.0.0-next.2

@embedpdf/plugin-selection@3.0.0-next.2

@embedpdf/plugin-shell@3.0.0-next.2

@embedpdf/plugin-stage@3.0.0-next.2

@embedpdf/plugin-stamp@3.0.0-next.2

@embedpdf/plugin-view-manager@3.0.0-next.2

@embedpdf/viewer-chrome@3.0.0-next.2

@embedpdf/viewer@3.0.0-next.2

@embedpdf/viewer-react@3.0.0-next.2