chore: roll up security migration

Cargo.toml

@@ -22,8 +22,8 @@ exclude = [
 ]
 
 [workspace]
-members = ["crates/tinydocs-bus", "crates/tinydocs-module"]
-default-members = [".", "crates/tinydocs-bus", "crates/tinydocs-module"]
+members = ["crates/tinydocs-bus", "crates/tinydocs-client", "crates/tinydocs-module"]
+default-members = [".", "crates/tinydocs-bus", "crates/tinydocs-client", "crates/tinydocs-module"]
 exclude = ["vendor/tinybus"]
 resolver = "3"
 
@@ -34,7 +34,7 @@ version = "0.2.7"
 [dependencies]
 # The dependency-light TinyBus contract owns payload types and errors. Re-export
 # it so library and bus callers use the exact same values.
-tinydocs-bus = { version = "0.2.4", path = "crates/tinydocs-bus" }
+tinydocs-bus = { version = "0.2.5", path = "crates/tinydocs-bus" }
 # OOXML `.docx` synthesis. Optional: exclusive to the `docx` feature so a host
 # that only needs extraction does not pull the writer stack.
 docx-rs = { git = "https://github.com/bokuweb/docx-rs", rev = "71df69c82ea14d777ab0c0e7236b08ffbacef31d", version = "0.4.23", optional = true }
@@ -52,7 +52,7 @@ zip = { version = "9", default-features = false, features = ["deflate"], optiona
 # Streaming XML events avoid building attacker-controlled DOM trees.
 quick-xml = { version = "0.41", optional = true }
 # Workbook row conversion for document-memory Markdown; implementation only.
-calamine = { version = "0.37", optional = true }
+calamine = { version = "0.38", optional = true }
 # Pure Rust PDF rasterization, isolated from the default extraction build.
 hayro = { version = "0.5", optional = true }
 

crates/tinydocs-client/Cargo.toml

@@ -0,0 +1,32 @@
+[package]
+name = "tinydocs-client"
+version.workspace = true
+edition = "2024"
+rust-version = "1.88"
+license = "GPL-3.0-only"
+description = "Typed TinyBus client for the TinyDocs module."
+repository = "https://github.com/tinyhumansai/tinydocs"
+documentation = "https://docs.rs/tinydocs-client"
+keywords = ["tinybus", "document", "agent"]
+categories = ["api-bindings"]
+
+[dependencies]
+# Module loading and typed failure reporting stay host-owned; this is the
+# published host-facing SDK without its native loader.
+tinybus = { version = "0.3.11", default-features = false }
+# Shared wire names and payload DTOs.
+tinydocs-bus = { version = "0.2.5", path = "../tinydocs-bus" }
+# The held-output protocol uses base64 chunks and verifies their SHA-256 digest.
+base64 = "0.22"
+sha2 = "0.10"
+serde_json = "1"
+# Cancellation-safe output release schedules cleanup on the caller's runtime.
+tokio = { version = "1", features = ["rt", "time"] }
+tracing = "0.1"
+
+[dev-dependencies]
+async-trait = "0.1"
+tokio = { version = "1", features = ["macros", "rt", "sync", "time", "test-util"] }
+
+[lints]
+workspace = true