@tinycloud/cli 1.1.0-beta.17 → 1.1.0-beta.19

package/dist/legacy-entry.js

@@ -13804,6 +13804,9 @@ function permissionRequestsPath(profile) {
 function grantHistoryPath(profile) {
   return join4(PROFILES_DIR, profile, "auth-grants.jsonl");
 }
+function localGrantArtifactsPath(profile) {
+  return join4(PROFILES_DIR, profile, "auth-grant-artifacts.json");
+}
 function createPermissionRequestArtifact(params) {
   return buildPermissionRequestArtifact({
     profile: params.profileName,
@@ -13828,6 +13831,32 @@ function didWithoutFragment(did) {
 async function loadAdditionalDelegations(profile) {
   return readAdditionalDelegations(profile);
 }
+async function loadLocalGrantArtifacts(profile) {
+  const path = localGrantArtifactsPath(profile);
+  if (!await fileExists(path)) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile2(path, "utf8"));
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  return parsed.filter(
+    (value) => value !== null && typeof value === "object" && typeof value.delegationCid === "string" && value.delegation !== null && typeof value.delegation === "object" && value.delegation.cid === value.delegationCid && typeof value.delegation.delegationHeader?.Authorization === "string"
+  );
+}
+async function appendLocalGrantArtifact(profile, delegation) {
+  await ProfileManager.ensureProfileDir(profile);
+  await withProfileLock2(profile, async () => {
+    await refuseWriteToDeletedProfile2(profile);
+    const records = await loadLocalGrantArtifacts(profile);
+    if (records.some((record) => record.delegationCid === delegation.cid)) return;
+    await writeJsonAtomic(localGrantArtifactsPath(profile), [
+      ...records,
+      { delegationCid: delegation.cid, delegation }
+    ]);
+  });
+}
 async function appendAdditionalDelegations(profile, entries) {
   const { mergeDelegationsWithoutRequest } = await import("@tinycloud/operations/delegation-binding");
   await updateProfileStore(profile, "additional-delegations", (stored) => ({
@@ -15246,11 +15275,15 @@ function ownerSpaceId(space, ownerDid) {
 function permissionTuples(permissions, ownerDid) {
   return new Set(permissions.flatMap((permission) => actionTuples(permission, ownerDid)));
 }
+function isRawCidRevocationPermission(permission) {
+  return permission.service === "tinycloud.delegation" && permission.space?.startsWith("urn:cid:") === true && permission.path === "" && permission.actions.includes("tinycloud.delegation/revoke");
+}
 function actionTuples(permission, ownerDid) {
   const service = permission.service.startsWith("tinycloud.") ? permission.service : `tinycloud.${permission.service}`;
-  const raw = isVerifiedRawEncryptionPermission(permission);
-  const space = raw ? ENCRYPTION_MANIFEST_SPACE2 : normalizePkhIdentifier(ownerSpaceId(permission.space ?? "", ownerDid));
-  const path = raw ? normalizePkhIdentifier(permission.path) : permission.path;
+  const rawEncryption = isVerifiedRawEncryptionPermission(permission);
+  const rawCidRevocation = isRawCidRevocationPermission(permission);
+  const space = rawEncryption ? ENCRYPTION_MANIFEST_SPACE2 : rawCidRevocation ? permission.space : normalizePkhIdentifier(ownerSpaceId(permission.space ?? "", ownerDid));
+  const path = rawEncryption ? normalizePkhIdentifier(permission.path) : permission.path;
   return permission.actions.map((action) => JSON.stringify([service, space, path, action.includes("/") ? action : `${service}/${action}`]));
 }
 function isLegacyNestedDecrypt(permission, requested, ownerDid, spaceId) {
@@ -15321,7 +15354,7 @@ function declinedPermissions(requested, signed, ownerDid) {
   const missing = [...permissionTuples(requested, ownerDid)].filter((tuple) => !granted.has(tuple));
   const requestedScopes = /* @__PURE__ */ new Map();
   for (const entry of requested) {
-    const space = isVerifiedRawEncryptionPermission(entry) ? entry.space ?? ENCRYPTION_MANIFEST_SPACE2 : ownerSpaceId(entry.space ?? "", ownerDid);
+    const space = isVerifiedRawEncryptionPermission(entry) ? entry.space ?? ENCRYPTION_MANIFEST_SPACE2 : isRawCidRevocationPermission(entry) ? entry.space : ownerSpaceId(entry.space ?? "", ownerDid);
     for (const tuple of actionTuples(entry, ownerDid)) {
       requestedScopes.set(tuple, { space, path: entry.path });
     }
@@ -15344,7 +15377,10 @@ function scopedLoginPermissions(permissions) {
 }
 function grantRequestPermissions(group, anchorSpace) {
   const request = group.map((p) => isRawEncryptionPermission(p) ? { ...p, space: ENCRYPTION_MANIFEST_SPACE2, path: canonicalNetworkUrn(p.path) } : p);
-  return withCapabilitiesRead(request, request.find((p) => !isRawEncryptionPermission(p))?.space ?? anchorSpace);
+  const capabilitySpace = request.find(
+    (permission) => !isRawEncryptionPermission(permission) && !isRawCidRevocationPermission(permission)
+  )?.space ?? anchorSpace;
+  return withCapabilitiesRead(request, capabilitySpace);
 }
 function withCapabilitiesRead(permissions, space) {
   const hasRead = permissions.some((p) => p.service === "tinycloud.capabilities" && p.path === "" && p.actions.includes(CAPABILITIES_READ) && normalizePkhIdentifier(p.space ?? "") === normalizePkhIdentifier(space));
@@ -15378,7 +15414,10 @@ function verifySignedSession(data, key, sessionDid, expected = {}) {
     if (/expir/i.test(error instanceof Error ? error.message : String(error))) {
       throw new CLIError("AUTH_EXPIRED", `The approved session has expired. ${notStored}`, ExitCode.AUTH_REQUIRED);
     }
-    throw new CLIError("OPENKEY_PROOF_INVALID", `OpenKey did not return a complete, verifiable session proof. ${notStored}`, ExitCode.AUTH_REQUIRED);
+    throw Object.assign(
+      new CLIError("OPENKEY_PROOF_INVALID", `OpenKey did not return a complete, verifiable session proof. ${notStored}`, ExitCode.AUTH_REQUIRED),
+      { cause: error }
+    );
   }
   const signedExpiry = Date.parse(expiresAt);
   if (signedExpiry <= Date.now()) {
@@ -15395,10 +15434,23 @@ function verifySignedSession(data, key, sessionDid, expected = {}) {
 }
 function verifyScopedLogin(data, key, sessionDid, requested, expected = {}) {
   const notStored = expected.purpose === "grant" ? "No grant was stored." : "No scoped session was saved.";
-  const signed = verifySignedSession(data, key, sessionDid, expected);
+  let signed;
+  try {
+    signed = verifySignedSession(data, key, sessionDid, expected);
+  } catch (error) {
+    const cause = error instanceof Error ? error.cause : void 0;
+    if (requested.some(isRawCidRevocationPermission) && /invalid ReCap resource URI/i.test(cause instanceof Error ? cause.message : String(cause ?? ""))) {
+      throw new CLIError(
+        "RAW_RECAP_RESOURCE_UNSUPPORTED",
+        "This WASM build cannot verify raw urn:cid ReCap resources.",
+        ExitCode.PERMISSION_DENIED
+      );
+    }
+    throw error;
+  }
   const spaceId = data.spaceId;
   for (const permission of requested) {
-    if (isRawEncryptionPermission(permission)) continue;
+    if (isRawEncryptionPermission(permission) || isRawCidRevocationPermission(permission)) continue;
     if (normalizePkhIdentifier(ownerSpaceId(permission.space ?? "", signed.ownerDid)) !== normalizePkhIdentifier(spaceId)) {
       throw new CLIError("OPENKEY_SCOPE_MISMATCH", `The approved space differs from the requested space. ${notStored}`, ExitCode.PERMISSION_DENIED);
     }
@@ -16439,6 +16491,13 @@ function registerAuthCommand(program) {
         yes: options.yes === true
       });
       const grant = await grantAuthRequest(node, resolvedRequest);
+      await appendLocalGrantArtifact(ctx.profile, grant.delegation);
+      await appendGrantHistory(ctx.profile, {
+        addedCaps: grant.permissions,
+        source: "cli",
+        delegationCid: grant.delegationCid,
+        expiry: grant.expiry
+      });
       outputJson(grant);
     } catch (error) {
       handleError(error);
@@ -16795,7 +16854,10 @@ async function activateAndStoreOpenKeyGrants(profileName2, host, node, grants, s
   });
 }
 async function ensureDelegationAuthority(params) {
-  if (!params.force && params.node.hasRuntimePermissions(params.requested)) return;
+  if (!params.force && params.node.hasRuntimePermissions(params.requested)) return void 0;
+  if (!params.consentAlreadyGiven && (params.persist === false || params.profile.authMethod !== "openkey")) {
+    await requirePermissionConsent(params.requested, params.yes);
+  }
   if (params.profile.authMethod === "openkey") {
     const key = await ProfileManager.getKey(params.ctx.profile);
     if (!key) {
@@ -16815,6 +16877,37 @@ async function ensureDelegationAuthority(params) {
       expiry: expiryCap
     };
     const anchorSpace = params.anchorSpace ?? params.profile.spaceId ?? params.profile.spaceName;
+    if (params.persist === false) {
+      const request = grantRequestPermissions(params.requested, anchorSpace);
+      let delegationData;
+      try {
+        delegationData = await acquireOpenKey(params.profile.did, {
+          jwk: key,
+          host: params.ctx.host,
+          permissions: request,
+          reason: permissionGrantReason(params.reason, request),
+          openkeyHost,
+          expiry: expiryCap === void 0 ? void 0 : openKeyExpiryParam(expiryCap)
+        });
+      } catch (error) {
+        if (params.requested.some(isRawCidRevocationPermission) && /invalid ReCap resource URI/i.test(error instanceof Error ? error.message : String(error))) {
+          throw new CLIError(
+            "RAW_RECAP_RESOURCE_UNSUPPORTED",
+            "The OpenKey/WASM ReCap encoder does not support raw urn:cid revocation resources.",
+            ExitCode.PERMISSION_DENIED
+          );
+        }
+        throw error;
+      }
+      const delegation = portableFromOpenKeyDelegation(
+        delegationData,
+        request,
+        params.ctx.host,
+        proof
+      );
+      await params.node.useRuntimeDelegation(delegation);
+      return delegation;
+    }
     const grants = [];
     for (const group of groupPermissionsBySpace(params.requested)) {
       const request = grantRequestPermissions(group, anchorSpace);
@@ -16832,21 +16925,11 @@ async function ensureDelegationAuthority(params) {
     await activateAndStoreOpenKeyGrants(params.ctx.profile, params.ctx.host, params.node, grants, "cli");
     return;
   }
-  if (isInteractive()) {
-    if (!params.yes) {
-      await confirmPermissionRequest(params.requested);
-    }
-  } else if (!params.yes) {
-    throw new CLIError(
-      "CONFIRMATION_REQUIRED",
-      "Local-key auth grants in non-interactive mode require --yes.",
-      ExitCode.USAGE_ERROR
-    );
-  }
   const delegations = await params.node.grantRuntimePermissions(
     params.requested,
     params.expiryOption !== void 0 ? { expiry: params.expiryOption } : void 0
   );
+  if (params.persist === false) return delegations[0];
   for (const delegation of delegations) {
     const covering = permissionsFromDelegation(delegation);
     await appendAdditionalDelegation(
@@ -16924,6 +17007,17 @@ async function confirmPermissionRequest(permissions) {
     throw new CLIError("REQUEST_CANCELLED", "Permission request cancelled.", ExitCode.ERROR);
   }
 }
+async function requirePermissionConsent(permissions, yes) {
+  if (isInteractive()) {
+    if (!yes) await confirmPermissionRequest(permissions);
+  } else if (!yes) {
+    throw new CLIError(
+      "CONFIRMATION_REQUIRED",
+      "Permission grants in non-interactive mode require --yes.",
+      ExitCode.USAGE_ERROR
+    );
+  }
+}
 function isDangerousPermission(permission) {
   if (permission.path === "" || permission.path === "/") return true;
   return permission.actions.some(
@@ -16952,7 +17046,7 @@ function groupPermissionsBySpace(permissions) {
   const groups = /* @__PURE__ */ new Map();
   const rawEntries = [];
   for (const permission of permissions) {
-    if (isRawEncryptionPermission(permission)) {
+    if (isRawEncryptionPermission(permission) || isRawCidRevocationPermission(permission)) {
       rawEntries.push(permission);
       continue;
     }
@@ -16983,11 +17077,13 @@ function portableFromOpenKeyDelegation(data, requested, host, proof) {
   }
   const returnedSpace = data.spaceId;
   const effective = session.permissions;
-  const spaced = effective.filter((permission) => !isRawEncryptionPermission(permission));
+  const spaced = effective.filter(
+    (permission) => !isRawEncryptionPermission(permission) && !isRawCidRevocationPermission(permission)
+  );
   const primary = spaced.find((permission) => permission.service !== "tinycloud.capabilities") ?? spaced[0] ?? effective[0];
   const resources = effective.map((permission) => ({
     service: permission.service.slice("tinycloud.".length),
-    space: isVerifiedRawEncryptionPermission(permission) ? "encryption" : returnedSpace,
+    space: isRawCidRevocationPermission(permission) ? permission.space : isVerifiedRawEncryptionPermission(permission) ? "encryption" : returnedSpace,
     path: permission.path,
     actions: [...permission.actions],
     ...permission.caveats === void 0 ? {} : { caveats: structuredClone(permission.caveats) }
@@ -17463,6 +17559,7 @@ init_profiles();
 init_formatter();
 init_errors();
 init_constants();
+import { parseSignedCompactUcanAttenuation } from "@tinycloud/sdk-core";
 function normalizeDid(input) {
   const normalized = input.trim();
   const fragmentIndex = normalized.indexOf("#");
@@ -17470,11 +17567,35 @@ function normalizeDid(input) {
 }
 function didMatches(actual, expected) {
   if (!actual) return false;
-  try {
-    return normalizeDid(actual) === normalizeDid(expected);
-  } catch {
-    return actual === expected;
+  return normalizeDid(actual) === normalizeDid(expected);
+}
+function ownerDidFromSpace(spaceId) {
+  const owner = /^tinycloud:((?:did:)?pkh:eip155:[1-9]\d*:0x[0-9a-fA-F]{40})(?::|\/|$)/.exec(spaceId ?? "")?.[1];
+  if (!owner) return void 0;
+  return owner.startsWith("did:") ? owner : `did:${owner}`;
+}
+async function resolveCidBoundTargetSpace(params) {
+  if (!params.ownerDid) return void 0;
+  const grants = await loadLocalGrantArtifacts(params.profileName);
+  for (const grant of grants) {
+    const delegation = grant.delegation;
+    if (grant.delegationCid !== params.cid || delegation.cid !== params.cid) continue;
+    try {
+      const authorization = delegation.delegationHeader.Authorization.replace(/^Bearer /i, "");
+      const signed = parseSignedCompactUcanAttenuation(authorization, params.cid);
+      for (const resource of Object.keys(signed.payload.att)) {
+        const space = /^(tinycloud:[^/]+)\/[^/]+\/.*$/.exec(resource)?.[1];
+        if (!space) continue;
+        const ownerMatch = /^tinycloud:((?:did:)?pkh:eip155:[1-9]\d*:0x[0-9a-fA-F]{40}):/.exec(space);
+        const owner = ownerMatch?.[1];
+        const ownerDid = owner?.startsWith("did:") ? owner : owner ? `did:${owner}` : void 0;
+        if (ownerDid && normalizeDid(ownerDid) === normalizeDid(params.ownerDid)) return space;
+      }
+    } catch {
+      continue;
+    }
   }
+  return void 0;
 }
 function registerDelegationCommand(program) {
   const delegation = program.command("delegation").description("Manage delegations");
@@ -17554,16 +17675,158 @@ function registerDelegationCommand(program) {
       handleError(error);
     }
   });
-  delegation.command("revoke <cid>").description("Revoke a delegation").action(async (cid, _options, cmd) => {
+  delegation.command("revoke <cid>").description("Revoke a delegation").option("--yes", "Skip local-key TTY confirmation", false).action(async (cid, options, cmd) => {
     try {
       const globalOpts = cmd.optsWithGlobals();
       const ctx = await ProfileManager.resolveContext(globalOpts);
       const node = await ensureAuthenticated(ctx);
-      const result = await node.delegationManager.revoke(cid);
+      const profile = await ProfileManager.getProfile(ctx.profile);
+      const revokePermission = {
+        service: "tinycloud.delegation",
+        space: `urn:cid:${cid}`,
+        path: "",
+        actions: ["tinycloud.delegation/revoke"]
+      };
+      const rawAuthorityCovered = node.hasRuntimePermissions([revokePermission]);
+      if (!rawAuthorityCovered) await requirePermissionConsent([revokePermission], options.yes);
+      let targetFound = false;
+      let targetSpaceSource;
+      let queryDenied = false;
+      let boundSpace;
+      const accountSpaceId = node.accountSpaceId;
+      if (!accountSpaceId) {
+        throw new CLIError(
+          "DELEGATION_QUERY_AUTHORITY_UNAVAILABLE",
+          "Cannot determine the account space needed to query delegation records.",
+          ExitCode.AUTH_REQUIRED
+        );
+      }
+      let cursor;
+      do {
+        const query = await node.delegationManager.query({
+          direction: "all",
+          limit: 100,
+          ...cursor === void 0 ? {} : { cursor }
+        });
+        if (!query.ok) {
+          if (query.error.meta?.status === 403) {
+            queryDenied = true;
+            break;
+          }
+          throw cliErrorFromService(query.error);
+        }
+        targetFound = query.data.items.some((delegation2) => delegation2.cid === cid);
+        cursor = targetFound ? void 0 : query.data.nextCursor;
+      } while (cursor !== void 0);
+      targetSpaceSource = "node";
+      if (!targetFound) {
+        const grantHistory = await readGrantHistory(ctx.profile);
+        const recordedGrant = [...grantHistory].reverse().find((entry) => entry.delegationCid === cid);
+        if (recordedGrant) {
+          targetSpaceSource = "local-grant-history";
+        } else if (queryDenied) {
+          boundSpace = await resolveCidBoundTargetSpace({
+            profileName: ctx.profile,
+            ownerDid: profile.ownerDid ?? ownerDidFromSpace(node.accountSpaceId) ?? ownerDidFromSpace(profile.spaceId),
+            cid
+          });
+          if (boundSpace) {
+            targetSpaceSource = "local-signed-grant-artifact";
+          } else {
+            throw new CLIError(
+              "TARGET_NOT_FOUND",
+              `Delegation "${cid}" was not found by the node or local grant sources.`,
+              ExitCode.NOT_FOUND
+            );
+          }
+        } else {
+          throw new CLIError(
+            "TARGET_NOT_FOUND",
+            `Delegation "${cid}" was not found by the node or local grant history.`,
+            ExitCode.NOT_FOUND
+          );
+        }
+      }
+      let authorityScopeSource = "cid-resource";
+      let authorityScopeReason = "The revoke authority is scoped to the exact delegation CID.";
+      let fallbackSpaceId;
+      let commandAuthorityCid;
+      const authorizeFallbackSpace = async (spaceId) => {
+        fallbackSpaceId = spaceId;
+        authorityScopeSource = "local-signed-grant-artifact";
+        authorityScopeReason = "Raw-CID revoke authority could not be issued; the fallback space came from an owner-signed local grant whose Authorization recomputes to this CID.";
+        targetSpaceSource = "local-signed-grant-artifact";
+        const acquired = await ensureDelegationAuthority({
+          ctx,
+          profile,
+          node,
+          requested: [{
+            service: "tinycloud.delegation",
+            space: spaceId === node.accountSpaceId ? "default" : spaceId,
+            path: "",
+            actions: ["tinycloud.delegation/revoke"]
+          }],
+          expiryOption: void 0,
+          reason: `Revoke delegation ${cid} using its CID-bound owner-signed grant artifact`,
+          yes: options.yes,
+          consentAlreadyGiven: true,
+          persist: false
+        });
+        commandAuthorityCid = acquired?.cid;
+      };
+      if (!rawAuthorityCovered) {
+        try {
+          const acquired = await ensureDelegationAuthority({
+            ctx,
+            profile,
+            node,
+            requested: [revokePermission],
+            expiryOption: void 0,
+            reason: `Revoke delegation ${cid}`,
+            yes: options.yes,
+            consentAlreadyGiven: true,
+            persist: false
+          });
+          commandAuthorityCid = acquired?.cid;
+        } catch (error) {
+          if (error === null || typeof error !== "object" || !("code" in error) || error.code !== "RAW_RECAP_RESOURCE_UNSUPPORTED") {
+            throw error;
+          }
+          const fallbackSpace = boundSpace ?? await resolveCidBoundTargetSpace({
+            profileName: ctx.profile,
+            ownerDid: profile.ownerDid ?? ownerDidFromSpace(node.accountSpaceId) ?? ownerDidFromSpace(profile.spaceId),
+            cid
+          });
+          if (!fallbackSpace) {
+            throw new CLIError(
+              "RAW_RECAP_RESOURCE_UNSUPPORTED",
+              `Cannot safely revoke "${cid}": raw CID ReCap resources are unavailable and no matching owner-signed local grant artifact binds its space to the CID.`,
+              ExitCode.PERMISSION_DENIED
+            );
+          }
+          await authorizeFallbackSpace(fallbackSpace);
+        }
+      }
+      const result = fallbackSpaceId ? await node.delegationManager.revoke(cid, {
+        targetSpaceId: fallbackSpaceId,
+        ...commandAuthorityCid === void 0 ? {} : { authorityCid: commandAuthorityCid }
+      }) : commandAuthorityCid === void 0 ? await node.revokeDelegation(cid) : await node.delegationManager.revoke(cid, { authorityCid: commandAuthorityCid });
       if (!result.ok) {
+        if (result.error.meta?.status === 403 && result.error.message === "Failed to revoke delegation: 403 - Unauthorized Revoker") {
+          const profileDid = profile.ownerDid ?? ownerDidFromSpace(node.accountSpaceId) ?? ownerDidFromSpace(profile.spaceId) ?? "unknown";
+          throw new CLIError(
+            "REVOKE_UNAUTHORIZED",
+            "The node rejected this revocation: Unauthorized Revoker.",
+            ExitCode.PERMISSION_DENIED,
+            {
+              status: 403,
+              hint: `Use a different profile belonging to the delegation's grantor, its recipient, or the owner of a space it covers; the rejected profile was "${ctx.profile}" (DID ${profileDid}). Retry with \`tc --profile <profile-name> delegation revoke ${cid}\`.`
+            }
+          );
+        }
         throw cliErrorFromService(result.error);
       }
-      outputJson({ cid, revoked: true });
+      outputJson({ cid, revoked: true, targetSpaceSource, authorityScopeSource, authorityScopeReason });
     } catch (error) {
       handleError(error);
     }
@@ -20418,6 +20681,8 @@ var ReplicaErrorCode = {
   CONFIG_MISMATCH: "REPLICA_CONFIG_MISMATCH",
   /** The runtime has no supported durable store (e.g. Node < 22.13). */
   RUNTIME_UNSUPPORTED: "RUNTIME_UNSUPPORTED",
+  /** A required open() argument is missing or malformed (e.g. `principal`). */
+  INVALID_ARGUMENT: "REPLICA_INVALID_ARGUMENT",
   /** The local store failed (I/O, corruption, schema). */
   STORAGE_ERROR: "STORAGE_ERROR",
   /** The local disk is full. */
@@ -20458,7 +20723,9 @@ var ReplicaErrorCode = {
   /** Fetched bytes do not hash to the ETag the node attested for them. */
   CONTENT_MISMATCH: "CONTENT_MISMATCH",
   /** A stored blob no longer hashes to its name. */
-  INTEGRITY_ERROR: "INTEGRITY_ERROR"
+  INTEGRITY_ERROR: "INTEGRITY_ERROR",
+  /** The replica handle was closed; in-flight calls settle with this code. */
+  CLOSED: "REPLICA_CLOSED"
 };
 var REPLICA_ERROR = /* @__PURE__ */ Symbol.for("tinycloud.replica.error");
 var ReplicaError = class extends Error {
@@ -20568,12 +20835,14 @@ var Replica = class {
   #transportFor;
   #now;
   #leaseTtlMs;
+  #onCommit;
   constructor(options) {
     this.#store = options.store;
     const transport = options.transport;
     this.#transportFor = options.transportFor ?? (transport === void 0 ? void 0 : () => transport);
     this.#now = options.now ?? Date.now;
     this.#leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
+    this.#onCommit = options.onCommit;
   }
   async #state() {
     const state = await this.#store.open();
@@ -20768,9 +21037,10 @@ var Replica = class {
     let cursor = state.cursor;
     let pinned = state.nodeDid;
     let coverage = state.coverage;
+    const retentionGrantCid = config.retentionGrantCid;
     for (; ; ) {
       let page;
-      const retentionGrant = config.retentionGrantCid;
+      const retentionGrant = retentionGrantCid;
       try {
         page = await attempt.transport.syncPage({
           prefix: config.prefix,
@@ -20806,6 +21076,7 @@ var Replica = class {
         authority: page.authority,
         coverage,
         at,
+        retentionGrantCid: retentionGrant,
         window,
         complete: !page.more,
         promoteGrant: attempt.promote
@@ -20815,6 +21086,7 @@ var Replica = class {
         attempt.promote = null;
       }
       report.pages += 1;
+      this.#onCommit?.();
       report.changes += page.changes.length;
       report.deleted += page.changes.filter((change) => change.deleted).length;
       report.fetched += verified.fetched;
@@ -20824,7 +21096,7 @@ var Replica = class {
       await this.#store.renewLease(attempt.lease, this.#leaseTtlMs);
       if (!page.more) break;
     }
-    report.repaired = await this.#repair(attempt, cursor, pinned, coverage);
+    report.repaired = await this.#repair(attempt, cursor, pinned, coverage, retentionGrantCid);
     report.blobsCollected = await this.#store.collectGarbage(attempt.lease);
     report.coverage = coverage;
     report.contentMissing = (await this.#store.pendingRepairs(Number.MAX_SAFE_INTEGER)).length;
@@ -20906,7 +21178,7 @@ var Replica = class {
     }
     return { changes, blobs, fetched: fetched2 };
   }
-  async #repair(attempt, cursor, nodeDid, coverage) {
+  async #repair(attempt, cursor, nodeDid, coverage, retentionGrantCid) {
     const pending = await this.#store.pendingRepairs(Number.MAX_SAFE_INTEGER);
     let repaired = 0;
     for (let start = 0; start < pending.length; start += REPAIR_BATCH) {
@@ -20934,11 +21206,13 @@ var Replica = class {
         authority: null,
         coverage,
         at: new Date(this.#now()).toISOString(),
+        retentionGrantCid,
         window: this.#syncWindow(state.authority, attempt.grant),
         complete: false,
         promoteGrant: null
       });
       repaired += changes.length;
+      this.#onCommit?.();
     }
     return repaired;
   }
@@ -21286,6 +21560,8 @@ var ReplicaErrorCode2 = {
   CONFIG_MISMATCH: "REPLICA_CONFIG_MISMATCH",
   /** The runtime has no supported durable store (e.g. Node < 22.13). */
   RUNTIME_UNSUPPORTED: "RUNTIME_UNSUPPORTED",
+  /** A required open() argument is missing or malformed (e.g. `principal`). */
+  INVALID_ARGUMENT: "REPLICA_INVALID_ARGUMENT",
   /** The local store failed (I/O, corruption, schema). */
   STORAGE_ERROR: "STORAGE_ERROR",
   /** The local disk is full. */
@@ -21326,7 +21602,9 @@ var ReplicaErrorCode2 = {
   /** Fetched bytes do not hash to the ETag the node attested for them. */
   CONTENT_MISMATCH: "CONTENT_MISMATCH",
   /** A stored blob no longer hashes to its name. */
-  INTEGRITY_ERROR: "INTEGRITY_ERROR"
+  INTEGRITY_ERROR: "INTEGRITY_ERROR",
+  /** The replica handle was closed; in-flight calls settle with this code. */
+  CLOSED: "REPLICA_CLOSED"
 };
 var REPLICA_ERROR2 = /* @__PURE__ */ Symbol.for("tinycloud.replica.error");
 var ReplicaError2 = class extends Error {
@@ -21729,9 +22007,10 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
   async setRetentionGrant(cid) {
     await this.#guardedWrite("Updating the retention grant", () => {
       this.#db.run(
-        "UPDATE replica SET retention_grant_cid = ?, local_read_policy = ? WHERE id = 1",
+        "UPDATE replica SET retention_grant_cid = ?, local_read_policy = ?, retain_until = NULL WHERE id = 1 AND retention_grant_cid IS NOT ?",
         cid,
-        cid === null ? "whileGrantValid" : "retainAfterExpiry"
+        cid === null ? "whileGrantValid" : "retainAfterExpiry",
+        cid
       );
     });
   }
@@ -21934,9 +22213,13 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
           const sets = ["cursor = ?", "coverage = ?"];
           const params = [p.cursor, p.coverage];
           if (p.authority !== null) {
-            sets.push("node_did = ?", "attested = 1", "not_before = ?", "expires_at = ?", "retain_until = ?", "last_sync_at = ?");
-            params.push(p.source.nodeDid, p.authority.notBefore, p.authority.expiresAt, p.authority.retainUntil, p.at);
-            if (p.authority.retainUntil !== null) sets.push("retention_revoked = NULL");
+            sets.push("node_did = ?", "attested = 1", "not_before = ?", "expires_at = ?", "last_sync_at = ?");
+            params.push(p.source.nodeDid, p.authority.notBefore, p.authority.expiresAt, p.at);
+            if (this.#row().retention_grant_cid === p.retentionGrantCid) {
+              sets.push("retain_until = ?");
+              params.push(p.authority.retainUntil);
+              if (p.authority.retainUntil !== null) sets.push("retention_revoked = NULL");
+            }
           }
           if (p.complete) {
             sets.push("last_complete_at = ?", "last_error = NULL");