@tinycloud/node-sdk 3.2.0-beta.2 → 3.2.0-beta.3

package/dist/replication/authority.cjs

@@ -0,0 +1,278 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/replication/authority.ts
+var authority_exports = {};
+__export(authority_exports, {
+  AUTHORITY_EXPIRY_MARGIN_MS: () => AUTHORITY_EXPIRY_MARGIN_MS,
+  assertValidReplicationConfig: () => assertValidReplicationConfig,
+  augmentSignInEntriesWithReplication: () => augmentSignInEntriesWithReplication,
+  createReplicationAuthority: () => createReplicationAuthority,
+  hasUnrestrictedGetCoverage: () => hasUnrestrictedGetCoverage,
+  replicationScopeFromSignedSession: () => replicationScopeFromSignedSession,
+  ucanAttCovers: () => ucanAttCovers,
+  ucanAttUnconstrainedFor: () => ucanAttUnconstrainedFor
+});
+module.exports = __toCommonJS(authority_exports);
+var import_sdk_core2 = require("@tinycloud/sdk-core");
+var import_replica = require("@tinycloud/replica");
+
+// src/replication/config.ts
+var import_sdk_services = require("@tinycloud/sdk-services");
+function assertValidReplicationConfig(replication) {
+  if (replication === void 0 || replication.enabled !== true) return;
+  if (replication.storage === void 0 || replication.storage === null) {
+    throw new TypeError("replication.enabled requires replication.storage");
+  }
+  if (!Array.isArray(replication.prefixes) || replication.prefixes.length === 0) {
+    throw new TypeError("replication.prefixes must be a non-empty array");
+  }
+  for (const prefix of replication.prefixes) {
+    if (typeof prefix !== "string" || prefix === "") {
+      throw new TypeError("replication.prefixes must not contain an empty prefix");
+    }
+  }
+  for (const [index, prefix] of replication.prefixes.entries()) {
+    for (const other of replication.prefixes.slice(index + 1)) {
+      if ((0, import_sdk_services.kvPrefixCovers)(prefix, other) || (0, import_sdk_services.kvPrefixCovers)(other, prefix)) {
+        throw new TypeError(
+          `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`
+        );
+      }
+    }
+    if (prefix.split("/", 1)[0] === "vault" && replication.allowSecrets !== true) {
+      throw new TypeError(
+        `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`
+      );
+    }
+  }
+}
+
+// src/replication/authority-sign-in.ts
+var import_sdk_core = require("@tinycloud/sdk-core");
+var import_sdk_services2 = require("@tinycloud/sdk-services");
+var KV_GET = import_sdk_core.KV.GET;
+var KV_SYNC = import_sdk_core.KV.SYNC;
+var KV_SERVICE = "tinycloud.kv";
+function hasUnrestrictedGetCoverage(entries, spaceId, prefix) {
+  const requiredPaths = (0, import_sdk_core.grantPathsForSelector)(prefix);
+  return (0, import_sdk_core.isCapabilitySubset)(
+    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),
+    [...entries]
+  ).subset;
+}
+function augmentSignInEntriesWithReplication(input) {
+  const out = [];
+  const replication = input.replication;
+  if (replication === void 0) return out;
+  for (const prefix of replication.prefixes) {
+    if ((0, import_sdk_services2.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
+      continue;
+    }
+    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {
+      continue;
+    }
+    for (const path of (0, import_sdk_core.grantPathsForSelector)(prefix)) {
+      out.push({
+        service: KV_SERVICE,
+        space: input.primarySpaceId,
+        path,
+        actions: [KV_GET, KV_SYNC]
+      });
+    }
+  }
+  return out;
+}
+
+// src/replication/authority.ts
+var parseUcanGrant = import_replica.parseUcanGrant;
+var KV_GET2 = import_sdk_core2.KV.GET;
+var KV_SYNC2 = import_sdk_core2.KV.SYNC;
+var KV_SERVICE2 = "tinycloud.kv";
+function replicationEntries(spaceId, prefix) {
+  return (0, import_sdk_core2.grantPathsForSelector)(prefix).map((path) => ({
+    service: KV_SERVICE2,
+    space: spaceId,
+    path,
+    actions: [KV_GET2, KV_SYNC2]
+  }));
+}
+function caveatBranchesUnconstrained(value) {
+  if (value === void 0 || value === null) return true;
+  if (typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0) {
+    return true;
+  }
+  if (!Array.isArray(value)) return false;
+  try {
+    return (0, import_sdk_core2.canonicalizeRecapCaveats)(value) === (0, import_sdk_core2.canonicalizeRecapCaveats)(void 0);
+  } catch {
+    return false;
+  }
+}
+function kvPathInResource(resource, space) {
+  for (const base of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {
+    if (resource.startsWith(base)) return resource.slice(base.length);
+  }
+  return void 0;
+}
+function ucanAttCovers(att, space, prefix, ability, options) {
+  const requiredPaths = prefix.endsWith("/") ? [prefix] : [prefix, `${prefix}/`];
+  return requiredPaths.every((requestedPath) => {
+    for (const [resource, abilities] of Object.entries(att)) {
+      const path = kvPathInResource(resource, space);
+      if (path === void 0) continue;
+      for (const [granted, caveats] of Object.entries(abilities)) {
+        if (!(0, import_sdk_core2.actionContains)(granted, ability)) continue;
+        if (!(0, import_sdk_core2.isCapabilitySubset)(
+          [{ service: KV_SERVICE2, space, path: requestedPath, actions: [ability] }],
+          [{ service: KV_SERVICE2, space, path, actions: [granted] }]
+        ).subset) continue;
+        if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;
+      }
+    }
+    return false;
+  });
+}
+function ucanAttUnconstrainedFor(att, space, prefix) {
+  return ucanAttCovers(att, space, prefix, KV_GET2) && ucanAttCovers(att, space, prefix, KV_SYNC2);
+}
+var AUTHORITY_EXPIRY_MARGIN_MS = 6e4;
+function replicationScopeFromSignedSession(input) {
+  let grant;
+  try {
+    grant = parseUcanGrant(input.delegationHeader.Authorization);
+  } catch {
+    return void 0;
+  }
+  const bareDid = (value) => value.split("#", 1)[0];
+  if (grant.cid !== input.delegationCid || bareDid(grant.audience) !== bareDid(input.verificationMethod)) return void 0;
+  for (const resource of Object.keys(grant.att)) {
+    const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv\//)?.[1];
+    if (space !== input.persistedSpace) continue;
+    const owner = (0, import_sdk_core2.parseSpaceUri)(space);
+    if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };
+  }
+  return void 0;
+}
+function createReplicationAuthority(host) {
+  const planOrRefusal = (entries) => {
+    const plan = host.planDelegation(entries);
+    if ("refused" in plan) return plan;
+    return { path: plan.path, parentCid: plan.parentCid, expiresAt: plan.expiresAt };
+  };
+  const sessionAudience = (value) => value.split("#", 1)[0];
+  const signedSessionGrant = (session) => {
+    const grant = parseUcanGrant(session.delegationHeader.Authorization);
+    if (grant.cid !== session.delegationCid || sessionAudience(grant.audience) !== sessionAudience(session.verificationMethod)) return void 0;
+    return grant;
+  };
+  const authority = {
+    get sessionOnly() {
+      const session = host.replicationSession();
+      return session !== void 0 && session.siwe === void 0;
+    },
+    sessionGrant(prefix) {
+      const session = host.replicationSession();
+      if (session === void 0) return { refused: "SESSION_EXPIRING" };
+      const siweExpiry = session.siwe ? host.siweExpiration(session.siwe)?.getTime() : void 0;
+      if (siweExpiry !== void 0 && siweExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {
+        return { refused: "SESSION_EXPIRING" };
+      }
+      let grant;
+      try {
+        const verified = signedSessionGrant(session);
+        if (!verified) return { refused: "NOT_COVERED" };
+        grant = verified;
+      } catch {
+        return { refused: "NOT_COVERED" };
+      }
+      const tokenExpiry = grant.expiresAt === null ? void 0 : grant.expiresAt * 1e3;
+      if (tokenExpiry === void 0 || tokenExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {
+        return { refused: "SESSION_EXPIRING" };
+      }
+      const covered = ucanAttCovers(grant.att, session.spaceId, prefix, KV_GET2, { ignoreCaveats: true }) && ucanAttCovers(grant.att, session.spaceId, prefix, KV_SYNC2, { ignoreCaveats: true });
+      if (!covered) return { refused: "NOT_COVERED" };
+      if (!ucanAttUnconstrainedFor(grant.att, session.spaceId, prefix)) {
+        return { refused: "CAVEATED_AUTHORITY" };
+      }
+      return {
+        ucan: grant.jwt,
+        device: { did: session.verificationMethod, jwk: session.jwk }
+      };
+    },
+    plan(prefix) {
+      const session = host.replicationSession();
+      if (session === void 0) return { refused: "SESSION_EXPIRING" };
+      const sessionGrant = this.sessionGrant(prefix);
+      if (!("refused" in sessionGrant)) {
+        const signed = signedSessionGrant(session);
+        if (!signed || signed.expiresAt === null) return { refused: "NOT_COVERED" };
+        return {
+          path: "session",
+          parentCid: session.delegationCid,
+          expiresAt: signed.expiresAt * 1e3
+        };
+      }
+      if (authority.sessionOnly) return sessionGrant;
+      return planOrRefusal(replicationEntries(session.spaceId, prefix));
+    },
+    async mint(deviceDid, prefix, signal) {
+      if (authority.sessionOnly) throw new Error("compact delegate sessions cannot mint device grants");
+      const session = host.replicationSession();
+      if (session === void 0) throw new Error("replication mint without a session");
+      const entries = replicationEntries(session.spaceId, prefix);
+      const plan = planOrRefusal(entries);
+      if ("refused" in plan) {
+        throw Object.assign(
+          new Error(`replication authority refused the mint: ${plan.refused}`),
+          { refused: plan.refused }
+        );
+      }
+      signal.throwIfAborted();
+      const minted = await new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason ?? new Error("replication mint aborted"));
+        signal.addEventListener("abort", onAbort, { once: true });
+        host.mintDelegation(deviceDid, entries).then(
+          (result) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(result);
+          },
+          (error) => {
+            signal.removeEventListener("abort", onAbort);
+            reject(error instanceof Error ? error : new Error(String(error)));
+          }
+        );
+      });
+      return { ucan: minted.ucan, parentCid: plan.parentCid, expiresAt: minted.expiresAt };
+    }
+  };
+  return authority;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AUTHORITY_EXPIRY_MARGIN_MS,
+  assertValidReplicationConfig,
+  augmentSignInEntriesWithReplication,
+  createReplicationAuthority,
+  hasUnrestrictedGetCoverage,
+  replicationScopeFromSignedSession,
+  ucanAttCovers,
+  ucanAttUnconstrainedFor
+});
+//# sourceMappingURL=authority.cjs.map

package/dist/replication/authority.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/replication/authority.ts","../../src/replication/config.ts","../../src/replication/authority-sign-in.ts"],"sourcesContent":["/**\n * Replication authority (TC-858, plan v3 §4).\n *\n * `ReplicationAuthority` answers, per configured prefix, whether this node's\n * session can back a local replica: the session UCAN itself (delegate\n * posture), a child UCAN minted through `delegateTo`, or nothing (the\n * controller then reports `grant_missing` and reads from the network).\n *\n * The unrestricted-authority rule is enforced here, before any network work:\n * a prefix covered only by a caveated `get`/`sync` refuses with\n * `CAVEATED_AUTHORITY` — on the session path, the runtime-grant path, and on\n * any reuse of an installed grant (the adapter marks every grant's\n * `unconstrained` flag; the controller enforces it on reuse).\n */\n\nimport {\n  grantPathsForSelector,\n  actionContains,\n  KV,\n  canonicalizeRecapCaveats,\n  isCapabilitySubset,\n  parseSpaceUri,\n  type PermissionEntry,\n  type TinyCloudSession,\n} from \"@tinycloud/sdk-core\";\nimport {\n  type AuthorityRefusal,\n  type ReplicaDevice,\n  type ReplicationAuthority,\n} from \"@tinycloud/sdk-services\";\nimport type { ReplicaRuntime } from \"./replica-contract\";\n// @ts-ignore -- node-sdk builds before replica declarations; keep the literal import for bundlers.\nimport { parseUcanGrant as replicaParseUcanGrant } from \"@tinycloud/replica\";\nconst parseUcanGrant = replicaParseUcanGrant as ReplicaRuntime[\"parseUcanGrant\"];\nexport { assertValidReplicationConfig } from \"./config\";\nexport { augmentSignInEntriesWithReplication, hasUnrestrictedGetCoverage } from \"./authority-sign-in\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\n/** The delegation the replication grant delegates: get + sync on one prefix of the session space. */\nfunction replicationEntries(spaceId: string, prefix: string): PermissionEntry[] {\n  return grantPathsForSelector(prefix).map((path) => ({\n    service: KV_SERVICE,\n    space: spaceId,\n    path,\n    actions: [KV_GET, KV_SYNC],\n  }));\n}\n\n\n\n\n/**\n * The signed UCAN attenuation (`att`: resource → ability → caveat branches).\n * Only array branch sets are known; anything else is treated as constrained —\n * fail closed, never assume unconstrained.\n */\nfunction caveatBranchesUnconstrained(value: unknown): boolean {\n  if (value === undefined || value === null) return true;\n  if (typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length === 0) {\n    return true;\n  }\n  if (!Array.isArray(value)) return false;\n  try {\n    return (\n      canonicalizeRecapCaveats(value as Record<string, unknown>[]) ===\n      canonicalizeRecapCaveats(undefined)\n    );\n  } catch {\n    return false;\n  }\n}\n\n/** The KV path a signed UCAN resource names in `space`, like replica's `kvPathIn`. */\nfunction kvPathInResource(resource: string, space: string): string | undefined {\n  for (const base of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {\n    if (resource.startsWith(base)) return resource.slice(base.length);\n  }\n  return undefined;\n}\n\n/**\n * Whether the signed `att` grants `ability` over the selected namespace, with\n * each grant unrestricted (no caveats). A bare selector requires both its\n * exact key and its slash descendants; a trailing-slash selector is one range.\n */\nexport function ucanAttCovers(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n  ability: string,\n  options?: { ignoreCaveats?: boolean },\n): boolean {\n  const requiredPaths = prefix.endsWith(\"/\") ? [prefix] : [prefix, `${prefix}/`];\n  return requiredPaths.every((requestedPath) => {\n    for (const [resource, abilities] of Object.entries(att)) {\n      const path = kvPathInResource(resource, space);\n      if (path === undefined) continue;\n      for (const [granted, caveats] of Object.entries(abilities)) {\n        if (!actionContains(granted, ability)) continue;\n        if (!isCapabilitySubset(\n          [{ service: KV_SERVICE, space, path: requestedPath, actions: [ability] }],\n          [{ service: KV_SERVICE, space, path, actions: [granted] }],\n        ).subset) continue;\n        if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;\n      }\n    }\n    return false;\n  });\n}\n\n/** `unconstrained` for `ReplicaGrantInfo` (§2.1): get AND sync on the prefix carry no caveats. */\nexport function ucanAttUnconstrainedFor(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n): boolean {\n  return (\n    ucanAttCovers(att, space, prefix, KV_GET) &&\n    ucanAttCovers(att, space, prefix, KV_SYNC)\n  );\n}\n\nexport interface DelegationPlanResult {\n  path: \"session\" | \"runtime\";\n  parentCid: string;\n  expiresAt: number;\n}\n\n/**\n * The `TinyCloudNode` internals the authority needs. `planDelegation` is the\n * pure extraction of `delegateTo`'s parent selection (§4.3), so `plan` and\n * `mint` can never disagree about which parent or expiry a delegation gets.\n */\nexport type ReplicationAuthoritySession = Pick<\n  TinyCloudSession,\n  \"delegationHeader\" | \"delegationCid\" | \"spaceId\" | \"verificationMethod\" | \"jwk\"\n> & Partial<Pick<TinyCloudSession, \"siwe\">>;\n\nexport interface ReplicationAuthorityHost {\n  replicationSession(): ReplicationAuthoritySession | undefined;\n  /** The SIWE \"Expiration Time\" of the session — the delegateTo delegation cap. */\n  siweExpiration(siwe: string): Date | undefined;\n  planDelegation(\n    entries: PermissionEntry[],\n    options?: { expiry?: string | number },\n  ): ({ grant?: unknown } & DelegationPlanResult) | AuthorityRefusal;\n  mintDelegation(\n    deviceDid: string,\n    entries: PermissionEntry[],\n  ): Promise<{ ucan: string; expiresAt: number }>;\n}\n\n/** Milliseconds of validity a session or parent must have left for authority reuse (delegateTo's margin). */\nexport const AUTHORITY_EXPIRY_MARGIN_MS = 60_000;\n\n\n/** Verify a compact session delegation before using any persisted space metadata. */\nexport function replicationScopeFromSignedSession(input: {\n  delegationHeader: { Authorization: string };\n  delegationCid: string;\n  verificationMethod: string;\n  persistedSpace: string;\n}): { space: string; principal: string } | undefined {\n  let grant: ReturnType<typeof parseUcanGrant>;\n  try {\n    grant = parseUcanGrant(input.delegationHeader.Authorization);\n  } catch {\n    return undefined;\n  }\n  const bareDid = (value: string): string => value.split(\"#\", 1)[0]!;\n  if (\n    grant.cid !== input.delegationCid ||\n    bareDid(grant.audience) !== bareDid(input.verificationMethod)\n  ) return undefined;\n  for (const resource of Object.keys(grant.att)) {\n    const space = resource.match(/^(?:tinycloud:\\/\\/)?(.+?)\\/kv\\//)?.[1];\n    if (space !== input.persistedSpace) continue;\n    const owner = parseSpaceUri(space);\n    if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };\n  }\n  return undefined;\n}\nexport function createReplicationAuthority(host: ReplicationAuthorityHost): ReplicationAuthority {\n  const planOrRefusal = (entries: PermissionEntry[]): DelegationPlanResult | AuthorityRefusal => {\n    const plan = host.planDelegation(entries);\n    if (\"refused\" in plan) return plan;\n    return { path: plan.path, parentCid: plan.parentCid, expiresAt: plan.expiresAt };\n  };\n  const sessionAudience = (value: string): string => value.split(\"#\", 1)[0]!;\n  const signedSessionGrant = (session: ReplicationAuthoritySession) => {\n    const grant = parseUcanGrant(session.delegationHeader.Authorization);\n    if (\n      grant.cid !== session.delegationCid ||\n      sessionAudience(grant.audience) !== sessionAudience(session.verificationMethod)\n    ) return undefined;\n    return grant;\n  };\n  const authority: ReplicationAuthority = {\n    get sessionOnly() {\n      const session = host.replicationSession();\n      return session !== undefined && session.siwe === undefined;\n    },\n    sessionGrant(prefix: string): { ucan: string; device: ReplicaDevice } | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const siweExpiry = session.siwe ? host.siweExpiration(session.siwe)?.getTime() : undefined;\n      if (siweExpiry !== undefined && siweExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      let grant: ReturnType<typeof parseUcanGrant>;\n      try {\n        const verified = signedSessionGrant(session);\n        if (!verified) return { refused: \"NOT_COVERED\" };\n        grant = verified;\n      } catch {\n        return { refused: \"NOT_COVERED\" };\n      }\n      const tokenExpiry = grant.expiresAt === null ? undefined : grant.expiresAt * 1000;\n      if (tokenExpiry === undefined || tokenExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      const covered = ucanAttCovers(grant.att, session.spaceId, prefix, KV_GET, { ignoreCaveats: true }) &&\n        ucanAttCovers(grant.att, session.spaceId, prefix, KV_SYNC, { ignoreCaveats: true });\n      if (!covered) return { refused: \"NOT_COVERED\" };\n      if (!ucanAttUnconstrainedFor(grant.att, session.spaceId, prefix)) {\n        return { refused: \"CAVEATED_AUTHORITY\" };\n      }\n      return {\n        ucan: grant.jwt,\n        device: { did: session.verificationMethod, jwk: session.jwk },\n      };\n    },\n    plan(prefix: string): DelegationPlanResult | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const sessionGrant = this.sessionGrant(prefix);\n      if (!(\"refused\" in sessionGrant)) {\n        const signed = signedSessionGrant(session);\n        if (!signed || signed.expiresAt === null) return { refused: \"NOT_COVERED\" };\n        return {\n          path: \"session\",\n          parentCid: session.delegationCid,\n          expiresAt: signed.expiresAt * 1000,\n        };\n      }\n      if (authority.sessionOnly) return sessionGrant;\n      return planOrRefusal(replicationEntries(session.spaceId, prefix));\n    },\n    async mint(\n      deviceDid: string,\n      prefix: string,\n      signal: AbortSignal,\n    ): Promise<{ ucan: string; parentCid: string; expiresAt: number }> {\n      if (authority.sessionOnly) throw new Error(\"compact delegate sessions cannot mint device grants\");\n      const session = host.replicationSession();\n      if (session === undefined) throw new Error(\"replication mint without a session\");\n      const entries = replicationEntries(session.spaceId, prefix);\n      const plan = planOrRefusal(entries);\n      if (\"refused\" in plan) {\n        throw Object.assign(\n          new Error(`replication authority refused the mint: ${plan.refused}`),\n          { refused: plan.refused },\n        );\n      }\n      signal.throwIfAborted();\n      const minted = await new Promise<{ ucan: string; expiresAt: number }>((resolve, reject) => {\n        const onAbort = (): void => reject(signal.reason ?? new Error(\"replication mint aborted\"));\n        signal.addEventListener(\"abort\", onAbort, { once: true });\n        host.mintDelegation(deviceDid, entries).then(\n          (result) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            resolve(result);\n          },\n          (error: unknown) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            reject(error instanceof Error ? error : new Error(String(error)));\n          },\n        );\n      });\n      return { ucan: minted.ucan, parentCid: plan.parentCid, expiresAt: minted.expiresAt };\n    },\n  };\n  return authority;\n}\n","import { kvPrefixCovers, type ReplicationOptions } from \"@tinycloud/sdk-services\";\n\n/** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */\nexport function assertValidReplicationConfig(\n  replication: (ReplicationOptions & { storage?: unknown }) | undefined,\n): void {\n  if (replication === undefined || replication.enabled !== true) return;\n  if (replication.storage === undefined || replication.storage === null) {\n    throw new TypeError(\"replication.enabled requires replication.storage\");\n  }\n  if (!Array.isArray(replication.prefixes) || replication.prefixes.length === 0) {\n    throw new TypeError(\"replication.prefixes must be a non-empty array\");\n  }\n  for (const prefix of replication.prefixes) {\n    if (typeof prefix !== \"string\" || prefix === \"\") {\n      throw new TypeError(\"replication.prefixes must not contain an empty prefix\");\n    }\n  }\n  for (const [index, prefix] of replication.prefixes.entries()) {\n    for (const other of replication.prefixes.slice(index + 1)) {\n      if (kvPrefixCovers(prefix, other) || kvPrefixCovers(other, prefix)) {\n        throw new TypeError(\n          `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`,\n        );\n      }\n    }\n    if (prefix.split(\"/\", 1)[0] === \"vault\" && replication.allowSecrets !== true) {\n      throw new TypeError(\n        `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`,\n      );\n    }\n  }\n}\n","import {\n  grantPathsForSelector,\n  KV,\n  isCapabilitySubset,\n  type PermissionEntry,\n  type ReplicationOptions,\n} from \"@tinycloud/sdk-core\";\nimport { requiresSecretsOptIn } from \"@tinycloud/sdk-services\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\nexport function hasUnrestrictedGetCoverage(\n  entries: readonly PermissionEntry[],\n  spaceId: string,\n  prefix: string,\n): boolean {\n  const requiredPaths = grantPathsForSelector(prefix);\n  return isCapabilitySubset(\n    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),\n    [...entries],\n  ).subset;\n}\n\nexport function augmentSignInEntriesWithReplication(input: {\n  entries: readonly PermissionEntry[];\n  primarySpaceId: string;\n  replication?: Pick<ReplicationOptions, \"prefixes\" | \"allowSecrets\">;\n}): PermissionEntry[] {\n  const out: PermissionEntry[] = [];\n  const replication = input.replication;\n  if (replication === undefined) return out;\n  for (const prefix of replication.prefixes) {\n    if (\n      requiresSecretsOptIn(input.primarySpaceId, prefix) &&\n      replication.allowSecrets !== true\n    ) {\n      continue;\n    }\n    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {\n      continue;\n    }\n    for (const path of grantPathsForSelector(prefix)) {\n      out.push({\n        service: KV_SERVICE,\n        space: input.primarySpaceId,\n        path,\n        actions: [KV_GET, KV_SYNC],\n      });\n    }\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,IAAAA,mBASO;AAQP,qBAAwD;;;AChCxD,0BAAwD;AAGjD,SAAS,6BACd,aACM;AACN,MAAI,gBAAgB,UAAa,YAAY,YAAY,KAAM;AAC/D,MAAI,YAAY,YAAY,UAAa,YAAY,YAAY,MAAM;AACrE,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,MAAI,CAAC,MAAM,QAAQ,YAAY,QAAQ,KAAK,YAAY,SAAS,WAAW,GAAG;AAC7E,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,aAAW,UAAU,YAAY,UAAU;AACzC,QAAI,OAAO,WAAW,YAAY,WAAW,IAAI;AAC/C,YAAM,IAAI,UAAU,uDAAuD;AAAA,IAC7E;AAAA,EACF;AACA,aAAW,CAAC,OAAO,MAAM,KAAK,YAAY,SAAS,QAAQ,GAAG;AAC5D,eAAW,SAAS,YAAY,SAAS,MAAM,QAAQ,CAAC,GAAG;AACzD,cAAI,oCAAe,QAAQ,KAAK,SAAK,oCAAe,OAAO,MAAM,GAAG;AAClE,cAAM,IAAI;AAAA,UACR,0CAA0C,KAAK,UAAU,MAAM,CAAC,QAAQ,KAAK,UAAU,KAAK,CAAC;AAAA,QAC/F;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,WAAW,YAAY,iBAAiB,MAAM;AAC5E,YAAM,IAAI;AAAA,QACR,sBAAsB,KAAK,UAAU,MAAM,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACF;;;AChCA,sBAMO;AACP,IAAAC,uBAAqC;AAErC,IAAM,SAAS,mBAAG;AAClB,IAAM,UAAU,mBAAG;AACnB,IAAM,aAAa;AAEZ,SAAS,2BACd,SACA,SACA,QACS;AACT,QAAM,oBAAgB,uCAAsB,MAAM;AAClD,aAAO;AAAA,IACL,cAAc,IAAI,CAAC,UAAU,EAAE,SAAS,YAAY,OAAO,SAAS,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9F,CAAC,GAAG,OAAO;AAAA,EACb,EAAE;AACJ;AAEO,SAAS,oCAAoC,OAI9B;AACpB,QAAM,MAAyB,CAAC;AAChC,QAAM,cAAc,MAAM;AAC1B,MAAI,gBAAgB,OAAW,QAAO;AACtC,aAAW,UAAU,YAAY,UAAU;AACzC,YACE,2CAAqB,MAAM,gBAAgB,MAAM,KACjD,YAAY,iBAAiB,MAC7B;AACA;AAAA,IACF;AACA,QAAI,CAAC,2BAA2B,MAAM,SAAS,MAAM,gBAAgB,MAAM,GAAG;AAC5E;AAAA,IACF;AACA,eAAW,YAAQ,uCAAsB,MAAM,GAAG;AAChD,UAAI,KAAK;AAAA,QACP,SAAS;AAAA,QACT,OAAO,MAAM;AAAA,QACb;AAAA,QACA,SAAS,CAAC,QAAQ,OAAO;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;;;AFpBA,IAAM,iBAAiB,eAAAC;AAIvB,IAAMC,UAAS,oBAAG;AAClB,IAAMC,WAAU,oBAAG;AACnB,IAAMC,cAAa;AAGnB,SAAS,mBAAmB,SAAiB,QAAmC;AAC9E,aAAO,wCAAsB,MAAM,EAAE,IAAI,CAAC,UAAU;AAAA,IAClD,SAASA;AAAA,IACT,OAAO;AAAA,IACP;AAAA,IACA,SAAS,CAACF,SAAQC,QAAO;AAAA,EAC3B,EAAE;AACJ;AAUA,SAAS,4BAA4B,OAAyB;AAC5D,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,WAAW,GAAG;AACzF,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,MAAI;AACF,eACE,2CAAyB,KAAkC,UAC3D,2CAAyB,MAAS;AAAA,EAEtC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,iBAAiB,UAAkB,OAAmC;AAC7E,aAAW,QAAQ,CAAC,GAAG,KAAK,QAAQ,eAAe,KAAK,MAAM,GAAG;AAC/D,QAAI,SAAS,WAAW,IAAI,EAAG,QAAO,SAAS,MAAM,KAAK,MAAM;AAAA,EAClE;AACA,SAAO;AACT;AAOO,SAAS,cACd,KACA,OACA,QACA,SACA,SACS;AACT,QAAM,gBAAgB,OAAO,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,GAAG,MAAM,GAAG;AAC7E,SAAO,cAAc,MAAM,CAAC,kBAAkB;AAC5C,eAAW,CAAC,UAAU,SAAS,KAAK,OAAO,QAAQ,GAAG,GAAG;AACvD,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,UAAI,SAAS,OAAW;AACxB,iBAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC1D,YAAI,KAAC,iCAAe,SAAS,OAAO,EAAG;AACvC,YAAI,KAAC;AAAA,UACH,CAAC,EAAE,SAASC,aAAY,OAAO,MAAM,eAAe,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,UACxE,CAAC,EAAE,SAASA,aAAY,OAAO,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,QAC3D,EAAE,OAAQ;AACV,YAAI,SAAS,kBAAkB,QAAQ,4BAA4B,OAAO,EAAG,QAAO;AAAA,MACtF;AAAA,IACF;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,wBACd,KACA,OACA,QACS;AACT,SACE,cAAc,KAAK,OAAO,QAAQF,OAAM,KACxC,cAAc,KAAK,OAAO,QAAQC,QAAO;AAE7C;AAiCO,IAAM,6BAA6B;AAInC,SAAS,kCAAkC,OAKG;AACnD,MAAI;AACJ,MAAI;AACF,YAAQ,eAAe,MAAM,iBAAiB,aAAa;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAChE,MACE,MAAM,QAAQ,MAAM,iBACpB,QAAQ,MAAM,QAAQ,MAAM,QAAQ,MAAM,kBAAkB,EAC5D,QAAO;AACT,aAAW,YAAY,OAAO,KAAK,MAAM,GAAG,GAAG;AAC7C,UAAM,QAAQ,SAAS,MAAM,iCAAiC,IAAI,CAAC;AACnE,QAAI,UAAU,MAAM,eAAgB;AACpC,UAAM,YAAQ,gCAAc,KAAK;AACjC,QAAI,OAAO,SAAS,MAAM,WAAW,MAAM,QAAS,QAAO,EAAE,OAAO,WAAW,MAAM,MAAM;AAAA,EAC7F;AACA,SAAO;AACT;AACO,SAAS,2BAA2B,MAAsD;AAC/F,QAAM,gBAAgB,CAAC,YAAwE;AAC7F,UAAM,OAAO,KAAK,eAAe,OAAO;AACxC,QAAI,aAAa,KAAM,QAAO;AAC9B,WAAO,EAAE,MAAM,KAAK,MAAM,WAAW,KAAK,WAAW,WAAW,KAAK,UAAU;AAAA,EACjF;AACA,QAAM,kBAAkB,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AACxE,QAAM,qBAAqB,CAAC,YAAyC;AACnE,UAAM,QAAQ,eAAe,QAAQ,iBAAiB,aAAa;AACnE,QACE,MAAM,QAAQ,QAAQ,iBACtB,gBAAgB,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,kBAAkB,EAC9E,QAAO;AACT,WAAO;AAAA,EACT;AACA,QAAM,YAAkC;AAAA,IACtC,IAAI,cAAc;AAChB,YAAM,UAAU,KAAK,mBAAmB;AACxC,aAAO,YAAY,UAAa,QAAQ,SAAS;AAAA,IACnD;AAAA,IACA,aAAa,QAA4E;AACvF,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,aAAa,QAAQ,OAAO,KAAK,eAAe,QAAQ,IAAI,GAAG,QAAQ,IAAI;AACjF,UAAI,eAAe,UAAa,cAAc,KAAK,IAAI,IAAI,4BAA4B;AACrF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,UAAI;AACJ,UAAI;AACF,cAAM,WAAW,mBAAmB,OAAO;AAC3C,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,cAAc;AAC/C,gBAAQ;AAAA,MACV,QAAQ;AACN,eAAO,EAAE,SAAS,cAAc;AAAA,MAClC;AACA,YAAM,cAAc,MAAM,cAAc,OAAO,SAAY,MAAM,YAAY;AAC7E,UAAI,gBAAgB,UAAa,eAAe,KAAK,IAAI,IAAI,4BAA4B;AACvF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,YAAM,UAAU,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQD,SAAQ,EAAE,eAAe,KAAK,CAAC,KAC/F,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQC,UAAS,EAAE,eAAe,KAAK,CAAC;AACpF,UAAI,CAAC,QAAS,QAAO,EAAE,SAAS,cAAc;AAC9C,UAAI,CAAC,wBAAwB,MAAM,KAAK,QAAQ,SAAS,MAAM,GAAG;AAChE,eAAO,EAAE,SAAS,qBAAqB;AAAA,MACzC;AACA,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,QAAQ,EAAE,KAAK,QAAQ,oBAAoB,KAAK,QAAQ,IAAI;AAAA,MAC9D;AAAA,IACF;AAAA,IACA,KAAK,QAAyD;AAC5D,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,eAAe,KAAK,aAAa,MAAM;AAC7C,UAAI,EAAE,aAAa,eAAe;AAChC,cAAM,SAAS,mBAAmB,OAAO;AACzC,YAAI,CAAC,UAAU,OAAO,cAAc,KAAM,QAAO,EAAE,SAAS,cAAc;AAC1E,eAAO;AAAA,UACL,MAAM;AAAA,UACN,WAAW,QAAQ;AAAA,UACnB,WAAW,OAAO,YAAY;AAAA,QAChC;AAAA,MACF;AACA,UAAI,UAAU,YAAa,QAAO;AAClC,aAAO,cAAc,mBAAmB,QAAQ,SAAS,MAAM,CAAC;AAAA,IAClE;AAAA,IACA,MAAM,KACJ,WACA,QACA,QACiE;AACjE,UAAI,UAAU,YAAa,OAAM,IAAI,MAAM,qDAAqD;AAChG,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,OAAM,IAAI,MAAM,oCAAoC;AAC/E,YAAM,UAAU,mBAAmB,QAAQ,SAAS,MAAM;AAC1D,YAAM,OAAO,cAAc,OAAO;AAClC,UAAI,aAAa,MAAM;AACrB,cAAM,OAAO;AAAA,UACX,IAAI,MAAM,2CAA2C,KAAK,OAAO,EAAE;AAAA,UACnE,EAAE,SAAS,KAAK,QAAQ;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,eAAe;AACtB,YAAM,SAAS,MAAM,IAAI,QAA6C,CAAC,SAAS,WAAW;AACzF,cAAM,UAAU,MAAY,OAAO,OAAO,UAAU,IAAI,MAAM,0BAA0B,CAAC;AACzF,eAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,aAAK,eAAe,WAAW,OAAO,EAAE;AAAA,UACtC,CAAC,WAAW;AACV,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,oBAAQ,MAAM;AAAA,UAChB;AAAA,UACA,CAAC,UAAmB;AAClB,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,mBAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,UAClE;AAAA,QACF;AAAA,MACF,CAAC;AACD,aAAO,EAAE,MAAM,OAAO,MAAM,WAAW,KAAK,WAAW,WAAW,OAAO,UAAU;AAAA,IACrF;AAAA,EACF;AACA,SAAO;AACT;","names":["import_sdk_core","import_sdk_services","replicaParseUcanGrant","KV_GET","KV_SYNC","KV_SERVICE"]}

package/dist/replication/authority.d.cts

@@ -0,0 +1,3 @@
+import '@tinycloud/sdk-core';
+import '@tinycloud/sdk-services';
+export { A as AUTHORITY_EXPIRY_MARGIN_MS, D as DelegationPlanResult, R as ReplicationAuthorityHost, a as ReplicationAuthoritySession, b as assertValidReplicationConfig, c as augmentSignInEntriesWithReplication, d as createReplicationAuthority, h as hasUnrestrictedGetCoverage, r as replicationScopeFromSignedSession, u as ucanAttCovers, e as ucanAttUnconstrainedFor } from '../authority-mTQEgN56.cjs';

package/dist/replication/authority.d.ts

@@ -0,0 +1,3 @@
+import '@tinycloud/sdk-core';
+import '@tinycloud/sdk-services';
+export { A as AUTHORITY_EXPIRY_MARGIN_MS, D as DelegationPlanResult, R as ReplicationAuthorityHost, a as ReplicationAuthoritySession, b as assertValidReplicationConfig, c as augmentSignInEntriesWithReplication, d as createReplicationAuthority, h as hasUnrestrictedGetCoverage, r as replicationScopeFromSignedSession, u as ucanAttCovers, e as ucanAttUnconstrainedFor } from '../authority-mTQEgN56.js';

package/dist/replication/authority.js

@@ -0,0 +1,257 @@
+// src/replication/authority.ts
+import {
+  grantPathsForSelector as grantPathsForSelector2,
+  actionContains,
+  KV as KV2,
+  canonicalizeRecapCaveats,
+  isCapabilitySubset as isCapabilitySubset2,
+  parseSpaceUri
+} from "@tinycloud/sdk-core";
+import { parseUcanGrant as replicaParseUcanGrant } from "@tinycloud/replica";
+
+// src/replication/config.ts
+import { kvPrefixCovers } from "@tinycloud/sdk-services";
+function assertValidReplicationConfig(replication) {
+  if (replication === void 0 || replication.enabled !== true) return;
+  if (replication.storage === void 0 || replication.storage === null) {
+    throw new TypeError("replication.enabled requires replication.storage");
+  }
+  if (!Array.isArray(replication.prefixes) || replication.prefixes.length === 0) {
+    throw new TypeError("replication.prefixes must be a non-empty array");
+  }
+  for (const prefix of replication.prefixes) {
+    if (typeof prefix !== "string" || prefix === "") {
+      throw new TypeError("replication.prefixes must not contain an empty prefix");
+    }
+  }
+  for (const [index, prefix] of replication.prefixes.entries()) {
+    for (const other of replication.prefixes.slice(index + 1)) {
+      if (kvPrefixCovers(prefix, other) || kvPrefixCovers(other, prefix)) {
+        throw new TypeError(
+          `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`
+        );
+      }
+    }
+    if (prefix.split("/", 1)[0] === "vault" && replication.allowSecrets !== true) {
+      throw new TypeError(
+        `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`
+      );
+    }
+  }
+}
+
+// src/replication/authority-sign-in.ts
+import {
+  grantPathsForSelector,
+  KV,
+  isCapabilitySubset
+} from "@tinycloud/sdk-core";
+import { requiresSecretsOptIn } from "@tinycloud/sdk-services";
+var KV_GET = KV.GET;
+var KV_SYNC = KV.SYNC;
+var KV_SERVICE = "tinycloud.kv";
+function hasUnrestrictedGetCoverage(entries, spaceId, prefix) {
+  const requiredPaths = grantPathsForSelector(prefix);
+  return isCapabilitySubset(
+    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),
+    [...entries]
+  ).subset;
+}
+function augmentSignInEntriesWithReplication(input) {
+  const out = [];
+  const replication = input.replication;
+  if (replication === void 0) return out;
+  for (const prefix of replication.prefixes) {
+    if (requiresSecretsOptIn(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
+      continue;
+    }
+    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {
+      continue;
+    }
+    for (const path of grantPathsForSelector(prefix)) {
+      out.push({
+        service: KV_SERVICE,
+        space: input.primarySpaceId,
+        path,
+        actions: [KV_GET, KV_SYNC]
+      });
+    }
+  }
+  return out;
+}
+
+// src/replication/authority.ts
+var parseUcanGrant = replicaParseUcanGrant;
+var KV_GET2 = KV2.GET;
+var KV_SYNC2 = KV2.SYNC;
+var KV_SERVICE2 = "tinycloud.kv";
+function replicationEntries(spaceId, prefix) {
+  return grantPathsForSelector2(prefix).map((path) => ({
+    service: KV_SERVICE2,
+    space: spaceId,
+    path,
+    actions: [KV_GET2, KV_SYNC2]
+  }));
+}
+function caveatBranchesUnconstrained(value) {
+  if (value === void 0 || value === null) return true;
+  if (typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0) {
+    return true;
+  }
+  if (!Array.isArray(value)) return false;
+  try {
+    return canonicalizeRecapCaveats(value) === canonicalizeRecapCaveats(void 0);
+  } catch {
+    return false;
+  }
+}
+function kvPathInResource(resource, space) {
+  for (const base of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {
+    if (resource.startsWith(base)) return resource.slice(base.length);
+  }
+  return void 0;
+}
+function ucanAttCovers(att, space, prefix, ability, options) {
+  const requiredPaths = prefix.endsWith("/") ? [prefix] : [prefix, `${prefix}/`];
+  return requiredPaths.every((requestedPath) => {
+    for (const [resource, abilities] of Object.entries(att)) {
+      const path = kvPathInResource(resource, space);
+      if (path === void 0) continue;
+      for (const [granted, caveats] of Object.entries(abilities)) {
+        if (!actionContains(granted, ability)) continue;
+        if (!isCapabilitySubset2(
+          [{ service: KV_SERVICE2, space, path: requestedPath, actions: [ability] }],
+          [{ service: KV_SERVICE2, space, path, actions: [granted] }]
+        ).subset) continue;
+        if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;
+      }
+    }
+    return false;
+  });
+}
+function ucanAttUnconstrainedFor(att, space, prefix) {
+  return ucanAttCovers(att, space, prefix, KV_GET2) && ucanAttCovers(att, space, prefix, KV_SYNC2);
+}
+var AUTHORITY_EXPIRY_MARGIN_MS = 6e4;
+function replicationScopeFromSignedSession(input) {
+  let grant;
+  try {
+    grant = parseUcanGrant(input.delegationHeader.Authorization);
+  } catch {
+    return void 0;
+  }
+  const bareDid = (value) => value.split("#", 1)[0];
+  if (grant.cid !== input.delegationCid || bareDid(grant.audience) !== bareDid(input.verificationMethod)) return void 0;
+  for (const resource of Object.keys(grant.att)) {
+    const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv\//)?.[1];
+    if (space !== input.persistedSpace) continue;
+    const owner = parseSpaceUri(space);
+    if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };
+  }
+  return void 0;
+}
+function createReplicationAuthority(host) {
+  const planOrRefusal = (entries) => {
+    const plan = host.planDelegation(entries);
+    if ("refused" in plan) return plan;
+    return { path: plan.path, parentCid: plan.parentCid, expiresAt: plan.expiresAt };
+  };
+  const sessionAudience = (value) => value.split("#", 1)[0];
+  const signedSessionGrant = (session) => {
+    const grant = parseUcanGrant(session.delegationHeader.Authorization);
+    if (grant.cid !== session.delegationCid || sessionAudience(grant.audience) !== sessionAudience(session.verificationMethod)) return void 0;
+    return grant;
+  };
+  const authority = {
+    get sessionOnly() {
+      const session = host.replicationSession();
+      return session !== void 0 && session.siwe === void 0;
+    },
+    sessionGrant(prefix) {
+      const session = host.replicationSession();
+      if (session === void 0) return { refused: "SESSION_EXPIRING" };
+      const siweExpiry = session.siwe ? host.siweExpiration(session.siwe)?.getTime() : void 0;
+      if (siweExpiry !== void 0 && siweExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {
+        return { refused: "SESSION_EXPIRING" };
+      }
+      let grant;
+      try {
+        const verified = signedSessionGrant(session);
+        if (!verified) return { refused: "NOT_COVERED" };
+        grant = verified;
+      } catch {
+        return { refused: "NOT_COVERED" };
+      }
+      const tokenExpiry = grant.expiresAt === null ? void 0 : grant.expiresAt * 1e3;
+      if (tokenExpiry === void 0 || tokenExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {
+        return { refused: "SESSION_EXPIRING" };
+      }
+      const covered = ucanAttCovers(grant.att, session.spaceId, prefix, KV_GET2, { ignoreCaveats: true }) && ucanAttCovers(grant.att, session.spaceId, prefix, KV_SYNC2, { ignoreCaveats: true });
+      if (!covered) return { refused: "NOT_COVERED" };
+      if (!ucanAttUnconstrainedFor(grant.att, session.spaceId, prefix)) {
+        return { refused: "CAVEATED_AUTHORITY" };
+      }
+      return {
+        ucan: grant.jwt,
+        device: { did: session.verificationMethod, jwk: session.jwk }
+      };
+    },
+    plan(prefix) {
+      const session = host.replicationSession();
+      if (session === void 0) return { refused: "SESSION_EXPIRING" };
+      const sessionGrant = this.sessionGrant(prefix);
+      if (!("refused" in sessionGrant)) {
+        const signed = signedSessionGrant(session);
+        if (!signed || signed.expiresAt === null) return { refused: "NOT_COVERED" };
+        return {
+          path: "session",
+          parentCid: session.delegationCid,
+          expiresAt: signed.expiresAt * 1e3
+        };
+      }
+      if (authority.sessionOnly) return sessionGrant;
+      return planOrRefusal(replicationEntries(session.spaceId, prefix));
+    },
+    async mint(deviceDid, prefix, signal) {
+      if (authority.sessionOnly) throw new Error("compact delegate sessions cannot mint device grants");
+      const session = host.replicationSession();
+      if (session === void 0) throw new Error("replication mint without a session");
+      const entries = replicationEntries(session.spaceId, prefix);
+      const plan = planOrRefusal(entries);
+      if ("refused" in plan) {
+        throw Object.assign(
+          new Error(`replication authority refused the mint: ${plan.refused}`),
+          { refused: plan.refused }
+        );
+      }
+      signal.throwIfAborted();
+      const minted = await new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason ?? new Error("replication mint aborted"));
+        signal.addEventListener("abort", onAbort, { once: true });
+        host.mintDelegation(deviceDid, entries).then(
+          (result) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(result);
+          },
+          (error) => {
+            signal.removeEventListener("abort", onAbort);
+            reject(error instanceof Error ? error : new Error(String(error)));
+          }
+        );
+      });
+      return { ucan: minted.ucan, parentCid: plan.parentCid, expiresAt: minted.expiresAt };
+    }
+  };
+  return authority;
+}
+export {
+  AUTHORITY_EXPIRY_MARGIN_MS,
+  assertValidReplicationConfig,
+  augmentSignInEntriesWithReplication,
+  createReplicationAuthority,
+  hasUnrestrictedGetCoverage,
+  replicationScopeFromSignedSession,
+  ucanAttCovers,
+  ucanAttUnconstrainedFor
+};
+//# sourceMappingURL=authority.js.map

package/dist/replication/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/replication/authority.ts","../../src/replication/config.ts","../../src/replication/authority-sign-in.ts"],"sourcesContent":["/**\n * Replication authority (TC-858, plan v3 §4).\n *\n * `ReplicationAuthority` answers, per configured prefix, whether this node's\n * session can back a local replica: the session UCAN itself (delegate\n * posture), a child UCAN minted through `delegateTo`, or nothing (the\n * controller then reports `grant_missing` and reads from the network).\n *\n * The unrestricted-authority rule is enforced here, before any network work:\n * a prefix covered only by a caveated `get`/`sync` refuses with\n * `CAVEATED_AUTHORITY` — on the session path, the runtime-grant path, and on\n * any reuse of an installed grant (the adapter marks every grant's\n * `unconstrained` flag; the controller enforces it on reuse).\n */\n\nimport {\n  grantPathsForSelector,\n  actionContains,\n  KV,\n  canonicalizeRecapCaveats,\n  isCapabilitySubset,\n  parseSpaceUri,\n  type PermissionEntry,\n  type TinyCloudSession,\n} from \"@tinycloud/sdk-core\";\nimport {\n  type AuthorityRefusal,\n  type ReplicaDevice,\n  type ReplicationAuthority,\n} from \"@tinycloud/sdk-services\";\nimport type { ReplicaRuntime } from \"./replica-contract\";\n// @ts-ignore -- node-sdk builds before replica declarations; keep the literal import for bundlers.\nimport { parseUcanGrant as replicaParseUcanGrant } from \"@tinycloud/replica\";\nconst parseUcanGrant = replicaParseUcanGrant as ReplicaRuntime[\"parseUcanGrant\"];\nexport { assertValidReplicationConfig } from \"./config\";\nexport { augmentSignInEntriesWithReplication, hasUnrestrictedGetCoverage } from \"./authority-sign-in\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\n/** The delegation the replication grant delegates: get + sync on one prefix of the session space. */\nfunction replicationEntries(spaceId: string, prefix: string): PermissionEntry[] {\n  return grantPathsForSelector(prefix).map((path) => ({\n    service: KV_SERVICE,\n    space: spaceId,\n    path,\n    actions: [KV_GET, KV_SYNC],\n  }));\n}\n\n\n\n\n/**\n * The signed UCAN attenuation (`att`: resource → ability → caveat branches).\n * Only array branch sets are known; anything else is treated as constrained —\n * fail closed, never assume unconstrained.\n */\nfunction caveatBranchesUnconstrained(value: unknown): boolean {\n  if (value === undefined || value === null) return true;\n  if (typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length === 0) {\n    return true;\n  }\n  if (!Array.isArray(value)) return false;\n  try {\n    return (\n      canonicalizeRecapCaveats(value as Record<string, unknown>[]) ===\n      canonicalizeRecapCaveats(undefined)\n    );\n  } catch {\n    return false;\n  }\n}\n\n/** The KV path a signed UCAN resource names in `space`, like replica's `kvPathIn`. */\nfunction kvPathInResource(resource: string, space: string): string | undefined {\n  for (const base of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {\n    if (resource.startsWith(base)) return resource.slice(base.length);\n  }\n  return undefined;\n}\n\n/**\n * Whether the signed `att` grants `ability` over the selected namespace, with\n * each grant unrestricted (no caveats). A bare selector requires both its\n * exact key and its slash descendants; a trailing-slash selector is one range.\n */\nexport function ucanAttCovers(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n  ability: string,\n  options?: { ignoreCaveats?: boolean },\n): boolean {\n  const requiredPaths = prefix.endsWith(\"/\") ? [prefix] : [prefix, `${prefix}/`];\n  return requiredPaths.every((requestedPath) => {\n    for (const [resource, abilities] of Object.entries(att)) {\n      const path = kvPathInResource(resource, space);\n      if (path === undefined) continue;\n      for (const [granted, caveats] of Object.entries(abilities)) {\n        if (!actionContains(granted, ability)) continue;\n        if (!isCapabilitySubset(\n          [{ service: KV_SERVICE, space, path: requestedPath, actions: [ability] }],\n          [{ service: KV_SERVICE, space, path, actions: [granted] }],\n        ).subset) continue;\n        if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;\n      }\n    }\n    return false;\n  });\n}\n\n/** `unconstrained` for `ReplicaGrantInfo` (§2.1): get AND sync on the prefix carry no caveats. */\nexport function ucanAttUnconstrainedFor(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n): boolean {\n  return (\n    ucanAttCovers(att, space, prefix, KV_GET) &&\n    ucanAttCovers(att, space, prefix, KV_SYNC)\n  );\n}\n\nexport interface DelegationPlanResult {\n  path: \"session\" | \"runtime\";\n  parentCid: string;\n  expiresAt: number;\n}\n\n/**\n * The `TinyCloudNode` internals the authority needs. `planDelegation` is the\n * pure extraction of `delegateTo`'s parent selection (§4.3), so `plan` and\n * `mint` can never disagree about which parent or expiry a delegation gets.\n */\nexport type ReplicationAuthoritySession = Pick<\n  TinyCloudSession,\n  \"delegationHeader\" | \"delegationCid\" | \"spaceId\" | \"verificationMethod\" | \"jwk\"\n> & Partial<Pick<TinyCloudSession, \"siwe\">>;\n\nexport interface ReplicationAuthorityHost {\n  replicationSession(): ReplicationAuthoritySession | undefined;\n  /** The SIWE \"Expiration Time\" of the session — the delegateTo delegation cap. */\n  siweExpiration(siwe: string): Date | undefined;\n  planDelegation(\n    entries: PermissionEntry[],\n    options?: { expiry?: string | number },\n  ): ({ grant?: unknown } & DelegationPlanResult) | AuthorityRefusal;\n  mintDelegation(\n    deviceDid: string,\n    entries: PermissionEntry[],\n  ): Promise<{ ucan: string; expiresAt: number }>;\n}\n\n/** Milliseconds of validity a session or parent must have left for authority reuse (delegateTo's margin). */\nexport const AUTHORITY_EXPIRY_MARGIN_MS = 60_000;\n\n\n/** Verify a compact session delegation before using any persisted space metadata. */\nexport function replicationScopeFromSignedSession(input: {\n  delegationHeader: { Authorization: string };\n  delegationCid: string;\n  verificationMethod: string;\n  persistedSpace: string;\n}): { space: string; principal: string } | undefined {\n  let grant: ReturnType<typeof parseUcanGrant>;\n  try {\n    grant = parseUcanGrant(input.delegationHeader.Authorization);\n  } catch {\n    return undefined;\n  }\n  const bareDid = (value: string): string => value.split(\"#\", 1)[0]!;\n  if (\n    grant.cid !== input.delegationCid ||\n    bareDid(grant.audience) !== bareDid(input.verificationMethod)\n  ) return undefined;\n  for (const resource of Object.keys(grant.att)) {\n    const space = resource.match(/^(?:tinycloud:\\/\\/)?(.+?)\\/kv\\//)?.[1];\n    if (space !== input.persistedSpace) continue;\n    const owner = parseSpaceUri(space);\n    if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };\n  }\n  return undefined;\n}\nexport function createReplicationAuthority(host: ReplicationAuthorityHost): ReplicationAuthority {\n  const planOrRefusal = (entries: PermissionEntry[]): DelegationPlanResult | AuthorityRefusal => {\n    const plan = host.planDelegation(entries);\n    if (\"refused\" in plan) return plan;\n    return { path: plan.path, parentCid: plan.parentCid, expiresAt: plan.expiresAt };\n  };\n  const sessionAudience = (value: string): string => value.split(\"#\", 1)[0]!;\n  const signedSessionGrant = (session: ReplicationAuthoritySession) => {\n    const grant = parseUcanGrant(session.delegationHeader.Authorization);\n    if (\n      grant.cid !== session.delegationCid ||\n      sessionAudience(grant.audience) !== sessionAudience(session.verificationMethod)\n    ) return undefined;\n    return grant;\n  };\n  const authority: ReplicationAuthority = {\n    get sessionOnly() {\n      const session = host.replicationSession();\n      return session !== undefined && session.siwe === undefined;\n    },\n    sessionGrant(prefix: string): { ucan: string; device: ReplicaDevice } | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const siweExpiry = session.siwe ? host.siweExpiration(session.siwe)?.getTime() : undefined;\n      if (siweExpiry !== undefined && siweExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      let grant: ReturnType<typeof parseUcanGrant>;\n      try {\n        const verified = signedSessionGrant(session);\n        if (!verified) return { refused: \"NOT_COVERED\" };\n        grant = verified;\n      } catch {\n        return { refused: \"NOT_COVERED\" };\n      }\n      const tokenExpiry = grant.expiresAt === null ? undefined : grant.expiresAt * 1000;\n      if (tokenExpiry === undefined || tokenExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      const covered = ucanAttCovers(grant.att, session.spaceId, prefix, KV_GET, { ignoreCaveats: true }) &&\n        ucanAttCovers(grant.att, session.spaceId, prefix, KV_SYNC, { ignoreCaveats: true });\n      if (!covered) return { refused: \"NOT_COVERED\" };\n      if (!ucanAttUnconstrainedFor(grant.att, session.spaceId, prefix)) {\n        return { refused: \"CAVEATED_AUTHORITY\" };\n      }\n      return {\n        ucan: grant.jwt,\n        device: { did: session.verificationMethod, jwk: session.jwk },\n      };\n    },\n    plan(prefix: string): DelegationPlanResult | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const sessionGrant = this.sessionGrant(prefix);\n      if (!(\"refused\" in sessionGrant)) {\n        const signed = signedSessionGrant(session);\n        if (!signed || signed.expiresAt === null) return { refused: \"NOT_COVERED\" };\n        return {\n          path: \"session\",\n          parentCid: session.delegationCid,\n          expiresAt: signed.expiresAt * 1000,\n        };\n      }\n      if (authority.sessionOnly) return sessionGrant;\n      return planOrRefusal(replicationEntries(session.spaceId, prefix));\n    },\n    async mint(\n      deviceDid: string,\n      prefix: string,\n      signal: AbortSignal,\n    ): Promise<{ ucan: string; parentCid: string; expiresAt: number }> {\n      if (authority.sessionOnly) throw new Error(\"compact delegate sessions cannot mint device grants\");\n      const session = host.replicationSession();\n      if (session === undefined) throw new Error(\"replication mint without a session\");\n      const entries = replicationEntries(session.spaceId, prefix);\n      const plan = planOrRefusal(entries);\n      if (\"refused\" in plan) {\n        throw Object.assign(\n          new Error(`replication authority refused the mint: ${plan.refused}`),\n          { refused: plan.refused },\n        );\n      }\n      signal.throwIfAborted();\n      const minted = await new Promise<{ ucan: string; expiresAt: number }>((resolve, reject) => {\n        const onAbort = (): void => reject(signal.reason ?? new Error(\"replication mint aborted\"));\n        signal.addEventListener(\"abort\", onAbort, { once: true });\n        host.mintDelegation(deviceDid, entries).then(\n          (result) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            resolve(result);\n          },\n          (error: unknown) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            reject(error instanceof Error ? error : new Error(String(error)));\n          },\n        );\n      });\n      return { ucan: minted.ucan, parentCid: plan.parentCid, expiresAt: minted.expiresAt };\n    },\n  };\n  return authority;\n}\n","import { kvPrefixCovers, type ReplicationOptions } from \"@tinycloud/sdk-services\";\n\n/** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */\nexport function assertValidReplicationConfig(\n  replication: (ReplicationOptions & { storage?: unknown }) | undefined,\n): void {\n  if (replication === undefined || replication.enabled !== true) return;\n  if (replication.storage === undefined || replication.storage === null) {\n    throw new TypeError(\"replication.enabled requires replication.storage\");\n  }\n  if (!Array.isArray(replication.prefixes) || replication.prefixes.length === 0) {\n    throw new TypeError(\"replication.prefixes must be a non-empty array\");\n  }\n  for (const prefix of replication.prefixes) {\n    if (typeof prefix !== \"string\" || prefix === \"\") {\n      throw new TypeError(\"replication.prefixes must not contain an empty prefix\");\n    }\n  }\n  for (const [index, prefix] of replication.prefixes.entries()) {\n    for (const other of replication.prefixes.slice(index + 1)) {\n      if (kvPrefixCovers(prefix, other) || kvPrefixCovers(other, prefix)) {\n        throw new TypeError(\n          `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`,\n        );\n      }\n    }\n    if (prefix.split(\"/\", 1)[0] === \"vault\" && replication.allowSecrets !== true) {\n      throw new TypeError(\n        `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`,\n      );\n    }\n  }\n}\n","import {\n  grantPathsForSelector,\n  KV,\n  isCapabilitySubset,\n  type PermissionEntry,\n  type ReplicationOptions,\n} from \"@tinycloud/sdk-core\";\nimport { requiresSecretsOptIn } from \"@tinycloud/sdk-services\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\nexport function hasUnrestrictedGetCoverage(\n  entries: readonly PermissionEntry[],\n  spaceId: string,\n  prefix: string,\n): boolean {\n  const requiredPaths = grantPathsForSelector(prefix);\n  return isCapabilitySubset(\n    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),\n    [...entries],\n  ).subset;\n}\n\nexport function augmentSignInEntriesWithReplication(input: {\n  entries: readonly PermissionEntry[];\n  primarySpaceId: string;\n  replication?: Pick<ReplicationOptions, \"prefixes\" | \"allowSecrets\">;\n}): PermissionEntry[] {\n  const out: PermissionEntry[] = [];\n  const replication = input.replication;\n  if (replication === undefined) return out;\n  for (const prefix of replication.prefixes) {\n    if (\n      requiresSecretsOptIn(input.primarySpaceId, prefix) &&\n      replication.allowSecrets !== true\n    ) {\n      continue;\n    }\n    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {\n      continue;\n    }\n    for (const path of grantPathsForSelector(prefix)) {\n      out.push({\n        service: KV_SERVICE,\n        space: input.primarySpaceId,\n        path,\n        actions: [KV_GET, KV_SYNC],\n      });\n    }\n  }\n  return out;\n}\n"],"mappings":";AAeA;AAAA,EACE,yBAAAA;AAAA,EACA;AAAA,EACA,MAAAC;AAAA,EACA;AAAA,EACA,sBAAAC;AAAA,EACA;AAAA,OAGK;AAQP,SAAS,kBAAkB,6BAA6B;;;AChCxD,SAAS,sBAA+C;AAGjD,SAAS,6BACd,aACM;AACN,MAAI,gBAAgB,UAAa,YAAY,YAAY,KAAM;AAC/D,MAAI,YAAY,YAAY,UAAa,YAAY,YAAY,MAAM;AACrE,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,MAAI,CAAC,MAAM,QAAQ,YAAY,QAAQ,KAAK,YAAY,SAAS,WAAW,GAAG;AAC7E,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,aAAW,UAAU,YAAY,UAAU;AACzC,QAAI,OAAO,WAAW,YAAY,WAAW,IAAI;AAC/C,YAAM,IAAI,UAAU,uDAAuD;AAAA,IAC7E;AAAA,EACF;AACA,aAAW,CAAC,OAAO,MAAM,KAAK,YAAY,SAAS,QAAQ,GAAG;AAC5D,eAAW,SAAS,YAAY,SAAS,MAAM,QAAQ,CAAC,GAAG;AACzD,UAAI,eAAe,QAAQ,KAAK,KAAK,eAAe,OAAO,MAAM,GAAG;AAClE,cAAM,IAAI;AAAA,UACR,0CAA0C,KAAK,UAAU,MAAM,CAAC,QAAQ,KAAK,UAAU,KAAK,CAAC;AAAA,QAC/F;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,WAAW,YAAY,iBAAiB,MAAM;AAC5E,YAAM,IAAI;AAAA,QACR,sBAAsB,KAAK,UAAU,MAAM,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACF;;;AChCA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,4BAA4B;AAErC,IAAM,SAAS,GAAG;AAClB,IAAM,UAAU,GAAG;AACnB,IAAM,aAAa;AAEZ,SAAS,2BACd,SACA,SACA,QACS;AACT,QAAM,gBAAgB,sBAAsB,MAAM;AAClD,SAAO;AAAA,IACL,cAAc,IAAI,CAAC,UAAU,EAAE,SAAS,YAAY,OAAO,SAAS,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9F,CAAC,GAAG,OAAO;AAAA,EACb,EAAE;AACJ;AAEO,SAAS,oCAAoC,OAI9B;AACpB,QAAM,MAAyB,CAAC;AAChC,QAAM,cAAc,MAAM;AAC1B,MAAI,gBAAgB,OAAW,QAAO;AACtC,aAAW,UAAU,YAAY,UAAU;AACzC,QACE,qBAAqB,MAAM,gBAAgB,MAAM,KACjD,YAAY,iBAAiB,MAC7B;AACA;AAAA,IACF;AACA,QAAI,CAAC,2BAA2B,MAAM,SAAS,MAAM,gBAAgB,MAAM,GAAG;AAC5E;AAAA,IACF;AACA,eAAW,QAAQ,sBAAsB,MAAM,GAAG;AAChD,UAAI,KAAK;AAAA,QACP,SAAS;AAAA,QACT,OAAO,MAAM;AAAA,QACb;AAAA,QACA,SAAS,CAAC,QAAQ,OAAO;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;;;AFpBA,IAAM,iBAAiB;AAIvB,IAAMC,UAASC,IAAG;AAClB,IAAMC,WAAUD,IAAG;AACnB,IAAME,cAAa;AAGnB,SAAS,mBAAmB,SAAiB,QAAmC;AAC9E,SAAOC,uBAAsB,MAAM,EAAE,IAAI,CAAC,UAAU;AAAA,IAClD,SAASD;AAAA,IACT,OAAO;AAAA,IACP;AAAA,IACA,SAAS,CAACH,SAAQE,QAAO;AAAA,EAC3B,EAAE;AACJ;AAUA,SAAS,4BAA4B,OAAyB;AAC5D,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,WAAW,GAAG;AACzF,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,MAAI;AACF,WACE,yBAAyB,KAAkC,MAC3D,yBAAyB,MAAS;AAAA,EAEtC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,iBAAiB,UAAkB,OAAmC;AAC7E,aAAW,QAAQ,CAAC,GAAG,KAAK,QAAQ,eAAe,KAAK,MAAM,GAAG;AAC/D,QAAI,SAAS,WAAW,IAAI,EAAG,QAAO,SAAS,MAAM,KAAK,MAAM;AAAA,EAClE;AACA,SAAO;AACT;AAOO,SAAS,cACd,KACA,OACA,QACA,SACA,SACS;AACT,QAAM,gBAAgB,OAAO,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,GAAG,MAAM,GAAG;AAC7E,SAAO,cAAc,MAAM,CAAC,kBAAkB;AAC5C,eAAW,CAAC,UAAU,SAAS,KAAK,OAAO,QAAQ,GAAG,GAAG;AACvD,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,UAAI,SAAS,OAAW;AACxB,iBAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC1D,YAAI,CAAC,eAAe,SAAS,OAAO,EAAG;AACvC,YAAI,CAACG;AAAA,UACH,CAAC,EAAE,SAASF,aAAY,OAAO,MAAM,eAAe,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,UACxE,CAAC,EAAE,SAASA,aAAY,OAAO,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,QAC3D,EAAE,OAAQ;AACV,YAAI,SAAS,kBAAkB,QAAQ,4BAA4B,OAAO,EAAG,QAAO;AAAA,MACtF;AAAA,IACF;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,wBACd,KACA,OACA,QACS;AACT,SACE,cAAc,KAAK,OAAO,QAAQH,OAAM,KACxC,cAAc,KAAK,OAAO,QAAQE,QAAO;AAE7C;AAiCO,IAAM,6BAA6B;AAInC,SAAS,kCAAkC,OAKG;AACnD,MAAI;AACJ,MAAI;AACF,YAAQ,eAAe,MAAM,iBAAiB,aAAa;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAChE,MACE,MAAM,QAAQ,MAAM,iBACpB,QAAQ,MAAM,QAAQ,MAAM,QAAQ,MAAM,kBAAkB,EAC5D,QAAO;AACT,aAAW,YAAY,OAAO,KAAK,MAAM,GAAG,GAAG;AAC7C,UAAM,QAAQ,SAAS,MAAM,iCAAiC,IAAI,CAAC;AACnE,QAAI,UAAU,MAAM,eAAgB;AACpC,UAAM,QAAQ,cAAc,KAAK;AACjC,QAAI,OAAO,SAAS,MAAM,WAAW,MAAM,QAAS,QAAO,EAAE,OAAO,WAAW,MAAM,MAAM;AAAA,EAC7F;AACA,SAAO;AACT;AACO,SAAS,2BAA2B,MAAsD;AAC/F,QAAM,gBAAgB,CAAC,YAAwE;AAC7F,UAAM,OAAO,KAAK,eAAe,OAAO;AACxC,QAAI,aAAa,KAAM,QAAO;AAC9B,WAAO,EAAE,MAAM,KAAK,MAAM,WAAW,KAAK,WAAW,WAAW,KAAK,UAAU;AAAA,EACjF;AACA,QAAM,kBAAkB,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AACxE,QAAM,qBAAqB,CAAC,YAAyC;AACnE,UAAM,QAAQ,eAAe,QAAQ,iBAAiB,aAAa;AACnE,QACE,MAAM,QAAQ,QAAQ,iBACtB,gBAAgB,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,kBAAkB,EAC9E,QAAO;AACT,WAAO;AAAA,EACT;AACA,QAAM,YAAkC;AAAA,IACtC,IAAI,cAAc;AAChB,YAAM,UAAU,KAAK,mBAAmB;AACxC,aAAO,YAAY,UAAa,QAAQ,SAAS;AAAA,IACnD;AAAA,IACA,aAAa,QAA4E;AACvF,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,aAAa,QAAQ,OAAO,KAAK,eAAe,QAAQ,IAAI,GAAG,QAAQ,IAAI;AACjF,UAAI,eAAe,UAAa,cAAc,KAAK,IAAI,IAAI,4BAA4B;AACrF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,UAAI;AACJ,UAAI;AACF,cAAM,WAAW,mBAAmB,OAAO;AAC3C,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,cAAc;AAC/C,gBAAQ;AAAA,MACV,QAAQ;AACN,eAAO,EAAE,SAAS,cAAc;AAAA,MAClC;AACA,YAAM,cAAc,MAAM,cAAc,OAAO,SAAY,MAAM,YAAY;AAC7E,UAAI,gBAAgB,UAAa,eAAe,KAAK,IAAI,IAAI,4BAA4B;AACvF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,YAAM,UAAU,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQF,SAAQ,EAAE,eAAe,KAAK,CAAC,KAC/F,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQE,UAAS,EAAE,eAAe,KAAK,CAAC;AACpF,UAAI,CAAC,QAAS,QAAO,EAAE,SAAS,cAAc;AAC9C,UAAI,CAAC,wBAAwB,MAAM,KAAK,QAAQ,SAAS,MAAM,GAAG;AAChE,eAAO,EAAE,SAAS,qBAAqB;AAAA,MACzC;AACA,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,QAAQ,EAAE,KAAK,QAAQ,oBAAoB,KAAK,QAAQ,IAAI;AAAA,MAC9D;AAAA,IACF;AAAA,IACA,KAAK,QAAyD;AAC5D,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,eAAe,KAAK,aAAa,MAAM;AAC7C,UAAI,EAAE,aAAa,eAAe;AAChC,cAAM,SAAS,mBAAmB,OAAO;AACzC,YAAI,CAAC,UAAU,OAAO,cAAc,KAAM,QAAO,EAAE,SAAS,cAAc;AAC1E,eAAO;AAAA,UACL,MAAM;AAAA,UACN,WAAW,QAAQ;AAAA,UACnB,WAAW,OAAO,YAAY;AAAA,QAChC;AAAA,MACF;AACA,UAAI,UAAU,YAAa,QAAO;AAClC,aAAO,cAAc,mBAAmB,QAAQ,SAAS,MAAM,CAAC;AAAA,IAClE;AAAA,IACA,MAAM,KACJ,WACA,QACA,QACiE;AACjE,UAAI,UAAU,YAAa,OAAM,IAAI,MAAM,qDAAqD;AAChG,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,OAAM,IAAI,MAAM,oCAAoC;AAC/E,YAAM,UAAU,mBAAmB,QAAQ,SAAS,MAAM;AAC1D,YAAM,OAAO,cAAc,OAAO;AAClC,UAAI,aAAa,MAAM;AACrB,cAAM,OAAO;AAAA,UACX,IAAI,MAAM,2CAA2C,KAAK,OAAO,EAAE;AAAA,UACnE,EAAE,SAAS,KAAK,QAAQ;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,eAAe;AACtB,YAAM,SAAS,MAAM,IAAI,QAA6C,CAAC,SAAS,WAAW;AACzF,cAAM,UAAU,MAAY,OAAO,OAAO,UAAU,IAAI,MAAM,0BAA0B,CAAC;AACzF,eAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,aAAK,eAAe,WAAW,OAAO,EAAE;AAAA,UACtC,CAAC,WAAW;AACV,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,oBAAQ,MAAM;AAAA,UAChB;AAAA,UACA,CAAC,UAAmB;AAClB,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,mBAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,UAClE;AAAA,QACF;AAAA,MACF,CAAC;AACD,aAAO,EAAE,MAAM,OAAO,MAAM,WAAW,KAAK,WAAW,WAAW,OAAO,UAAU;AAAA,IACrF;AAAA,EACF;AACA,SAAO;AACT;","names":["grantPathsForSelector","KV","isCapabilitySubset","KV_GET","KV","KV_SYNC","KV_SERVICE","grantPathsForSelector","isCapabilitySubset"]}