@tinycloud/node-sdk 3.2.0-beta.3 → 3.2.0-beta.5

package/dist/{WasmKeyProvider-DjfRu9aL.d.cts → WasmKeyProvider-D2gBxuiY.d.cts}

@@ -329,6 +329,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private _address?;
     private _chainId?;
     private _nodeFeatures;
+    private _nodeFeaturesKnown;
     /**
      * `nodeId` from the `GET /info` performed during sign-in/restore, tagged with
      * the host it came from. Callers that need the node DID (encryption-network
@@ -383,7 +384,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     setRestoredTinyCloudSession(session: TinyCloudSession, hosts?: string[]): void;
     /** @internal Atomically adopt the state staged by TinyCloudNode.restoreSession. */
-    installRestoredSession(sessionManager: ISessionManager, session: TinyCloudSession | undefined, hosts?: string[]): void;
+    installRestoredSession(sessionManager: ISessionManager, session: TinyCloudSession | undefined, hosts?: string[], nodeFeatures?: string[]): void;
     /**
      * Ensure `tinycloudHosts` are resolved before a host-needing call.
      *
@@ -403,6 +404,8 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private requireTinyCloudHosts;
     private get primaryTinyCloudHost();
     get nodeFeatures(): string[];
+    get nodeFeaturesKnown(): boolean;
+    refreshNodeInfo(): Promise<void>;
     /**
      * The node DID reported by `GET /info` for `host`, if the sign-in (or
      * restore) that populated it targeted that same host. Returns `undefined`
@@ -1474,6 +1477,7 @@ declare class TinyCloudNode {
      * {@link currentTinyCloudSession} as a fallback for `auth.tinyCloudSession`.
      */
     private _restoredTcSession?;
+    private _restoredNodeFeatures?;
     private _activeServiceSession?;
     /**
      * True when the last signIn() detected an interactive signer and skipped
@@ -1504,6 +1508,7 @@ declare class TinyCloudNode {
         warnings?: BootstrapWarning[];
     };
     private get nodeFeatures();
+    private get replicationNodeFeatures();
     /** SIWE domain — uses config override or defaults to app.tinycloud.xyz */
     private get siweDomain();
     private readonly invokeWithRuntimePermissions;

package/dist/{WasmKeyProvider-DjfRu9aL.d.ts → WasmKeyProvider-D2gBxuiY.d.ts}

@@ -329,6 +329,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private _address?;
     private _chainId?;
     private _nodeFeatures;
+    private _nodeFeaturesKnown;
     /**
      * `nodeId` from the `GET /info` performed during sign-in/restore, tagged with
      * the host it came from. Callers that need the node DID (encryption-network
@@ -383,7 +384,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     setRestoredTinyCloudSession(session: TinyCloudSession, hosts?: string[]): void;
     /** @internal Atomically adopt the state staged by TinyCloudNode.restoreSession. */
-    installRestoredSession(sessionManager: ISessionManager, session: TinyCloudSession | undefined, hosts?: string[]): void;
+    installRestoredSession(sessionManager: ISessionManager, session: TinyCloudSession | undefined, hosts?: string[], nodeFeatures?: string[]): void;
     /**
      * Ensure `tinycloudHosts` are resolved before a host-needing call.
      *
@@ -403,6 +404,8 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private requireTinyCloudHosts;
     private get primaryTinyCloudHost();
     get nodeFeatures(): string[];
+    get nodeFeaturesKnown(): boolean;
+    refreshNodeInfo(): Promise<void>;
     /**
      * The node DID reported by `GET /info` for `host`, if the sign-in (or
      * restore) that populated it targeted that same host. Returns `undefined`
@@ -1474,6 +1477,7 @@ declare class TinyCloudNode {
      * {@link currentTinyCloudSession} as a fallback for `auth.tinyCloudSession`.
      */
     private _restoredTcSession?;
+    private _restoredNodeFeatures?;
     private _activeServiceSession?;
     /**
      * True when the last signIn() detected an interactive signer and skipped
@@ -1504,6 +1508,7 @@ declare class TinyCloudNode {
         warnings?: BootstrapWarning[];
     };
     private get nodeFeatures();
+    private get replicationNodeFeatures();
     /** SIWE domain — uses config override or defaults to app.tinycloud.xyz */
     private get siweDomain();
     private readonly invokeWithRuntimePermissions;

package/dist/{authority-mTQEgN56.d.cts → authority-DDGtccBK.d.cts}

@@ -1,5 +1,5 @@
-import { PermissionEntry, ReplicationOptions as ReplicationOptions$1, TinyCloudSession } from '@tinycloud/sdk-core';
-import { ReplicationOptions, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
+import { ReplicationOptions, PermissionEntry, TinyCloudSession } from '@tinycloud/sdk-core';
+import { AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {
@@ -10,7 +10,7 @@ declare function hasUnrestrictedGetCoverage(entries: readonly PermissionEntry[],
 declare function augmentSignInEntriesWithReplication(input: {
     entries: readonly PermissionEntry[];
     primarySpaceId: string;
-    replication?: Pick<ReplicationOptions$1, "prefixes" | "allowSecrets">;
+    replication?: Pick<ReplicationOptions, "prefixes" | "allowSecrets">;
 }): PermissionEntry[];
 
 /**
@@ -29,9 +29,8 @@ declare function augmentSignInEntriesWithReplication(input: {
  */
 
 /**
- * Whether the signed `att` grants `ability` over the selected namespace, with
- * each grant unrestricted (no caveats). A bare selector requires both its
- * exact key and its slash descendants; a trailing-slash selector is one range.
+ * Whether the signed `att` grants `ability` over the folder prefix, with
+ * unrestricted authority unless explicitly asked to ignore caveats.
  */
 declare function ucanAttCovers(att: Record<string, Record<string, unknown>>, space: string, prefix: string, ability: string, options?: {
     ignoreCaveats?: boolean;

package/dist/{authority-mTQEgN56.d.ts → authority-DDGtccBK.d.ts}

@@ -1,5 +1,5 @@
-import { PermissionEntry, ReplicationOptions as ReplicationOptions$1, TinyCloudSession } from '@tinycloud/sdk-core';
-import { ReplicationOptions, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
+import { ReplicationOptions, PermissionEntry, TinyCloudSession } from '@tinycloud/sdk-core';
+import { AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {
@@ -10,7 +10,7 @@ declare function hasUnrestrictedGetCoverage(entries: readonly PermissionEntry[],
 declare function augmentSignInEntriesWithReplication(input: {
     entries: readonly PermissionEntry[];
     primarySpaceId: string;
-    replication?: Pick<ReplicationOptions$1, "prefixes" | "allowSecrets">;
+    replication?: Pick<ReplicationOptions, "prefixes" | "allowSecrets">;
 }): PermissionEntry[];
 
 /**
@@ -29,9 +29,8 @@ declare function augmentSignInEntriesWithReplication(input: {
  */
 
 /**
- * Whether the signed `att` grants `ability` over the selected namespace, with
- * each grant unrestricted (no caveats). A bare selector requires both its
- * exact key and its slash descendants; a trailing-slash selector is one range.
+ * Whether the signed `att` grants `ability` over the folder prefix, with
+ * unrestricted authority unless explicitly asked to ignore caveats.
  */
 declare function ucanAttCovers(att: Record<string, Record<string, unknown>>, space: string, prefix: string, ability: string, options?: {
     ignoreCaveats?: boolean;

package/dist/core.cjs

@@ -347,13 +347,13 @@ var import_sdk_core4 = require("@tinycloud/sdk-core");
 // src/replication/authority-sign-in.ts
 var import_sdk_core2 = require("@tinycloud/sdk-core");
 var import_sdk_services = require("@tinycloud/sdk-services");
+var import_prefix = require("@tinycloud/sdk-services/kv/replication/prefix");
 var KV_GET = import_sdk_core2.KV.GET;
 var KV_SYNC = import_sdk_core2.KV.SYNC;
 var KV_SERVICE = "tinycloud.kv";
 function hasUnrestrictedGetCoverage(entries, spaceId, prefix) {
-  const requiredPaths = (0, import_sdk_core2.grantPathsForSelector)(prefix);
   return (0, import_sdk_core2.isCapabilitySubset)(
-    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),
+    [{ service: KV_SERVICE, space: spaceId, path: prefix, actions: [KV_GET] }],
     [...entries]
   ).subset;
 }
@@ -361,21 +361,33 @@ function augmentSignInEntriesWithReplication(input) {
   const out = [];
   const replication = input.replication;
   if (replication === void 0) return out;
+  const eligiblePaths = [];
   for (const prefix of replication.prefixes) {
+    (0, import_prefix.assertFolderPrefix)(prefix);
+    const path = prefix === "/" ? "" : prefix;
     if ((0, import_sdk_services.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
       continue;
     }
-    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {
+    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, path)) {
       continue;
     }
-    for (const path of (0, import_sdk_core2.grantPathsForSelector)(prefix)) {
-      out.push({
-        service: KV_SERVICE,
-        space: input.primarySpaceId,
-        path,
-        actions: [KV_GET, KV_SYNC]
-      });
-    }
+    eligiblePaths.push(path);
+  }
+  if (eligiblePaths.length === replication.prefixes.length && eligiblePaths.length > 0 && hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, "")) {
+    return [{
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path: "",
+      actions: [KV_GET, KV_SYNC]
+    }];
+  }
+  for (const path of eligiblePaths) {
+    out.push({
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path,
+      actions: [KV_GET, KV_SYNC]
+    });
   }
   return out;
 }
@@ -444,6 +456,7 @@ var NodeUserAuthorization = class {
     this.activeSessionKeyId = "default";
     this.extensions = [];
     this._nodeFeatures = [];
+    this._nodeFeaturesKnown = false;
     this._lastActivationSkippedSpaceIds = [];
     this.wasm = config.wasmBindings;
     this.signer = config.signer;
@@ -567,8 +580,11 @@ var NodeUserAuthorization = class {
     }
   }
   /** @internal Atomically adopt the state staged by TinyCloudNode.restoreSession. */
-  installRestoredSession(sessionManager, session, hosts) {
+  installRestoredSession(sessionManager, session, hosts, nodeFeatures) {
     this.sessionManager = sessionManager;
+    this._nodeFeatures = nodeFeatures === void 0 ? [] : [...nodeFeatures];
+    this._nodeFeaturesKnown = nodeFeatures !== void 0;
+    this._nodeInfoIdentity = void 0;
     this.tinycloudHosts = hosts && hosts.length > 0 ? [...hosts] : void 0;
     this._lastActivationSkippedSpaceIds = [];
     if (!session) {
@@ -643,6 +659,16 @@ var NodeUserAuthorization = class {
   get nodeFeatures() {
     return this._nodeFeatures;
   }
+  get nodeFeaturesKnown() {
+    return this._nodeFeaturesKnown;
+  }
+  async refreshNodeInfo() {
+    const infoHost = this.primaryTinyCloudHost;
+    const nodeInfo = await (0, import_sdk_core4.checkNodeInfo)(infoHost, this.wasm.protocolVersion());
+    this._nodeFeatures = nodeInfo.features;
+    this._nodeFeaturesKnown = true;
+    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+  }
   /**
    * The node DID reported by `GET /info` for `host`, if the sign-in (or
    * restore) that populated it targeted that same host. Returns `undefined`
@@ -1306,13 +1332,7 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await (0, import_sdk_core4.checkNodeInfo)(
-      infoHost,
-      this.wasm.protocolVersion()
-    );
-    this._nodeFeatures = nodeInfo.features;
-    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+    await this.refreshNodeInfo();
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -1478,13 +1498,7 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await (0, import_sdk_core4.checkNodeInfo)(
-      infoHost,
-      this.wasm.protocolVersion()
-    );
-    this._nodeFeatures = nodeInfo.features;
-    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+    await this.refreshNodeInfo();
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -2437,7 +2451,7 @@ function deserializeDelegation(data) {
 }
 
 // src/replication/config.ts
-var import_sdk_services2 = require("@tinycloud/sdk-services");
+var import_prefix2 = require("@tinycloud/sdk-services/kv/replication/prefix");
 function assertValidReplicationConfig(replication) {
   if (replication === void 0 || replication.enabled !== true) return;
   if (replication.storage === void 0 || replication.storage === null) {
@@ -2447,19 +2461,21 @@ function assertValidReplicationConfig(replication) {
     throw new TypeError("replication.prefixes must be a non-empty array");
   }
   for (const prefix of replication.prefixes) {
-    if (typeof prefix !== "string" || prefix === "") {
-      throw new TypeError("replication.prefixes must not contain an empty prefix");
+    try {
+      (0, import_prefix2.assertFolderPrefix)(prefix);
+    } catch (error) {
+      throw new TypeError(error instanceof Error ? error.message : String(error));
     }
   }
   for (const [index, prefix] of replication.prefixes.entries()) {
     for (const other of replication.prefixes.slice(index + 1)) {
-      if ((0, import_sdk_services2.kvPrefixCovers)(prefix, other) || (0, import_sdk_services2.kvPrefixCovers)(other, prefix)) {
+      if ((0, import_prefix2.kvPrefixCovers)(prefix, other) || (0, import_prefix2.kvPrefixCovers)(other, prefix)) {
         throw new TypeError(
           `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`
         );
       }
     }
-    if (prefix.split("/", 1)[0] === "vault" && replication.allowSecrets !== true) {
+    if ((prefix === "/" || prefix.split("/", 1)[0] === "vault") && replication.allowSecrets !== true) {
       throw new TypeError(
         `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`
       );
@@ -2469,7 +2485,7 @@ function assertValidReplicationConfig(replication) {
 
 // src/TinyCloudNode.ts
 var import_sdk_core10 = require("@tinycloud/sdk-core");
-var import_sdk_services3 = require("@tinycloud/sdk-services");
+var import_sdk_services2 = require("@tinycloud/sdk-services");
 
 // src/account/AccountService.ts
 var import_sdk_core6 = require("@tinycloud/sdk-core");
@@ -3567,7 +3583,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     return this._bootstrapStatus;
   }
   get nodeFeatures() {
-    return this.auth?.nodeFeatures ?? [];
+    return this.auth?.nodeFeatures ?? this._restoredNodeFeatures ?? [];
+  }
+  get replicationNodeFeatures() {
+    if (this.auth) return this.auth.nodeFeaturesKnown ? this.auth.nodeFeatures : void 0;
+    return this._restoredNodeFeatures;
   }
   /** SIWE domain — uses config override or defaults to app.tinycloud.xyz */
   get siweDomain() {
@@ -4920,6 +4940,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       sessionData.chainId
     );
     const stagedHost = resolvedHost ?? this.config.host;
+    let restoredNodeFeatures;
+    if (this.config.replication?.enabled) {
+      try {
+        restoredNodeFeatures = (await (0, import_sdk_core10.checkNodeInfo)(stagedHost, this.wasmBindings.protocolVersion())).features;
+      } catch (error) {
+        if (!(error instanceof import_sdk_core10.VersionCheckError)) throw error;
+      }
+    }
     const stagedAddress = restoredAddress;
     const stagedChainId = sessionData.chainId ?? 1;
     let replicationPrincipal;
@@ -5022,8 +5050,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._recapOperationsCache = stagedPrimary.cache;
     this.runtimePermissionGrants = stagedPrimary.grants;
     this.confirmedHostedSpaceIds.clear();
+    this._restoredNodeFeatures = restoredNodeFeatures;
     if (this.auth) {
-      this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost]);
+      this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost], restoredNodeFeatures);
       this._restoredTcSession = void 0;
     } else {
       this._restoredTcSession = stagedTcSession;
@@ -5853,7 +5882,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         graph.assertActive();
         if (!response.ok) {
-          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services3.parsePermissionHint)({
+          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services2.parsePermissionHint)({
             service: "tinycloud.encryption",
             path: networkId,
             actions: ["tinycloud.encryption/decrypt"]
@@ -6621,7 +6650,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     );
     if (result.status !== "ok") {
       if (result.status === "permission_required") {
-        const hint = (0, import_sdk_services3.parsePermissionHint)(result.hint);
+        const hint = (0, import_sdk_services2.parsePermissionHint)(result.hint);
         if (hint === void 0) return { status: "read_failed" };
         return {
           status: "permission_required",
@@ -7597,6 +7626,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       session,
       principal: identityPrincipal,
       authority,
+      nodeFeatures: this.replicationNodeFeatures,
       primaryKV: [{ space: session.spaceId, kv }]
     });
   }