@tinycloud/node-sdk 3.2.0-beta.3 → 3.2.0-beta.5

package/dist/replication/authority.cjs

@@ -34,7 +34,7 @@ var import_sdk_core2 = require("@tinycloud/sdk-core");
 var import_replica = require("@tinycloud/replica");
 
 // src/replication/config.ts
-var import_sdk_services = require("@tinycloud/sdk-services");
+var import_prefix = require("@tinycloud/sdk-services/kv/replication/prefix");
 function assertValidReplicationConfig(replication) {
   if (replication === void 0 || replication.enabled !== true) return;
   if (replication.storage === void 0 || replication.storage === null) {
@@ -44,19 +44,21 @@ function assertValidReplicationConfig(replication) {
     throw new TypeError("replication.prefixes must be a non-empty array");
   }
   for (const prefix of replication.prefixes) {
-    if (typeof prefix !== "string" || prefix === "") {
-      throw new TypeError("replication.prefixes must not contain an empty prefix");
+    try {
+      (0, import_prefix.assertFolderPrefix)(prefix);
+    } catch (error) {
+      throw new TypeError(error instanceof Error ? error.message : String(error));
     }
   }
   for (const [index, prefix] of replication.prefixes.entries()) {
     for (const other of replication.prefixes.slice(index + 1)) {
-      if ((0, import_sdk_services.kvPrefixCovers)(prefix, other) || (0, import_sdk_services.kvPrefixCovers)(other, prefix)) {
+      if ((0, import_prefix.kvPrefixCovers)(prefix, other) || (0, import_prefix.kvPrefixCovers)(other, prefix)) {
         throw new TypeError(
           `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`
         );
       }
     }
-    if (prefix.split("/", 1)[0] === "vault" && replication.allowSecrets !== true) {
+    if ((prefix === "/" || prefix.split("/", 1)[0] === "vault") && replication.allowSecrets !== true) {
       throw new TypeError(
         `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`
       );
@@ -66,14 +68,14 @@ function assertValidReplicationConfig(replication) {
 
 // src/replication/authority-sign-in.ts
 var import_sdk_core = require("@tinycloud/sdk-core");
-var import_sdk_services2 = require("@tinycloud/sdk-services");
+var import_sdk_services = require("@tinycloud/sdk-services");
+var import_prefix2 = require("@tinycloud/sdk-services/kv/replication/prefix");
 var KV_GET = import_sdk_core.KV.GET;
 var KV_SYNC = import_sdk_core.KV.SYNC;
 var KV_SERVICE = "tinycloud.kv";
 function hasUnrestrictedGetCoverage(entries, spaceId, prefix) {
-  const requiredPaths = (0, import_sdk_core.grantPathsForSelector)(prefix);
   return (0, import_sdk_core.isCapabilitySubset)(
-    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),
+    [{ service: KV_SERVICE, space: spaceId, path: prefix, actions: [KV_GET] }],
     [...entries]
   ).subset;
 }
@@ -81,21 +83,33 @@ function augmentSignInEntriesWithReplication(input) {
   const out = [];
   const replication = input.replication;
   if (replication === void 0) return out;
+  const eligiblePaths = [];
   for (const prefix of replication.prefixes) {
-    if ((0, import_sdk_services2.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
+    (0, import_prefix2.assertFolderPrefix)(prefix);
+    const path = prefix === "/" ? "" : prefix;
+    if ((0, import_sdk_services.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
       continue;
     }
-    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {
+    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, path)) {
       continue;
     }
-    for (const path of (0, import_sdk_core.grantPathsForSelector)(prefix)) {
-      out.push({
-        service: KV_SERVICE,
-        space: input.primarySpaceId,
-        path,
-        actions: [KV_GET, KV_SYNC]
-      });
-    }
+    eligiblePaths.push(path);
+  }
+  if (eligiblePaths.length === replication.prefixes.length && eligiblePaths.length > 0 && hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, "")) {
+    return [{
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path: "",
+      actions: [KV_GET, KV_SYNC]
+    }];
+  }
+  for (const path of eligiblePaths) {
+    out.push({
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path,
+      actions: [KV_GET, KV_SYNC]
+    });
   }
   return out;
 }
@@ -106,12 +120,12 @@ var KV_GET2 = import_sdk_core2.KV.GET;
 var KV_SYNC2 = import_sdk_core2.KV.SYNC;
 var KV_SERVICE2 = "tinycloud.kv";
 function replicationEntries(spaceId, prefix) {
-  return (0, import_sdk_core2.grantPathsForSelector)(prefix).map((path) => ({
+  return [{
     service: KV_SERVICE2,
     space: spaceId,
-    path,
+    path: prefix === "/" ? "" : prefix,
     actions: [KV_GET2, KV_SYNC2]
-  }));
+  }];
 }
 function caveatBranchesUnconstrained(value) {
   if (value === void 0 || value === null) return true;
@@ -126,28 +140,28 @@ function caveatBranchesUnconstrained(value) {
   }
 }
 function kvPathInResource(resource, space) {
+  for (const root of [`${space}/kv`, `tinycloud://${space}/kv`]) {
+    if (resource === root || resource === `${root}/`) return "/";
+  }
   for (const base of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {
     if (resource.startsWith(base)) return resource.slice(base.length);
   }
   return void 0;
 }
 function ucanAttCovers(att, space, prefix, ability, options) {
-  const requiredPaths = prefix.endsWith("/") ? [prefix] : [prefix, `${prefix}/`];
-  return requiredPaths.every((requestedPath) => {
-    for (const [resource, abilities] of Object.entries(att)) {
-      const path = kvPathInResource(resource, space);
-      if (path === void 0) continue;
-      for (const [granted, caveats] of Object.entries(abilities)) {
-        if (!(0, import_sdk_core2.actionContains)(granted, ability)) continue;
-        if (!(0, import_sdk_core2.isCapabilitySubset)(
-          [{ service: KV_SERVICE2, space, path: requestedPath, actions: [ability] }],
-          [{ service: KV_SERVICE2, space, path, actions: [granted] }]
-        ).subset) continue;
-        if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;
-      }
+  for (const [resource, abilities] of Object.entries(att)) {
+    const path = kvPathInResource(resource, space);
+    if (path === void 0) continue;
+    for (const [granted, caveats] of Object.entries(abilities)) {
+      if (!(0, import_sdk_core2.actionContains)(granted, ability)) continue;
+      if (!(0, import_sdk_core2.isCapabilitySubset)(
+        [{ service: KV_SERVICE2, space, path: prefix, actions: [ability] }],
+        [{ service: KV_SERVICE2, space, path, actions: [granted] }]
+      ).subset) continue;
+      if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;
     }
-    return false;
-  });
+  }
+  return false;
 }
 function ucanAttUnconstrainedFor(att, space, prefix) {
   return ucanAttCovers(att, space, prefix, KV_GET2) && ucanAttCovers(att, space, prefix, KV_SYNC2);
@@ -163,7 +177,7 @@ function replicationScopeFromSignedSession(input) {
   const bareDid = (value) => value.split("#", 1)[0];
   if (grant.cid !== input.delegationCid || bareDid(grant.audience) !== bareDid(input.verificationMethod)) return void 0;
   for (const resource of Object.keys(grant.att)) {
-    const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv\//)?.[1];
+    const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv(?:\/|$)/)?.[1];
     if (space !== input.persistedSpace) continue;
     const owner = (0, import_sdk_core2.parseSpaceUri)(space);
     if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };

package/dist/replication/authority.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/replication/authority.ts","../../src/replication/config.ts","../../src/replication/authority-sign-in.ts"],"sourcesContent":["/**\n * Replication authority (TC-858, plan v3 §4).\n *\n * `ReplicationAuthority` answers, per configured prefix, whether this node's\n * session can back a local replica: the session UCAN itself (delegate\n * posture), a child UCAN minted through `delegateTo`, or nothing (the\n * controller then reports `grant_missing` and reads from the network).\n *\n * The unrestricted-authority rule is enforced here, before any network work:\n * a prefix covered only by a caveated `get`/`sync` refuses with\n * `CAVEATED_AUTHORITY` — on the session path, the runtime-grant path, and on\n * any reuse of an installed grant (the adapter marks every grant's\n * `unconstrained` flag; the controller enforces it on reuse).\n */\n\nimport {\n  grantPathsForSelector,\n  actionContains,\n  KV,\n  canonicalizeRecapCaveats,\n  isCapabilitySubset,\n  parseSpaceUri,\n  type PermissionEntry,\n  type TinyCloudSession,\n} from \"@tinycloud/sdk-core\";\nimport {\n  type AuthorityRefusal,\n  type ReplicaDevice,\n  type ReplicationAuthority,\n} from \"@tinycloud/sdk-services\";\nimport type { ReplicaRuntime } from \"./replica-contract\";\n// @ts-ignore -- node-sdk builds before replica declarations; keep the literal import for bundlers.\nimport { parseUcanGrant as replicaParseUcanGrant } from \"@tinycloud/replica\";\nconst parseUcanGrant = replicaParseUcanGrant as ReplicaRuntime[\"parseUcanGrant\"];\nexport { assertValidReplicationConfig } from \"./config\";\nexport { augmentSignInEntriesWithReplication, hasUnrestrictedGetCoverage } from \"./authority-sign-in\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\n/** The delegation the replication grant delegates: get + sync on one prefix of the session space. */\nfunction replicationEntries(spaceId: string, prefix: string): PermissionEntry[] {\n  return grantPathsForSelector(prefix).map((path) => ({\n    service: KV_SERVICE,\n    space: spaceId,\n    path,\n    actions: [KV_GET, KV_SYNC],\n  }));\n}\n\n\n\n\n/**\n * The signed UCAN attenuation (`att`: resource → ability → caveat branches).\n * Only array branch sets are known; anything else is treated as constrained —\n * fail closed, never assume unconstrained.\n */\nfunction caveatBranchesUnconstrained(value: unknown): boolean {\n  if (value === undefined || value === null) return true;\n  if (typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length === 0) {\n    return true;\n  }\n  if (!Array.isArray(value)) return false;\n  try {\n    return (\n      canonicalizeRecapCaveats(value as Record<string, unknown>[]) ===\n      canonicalizeRecapCaveats(undefined)\n    );\n  } catch {\n    return false;\n  }\n}\n\n/** The KV path a signed UCAN resource names in `space`, like replica's `kvPathIn`. */\nfunction kvPathInResource(resource: string, space: string): string | undefined {\n  for (const base of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {\n    if (resource.startsWith(base)) return resource.slice(base.length);\n  }\n  return undefined;\n}\n\n/**\n * Whether the signed `att` grants `ability` over the selected namespace, with\n * each grant unrestricted (no caveats). A bare selector requires both its\n * exact key and its slash descendants; a trailing-slash selector is one range.\n */\nexport function ucanAttCovers(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n  ability: string,\n  options?: { ignoreCaveats?: boolean },\n): boolean {\n  const requiredPaths = prefix.endsWith(\"/\") ? [prefix] : [prefix, `${prefix}/`];\n  return requiredPaths.every((requestedPath) => {\n    for (const [resource, abilities] of Object.entries(att)) {\n      const path = kvPathInResource(resource, space);\n      if (path === undefined) continue;\n      for (const [granted, caveats] of Object.entries(abilities)) {\n        if (!actionContains(granted, ability)) continue;\n        if (!isCapabilitySubset(\n          [{ service: KV_SERVICE, space, path: requestedPath, actions: [ability] }],\n          [{ service: KV_SERVICE, space, path, actions: [granted] }],\n        ).subset) continue;\n        if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;\n      }\n    }\n    return false;\n  });\n}\n\n/** `unconstrained` for `ReplicaGrantInfo` (§2.1): get AND sync on the prefix carry no caveats. */\nexport function ucanAttUnconstrainedFor(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n): boolean {\n  return (\n    ucanAttCovers(att, space, prefix, KV_GET) &&\n    ucanAttCovers(att, space, prefix, KV_SYNC)\n  );\n}\n\nexport interface DelegationPlanResult {\n  path: \"session\" | \"runtime\";\n  parentCid: string;\n  expiresAt: number;\n}\n\n/**\n * The `TinyCloudNode` internals the authority needs. `planDelegation` is the\n * pure extraction of `delegateTo`'s parent selection (§4.3), so `plan` and\n * `mint` can never disagree about which parent or expiry a delegation gets.\n */\nexport type ReplicationAuthoritySession = Pick<\n  TinyCloudSession,\n  \"delegationHeader\" | \"delegationCid\" | \"spaceId\" | \"verificationMethod\" | \"jwk\"\n> & Partial<Pick<TinyCloudSession, \"siwe\">>;\n\nexport interface ReplicationAuthorityHost {\n  replicationSession(): ReplicationAuthoritySession | undefined;\n  /** The SIWE \"Expiration Time\" of the session — the delegateTo delegation cap. */\n  siweExpiration(siwe: string): Date | undefined;\n  planDelegation(\n    entries: PermissionEntry[],\n    options?: { expiry?: string | number },\n  ): ({ grant?: unknown } & DelegationPlanResult) | AuthorityRefusal;\n  mintDelegation(\n    deviceDid: string,\n    entries: PermissionEntry[],\n  ): Promise<{ ucan: string; expiresAt: number }>;\n}\n\n/** Milliseconds of validity a session or parent must have left for authority reuse (delegateTo's margin). */\nexport const AUTHORITY_EXPIRY_MARGIN_MS = 60_000;\n\n\n/** Verify a compact session delegation before using any persisted space metadata. */\nexport function replicationScopeFromSignedSession(input: {\n  delegationHeader: { Authorization: string };\n  delegationCid: string;\n  verificationMethod: string;\n  persistedSpace: string;\n}): { space: string; principal: string } | undefined {\n  let grant: ReturnType<typeof parseUcanGrant>;\n  try {\n    grant = parseUcanGrant(input.delegationHeader.Authorization);\n  } catch {\n    return undefined;\n  }\n  const bareDid = (value: string): string => value.split(\"#\", 1)[0]!;\n  if (\n    grant.cid !== input.delegationCid ||\n    bareDid(grant.audience) !== bareDid(input.verificationMethod)\n  ) return undefined;\n  for (const resource of Object.keys(grant.att)) {\n    const space = resource.match(/^(?:tinycloud:\\/\\/)?(.+?)\\/kv\\//)?.[1];\n    if (space !== input.persistedSpace) continue;\n    const owner = parseSpaceUri(space);\n    if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };\n  }\n  return undefined;\n}\nexport function createReplicationAuthority(host: ReplicationAuthorityHost): ReplicationAuthority {\n  const planOrRefusal = (entries: PermissionEntry[]): DelegationPlanResult | AuthorityRefusal => {\n    const plan = host.planDelegation(entries);\n    if (\"refused\" in plan) return plan;\n    return { path: plan.path, parentCid: plan.parentCid, expiresAt: plan.expiresAt };\n  };\n  const sessionAudience = (value: string): string => value.split(\"#\", 1)[0]!;\n  const signedSessionGrant = (session: ReplicationAuthoritySession) => {\n    const grant = parseUcanGrant(session.delegationHeader.Authorization);\n    if (\n      grant.cid !== session.delegationCid ||\n      sessionAudience(grant.audience) !== sessionAudience(session.verificationMethod)\n    ) return undefined;\n    return grant;\n  };\n  const authority: ReplicationAuthority = {\n    get sessionOnly() {\n      const session = host.replicationSession();\n      return session !== undefined && session.siwe === undefined;\n    },\n    sessionGrant(prefix: string): { ucan: string; device: ReplicaDevice } | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const siweExpiry = session.siwe ? host.siweExpiration(session.siwe)?.getTime() : undefined;\n      if (siweExpiry !== undefined && siweExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      let grant: ReturnType<typeof parseUcanGrant>;\n      try {\n        const verified = signedSessionGrant(session);\n        if (!verified) return { refused: \"NOT_COVERED\" };\n        grant = verified;\n      } catch {\n        return { refused: \"NOT_COVERED\" };\n      }\n      const tokenExpiry = grant.expiresAt === null ? undefined : grant.expiresAt * 1000;\n      if (tokenExpiry === undefined || tokenExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      const covered = ucanAttCovers(grant.att, session.spaceId, prefix, KV_GET, { ignoreCaveats: true }) &&\n        ucanAttCovers(grant.att, session.spaceId, prefix, KV_SYNC, { ignoreCaveats: true });\n      if (!covered) return { refused: \"NOT_COVERED\" };\n      if (!ucanAttUnconstrainedFor(grant.att, session.spaceId, prefix)) {\n        return { refused: \"CAVEATED_AUTHORITY\" };\n      }\n      return {\n        ucan: grant.jwt,\n        device: { did: session.verificationMethod, jwk: session.jwk },\n      };\n    },\n    plan(prefix: string): DelegationPlanResult | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const sessionGrant = this.sessionGrant(prefix);\n      if (!(\"refused\" in sessionGrant)) {\n        const signed = signedSessionGrant(session);\n        if (!signed || signed.expiresAt === null) return { refused: \"NOT_COVERED\" };\n        return {\n          path: \"session\",\n          parentCid: session.delegationCid,\n          expiresAt: signed.expiresAt * 1000,\n        };\n      }\n      if (authority.sessionOnly) return sessionGrant;\n      return planOrRefusal(replicationEntries(session.spaceId, prefix));\n    },\n    async mint(\n      deviceDid: string,\n      prefix: string,\n      signal: AbortSignal,\n    ): Promise<{ ucan: string; parentCid: string; expiresAt: number }> {\n      if (authority.sessionOnly) throw new Error(\"compact delegate sessions cannot mint device grants\");\n      const session = host.replicationSession();\n      if (session === undefined) throw new Error(\"replication mint without a session\");\n      const entries = replicationEntries(session.spaceId, prefix);\n      const plan = planOrRefusal(entries);\n      if (\"refused\" in plan) {\n        throw Object.assign(\n          new Error(`replication authority refused the mint: ${plan.refused}`),\n          { refused: plan.refused },\n        );\n      }\n      signal.throwIfAborted();\n      const minted = await new Promise<{ ucan: string; expiresAt: number }>((resolve, reject) => {\n        const onAbort = (): void => reject(signal.reason ?? new Error(\"replication mint aborted\"));\n        signal.addEventListener(\"abort\", onAbort, { once: true });\n        host.mintDelegation(deviceDid, entries).then(\n          (result) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            resolve(result);\n          },\n          (error: unknown) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            reject(error instanceof Error ? error : new Error(String(error)));\n          },\n        );\n      });\n      return { ucan: minted.ucan, parentCid: plan.parentCid, expiresAt: minted.expiresAt };\n    },\n  };\n  return authority;\n}\n","import { kvPrefixCovers, type ReplicationOptions } from \"@tinycloud/sdk-services\";\n\n/** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */\nexport function assertValidReplicationConfig(\n  replication: (ReplicationOptions & { storage?: unknown }) | undefined,\n): void {\n  if (replication === undefined || replication.enabled !== true) return;\n  if (replication.storage === undefined || replication.storage === null) {\n    throw new TypeError(\"replication.enabled requires replication.storage\");\n  }\n  if (!Array.isArray(replication.prefixes) || replication.prefixes.length === 0) {\n    throw new TypeError(\"replication.prefixes must be a non-empty array\");\n  }\n  for (const prefix of replication.prefixes) {\n    if (typeof prefix !== \"string\" || prefix === \"\") {\n      throw new TypeError(\"replication.prefixes must not contain an empty prefix\");\n    }\n  }\n  for (const [index, prefix] of replication.prefixes.entries()) {\n    for (const other of replication.prefixes.slice(index + 1)) {\n      if (kvPrefixCovers(prefix, other) || kvPrefixCovers(other, prefix)) {\n        throw new TypeError(\n          `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`,\n        );\n      }\n    }\n    if (prefix.split(\"/\", 1)[0] === \"vault\" && replication.allowSecrets !== true) {\n      throw new TypeError(\n        `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`,\n      );\n    }\n  }\n}\n","import {\n  grantPathsForSelector,\n  KV,\n  isCapabilitySubset,\n  type PermissionEntry,\n  type ReplicationOptions,\n} from \"@tinycloud/sdk-core\";\nimport { requiresSecretsOptIn } from \"@tinycloud/sdk-services\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\nexport function hasUnrestrictedGetCoverage(\n  entries: readonly PermissionEntry[],\n  spaceId: string,\n  prefix: string,\n): boolean {\n  const requiredPaths = grantPathsForSelector(prefix);\n  return isCapabilitySubset(\n    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),\n    [...entries],\n  ).subset;\n}\n\nexport function augmentSignInEntriesWithReplication(input: {\n  entries: readonly PermissionEntry[];\n  primarySpaceId: string;\n  replication?: Pick<ReplicationOptions, \"prefixes\" | \"allowSecrets\">;\n}): PermissionEntry[] {\n  const out: PermissionEntry[] = [];\n  const replication = input.replication;\n  if (replication === undefined) return out;\n  for (const prefix of replication.prefixes) {\n    if (\n      requiresSecretsOptIn(input.primarySpaceId, prefix) &&\n      replication.allowSecrets !== true\n    ) {\n      continue;\n    }\n    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {\n      continue;\n    }\n    for (const path of grantPathsForSelector(prefix)) {\n      out.push({\n        service: KV_SERVICE,\n        space: input.primarySpaceId,\n        path,\n        actions: [KV_GET, KV_SYNC],\n      });\n    }\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,IAAAA,mBASO;AAQP,qBAAwD;;;AChCxD,0BAAwD;AAGjD,SAAS,6BACd,aACM;AACN,MAAI,gBAAgB,UAAa,YAAY,YAAY,KAAM;AAC/D,MAAI,YAAY,YAAY,UAAa,YAAY,YAAY,MAAM;AACrE,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,MAAI,CAAC,MAAM,QAAQ,YAAY,QAAQ,KAAK,YAAY,SAAS,WAAW,GAAG;AAC7E,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,aAAW,UAAU,YAAY,UAAU;AACzC,QAAI,OAAO,WAAW,YAAY,WAAW,IAAI;AAC/C,YAAM,IAAI,UAAU,uDAAuD;AAAA,IAC7E;AAAA,EACF;AACA,aAAW,CAAC,OAAO,MAAM,KAAK,YAAY,SAAS,QAAQ,GAAG;AAC5D,eAAW,SAAS,YAAY,SAAS,MAAM,QAAQ,CAAC,GAAG;AACzD,cAAI,oCAAe,QAAQ,KAAK,SAAK,oCAAe,OAAO,MAAM,GAAG;AAClE,cAAM,IAAI;AAAA,UACR,0CAA0C,KAAK,UAAU,MAAM,CAAC,QAAQ,KAAK,UAAU,KAAK,CAAC;AAAA,QAC/F;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,WAAW,YAAY,iBAAiB,MAAM;AAC5E,YAAM,IAAI;AAAA,QACR,sBAAsB,KAAK,UAAU,MAAM,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACF;;;AChCA,sBAMO;AACP,IAAAC,uBAAqC;AAErC,IAAM,SAAS,mBAAG;AAClB,IAAM,UAAU,mBAAG;AACnB,IAAM,aAAa;AAEZ,SAAS,2BACd,SACA,SACA,QACS;AACT,QAAM,oBAAgB,uCAAsB,MAAM;AAClD,aAAO;AAAA,IACL,cAAc,IAAI,CAAC,UAAU,EAAE,SAAS,YAAY,OAAO,SAAS,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9F,CAAC,GAAG,OAAO;AAAA,EACb,EAAE;AACJ;AAEO,SAAS,oCAAoC,OAI9B;AACpB,QAAM,MAAyB,CAAC;AAChC,QAAM,cAAc,MAAM;AAC1B,MAAI,gBAAgB,OAAW,QAAO;AACtC,aAAW,UAAU,YAAY,UAAU;AACzC,YACE,2CAAqB,MAAM,gBAAgB,MAAM,KACjD,YAAY,iBAAiB,MAC7B;AACA;AAAA,IACF;AACA,QAAI,CAAC,2BAA2B,MAAM,SAAS,MAAM,gBAAgB,MAAM,GAAG;AAC5E;AAAA,IACF;AACA,eAAW,YAAQ,uCAAsB,MAAM,GAAG;AAChD,UAAI,KAAK;AAAA,QACP,SAAS;AAAA,QACT,OAAO,MAAM;AAAA,QACb;AAAA,QACA,SAAS,CAAC,QAAQ,OAAO;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;;;AFpBA,IAAM,iBAAiB,eAAAC;AAIvB,IAAMC,UAAS,oBAAG;AAClB,IAAMC,WAAU,oBAAG;AACnB,IAAMC,cAAa;AAGnB,SAAS,mBAAmB,SAAiB,QAAmC;AAC9E,aAAO,wCAAsB,MAAM,EAAE,IAAI,CAAC,UAAU;AAAA,IAClD,SAASA;AAAA,IACT,OAAO;AAAA,IACP;AAAA,IACA,SAAS,CAACF,SAAQC,QAAO;AAAA,EAC3B,EAAE;AACJ;AAUA,SAAS,4BAA4B,OAAyB;AAC5D,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,WAAW,GAAG;AACzF,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,MAAI;AACF,eACE,2CAAyB,KAAkC,UAC3D,2CAAyB,MAAS;AAAA,EAEtC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,iBAAiB,UAAkB,OAAmC;AAC7E,aAAW,QAAQ,CAAC,GAAG,KAAK,QAAQ,eAAe,KAAK,MAAM,GAAG;AAC/D,QAAI,SAAS,WAAW,IAAI,EAAG,QAAO,SAAS,MAAM,KAAK,MAAM;AAAA,EAClE;AACA,SAAO;AACT;AAOO,SAAS,cACd,KACA,OACA,QACA,SACA,SACS;AACT,QAAM,gBAAgB,OAAO,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,GAAG,MAAM,GAAG;AAC7E,SAAO,cAAc,MAAM,CAAC,kBAAkB;AAC5C,eAAW,CAAC,UAAU,SAAS,KAAK,OAAO,QAAQ,GAAG,GAAG;AACvD,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,UAAI,SAAS,OAAW;AACxB,iBAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC1D,YAAI,KAAC,iCAAe,SAAS,OAAO,EAAG;AACvC,YAAI,KAAC;AAAA,UACH,CAAC,EAAE,SAASC,aAAY,OAAO,MAAM,eAAe,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,UACxE,CAAC,EAAE,SAASA,aAAY,OAAO,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,QAC3D,EAAE,OAAQ;AACV,YAAI,SAAS,kBAAkB,QAAQ,4BAA4B,OAAO,EAAG,QAAO;AAAA,MACtF;AAAA,IACF;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,wBACd,KACA,OACA,QACS;AACT,SACE,cAAc,KAAK,OAAO,QAAQF,OAAM,KACxC,cAAc,KAAK,OAAO,QAAQC,QAAO;AAE7C;AAiCO,IAAM,6BAA6B;AAInC,SAAS,kCAAkC,OAKG;AACnD,MAAI;AACJ,MAAI;AACF,YAAQ,eAAe,MAAM,iBAAiB,aAAa;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAChE,MACE,MAAM,QAAQ,MAAM,iBACpB,QAAQ,MAAM,QAAQ,MAAM,QAAQ,MAAM,kBAAkB,EAC5D,QAAO;AACT,aAAW,YAAY,OAAO,KAAK,MAAM,GAAG,GAAG;AAC7C,UAAM,QAAQ,SAAS,MAAM,iCAAiC,IAAI,CAAC;AACnE,QAAI,UAAU,MAAM,eAAgB;AACpC,UAAM,YAAQ,gCAAc,KAAK;AACjC,QAAI,OAAO,SAAS,MAAM,WAAW,MAAM,QAAS,QAAO,EAAE,OAAO,WAAW,MAAM,MAAM;AAAA,EAC7F;AACA,SAAO;AACT;AACO,SAAS,2BAA2B,MAAsD;AAC/F,QAAM,gBAAgB,CAAC,YAAwE;AAC7F,UAAM,OAAO,KAAK,eAAe,OAAO;AACxC,QAAI,aAAa,KAAM,QAAO;AAC9B,WAAO,EAAE,MAAM,KAAK,MAAM,WAAW,KAAK,WAAW,WAAW,KAAK,UAAU;AAAA,EACjF;AACA,QAAM,kBAAkB,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AACxE,QAAM,qBAAqB,CAAC,YAAyC;AACnE,UAAM,QAAQ,eAAe,QAAQ,iBAAiB,aAAa;AACnE,QACE,MAAM,QAAQ,QAAQ,iBACtB,gBAAgB,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,kBAAkB,EAC9E,QAAO;AACT,WAAO;AAAA,EACT;AACA,QAAM,YAAkC;AAAA,IACtC,IAAI,cAAc;AAChB,YAAM,UAAU,KAAK,mBAAmB;AACxC,aAAO,YAAY,UAAa,QAAQ,SAAS;AAAA,IACnD;AAAA,IACA,aAAa,QAA4E;AACvF,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,aAAa,QAAQ,OAAO,KAAK,eAAe,QAAQ,IAAI,GAAG,QAAQ,IAAI;AACjF,UAAI,eAAe,UAAa,cAAc,KAAK,IAAI,IAAI,4BAA4B;AACrF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,UAAI;AACJ,UAAI;AACF,cAAM,WAAW,mBAAmB,OAAO;AAC3C,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,cAAc;AAC/C,gBAAQ;AAAA,MACV,QAAQ;AACN,eAAO,EAAE,SAAS,cAAc;AAAA,MAClC;AACA,YAAM,cAAc,MAAM,cAAc,OAAO,SAAY,MAAM,YAAY;AAC7E,UAAI,gBAAgB,UAAa,eAAe,KAAK,IAAI,IAAI,4BAA4B;AACvF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,YAAM,UAAU,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQD,SAAQ,EAAE,eAAe,KAAK,CAAC,KAC/F,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQC,UAAS,EAAE,eAAe,KAAK,CAAC;AACpF,UAAI,CAAC,QAAS,QAAO,EAAE,SAAS,cAAc;AAC9C,UAAI,CAAC,wBAAwB,MAAM,KAAK,QAAQ,SAAS,MAAM,GAAG;AAChE,eAAO,EAAE,SAAS,qBAAqB;AAAA,MACzC;AACA,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,QAAQ,EAAE,KAAK,QAAQ,oBAAoB,KAAK,QAAQ,IAAI;AAAA,MAC9D;AAAA,IACF;AAAA,IACA,KAAK,QAAyD;AAC5D,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,eAAe,KAAK,aAAa,MAAM;AAC7C,UAAI,EAAE,aAAa,eAAe;AAChC,cAAM,SAAS,mBAAmB,OAAO;AACzC,YAAI,CAAC,UAAU,OAAO,cAAc,KAAM,QAAO,EAAE,SAAS,cAAc;AAC1E,eAAO;AAAA,UACL,MAAM;AAAA,UACN,WAAW,QAAQ;AAAA,UACnB,WAAW,OAAO,YAAY;AAAA,QAChC;AAAA,MACF;AACA,UAAI,UAAU,YAAa,QAAO;AAClC,aAAO,cAAc,mBAAmB,QAAQ,SAAS,MAAM,CAAC;AAAA,IAClE;AAAA,IACA,MAAM,KACJ,WACA,QACA,QACiE;AACjE,UAAI,UAAU,YAAa,OAAM,IAAI,MAAM,qDAAqD;AAChG,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,OAAM,IAAI,MAAM,oCAAoC;AAC/E,YAAM,UAAU,mBAAmB,QAAQ,SAAS,MAAM;AAC1D,YAAM,OAAO,cAAc,OAAO;AAClC,UAAI,aAAa,MAAM;AACrB,cAAM,OAAO;AAAA,UACX,IAAI,MAAM,2CAA2C,KAAK,OAAO,EAAE;AAAA,UACnE,EAAE,SAAS,KAAK,QAAQ;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,eAAe;AACtB,YAAM,SAAS,MAAM,IAAI,QAA6C,CAAC,SAAS,WAAW;AACzF,cAAM,UAAU,MAAY,OAAO,OAAO,UAAU,IAAI,MAAM,0BAA0B,CAAC;AACzF,eAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,aAAK,eAAe,WAAW,OAAO,EAAE;AAAA,UACtC,CAAC,WAAW;AACV,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,oBAAQ,MAAM;AAAA,UAChB;AAAA,UACA,CAAC,UAAmB;AAClB,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,mBAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,UAClE;AAAA,QACF;AAAA,MACF,CAAC;AACD,aAAO,EAAE,MAAM,OAAO,MAAM,WAAW,KAAK,WAAW,WAAW,OAAO,UAAU;AAAA,IACrF;AAAA,EACF;AACA,SAAO;AACT;","names":["import_sdk_core","import_sdk_services","replicaParseUcanGrant","KV_GET","KV_SYNC","KV_SERVICE"]}
+{"version":3,"sources":["../../src/replication/authority.ts","../../src/replication/config.ts","../../src/replication/authority-sign-in.ts"],"sourcesContent":["/**\n * Replication authority (TC-858, plan v3 §4).\n *\n * `ReplicationAuthority` answers, per configured prefix, whether this node's\n * session can back a local replica: the session UCAN itself (delegate\n * posture), a child UCAN minted through `delegateTo`, or nothing (the\n * controller then reports `grant_missing` and reads from the network).\n *\n * The unrestricted-authority rule is enforced here, before any network work:\n * a prefix covered only by a caveated `get`/`sync` refuses with\n * `CAVEATED_AUTHORITY` — on the session path, the runtime-grant path, and on\n * any reuse of an installed grant (the adapter marks every grant's\n * `unconstrained` flag; the controller enforces it on reuse).\n */\n\nimport {\n  actionContains,\n  KV,\n  canonicalizeRecapCaveats,\n  isCapabilitySubset,\n  parseSpaceUri,\n  type PermissionEntry,\n  type TinyCloudSession,\n} from \"@tinycloud/sdk-core\";\nimport {\n  type AuthorityRefusal,\n  type ReplicaDevice,\n  type ReplicationAuthority,\n} from \"@tinycloud/sdk-services\";\nimport type { ReplicaRuntime } from \"./replica-contract\";\n// @ts-ignore -- node-sdk builds before replica declarations; keep the literal import for bundlers.\nimport { parseUcanGrant as replicaParseUcanGrant } from \"@tinycloud/replica\";\nconst parseUcanGrant = replicaParseUcanGrant as ReplicaRuntime[\"parseUcanGrant\"];\nexport { assertValidReplicationConfig } from \"./config\";\nexport { augmentSignInEntriesWithReplication, hasUnrestrictedGetCoverage } from \"./authority-sign-in\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\n/** The delegation the replication grant delegates: get + sync on one folder prefix. */\nfunction replicationEntries(spaceId: string, prefix: string): PermissionEntry[] {\n  return [{\n    service: KV_SERVICE,\n    space: spaceId,\n    path: prefix === \"/\" ? \"\" : prefix,\n    actions: [KV_GET, KV_SYNC],\n  }];\n}\n\n\n\n\n/**\n * The signed UCAN attenuation (`att`: resource → ability → caveat branches).\n * Only array branch sets are known; anything else is treated as constrained —\n * fail closed, never assume unconstrained.\n */\nfunction caveatBranchesUnconstrained(value: unknown): boolean {\n  if (value === undefined || value === null) return true;\n  if (typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length === 0) {\n    return true;\n  }\n  if (!Array.isArray(value)) return false;\n  try {\n    return (\n      canonicalizeRecapCaveats(value as Record<string, unknown>[]) ===\n      canonicalizeRecapCaveats(undefined)\n    );\n  } catch {\n    return false;\n  }\n}\n\n/** The KV path a signed UCAN resource names in `space`, like replica's `kvPathIn`. */\nfunction kvPathInResource(resource: string, space: string): string | undefined {\n  for (const root of [`${space}/kv`, `tinycloud://${space}/kv`]) {\n    if (resource === root || resource === `${root}/`) return \"/\";\n  }\n  for (const base of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {\n    if (resource.startsWith(base)) return resource.slice(base.length);\n  }\n  return undefined;\n\n}\n/**\n * Whether the signed `att` grants `ability` over the folder prefix, with\n * unrestricted authority unless explicitly asked to ignore caveats.\n */\nexport function ucanAttCovers(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n  ability: string,\n  options?: { ignoreCaveats?: boolean },\n): boolean {\n  for (const [resource, abilities] of Object.entries(att)) {\n    const path = kvPathInResource(resource, space);\n    if (path === undefined) continue;\n    for (const [granted, caveats] of Object.entries(abilities)) {\n      if (!actionContains(granted, ability)) continue;\n      if (!isCapabilitySubset(\n        [{ service: KV_SERVICE, space, path: prefix, actions: [ability] }],\n        [{ service: KV_SERVICE, space, path, actions: [granted] }],\n      ).subset) continue;\n      if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;\n    }\n  }\n  return false;\n}\n\n/** `unconstrained` for `ReplicaGrantInfo` (§2.1): get AND sync on the prefix carry no caveats. */\nexport function ucanAttUnconstrainedFor(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n): boolean {\n  return (\n    ucanAttCovers(att, space, prefix, KV_GET) &&\n    ucanAttCovers(att, space, prefix, KV_SYNC)\n  );\n}\n\nexport interface DelegationPlanResult {\n  path: \"session\" | \"runtime\";\n  parentCid: string;\n  expiresAt: number;\n}\n\n/**\n * The `TinyCloudNode` internals the authority needs. `planDelegation` is the\n * pure extraction of `delegateTo`'s parent selection (§4.3), so `plan` and\n * `mint` can never disagree about which parent or expiry a delegation gets.\n */\nexport type ReplicationAuthoritySession = Pick<\n  TinyCloudSession,\n  \"delegationHeader\" | \"delegationCid\" | \"spaceId\" | \"verificationMethod\" | \"jwk\"\n> & Partial<Pick<TinyCloudSession, \"siwe\">>;\n\nexport interface ReplicationAuthorityHost {\n  replicationSession(): ReplicationAuthoritySession | undefined;\n  /** The SIWE \"Expiration Time\" of the session — the delegateTo delegation cap. */\n  siweExpiration(siwe: string): Date | undefined;\n  planDelegation(\n    entries: PermissionEntry[],\n    options?: { expiry?: string | number },\n  ): ({ grant?: unknown } & DelegationPlanResult) | AuthorityRefusal;\n  mintDelegation(\n    deviceDid: string,\n    entries: PermissionEntry[],\n  ): Promise<{ ucan: string; expiresAt: number }>;\n}\n\n/** Milliseconds of validity a session or parent must have left for authority reuse (delegateTo's margin). */\nexport const AUTHORITY_EXPIRY_MARGIN_MS = 60_000;\n\n\n/** Verify a compact session delegation before using any persisted space metadata. */\nexport function replicationScopeFromSignedSession(input: {\n  delegationHeader: { Authorization: string };\n  delegationCid: string;\n  verificationMethod: string;\n  persistedSpace: string;\n}): { space: string; principal: string } | undefined {\n  let grant: ReturnType<typeof parseUcanGrant>;\n  try {\n    grant = parseUcanGrant(input.delegationHeader.Authorization);\n  } catch {\n    return undefined;\n  }\n  const bareDid = (value: string): string => value.split(\"#\", 1)[0]!;\n  if (\n    grant.cid !== input.delegationCid ||\n    bareDid(grant.audience) !== bareDid(input.verificationMethod)\n  ) return undefined;\n  for (const resource of Object.keys(grant.att)) {\n    const space = resource.match(/^(?:tinycloud:\\/\\/)?(.+?)\\/kv(?:\\/|$)/)?.[1];\n    if (space !== input.persistedSpace) continue;\n    const owner = parseSpaceUri(space);\n    if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };\n  }\n  return undefined;\n}\nexport function createReplicationAuthority(host: ReplicationAuthorityHost): ReplicationAuthority {\n  const planOrRefusal = (entries: PermissionEntry[]): DelegationPlanResult | AuthorityRefusal => {\n    const plan = host.planDelegation(entries);\n    if (\"refused\" in plan) return plan;\n    return { path: plan.path, parentCid: plan.parentCid, expiresAt: plan.expiresAt };\n  };\n  const sessionAudience = (value: string): string => value.split(\"#\", 1)[0]!;\n  const signedSessionGrant = (session: ReplicationAuthoritySession) => {\n    const grant = parseUcanGrant(session.delegationHeader.Authorization);\n    if (\n      grant.cid !== session.delegationCid ||\n      sessionAudience(grant.audience) !== sessionAudience(session.verificationMethod)\n    ) return undefined;\n    return grant;\n  };\n  const authority: ReplicationAuthority = {\n    get sessionOnly() {\n      const session = host.replicationSession();\n      return session !== undefined && session.siwe === undefined;\n    },\n    sessionGrant(prefix: string): { ucan: string; device: ReplicaDevice } | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const siweExpiry = session.siwe ? host.siweExpiration(session.siwe)?.getTime() : undefined;\n      if (siweExpiry !== undefined && siweExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      let grant: ReturnType<typeof parseUcanGrant>;\n      try {\n        const verified = signedSessionGrant(session);\n        if (!verified) return { refused: \"NOT_COVERED\" };\n        grant = verified;\n      } catch {\n        return { refused: \"NOT_COVERED\" };\n      }\n      const tokenExpiry = grant.expiresAt === null ? undefined : grant.expiresAt * 1000;\n      if (tokenExpiry === undefined || tokenExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      const covered = ucanAttCovers(grant.att, session.spaceId, prefix, KV_GET, { ignoreCaveats: true }) &&\n        ucanAttCovers(grant.att, session.spaceId, prefix, KV_SYNC, { ignoreCaveats: true });\n      if (!covered) return { refused: \"NOT_COVERED\" };\n      if (!ucanAttUnconstrainedFor(grant.att, session.spaceId, prefix)) {\n        return { refused: \"CAVEATED_AUTHORITY\" };\n      }\n      return {\n        ucan: grant.jwt,\n        device: { did: session.verificationMethod, jwk: session.jwk },\n      };\n    },\n    plan(prefix: string): DelegationPlanResult | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const sessionGrant = this.sessionGrant(prefix);\n      if (!(\"refused\" in sessionGrant)) {\n        const signed = signedSessionGrant(session);\n        if (!signed || signed.expiresAt === null) return { refused: \"NOT_COVERED\" };\n        return {\n          path: \"session\",\n          parentCid: session.delegationCid,\n          expiresAt: signed.expiresAt * 1000,\n        };\n      }\n      if (authority.sessionOnly) return sessionGrant;\n      return planOrRefusal(replicationEntries(session.spaceId, prefix));\n    },\n    async mint(\n      deviceDid: string,\n      prefix: string,\n      signal: AbortSignal,\n    ): Promise<{ ucan: string; parentCid: string; expiresAt: number }> {\n      if (authority.sessionOnly) throw new Error(\"compact delegate sessions cannot mint device grants\");\n      const session = host.replicationSession();\n      if (session === undefined) throw new Error(\"replication mint without a session\");\n      const entries = replicationEntries(session.spaceId, prefix);\n      const plan = planOrRefusal(entries);\n      if (\"refused\" in plan) {\n        throw Object.assign(\n          new Error(`replication authority refused the mint: ${plan.refused}`),\n          { refused: plan.refused },\n        );\n      }\n      signal.throwIfAborted();\n      const minted = await new Promise<{ ucan: string; expiresAt: number }>((resolve, reject) => {\n        const onAbort = (): void => reject(signal.reason ?? new Error(\"replication mint aborted\"));\n        signal.addEventListener(\"abort\", onAbort, { once: true });\n        host.mintDelegation(deviceDid, entries).then(\n          (result) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            resolve(result);\n          },\n          (error: unknown) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            reject(error instanceof Error ? error : new Error(String(error)));\n          },\n        );\n      });\n      return { ucan: minted.ucan, parentCid: plan.parentCid, expiresAt: minted.expiresAt };\n    },\n  };\n  return authority;\n}\n","import { assertFolderPrefix as assertPureFolderPrefix, kvPrefixCovers } from \"@tinycloud/sdk-services/kv/replication/prefix\";\nimport type { ReplicationOptions } from \"@tinycloud/sdk-core\";\n\n/** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */\nexport function assertValidReplicationConfig(\n  replication: (ReplicationOptions & { storage?: unknown }) | undefined,\n): void {\n  if (replication === undefined || replication.enabled !== true) return;\n  if (replication.storage === undefined || replication.storage === null) {\n    throw new TypeError(\"replication.enabled requires replication.storage\");\n  }\n  if (!Array.isArray(replication.prefixes) || replication.prefixes.length === 0) {\n    throw new TypeError(\"replication.prefixes must be a non-empty array\");\n  }\n  for (const prefix of replication.prefixes) {\n    try {\n      assertPureFolderPrefix(prefix);\n    } catch (error) {\n      throw new TypeError(error instanceof Error ? error.message : String(error));\n    }\n  }\n  for (const [index, prefix] of replication.prefixes.entries()) {\n    for (const other of replication.prefixes.slice(index + 1)) {\n      if (kvPrefixCovers(prefix, other) || kvPrefixCovers(other, prefix)) {\n        throw new TypeError(\n          `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`,\n        );\n      }\n    }\n    if ((prefix === \"/\" || prefix.split(\"/\", 1)[0] === \"vault\") && replication.allowSecrets !== true) {\n      throw new TypeError(\n        `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`,\n      );\n    }\n  }\n}\n","import {\n  KV,\n  isCapabilitySubset,\n  type PermissionEntry,\n  type ReplicationOptions,\n} from \"@tinycloud/sdk-core\";\nimport { requiresSecretsOptIn } from \"@tinycloud/sdk-services\";\nimport { assertFolderPrefix } from \"@tinycloud/sdk-services/kv/replication/prefix\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\nexport function hasUnrestrictedGetCoverage(\n  entries: readonly PermissionEntry[],\n  spaceId: string,\n  prefix: string,\n): boolean {\n  return isCapabilitySubset(\n    [{ service: KV_SERVICE, space: spaceId, path: prefix, actions: [KV_GET] }],\n    [...entries],\n  ).subset;\n}\n\nexport function augmentSignInEntriesWithReplication(input: {\n  entries: readonly PermissionEntry[];\n  primarySpaceId: string;\n  replication?: Pick<ReplicationOptions, \"prefixes\" | \"allowSecrets\">;\n}): PermissionEntry[] {\n  const out: PermissionEntry[] = [];\n  const replication = input.replication;\n  if (replication === undefined) return out;\n  const eligiblePaths: string[] = [];\n  for (const prefix of replication.prefixes) {\n    assertFolderPrefix(prefix);\n    const path = prefix === \"/\" ? \"\" : prefix;\n    if (\n      requiresSecretsOptIn(input.primarySpaceId, prefix) &&\n      replication.allowSecrets !== true\n    ) {\n      continue;\n    }\n    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, path)) {\n      continue;\n    }\n    eligiblePaths.push(path);\n  }\n  if (\n    eligiblePaths.length === replication.prefixes.length &&\n    eligiblePaths.length > 0 &&\n    hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, \"\")\n  ) {\n    return [{\n      service: KV_SERVICE,\n      space: input.primarySpaceId,\n      path: \"\",\n      actions: [KV_GET, KV_SYNC],\n    }];\n  }\n  for (const path of eligiblePaths) {\n    out.push({\n      service: KV_SERVICE,\n      space: input.primarySpaceId,\n      path,\n      actions: [KV_GET, KV_SYNC],\n    });\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,IAAAA,mBAQO;AAQP,qBAAwD;;;AC/BxD,oBAA6E;AAItE,SAAS,6BACd,aACM;AACN,MAAI,gBAAgB,UAAa,YAAY,YAAY,KAAM;AAC/D,MAAI,YAAY,YAAY,UAAa,YAAY,YAAY,MAAM;AACrE,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,MAAI,CAAC,MAAM,QAAQ,YAAY,QAAQ,KAAK,YAAY,SAAS,WAAW,GAAG;AAC7E,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,aAAW,UAAU,YAAY,UAAU;AACzC,QAAI;AACF,wBAAAC,oBAAuB,MAAM;AAAA,IAC/B,SAAS,OAAO;AACd,YAAM,IAAI,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC5E;AAAA,EACF;AACA,aAAW,CAAC,OAAO,MAAM,KAAK,YAAY,SAAS,QAAQ,GAAG;AAC5D,eAAW,SAAS,YAAY,SAAS,MAAM,QAAQ,CAAC,GAAG;AACzD,cAAI,8BAAe,QAAQ,KAAK,SAAK,8BAAe,OAAO,MAAM,GAAG;AAClE,cAAM,IAAI;AAAA,UACR,0CAA0C,KAAK,UAAU,MAAM,CAAC,QAAQ,KAAK,UAAU,KAAK,CAAC;AAAA,QAC/F;AAAA,MACF;AAAA,IACF;AACA,SAAK,WAAW,OAAO,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,YAAY,YAAY,iBAAiB,MAAM;AAChG,YAAM,IAAI;AAAA,QACR,sBAAsB,KAAK,UAAU,MAAM,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACF;;;ACnCA,sBAKO;AACP,0BAAqC;AACrC,IAAAC,iBAAmC;AAEnC,IAAM,SAAS,mBAAG;AAClB,IAAM,UAAU,mBAAG;AACnB,IAAM,aAAa;AAEZ,SAAS,2BACd,SACA,SACA,QACS;AACT,aAAO;AAAA,IACL,CAAC,EAAE,SAAS,YAAY,OAAO,SAAS,MAAM,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC;AAAA,IACzE,CAAC,GAAG,OAAO;AAAA,EACb,EAAE;AACJ;AAEO,SAAS,oCAAoC,OAI9B;AACpB,QAAM,MAAyB,CAAC;AAChC,QAAM,cAAc,MAAM;AAC1B,MAAI,gBAAgB,OAAW,QAAO;AACtC,QAAM,gBAA0B,CAAC;AACjC,aAAW,UAAU,YAAY,UAAU;AACzC,2CAAmB,MAAM;AACzB,UAAM,OAAO,WAAW,MAAM,KAAK;AACnC,YACE,0CAAqB,MAAM,gBAAgB,MAAM,KACjD,YAAY,iBAAiB,MAC7B;AACA;AAAA,IACF;AACA,QAAI,CAAC,2BAA2B,MAAM,SAAS,MAAM,gBAAgB,IAAI,GAAG;AAC1E;AAAA,IACF;AACA,kBAAc,KAAK,IAAI;AAAA,EACzB;AACA,MACE,cAAc,WAAW,YAAY,SAAS,UAC9C,cAAc,SAAS,KACvB,2BAA2B,MAAM,SAAS,MAAM,gBAAgB,EAAE,GAClE;AACA,WAAO,CAAC;AAAA,MACN,SAAS;AAAA,MACT,OAAO,MAAM;AAAA,MACb,MAAM;AAAA,MACN,SAAS,CAAC,QAAQ,OAAO;AAAA,IAC3B,CAAC;AAAA,EACH;AACA,aAAW,QAAQ,eAAe;AAChC,QAAI,KAAK;AAAA,MACP,SAAS;AAAA,MACT,OAAO,MAAM;AAAA,MACb;AAAA,MACA,SAAS,CAAC,QAAQ,OAAO;AAAA,IAC3B,CAAC;AAAA,EACH;AACA,SAAO;AACT;;;AFpCA,IAAM,iBAAiB,eAAAC;AAIvB,IAAMC,UAAS,oBAAG;AAClB,IAAMC,WAAU,oBAAG;AACnB,IAAMC,cAAa;AAGnB,SAAS,mBAAmB,SAAiB,QAAmC;AAC9E,SAAO,CAAC;AAAA,IACN,SAASA;AAAA,IACT,OAAO;AAAA,IACP,MAAM,WAAW,MAAM,KAAK;AAAA,IAC5B,SAAS,CAACF,SAAQC,QAAO;AAAA,EAC3B,CAAC;AACH;AAUA,SAAS,4BAA4B,OAAyB;AAC5D,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,WAAW,GAAG;AACzF,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,MAAI;AACF,eACE,2CAAyB,KAAkC,UAC3D,2CAAyB,MAAS;AAAA,EAEtC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,iBAAiB,UAAkB,OAAmC;AAC7E,aAAW,QAAQ,CAAC,GAAG,KAAK,OAAO,eAAe,KAAK,KAAK,GAAG;AAC7D,QAAI,aAAa,QAAQ,aAAa,GAAG,IAAI,IAAK,QAAO;AAAA,EAC3D;AACA,aAAW,QAAQ,CAAC,GAAG,KAAK,QAAQ,eAAe,KAAK,MAAM,GAAG;AAC/D,QAAI,SAAS,WAAW,IAAI,EAAG,QAAO,SAAS,MAAM,KAAK,MAAM;AAAA,EAClE;AACA,SAAO;AAET;AAKO,SAAS,cACd,KACA,OACA,QACA,SACA,SACS;AACT,aAAW,CAAC,UAAU,SAAS,KAAK,OAAO,QAAQ,GAAG,GAAG;AACvD,UAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,QAAI,SAAS,OAAW;AACxB,eAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC1D,UAAI,KAAC,iCAAe,SAAS,OAAO,EAAG;AACvC,UAAI,KAAC;AAAA,QACH,CAAC,EAAE,SAASC,aAAY,OAAO,MAAM,QAAQ,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,QACjE,CAAC,EAAE,SAASA,aAAY,OAAO,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,MAC3D,EAAE,OAAQ;AACV,UAAI,SAAS,kBAAkB,QAAQ,4BAA4B,OAAO,EAAG,QAAO;AAAA,IACtF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,wBACd,KACA,OACA,QACS;AACT,SACE,cAAc,KAAK,OAAO,QAAQF,OAAM,KACxC,cAAc,KAAK,OAAO,QAAQC,QAAO;AAE7C;AAiCO,IAAM,6BAA6B;AAInC,SAAS,kCAAkC,OAKG;AACnD,MAAI;AACJ,MAAI;AACF,YAAQ,eAAe,MAAM,iBAAiB,aAAa;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAChE,MACE,MAAM,QAAQ,MAAM,iBACpB,QAAQ,MAAM,QAAQ,MAAM,QAAQ,MAAM,kBAAkB,EAC5D,QAAO;AACT,aAAW,YAAY,OAAO,KAAK,MAAM,GAAG,GAAG;AAC7C,UAAM,QAAQ,SAAS,MAAM,uCAAuC,IAAI,CAAC;AACzE,QAAI,UAAU,MAAM,eAAgB;AACpC,UAAM,YAAQ,gCAAc,KAAK;AACjC,QAAI,OAAO,SAAS,MAAM,WAAW,MAAM,QAAS,QAAO,EAAE,OAAO,WAAW,MAAM,MAAM;AAAA,EAC7F;AACA,SAAO;AACT;AACO,SAAS,2BAA2B,MAAsD;AAC/F,QAAM,gBAAgB,CAAC,YAAwE;AAC7F,UAAM,OAAO,KAAK,eAAe,OAAO;AACxC,QAAI,aAAa,KAAM,QAAO;AAC9B,WAAO,EAAE,MAAM,KAAK,MAAM,WAAW,KAAK,WAAW,WAAW,KAAK,UAAU;AAAA,EACjF;AACA,QAAM,kBAAkB,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AACxE,QAAM,qBAAqB,CAAC,YAAyC;AACnE,UAAM,QAAQ,eAAe,QAAQ,iBAAiB,aAAa;AACnE,QACE,MAAM,QAAQ,QAAQ,iBACtB,gBAAgB,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,kBAAkB,EAC9E,QAAO;AACT,WAAO;AAAA,EACT;AACA,QAAM,YAAkC;AAAA,IACtC,IAAI,cAAc;AAChB,YAAM,UAAU,KAAK,mBAAmB;AACxC,aAAO,YAAY,UAAa,QAAQ,SAAS;AAAA,IACnD;AAAA,IACA,aAAa,QAA4E;AACvF,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,aAAa,QAAQ,OAAO,KAAK,eAAe,QAAQ,IAAI,GAAG,QAAQ,IAAI;AACjF,UAAI,eAAe,UAAa,cAAc,KAAK,IAAI,IAAI,4BAA4B;AACrF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,UAAI;AACJ,UAAI;AACF,cAAM,WAAW,mBAAmB,OAAO;AAC3C,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,cAAc;AAC/C,gBAAQ;AAAA,MACV,QAAQ;AACN,eAAO,EAAE,SAAS,cAAc;AAAA,MAClC;AACA,YAAM,cAAc,MAAM,cAAc,OAAO,SAAY,MAAM,YAAY;AAC7E,UAAI,gBAAgB,UAAa,eAAe,KAAK,IAAI,IAAI,4BAA4B;AACvF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,YAAM,UAAU,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQD,SAAQ,EAAE,eAAe,KAAK,CAAC,KAC/F,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQC,UAAS,EAAE,eAAe,KAAK,CAAC;AACpF,UAAI,CAAC,QAAS,QAAO,EAAE,SAAS,cAAc;AAC9C,UAAI,CAAC,wBAAwB,MAAM,KAAK,QAAQ,SAAS,MAAM,GAAG;AAChE,eAAO,EAAE,SAAS,qBAAqB;AAAA,MACzC;AACA,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,QAAQ,EAAE,KAAK,QAAQ,oBAAoB,KAAK,QAAQ,IAAI;AAAA,MAC9D;AAAA,IACF;AAAA,IACA,KAAK,QAAyD;AAC5D,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,eAAe,KAAK,aAAa,MAAM;AAC7C,UAAI,EAAE,aAAa,eAAe;AAChC,cAAM,SAAS,mBAAmB,OAAO;AACzC,YAAI,CAAC,UAAU,OAAO,cAAc,KAAM,QAAO,EAAE,SAAS,cAAc;AAC1E,eAAO;AAAA,UACL,MAAM;AAAA,UACN,WAAW,QAAQ;AAAA,UACnB,WAAW,OAAO,YAAY;AAAA,QAChC;AAAA,MACF;AACA,UAAI,UAAU,YAAa,QAAO;AAClC,aAAO,cAAc,mBAAmB,QAAQ,SAAS,MAAM,CAAC;AAAA,IAClE;AAAA,IACA,MAAM,KACJ,WACA,QACA,QACiE;AACjE,UAAI,UAAU,YAAa,OAAM,IAAI,MAAM,qDAAqD;AAChG,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,OAAM,IAAI,MAAM,oCAAoC;AAC/E,YAAM,UAAU,mBAAmB,QAAQ,SAAS,MAAM;AAC1D,YAAM,OAAO,cAAc,OAAO;AAClC,UAAI,aAAa,MAAM;AACrB,cAAM,OAAO;AAAA,UACX,IAAI,MAAM,2CAA2C,KAAK,OAAO,EAAE;AAAA,UACnE,EAAE,SAAS,KAAK,QAAQ;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,eAAe;AACtB,YAAM,SAAS,MAAM,IAAI,QAA6C,CAAC,SAAS,WAAW;AACzF,cAAM,UAAU,MAAY,OAAO,OAAO,UAAU,IAAI,MAAM,0BAA0B,CAAC;AACzF,eAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,aAAK,eAAe,WAAW,OAAO,EAAE;AAAA,UACtC,CAAC,WAAW;AACV,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,oBAAQ,MAAM;AAAA,UAChB;AAAA,UACA,CAAC,UAAmB;AAClB,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,mBAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,UAClE;AAAA,QACF;AAAA,MACF,CAAC;AACD,aAAO,EAAE,MAAM,OAAO,MAAM,WAAW,KAAK,WAAW,WAAW,OAAO,UAAU;AAAA,IACrF;AAAA,EACF;AACA,SAAO;AACT;","names":["import_sdk_core","assertPureFolderPrefix","import_prefix","replicaParseUcanGrant","KV_GET","KV_SYNC","KV_SERVICE"]}

package/dist/replication/authority.d.cts

@@ -1,3 +1,3 @@
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services';
-export { A as AUTHORITY_EXPIRY_MARGIN_MS, D as DelegationPlanResult, R as ReplicationAuthorityHost, a as ReplicationAuthoritySession, b as assertValidReplicationConfig, c as augmentSignInEntriesWithReplication, d as createReplicationAuthority, h as hasUnrestrictedGetCoverage, r as replicationScopeFromSignedSession, u as ucanAttCovers, e as ucanAttUnconstrainedFor } from '../authority-mTQEgN56.cjs';
+export { A as AUTHORITY_EXPIRY_MARGIN_MS, D as DelegationPlanResult, R as ReplicationAuthorityHost, a as ReplicationAuthoritySession, b as assertValidReplicationConfig, c as augmentSignInEntriesWithReplication, d as createReplicationAuthority, h as hasUnrestrictedGetCoverage, r as replicationScopeFromSignedSession, u as ucanAttCovers, e as ucanAttUnconstrainedFor } from '../authority-DDGtccBK.cjs';

package/dist/replication/authority.d.ts

@@ -1,3 +1,3 @@
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services';
-export { A as AUTHORITY_EXPIRY_MARGIN_MS, D as DelegationPlanResult, R as ReplicationAuthorityHost, a as ReplicationAuthoritySession, b as assertValidReplicationConfig, c as augmentSignInEntriesWithReplication, d as createReplicationAuthority, h as hasUnrestrictedGetCoverage, r as replicationScopeFromSignedSession, u as ucanAttCovers, e as ucanAttUnconstrainedFor } from '../authority-mTQEgN56.js';
+export { A as AUTHORITY_EXPIRY_MARGIN_MS, D as DelegationPlanResult, R as ReplicationAuthorityHost, a as ReplicationAuthoritySession, b as assertValidReplicationConfig, c as augmentSignInEntriesWithReplication, d as createReplicationAuthority, h as hasUnrestrictedGetCoverage, r as replicationScopeFromSignedSession, u as ucanAttCovers, e as ucanAttUnconstrainedFor } from '../authority-DDGtccBK.js';

package/dist/replication/authority.js

@@ -1,6 +1,5 @@
 // src/replication/authority.ts
 import {
-  grantPathsForSelector as grantPathsForSelector2,
   actionContains,
   KV as KV2,
   canonicalizeRecapCaveats,
@@ -10,7 +9,7 @@ import {
 import { parseUcanGrant as replicaParseUcanGrant } from "@tinycloud/replica";
 
 // src/replication/config.ts
-import { kvPrefixCovers } from "@tinycloud/sdk-services";
+import { assertFolderPrefix as assertPureFolderPrefix, kvPrefixCovers } from "@tinycloud/sdk-services/kv/replication/prefix";
 function assertValidReplicationConfig(replication) {
   if (replication === void 0 || replication.enabled !== true) return;
   if (replication.storage === void 0 || replication.storage === null) {
@@ -20,8 +19,10 @@ function assertValidReplicationConfig(replication) {
     throw new TypeError("replication.prefixes must be a non-empty array");
   }
   for (const prefix of replication.prefixes) {
-    if (typeof prefix !== "string" || prefix === "") {
-      throw new TypeError("replication.prefixes must not contain an empty prefix");
+    try {
+      assertPureFolderPrefix(prefix);
+    } catch (error) {
+      throw new TypeError(error instanceof Error ? error.message : String(error));
     }
   }
   for (const [index, prefix] of replication.prefixes.entries()) {
@@ -32,7 +33,7 @@ function assertValidReplicationConfig(replication) {
         );
       }
     }
-    if (prefix.split("/", 1)[0] === "vault" && replication.allowSecrets !== true) {
+    if ((prefix === "/" || prefix.split("/", 1)[0] === "vault") && replication.allowSecrets !== true) {
       throw new TypeError(
         `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`
       );
@@ -42,18 +43,17 @@ function assertValidReplicationConfig(replication) {
 
 // src/replication/authority-sign-in.ts
 import {
-  grantPathsForSelector,
   KV,
   isCapabilitySubset
 } from "@tinycloud/sdk-core";
 import { requiresSecretsOptIn } from "@tinycloud/sdk-services";
+import { assertFolderPrefix } from "@tinycloud/sdk-services/kv/replication/prefix";
 var KV_GET = KV.GET;
 var KV_SYNC = KV.SYNC;
 var KV_SERVICE = "tinycloud.kv";
 function hasUnrestrictedGetCoverage(entries, spaceId, prefix) {
-  const requiredPaths = grantPathsForSelector(prefix);
   return isCapabilitySubset(
-    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),
+    [{ service: KV_SERVICE, space: spaceId, path: prefix, actions: [KV_GET] }],
     [...entries]
   ).subset;
 }
@@ -61,21 +61,33 @@ function augmentSignInEntriesWithReplication(input) {
   const out = [];
   const replication = input.replication;
   if (replication === void 0) return out;
+  const eligiblePaths = [];
   for (const prefix of replication.prefixes) {
+    assertFolderPrefix(prefix);
+    const path = prefix === "/" ? "" : prefix;
     if (requiresSecretsOptIn(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
       continue;
     }
-    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {
+    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, path)) {
       continue;
     }
-    for (const path of grantPathsForSelector(prefix)) {
-      out.push({
-        service: KV_SERVICE,
-        space: input.primarySpaceId,
-        path,
-        actions: [KV_GET, KV_SYNC]
-      });
-    }
+    eligiblePaths.push(path);
+  }
+  if (eligiblePaths.length === replication.prefixes.length && eligiblePaths.length > 0 && hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, "")) {
+    return [{
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path: "",
+      actions: [KV_GET, KV_SYNC]
+    }];
+  }
+  for (const path of eligiblePaths) {
+    out.push({
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path,
+      actions: [KV_GET, KV_SYNC]
+    });
   }
   return out;
 }
@@ -86,12 +98,12 @@ var KV_GET2 = KV2.GET;
 var KV_SYNC2 = KV2.SYNC;
 var KV_SERVICE2 = "tinycloud.kv";
 function replicationEntries(spaceId, prefix) {
-  return grantPathsForSelector2(prefix).map((path) => ({
+  return [{
     service: KV_SERVICE2,
     space: spaceId,
-    path,
+    path: prefix === "/" ? "" : prefix,
     actions: [KV_GET2, KV_SYNC2]
-  }));
+  }];
 }
 function caveatBranchesUnconstrained(value) {
   if (value === void 0 || value === null) return true;
@@ -106,28 +118,28 @@ function caveatBranchesUnconstrained(value) {
   }
 }
 function kvPathInResource(resource, space) {
+  for (const root of [`${space}/kv`, `tinycloud://${space}/kv`]) {
+    if (resource === root || resource === `${root}/`) return "/";
+  }
   for (const base of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {
     if (resource.startsWith(base)) return resource.slice(base.length);
   }
   return void 0;
 }
 function ucanAttCovers(att, space, prefix, ability, options) {
-  const requiredPaths = prefix.endsWith("/") ? [prefix] : [prefix, `${prefix}/`];
-  return requiredPaths.every((requestedPath) => {
-    for (const [resource, abilities] of Object.entries(att)) {
-      const path = kvPathInResource(resource, space);
-      if (path === void 0) continue;
-      for (const [granted, caveats] of Object.entries(abilities)) {
-        if (!actionContains(granted, ability)) continue;
-        if (!isCapabilitySubset2(
-          [{ service: KV_SERVICE2, space, path: requestedPath, actions: [ability] }],
-          [{ service: KV_SERVICE2, space, path, actions: [granted] }]
-        ).subset) continue;
-        if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;
-      }
+  for (const [resource, abilities] of Object.entries(att)) {
+    const path = kvPathInResource(resource, space);
+    if (path === void 0) continue;
+    for (const [granted, caveats] of Object.entries(abilities)) {
+      if (!actionContains(granted, ability)) continue;
+      if (!isCapabilitySubset2(
+        [{ service: KV_SERVICE2, space, path: prefix, actions: [ability] }],
+        [{ service: KV_SERVICE2, space, path, actions: [granted] }]
+      ).subset) continue;
+      if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;
     }
-    return false;
-  });
+  }
+  return false;
 }
 function ucanAttUnconstrainedFor(att, space, prefix) {
   return ucanAttCovers(att, space, prefix, KV_GET2) && ucanAttCovers(att, space, prefix, KV_SYNC2);
@@ -143,7 +155,7 @@ function replicationScopeFromSignedSession(input) {
   const bareDid = (value) => value.split("#", 1)[0];
   if (grant.cid !== input.delegationCid || bareDid(grant.audience) !== bareDid(input.verificationMethod)) return void 0;
   for (const resource of Object.keys(grant.att)) {
-    const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv\//)?.[1];
+    const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv(?:\/|$)/)?.[1];
     if (space !== input.persistedSpace) continue;
     const owner = parseSpaceUri(space);
     if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };

package/dist/replication/authority.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/replication/authority.ts","../../src/replication/config.ts","../../src/replication/authority-sign-in.ts"],"sourcesContent":["/**\n * Replication authority (TC-858, plan v3 §4).\n *\n * `ReplicationAuthority` answers, per configured prefix, whether this node's\n * session can back a local replica: the session UCAN itself (delegate\n * posture), a child UCAN minted through `delegateTo`, or nothing (the\n * controller then reports `grant_missing` and reads from the network).\n *\n * The unrestricted-authority rule is enforced here, before any network work:\n * a prefix covered only by a caveated `get`/`sync` refuses with\n * `CAVEATED_AUTHORITY` — on the session path, the runtime-grant path, and on\n * any reuse of an installed grant (the adapter marks every grant's\n * `unconstrained` flag; the controller enforces it on reuse).\n */\n\nimport {\n  grantPathsForSelector,\n  actionContains,\n  KV,\n  canonicalizeRecapCaveats,\n  isCapabilitySubset,\n  parseSpaceUri,\n  type PermissionEntry,\n  type TinyCloudSession,\n} from \"@tinycloud/sdk-core\";\nimport {\n  type AuthorityRefusal,\n  type ReplicaDevice,\n  type ReplicationAuthority,\n} from \"@tinycloud/sdk-services\";\nimport type { ReplicaRuntime } from \"./replica-contract\";\n// @ts-ignore -- node-sdk builds before replica declarations; keep the literal import for bundlers.\nimport { parseUcanGrant as replicaParseUcanGrant } from \"@tinycloud/replica\";\nconst parseUcanGrant = replicaParseUcanGrant as ReplicaRuntime[\"parseUcanGrant\"];\nexport { assertValidReplicationConfig } from \"./config\";\nexport { augmentSignInEntriesWithReplication, hasUnrestrictedGetCoverage } from \"./authority-sign-in\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\n/** The delegation the replication grant delegates: get + sync on one prefix of the session space. */\nfunction replicationEntries(spaceId: string, prefix: string): PermissionEntry[] {\n  return grantPathsForSelector(prefix).map((path) => ({\n    service: KV_SERVICE,\n    space: spaceId,\n    path,\n    actions: [KV_GET, KV_SYNC],\n  }));\n}\n\n\n\n\n/**\n * The signed UCAN attenuation (`att`: resource → ability → caveat branches).\n * Only array branch sets are known; anything else is treated as constrained —\n * fail closed, never assume unconstrained.\n */\nfunction caveatBranchesUnconstrained(value: unknown): boolean {\n  if (value === undefined || value === null) return true;\n  if (typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length === 0) {\n    return true;\n  }\n  if (!Array.isArray(value)) return false;\n  try {\n    return (\n      canonicalizeRecapCaveats(value as Record<string, unknown>[]) ===\n      canonicalizeRecapCaveats(undefined)\n    );\n  } catch {\n    return false;\n  }\n}\n\n/** The KV path a signed UCAN resource names in `space`, like replica's `kvPathIn`. */\nfunction kvPathInResource(resource: string, space: string): string | undefined {\n  for (const base of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {\n    if (resource.startsWith(base)) return resource.slice(base.length);\n  }\n  return undefined;\n}\n\n/**\n * Whether the signed `att` grants `ability` over the selected namespace, with\n * each grant unrestricted (no caveats). A bare selector requires both its\n * exact key and its slash descendants; a trailing-slash selector is one range.\n */\nexport function ucanAttCovers(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n  ability: string,\n  options?: { ignoreCaveats?: boolean },\n): boolean {\n  const requiredPaths = prefix.endsWith(\"/\") ? [prefix] : [prefix, `${prefix}/`];\n  return requiredPaths.every((requestedPath) => {\n    for (const [resource, abilities] of Object.entries(att)) {\n      const path = kvPathInResource(resource, space);\n      if (path === undefined) continue;\n      for (const [granted, caveats] of Object.entries(abilities)) {\n        if (!actionContains(granted, ability)) continue;\n        if (!isCapabilitySubset(\n          [{ service: KV_SERVICE, space, path: requestedPath, actions: [ability] }],\n          [{ service: KV_SERVICE, space, path, actions: [granted] }],\n        ).subset) continue;\n        if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;\n      }\n    }\n    return false;\n  });\n}\n\n/** `unconstrained` for `ReplicaGrantInfo` (§2.1): get AND sync on the prefix carry no caveats. */\nexport function ucanAttUnconstrainedFor(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n): boolean {\n  return (\n    ucanAttCovers(att, space, prefix, KV_GET) &&\n    ucanAttCovers(att, space, prefix, KV_SYNC)\n  );\n}\n\nexport interface DelegationPlanResult {\n  path: \"session\" | \"runtime\";\n  parentCid: string;\n  expiresAt: number;\n}\n\n/**\n * The `TinyCloudNode` internals the authority needs. `planDelegation` is the\n * pure extraction of `delegateTo`'s parent selection (§4.3), so `plan` and\n * `mint` can never disagree about which parent or expiry a delegation gets.\n */\nexport type ReplicationAuthoritySession = Pick<\n  TinyCloudSession,\n  \"delegationHeader\" | \"delegationCid\" | \"spaceId\" | \"verificationMethod\" | \"jwk\"\n> & Partial<Pick<TinyCloudSession, \"siwe\">>;\n\nexport interface ReplicationAuthorityHost {\n  replicationSession(): ReplicationAuthoritySession | undefined;\n  /** The SIWE \"Expiration Time\" of the session — the delegateTo delegation cap. */\n  siweExpiration(siwe: string): Date | undefined;\n  planDelegation(\n    entries: PermissionEntry[],\n    options?: { expiry?: string | number },\n  ): ({ grant?: unknown } & DelegationPlanResult) | AuthorityRefusal;\n  mintDelegation(\n    deviceDid: string,\n    entries: PermissionEntry[],\n  ): Promise<{ ucan: string; expiresAt: number }>;\n}\n\n/** Milliseconds of validity a session or parent must have left for authority reuse (delegateTo's margin). */\nexport const AUTHORITY_EXPIRY_MARGIN_MS = 60_000;\n\n\n/** Verify a compact session delegation before using any persisted space metadata. */\nexport function replicationScopeFromSignedSession(input: {\n  delegationHeader: { Authorization: string };\n  delegationCid: string;\n  verificationMethod: string;\n  persistedSpace: string;\n}): { space: string; principal: string } | undefined {\n  let grant: ReturnType<typeof parseUcanGrant>;\n  try {\n    grant = parseUcanGrant(input.delegationHeader.Authorization);\n  } catch {\n    return undefined;\n  }\n  const bareDid = (value: string): string => value.split(\"#\", 1)[0]!;\n  if (\n    grant.cid !== input.delegationCid ||\n    bareDid(grant.audience) !== bareDid(input.verificationMethod)\n  ) return undefined;\n  for (const resource of Object.keys(grant.att)) {\n    const space = resource.match(/^(?:tinycloud:\\/\\/)?(.+?)\\/kv\\//)?.[1];\n    if (space !== input.persistedSpace) continue;\n    const owner = parseSpaceUri(space);\n    if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };\n  }\n  return undefined;\n}\nexport function createReplicationAuthority(host: ReplicationAuthorityHost): ReplicationAuthority {\n  const planOrRefusal = (entries: PermissionEntry[]): DelegationPlanResult | AuthorityRefusal => {\n    const plan = host.planDelegation(entries);\n    if (\"refused\" in plan) return plan;\n    return { path: plan.path, parentCid: plan.parentCid, expiresAt: plan.expiresAt };\n  };\n  const sessionAudience = (value: string): string => value.split(\"#\", 1)[0]!;\n  const signedSessionGrant = (session: ReplicationAuthoritySession) => {\n    const grant = parseUcanGrant(session.delegationHeader.Authorization);\n    if (\n      grant.cid !== session.delegationCid ||\n      sessionAudience(grant.audience) !== sessionAudience(session.verificationMethod)\n    ) return undefined;\n    return grant;\n  };\n  const authority: ReplicationAuthority = {\n    get sessionOnly() {\n      const session = host.replicationSession();\n      return session !== undefined && session.siwe === undefined;\n    },\n    sessionGrant(prefix: string): { ucan: string; device: ReplicaDevice } | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const siweExpiry = session.siwe ? host.siweExpiration(session.siwe)?.getTime() : undefined;\n      if (siweExpiry !== undefined && siweExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      let grant: ReturnType<typeof parseUcanGrant>;\n      try {\n        const verified = signedSessionGrant(session);\n        if (!verified) return { refused: \"NOT_COVERED\" };\n        grant = verified;\n      } catch {\n        return { refused: \"NOT_COVERED\" };\n      }\n      const tokenExpiry = grant.expiresAt === null ? undefined : grant.expiresAt * 1000;\n      if (tokenExpiry === undefined || tokenExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      const covered = ucanAttCovers(grant.att, session.spaceId, prefix, KV_GET, { ignoreCaveats: true }) &&\n        ucanAttCovers(grant.att, session.spaceId, prefix, KV_SYNC, { ignoreCaveats: true });\n      if (!covered) return { refused: \"NOT_COVERED\" };\n      if (!ucanAttUnconstrainedFor(grant.att, session.spaceId, prefix)) {\n        return { refused: \"CAVEATED_AUTHORITY\" };\n      }\n      return {\n        ucan: grant.jwt,\n        device: { did: session.verificationMethod, jwk: session.jwk },\n      };\n    },\n    plan(prefix: string): DelegationPlanResult | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const sessionGrant = this.sessionGrant(prefix);\n      if (!(\"refused\" in sessionGrant)) {\n        const signed = signedSessionGrant(session);\n        if (!signed || signed.expiresAt === null) return { refused: \"NOT_COVERED\" };\n        return {\n          path: \"session\",\n          parentCid: session.delegationCid,\n          expiresAt: signed.expiresAt * 1000,\n        };\n      }\n      if (authority.sessionOnly) return sessionGrant;\n      return planOrRefusal(replicationEntries(session.spaceId, prefix));\n    },\n    async mint(\n      deviceDid: string,\n      prefix: string,\n      signal: AbortSignal,\n    ): Promise<{ ucan: string; parentCid: string; expiresAt: number }> {\n      if (authority.sessionOnly) throw new Error(\"compact delegate sessions cannot mint device grants\");\n      const session = host.replicationSession();\n      if (session === undefined) throw new Error(\"replication mint without a session\");\n      const entries = replicationEntries(session.spaceId, prefix);\n      const plan = planOrRefusal(entries);\n      if (\"refused\" in plan) {\n        throw Object.assign(\n          new Error(`replication authority refused the mint: ${plan.refused}`),\n          { refused: plan.refused },\n        );\n      }\n      signal.throwIfAborted();\n      const minted = await new Promise<{ ucan: string; expiresAt: number }>((resolve, reject) => {\n        const onAbort = (): void => reject(signal.reason ?? new Error(\"replication mint aborted\"));\n        signal.addEventListener(\"abort\", onAbort, { once: true });\n        host.mintDelegation(deviceDid, entries).then(\n          (result) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            resolve(result);\n          },\n          (error: unknown) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            reject(error instanceof Error ? error : new Error(String(error)));\n          },\n        );\n      });\n      return { ucan: minted.ucan, parentCid: plan.parentCid, expiresAt: minted.expiresAt };\n    },\n  };\n  return authority;\n}\n","import { kvPrefixCovers, type ReplicationOptions } from \"@tinycloud/sdk-services\";\n\n/** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */\nexport function assertValidReplicationConfig(\n  replication: (ReplicationOptions & { storage?: unknown }) | undefined,\n): void {\n  if (replication === undefined || replication.enabled !== true) return;\n  if (replication.storage === undefined || replication.storage === null) {\n    throw new TypeError(\"replication.enabled requires replication.storage\");\n  }\n  if (!Array.isArray(replication.prefixes) || replication.prefixes.length === 0) {\n    throw new TypeError(\"replication.prefixes must be a non-empty array\");\n  }\n  for (const prefix of replication.prefixes) {\n    if (typeof prefix !== \"string\" || prefix === \"\") {\n      throw new TypeError(\"replication.prefixes must not contain an empty prefix\");\n    }\n  }\n  for (const [index, prefix] of replication.prefixes.entries()) {\n    for (const other of replication.prefixes.slice(index + 1)) {\n      if (kvPrefixCovers(prefix, other) || kvPrefixCovers(other, prefix)) {\n        throw new TypeError(\n          `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`,\n        );\n      }\n    }\n    if (prefix.split(\"/\", 1)[0] === \"vault\" && replication.allowSecrets !== true) {\n      throw new TypeError(\n        `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`,\n      );\n    }\n  }\n}\n","import {\n  grantPathsForSelector,\n  KV,\n  isCapabilitySubset,\n  type PermissionEntry,\n  type ReplicationOptions,\n} from \"@tinycloud/sdk-core\";\nimport { requiresSecretsOptIn } from \"@tinycloud/sdk-services\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\nexport function hasUnrestrictedGetCoverage(\n  entries: readonly PermissionEntry[],\n  spaceId: string,\n  prefix: string,\n): boolean {\n  const requiredPaths = grantPathsForSelector(prefix);\n  return isCapabilitySubset(\n    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),\n    [...entries],\n  ).subset;\n}\n\nexport function augmentSignInEntriesWithReplication(input: {\n  entries: readonly PermissionEntry[];\n  primarySpaceId: string;\n  replication?: Pick<ReplicationOptions, \"prefixes\" | \"allowSecrets\">;\n}): PermissionEntry[] {\n  const out: PermissionEntry[] = [];\n  const replication = input.replication;\n  if (replication === undefined) return out;\n  for (const prefix of replication.prefixes) {\n    if (\n      requiresSecretsOptIn(input.primarySpaceId, prefix) &&\n      replication.allowSecrets !== true\n    ) {\n      continue;\n    }\n    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {\n      continue;\n    }\n    for (const path of grantPathsForSelector(prefix)) {\n      out.push({\n        service: KV_SERVICE,\n        space: input.primarySpaceId,\n        path,\n        actions: [KV_GET, KV_SYNC],\n      });\n    }\n  }\n  return out;\n}\n"],"mappings":";AAeA;AAAA,EACE,yBAAAA;AAAA,EACA;AAAA,EACA,MAAAC;AAAA,EACA;AAAA,EACA,sBAAAC;AAAA,EACA;AAAA,OAGK;AAQP,SAAS,kBAAkB,6BAA6B;;;AChCxD,SAAS,sBAA+C;AAGjD,SAAS,6BACd,aACM;AACN,MAAI,gBAAgB,UAAa,YAAY,YAAY,KAAM;AAC/D,MAAI,YAAY,YAAY,UAAa,YAAY,YAAY,MAAM;AACrE,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,MAAI,CAAC,MAAM,QAAQ,YAAY,QAAQ,KAAK,YAAY,SAAS,WAAW,GAAG;AAC7E,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,aAAW,UAAU,YAAY,UAAU;AACzC,QAAI,OAAO,WAAW,YAAY,WAAW,IAAI;AAC/C,YAAM,IAAI,UAAU,uDAAuD;AAAA,IAC7E;AAAA,EACF;AACA,aAAW,CAAC,OAAO,MAAM,KAAK,YAAY,SAAS,QAAQ,GAAG;AAC5D,eAAW,SAAS,YAAY,SAAS,MAAM,QAAQ,CAAC,GAAG;AACzD,UAAI,eAAe,QAAQ,KAAK,KAAK,eAAe,OAAO,MAAM,GAAG;AAClE,cAAM,IAAI;AAAA,UACR,0CAA0C,KAAK,UAAU,MAAM,CAAC,QAAQ,KAAK,UAAU,KAAK,CAAC;AAAA,QAC/F;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,WAAW,YAAY,iBAAiB,MAAM;AAC5E,YAAM,IAAI;AAAA,QACR,sBAAsB,KAAK,UAAU,MAAM,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACF;;;AChCA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,4BAA4B;AAErC,IAAM,SAAS,GAAG;AAClB,IAAM,UAAU,GAAG;AACnB,IAAM,aAAa;AAEZ,SAAS,2BACd,SACA,SACA,QACS;AACT,QAAM,gBAAgB,sBAAsB,MAAM;AAClD,SAAO;AAAA,IACL,cAAc,IAAI,CAAC,UAAU,EAAE,SAAS,YAAY,OAAO,SAAS,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9F,CAAC,GAAG,OAAO;AAAA,EACb,EAAE;AACJ;AAEO,SAAS,oCAAoC,OAI9B;AACpB,QAAM,MAAyB,CAAC;AAChC,QAAM,cAAc,MAAM;AAC1B,MAAI,gBAAgB,OAAW,QAAO;AACtC,aAAW,UAAU,YAAY,UAAU;AACzC,QACE,qBAAqB,MAAM,gBAAgB,MAAM,KACjD,YAAY,iBAAiB,MAC7B;AACA;AAAA,IACF;AACA,QAAI,CAAC,2BAA2B,MAAM,SAAS,MAAM,gBAAgB,MAAM,GAAG;AAC5E;AAAA,IACF;AACA,eAAW,QAAQ,sBAAsB,MAAM,GAAG;AAChD,UAAI,KAAK;AAAA,QACP,SAAS;AAAA,QACT,OAAO,MAAM;AAAA,QACb;AAAA,QACA,SAAS,CAAC,QAAQ,OAAO;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;;;AFpBA,IAAM,iBAAiB;AAIvB,IAAMC,UAASC,IAAG;AAClB,IAAMC,WAAUD,IAAG;AACnB,IAAME,cAAa;AAGnB,SAAS,mBAAmB,SAAiB,QAAmC;AAC9E,SAAOC,uBAAsB,MAAM,EAAE,IAAI,CAAC,UAAU;AAAA,IAClD,SAASD;AAAA,IACT,OAAO;AAAA,IACP;AAAA,IACA,SAAS,CAACH,SAAQE,QAAO;AAAA,EAC3B,EAAE;AACJ;AAUA,SAAS,4BAA4B,OAAyB;AAC5D,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,WAAW,GAAG;AACzF,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,MAAI;AACF,WACE,yBAAyB,KAAkC,MAC3D,yBAAyB,MAAS;AAAA,EAEtC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,iBAAiB,UAAkB,OAAmC;AAC7E,aAAW,QAAQ,CAAC,GAAG,KAAK,QAAQ,eAAe,KAAK,MAAM,GAAG;AAC/D,QAAI,SAAS,WAAW,IAAI,EAAG,QAAO,SAAS,MAAM,KAAK,MAAM;AAAA,EAClE;AACA,SAAO;AACT;AAOO,SAAS,cACd,KACA,OACA,QACA,SACA,SACS;AACT,QAAM,gBAAgB,OAAO,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,GAAG,MAAM,GAAG;AAC7E,SAAO,cAAc,MAAM,CAAC,kBAAkB;AAC5C,eAAW,CAAC,UAAU,SAAS,KAAK,OAAO,QAAQ,GAAG,GAAG;AACvD,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,UAAI,SAAS,OAAW;AACxB,iBAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC1D,YAAI,CAAC,eAAe,SAAS,OAAO,EAAG;AACvC,YAAI,CAACG;AAAA,UACH,CAAC,EAAE,SAASF,aAAY,OAAO,MAAM,eAAe,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,UACxE,CAAC,EAAE,SAASA,aAAY,OAAO,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,QAC3D,EAAE,OAAQ;AACV,YAAI,SAAS,kBAAkB,QAAQ,4BAA4B,OAAO,EAAG,QAAO;AAAA,MACtF;AAAA,IACF;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAGO,SAAS,wBACd,KACA,OACA,QACS;AACT,SACE,cAAc,KAAK,OAAO,QAAQH,OAAM,KACxC,cAAc,KAAK,OAAO,QAAQE,QAAO;AAE7C;AAiCO,IAAM,6BAA6B;AAInC,SAAS,kCAAkC,OAKG;AACnD,MAAI;AACJ,MAAI;AACF,YAAQ,eAAe,MAAM,iBAAiB,aAAa;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAChE,MACE,MAAM,QAAQ,MAAM,iBACpB,QAAQ,MAAM,QAAQ,MAAM,QAAQ,MAAM,kBAAkB,EAC5D,QAAO;AACT,aAAW,YAAY,OAAO,KAAK,MAAM,GAAG,GAAG;AAC7C,UAAM,QAAQ,SAAS,MAAM,iCAAiC,IAAI,CAAC;AACnE,QAAI,UAAU,MAAM,eAAgB;AACpC,UAAM,QAAQ,cAAc,KAAK;AACjC,QAAI,OAAO,SAAS,MAAM,WAAW,MAAM,QAAS,QAAO,EAAE,OAAO,WAAW,MAAM,MAAM;AAAA,EAC7F;AACA,SAAO;AACT;AACO,SAAS,2BAA2B,MAAsD;AAC/F,QAAM,gBAAgB,CAAC,YAAwE;AAC7F,UAAM,OAAO,KAAK,eAAe,OAAO;AACxC,QAAI,aAAa,KAAM,QAAO;AAC9B,WAAO,EAAE,MAAM,KAAK,MAAM,WAAW,KAAK,WAAW,WAAW,KAAK,UAAU;AAAA,EACjF;AACA,QAAM,kBAAkB,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AACxE,QAAM,qBAAqB,CAAC,YAAyC;AACnE,UAAM,QAAQ,eAAe,QAAQ,iBAAiB,aAAa;AACnE,QACE,MAAM,QAAQ,QAAQ,iBACtB,gBAAgB,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,kBAAkB,EAC9E,QAAO;AACT,WAAO;AAAA,EACT;AACA,QAAM,YAAkC;AAAA,IACtC,IAAI,cAAc;AAChB,YAAM,UAAU,KAAK,mBAAmB;AACxC,aAAO,YAAY,UAAa,QAAQ,SAAS;AAAA,IACnD;AAAA,IACA,aAAa,QAA4E;AACvF,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,aAAa,QAAQ,OAAO,KAAK,eAAe,QAAQ,IAAI,GAAG,QAAQ,IAAI;AACjF,UAAI,eAAe,UAAa,cAAc,KAAK,IAAI,IAAI,4BAA4B;AACrF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,UAAI;AACJ,UAAI;AACF,cAAM,WAAW,mBAAmB,OAAO;AAC3C,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,cAAc;AAC/C,gBAAQ;AAAA,MACV,QAAQ;AACN,eAAO,EAAE,SAAS,cAAc;AAAA,MAClC;AACA,YAAM,cAAc,MAAM,cAAc,OAAO,SAAY,MAAM,YAAY;AAC7E,UAAI,gBAAgB,UAAa,eAAe,KAAK,IAAI,IAAI,4BAA4B;AACvF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,YAAM,UAAU,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQF,SAAQ,EAAE,eAAe,KAAK,CAAC,KAC/F,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQE,UAAS,EAAE,eAAe,KAAK,CAAC;AACpF,UAAI,CAAC,QAAS,QAAO,EAAE,SAAS,cAAc;AAC9C,UAAI,CAAC,wBAAwB,MAAM,KAAK,QAAQ,SAAS,MAAM,GAAG;AAChE,eAAO,EAAE,SAAS,qBAAqB;AAAA,MACzC;AACA,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,QAAQ,EAAE,KAAK,QAAQ,oBAAoB,KAAK,QAAQ,IAAI;AAAA,MAC9D;AAAA,IACF;AAAA,IACA,KAAK,QAAyD;AAC5D,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,eAAe,KAAK,aAAa,MAAM;AAC7C,UAAI,EAAE,aAAa,eAAe;AAChC,cAAM,SAAS,mBAAmB,OAAO;AACzC,YAAI,CAAC,UAAU,OAAO,cAAc,KAAM,QAAO,EAAE,SAAS,cAAc;AAC1E,eAAO;AAAA,UACL,MAAM;AAAA,UACN,WAAW,QAAQ;AAAA,UACnB,WAAW,OAAO,YAAY;AAAA,QAChC;AAAA,MACF;AACA,UAAI,UAAU,YAAa,QAAO;AAClC,aAAO,cAAc,mBAAmB,QAAQ,SAAS,MAAM,CAAC;AAAA,IAClE;AAAA,IACA,MAAM,KACJ,WACA,QACA,QACiE;AACjE,UAAI,UAAU,YAAa,OAAM,IAAI,MAAM,qDAAqD;AAChG,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,OAAM,IAAI,MAAM,oCAAoC;AAC/E,YAAM,UAAU,mBAAmB,QAAQ,SAAS,MAAM;AAC1D,YAAM,OAAO,cAAc,OAAO;AAClC,UAAI,aAAa,MAAM;AACrB,cAAM,OAAO;AAAA,UACX,IAAI,MAAM,2CAA2C,KAAK,OAAO,EAAE;AAAA,UACnE,EAAE,SAAS,KAAK,QAAQ;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,eAAe;AACtB,YAAM,SAAS,MAAM,IAAI,QAA6C,CAAC,SAAS,WAAW;AACzF,cAAM,UAAU,MAAY,OAAO,OAAO,UAAU,IAAI,MAAM,0BAA0B,CAAC;AACzF,eAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,aAAK,eAAe,WAAW,OAAO,EAAE;AAAA,UACtC,CAAC,WAAW;AACV,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,oBAAQ,MAAM;AAAA,UAChB;AAAA,UACA,CAAC,UAAmB;AAClB,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,mBAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,UAClE;AAAA,QACF;AAAA,MACF,CAAC;AACD,aAAO,EAAE,MAAM,OAAO,MAAM,WAAW,KAAK,WAAW,WAAW,OAAO,UAAU;AAAA,IACrF;AAAA,EACF;AACA,SAAO;AACT;","names":["grantPathsForSelector","KV","isCapabilitySubset","KV_GET","KV","KV_SYNC","KV_SERVICE","grantPathsForSelector","isCapabilitySubset"]}
+{"version":3,"sources":["../../src/replication/authority.ts","../../src/replication/config.ts","../../src/replication/authority-sign-in.ts"],"sourcesContent":["/**\n * Replication authority (TC-858, plan v3 §4).\n *\n * `ReplicationAuthority` answers, per configured prefix, whether this node's\n * session can back a local replica: the session UCAN itself (delegate\n * posture), a child UCAN minted through `delegateTo`, or nothing (the\n * controller then reports `grant_missing` and reads from the network).\n *\n * The unrestricted-authority rule is enforced here, before any network work:\n * a prefix covered only by a caveated `get`/`sync` refuses with\n * `CAVEATED_AUTHORITY` — on the session path, the runtime-grant path, and on\n * any reuse of an installed grant (the adapter marks every grant's\n * `unconstrained` flag; the controller enforces it on reuse).\n */\n\nimport {\n  actionContains,\n  KV,\n  canonicalizeRecapCaveats,\n  isCapabilitySubset,\n  parseSpaceUri,\n  type PermissionEntry,\n  type TinyCloudSession,\n} from \"@tinycloud/sdk-core\";\nimport {\n  type AuthorityRefusal,\n  type ReplicaDevice,\n  type ReplicationAuthority,\n} from \"@tinycloud/sdk-services\";\nimport type { ReplicaRuntime } from \"./replica-contract\";\n// @ts-ignore -- node-sdk builds before replica declarations; keep the literal import for bundlers.\nimport { parseUcanGrant as replicaParseUcanGrant } from \"@tinycloud/replica\";\nconst parseUcanGrant = replicaParseUcanGrant as ReplicaRuntime[\"parseUcanGrant\"];\nexport { assertValidReplicationConfig } from \"./config\";\nexport { augmentSignInEntriesWithReplication, hasUnrestrictedGetCoverage } from \"./authority-sign-in\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\n/** The delegation the replication grant delegates: get + sync on one folder prefix. */\nfunction replicationEntries(spaceId: string, prefix: string): PermissionEntry[] {\n  return [{\n    service: KV_SERVICE,\n    space: spaceId,\n    path: prefix === \"/\" ? \"\" : prefix,\n    actions: [KV_GET, KV_SYNC],\n  }];\n}\n\n\n\n\n/**\n * The signed UCAN attenuation (`att`: resource → ability → caveat branches).\n * Only array branch sets are known; anything else is treated as constrained —\n * fail closed, never assume unconstrained.\n */\nfunction caveatBranchesUnconstrained(value: unknown): boolean {\n  if (value === undefined || value === null) return true;\n  if (typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length === 0) {\n    return true;\n  }\n  if (!Array.isArray(value)) return false;\n  try {\n    return (\n      canonicalizeRecapCaveats(value as Record<string, unknown>[]) ===\n      canonicalizeRecapCaveats(undefined)\n    );\n  } catch {\n    return false;\n  }\n}\n\n/** The KV path a signed UCAN resource names in `space`, like replica's `kvPathIn`. */\nfunction kvPathInResource(resource: string, space: string): string | undefined {\n  for (const root of [`${space}/kv`, `tinycloud://${space}/kv`]) {\n    if (resource === root || resource === `${root}/`) return \"/\";\n  }\n  for (const base of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {\n    if (resource.startsWith(base)) return resource.slice(base.length);\n  }\n  return undefined;\n\n}\n/**\n * Whether the signed `att` grants `ability` over the folder prefix, with\n * unrestricted authority unless explicitly asked to ignore caveats.\n */\nexport function ucanAttCovers(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n  ability: string,\n  options?: { ignoreCaveats?: boolean },\n): boolean {\n  for (const [resource, abilities] of Object.entries(att)) {\n    const path = kvPathInResource(resource, space);\n    if (path === undefined) continue;\n    for (const [granted, caveats] of Object.entries(abilities)) {\n      if (!actionContains(granted, ability)) continue;\n      if (!isCapabilitySubset(\n        [{ service: KV_SERVICE, space, path: prefix, actions: [ability] }],\n        [{ service: KV_SERVICE, space, path, actions: [granted] }],\n      ).subset) continue;\n      if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;\n    }\n  }\n  return false;\n}\n\n/** `unconstrained` for `ReplicaGrantInfo` (§2.1): get AND sync on the prefix carry no caveats. */\nexport function ucanAttUnconstrainedFor(\n  att: Record<string, Record<string, unknown>>,\n  space: string,\n  prefix: string,\n): boolean {\n  return (\n    ucanAttCovers(att, space, prefix, KV_GET) &&\n    ucanAttCovers(att, space, prefix, KV_SYNC)\n  );\n}\n\nexport interface DelegationPlanResult {\n  path: \"session\" | \"runtime\";\n  parentCid: string;\n  expiresAt: number;\n}\n\n/**\n * The `TinyCloudNode` internals the authority needs. `planDelegation` is the\n * pure extraction of `delegateTo`'s parent selection (§4.3), so `plan` and\n * `mint` can never disagree about which parent or expiry a delegation gets.\n */\nexport type ReplicationAuthoritySession = Pick<\n  TinyCloudSession,\n  \"delegationHeader\" | \"delegationCid\" | \"spaceId\" | \"verificationMethod\" | \"jwk\"\n> & Partial<Pick<TinyCloudSession, \"siwe\">>;\n\nexport interface ReplicationAuthorityHost {\n  replicationSession(): ReplicationAuthoritySession | undefined;\n  /** The SIWE \"Expiration Time\" of the session — the delegateTo delegation cap. */\n  siweExpiration(siwe: string): Date | undefined;\n  planDelegation(\n    entries: PermissionEntry[],\n    options?: { expiry?: string | number },\n  ): ({ grant?: unknown } & DelegationPlanResult) | AuthorityRefusal;\n  mintDelegation(\n    deviceDid: string,\n    entries: PermissionEntry[],\n  ): Promise<{ ucan: string; expiresAt: number }>;\n}\n\n/** Milliseconds of validity a session or parent must have left for authority reuse (delegateTo's margin). */\nexport const AUTHORITY_EXPIRY_MARGIN_MS = 60_000;\n\n\n/** Verify a compact session delegation before using any persisted space metadata. */\nexport function replicationScopeFromSignedSession(input: {\n  delegationHeader: { Authorization: string };\n  delegationCid: string;\n  verificationMethod: string;\n  persistedSpace: string;\n}): { space: string; principal: string } | undefined {\n  let grant: ReturnType<typeof parseUcanGrant>;\n  try {\n    grant = parseUcanGrant(input.delegationHeader.Authorization);\n  } catch {\n    return undefined;\n  }\n  const bareDid = (value: string): string => value.split(\"#\", 1)[0]!;\n  if (\n    grant.cid !== input.delegationCid ||\n    bareDid(grant.audience) !== bareDid(input.verificationMethod)\n  ) return undefined;\n  for (const resource of Object.keys(grant.att)) {\n    const space = resource.match(/^(?:tinycloud:\\/\\/)?(.+?)\\/kv(?:\\/|$)/)?.[1];\n    if (space !== input.persistedSpace) continue;\n    const owner = parseSpaceUri(space);\n    if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };\n  }\n  return undefined;\n}\nexport function createReplicationAuthority(host: ReplicationAuthorityHost): ReplicationAuthority {\n  const planOrRefusal = (entries: PermissionEntry[]): DelegationPlanResult | AuthorityRefusal => {\n    const plan = host.planDelegation(entries);\n    if (\"refused\" in plan) return plan;\n    return { path: plan.path, parentCid: plan.parentCid, expiresAt: plan.expiresAt };\n  };\n  const sessionAudience = (value: string): string => value.split(\"#\", 1)[0]!;\n  const signedSessionGrant = (session: ReplicationAuthoritySession) => {\n    const grant = parseUcanGrant(session.delegationHeader.Authorization);\n    if (\n      grant.cid !== session.delegationCid ||\n      sessionAudience(grant.audience) !== sessionAudience(session.verificationMethod)\n    ) return undefined;\n    return grant;\n  };\n  const authority: ReplicationAuthority = {\n    get sessionOnly() {\n      const session = host.replicationSession();\n      return session !== undefined && session.siwe === undefined;\n    },\n    sessionGrant(prefix: string): { ucan: string; device: ReplicaDevice } | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const siweExpiry = session.siwe ? host.siweExpiration(session.siwe)?.getTime() : undefined;\n      if (siweExpiry !== undefined && siweExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      let grant: ReturnType<typeof parseUcanGrant>;\n      try {\n        const verified = signedSessionGrant(session);\n        if (!verified) return { refused: \"NOT_COVERED\" };\n        grant = verified;\n      } catch {\n        return { refused: \"NOT_COVERED\" };\n      }\n      const tokenExpiry = grant.expiresAt === null ? undefined : grant.expiresAt * 1000;\n      if (tokenExpiry === undefined || tokenExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {\n        return { refused: \"SESSION_EXPIRING\" };\n      }\n      const covered = ucanAttCovers(grant.att, session.spaceId, prefix, KV_GET, { ignoreCaveats: true }) &&\n        ucanAttCovers(grant.att, session.spaceId, prefix, KV_SYNC, { ignoreCaveats: true });\n      if (!covered) return { refused: \"NOT_COVERED\" };\n      if (!ucanAttUnconstrainedFor(grant.att, session.spaceId, prefix)) {\n        return { refused: \"CAVEATED_AUTHORITY\" };\n      }\n      return {\n        ucan: grant.jwt,\n        device: { did: session.verificationMethod, jwk: session.jwk },\n      };\n    },\n    plan(prefix: string): DelegationPlanResult | AuthorityRefusal {\n      const session = host.replicationSession();\n      if (session === undefined) return { refused: \"SESSION_EXPIRING\" };\n      const sessionGrant = this.sessionGrant(prefix);\n      if (!(\"refused\" in sessionGrant)) {\n        const signed = signedSessionGrant(session);\n        if (!signed || signed.expiresAt === null) return { refused: \"NOT_COVERED\" };\n        return {\n          path: \"session\",\n          parentCid: session.delegationCid,\n          expiresAt: signed.expiresAt * 1000,\n        };\n      }\n      if (authority.sessionOnly) return sessionGrant;\n      return planOrRefusal(replicationEntries(session.spaceId, prefix));\n    },\n    async mint(\n      deviceDid: string,\n      prefix: string,\n      signal: AbortSignal,\n    ): Promise<{ ucan: string; parentCid: string; expiresAt: number }> {\n      if (authority.sessionOnly) throw new Error(\"compact delegate sessions cannot mint device grants\");\n      const session = host.replicationSession();\n      if (session === undefined) throw new Error(\"replication mint without a session\");\n      const entries = replicationEntries(session.spaceId, prefix);\n      const plan = planOrRefusal(entries);\n      if (\"refused\" in plan) {\n        throw Object.assign(\n          new Error(`replication authority refused the mint: ${plan.refused}`),\n          { refused: plan.refused },\n        );\n      }\n      signal.throwIfAborted();\n      const minted = await new Promise<{ ucan: string; expiresAt: number }>((resolve, reject) => {\n        const onAbort = (): void => reject(signal.reason ?? new Error(\"replication mint aborted\"));\n        signal.addEventListener(\"abort\", onAbort, { once: true });\n        host.mintDelegation(deviceDid, entries).then(\n          (result) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            resolve(result);\n          },\n          (error: unknown) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            reject(error instanceof Error ? error : new Error(String(error)));\n          },\n        );\n      });\n      return { ucan: minted.ucan, parentCid: plan.parentCid, expiresAt: minted.expiresAt };\n    },\n  };\n  return authority;\n}\n","import { assertFolderPrefix as assertPureFolderPrefix, kvPrefixCovers } from \"@tinycloud/sdk-services/kv/replication/prefix\";\nimport type { ReplicationOptions } from \"@tinycloud/sdk-core\";\n\n/** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */\nexport function assertValidReplicationConfig(\n  replication: (ReplicationOptions & { storage?: unknown }) | undefined,\n): void {\n  if (replication === undefined || replication.enabled !== true) return;\n  if (replication.storage === undefined || replication.storage === null) {\n    throw new TypeError(\"replication.enabled requires replication.storage\");\n  }\n  if (!Array.isArray(replication.prefixes) || replication.prefixes.length === 0) {\n    throw new TypeError(\"replication.prefixes must be a non-empty array\");\n  }\n  for (const prefix of replication.prefixes) {\n    try {\n      assertPureFolderPrefix(prefix);\n    } catch (error) {\n      throw new TypeError(error instanceof Error ? error.message : String(error));\n    }\n  }\n  for (const [index, prefix] of replication.prefixes.entries()) {\n    for (const other of replication.prefixes.slice(index + 1)) {\n      if (kvPrefixCovers(prefix, other) || kvPrefixCovers(other, prefix)) {\n        throw new TypeError(\n          `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`,\n        );\n      }\n    }\n    if ((prefix === \"/\" || prefix.split(\"/\", 1)[0] === \"vault\") && replication.allowSecrets !== true) {\n      throw new TypeError(\n        `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`,\n      );\n    }\n  }\n}\n","import {\n  KV,\n  isCapabilitySubset,\n  type PermissionEntry,\n  type ReplicationOptions,\n} from \"@tinycloud/sdk-core\";\nimport { requiresSecretsOptIn } from \"@tinycloud/sdk-services\";\nimport { assertFolderPrefix } from \"@tinycloud/sdk-services/kv/replication/prefix\";\n\nconst KV_GET = KV.GET;\nconst KV_SYNC = KV.SYNC;\nconst KV_SERVICE = \"tinycloud.kv\";\n\nexport function hasUnrestrictedGetCoverage(\n  entries: readonly PermissionEntry[],\n  spaceId: string,\n  prefix: string,\n): boolean {\n  return isCapabilitySubset(\n    [{ service: KV_SERVICE, space: spaceId, path: prefix, actions: [KV_GET] }],\n    [...entries],\n  ).subset;\n}\n\nexport function augmentSignInEntriesWithReplication(input: {\n  entries: readonly PermissionEntry[];\n  primarySpaceId: string;\n  replication?: Pick<ReplicationOptions, \"prefixes\" | \"allowSecrets\">;\n}): PermissionEntry[] {\n  const out: PermissionEntry[] = [];\n  const replication = input.replication;\n  if (replication === undefined) return out;\n  const eligiblePaths: string[] = [];\n  for (const prefix of replication.prefixes) {\n    assertFolderPrefix(prefix);\n    const path = prefix === \"/\" ? \"\" : prefix;\n    if (\n      requiresSecretsOptIn(input.primarySpaceId, prefix) &&\n      replication.allowSecrets !== true\n    ) {\n      continue;\n    }\n    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, path)) {\n      continue;\n    }\n    eligiblePaths.push(path);\n  }\n  if (\n    eligiblePaths.length === replication.prefixes.length &&\n    eligiblePaths.length > 0 &&\n    hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, \"\")\n  ) {\n    return [{\n      service: KV_SERVICE,\n      space: input.primarySpaceId,\n      path: \"\",\n      actions: [KV_GET, KV_SYNC],\n    }];\n  }\n  for (const path of eligiblePaths) {\n    out.push({\n      service: KV_SERVICE,\n      space: input.primarySpaceId,\n      path,\n      actions: [KV_GET, KV_SYNC],\n    });\n  }\n  return out;\n}\n"],"mappings":";AAeA;AAAA,EACE;AAAA,EACA,MAAAA;AAAA,EACA;AAAA,EACA,sBAAAC;AAAA,EACA;AAAA,OAGK;AAQP,SAAS,kBAAkB,6BAA6B;;;AC/BxD,SAAS,sBAAsB,wBAAwB,sBAAsB;AAItE,SAAS,6BACd,aACM;AACN,MAAI,gBAAgB,UAAa,YAAY,YAAY,KAAM;AAC/D,MAAI,YAAY,YAAY,UAAa,YAAY,YAAY,MAAM;AACrE,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,MAAI,CAAC,MAAM,QAAQ,YAAY,QAAQ,KAAK,YAAY,SAAS,WAAW,GAAG;AAC7E,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,aAAW,UAAU,YAAY,UAAU;AACzC,QAAI;AACF,6BAAuB,MAAM;AAAA,IAC/B,SAAS,OAAO;AACd,YAAM,IAAI,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC5E;AAAA,EACF;AACA,aAAW,CAAC,OAAO,MAAM,KAAK,YAAY,SAAS,QAAQ,GAAG;AAC5D,eAAW,SAAS,YAAY,SAAS,MAAM,QAAQ,CAAC,GAAG;AACzD,UAAI,eAAe,QAAQ,KAAK,KAAK,eAAe,OAAO,MAAM,GAAG;AAClE,cAAM,IAAI;AAAA,UACR,0CAA0C,KAAK,UAAU,MAAM,CAAC,QAAQ,KAAK,UAAU,KAAK,CAAC;AAAA,QAC/F;AAAA,MACF;AAAA,IACF;AACA,SAAK,WAAW,OAAO,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,YAAY,YAAY,iBAAiB,MAAM;AAChG,YAAM,IAAI;AAAA,QACR,sBAAsB,KAAK,UAAU,MAAM,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACF;;;ACnCA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,4BAA4B;AACrC,SAAS,0BAA0B;AAEnC,IAAM,SAAS,GAAG;AAClB,IAAM,UAAU,GAAG;AACnB,IAAM,aAAa;AAEZ,SAAS,2BACd,SACA,SACA,QACS;AACT,SAAO;AAAA,IACL,CAAC,EAAE,SAAS,YAAY,OAAO,SAAS,MAAM,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC;AAAA,IACzE,CAAC,GAAG,OAAO;AAAA,EACb,EAAE;AACJ;AAEO,SAAS,oCAAoC,OAI9B;AACpB,QAAM,MAAyB,CAAC;AAChC,QAAM,cAAc,MAAM;AAC1B,MAAI,gBAAgB,OAAW,QAAO;AACtC,QAAM,gBAA0B,CAAC;AACjC,aAAW,UAAU,YAAY,UAAU;AACzC,uBAAmB,MAAM;AACzB,UAAM,OAAO,WAAW,MAAM,KAAK;AACnC,QACE,qBAAqB,MAAM,gBAAgB,MAAM,KACjD,YAAY,iBAAiB,MAC7B;AACA;AAAA,IACF;AACA,QAAI,CAAC,2BAA2B,MAAM,SAAS,MAAM,gBAAgB,IAAI,GAAG;AAC1E;AAAA,IACF;AACA,kBAAc,KAAK,IAAI;AAAA,EACzB;AACA,MACE,cAAc,WAAW,YAAY,SAAS,UAC9C,cAAc,SAAS,KACvB,2BAA2B,MAAM,SAAS,MAAM,gBAAgB,EAAE,GAClE;AACA,WAAO,CAAC;AAAA,MACN,SAAS;AAAA,MACT,OAAO,MAAM;AAAA,MACb,MAAM;AAAA,MACN,SAAS,CAAC,QAAQ,OAAO;AAAA,IAC3B,CAAC;AAAA,EACH;AACA,aAAW,QAAQ,eAAe;AAChC,QAAI,KAAK;AAAA,MACP,SAAS;AAAA,MACT,OAAO,MAAM;AAAA,MACb;AAAA,MACA,SAAS,CAAC,QAAQ,OAAO;AAAA,IAC3B,CAAC;AAAA,EACH;AACA,SAAO;AACT;;;AFpCA,IAAM,iBAAiB;AAIvB,IAAMC,UAASC,IAAG;AAClB,IAAMC,WAAUD,IAAG;AACnB,IAAME,cAAa;AAGnB,SAAS,mBAAmB,SAAiB,QAAmC;AAC9E,SAAO,CAAC;AAAA,IACN,SAASA;AAAA,IACT,OAAO;AAAA,IACP,MAAM,WAAW,MAAM,KAAK;AAAA,IAC5B,SAAS,CAACH,SAAQE,QAAO;AAAA,EAC3B,CAAC;AACH;AAUA,SAAS,4BAA4B,OAAyB;AAC5D,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,WAAW,GAAG;AACzF,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,MAAI;AACF,WACE,yBAAyB,KAAkC,MAC3D,yBAAyB,MAAS;AAAA,EAEtC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,iBAAiB,UAAkB,OAAmC;AAC7E,aAAW,QAAQ,CAAC,GAAG,KAAK,OAAO,eAAe,KAAK,KAAK,GAAG;AAC7D,QAAI,aAAa,QAAQ,aAAa,GAAG,IAAI,IAAK,QAAO;AAAA,EAC3D;AACA,aAAW,QAAQ,CAAC,GAAG,KAAK,QAAQ,eAAe,KAAK,MAAM,GAAG;AAC/D,QAAI,SAAS,WAAW,IAAI,EAAG,QAAO,SAAS,MAAM,KAAK,MAAM;AAAA,EAClE;AACA,SAAO;AAET;AAKO,SAAS,cACd,KACA,OACA,QACA,SACA,SACS;AACT,aAAW,CAAC,UAAU,SAAS,KAAK,OAAO,QAAQ,GAAG,GAAG;AACvD,UAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,QAAI,SAAS,OAAW;AACxB,eAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC1D,UAAI,CAAC,eAAe,SAAS,OAAO,EAAG;AACvC,UAAI,CAACE;AAAA,QACH,CAAC,EAAE,SAASD,aAAY,OAAO,MAAM,QAAQ,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,QACjE,CAAC,EAAE,SAASA,aAAY,OAAO,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;AAAA,MAC3D,EAAE,OAAQ;AACV,UAAI,SAAS,kBAAkB,QAAQ,4BAA4B,OAAO,EAAG,QAAO;AAAA,IACtF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,wBACd,KACA,OACA,QACS;AACT,SACE,cAAc,KAAK,OAAO,QAAQH,OAAM,KACxC,cAAc,KAAK,OAAO,QAAQE,QAAO;AAE7C;AAiCO,IAAM,6BAA6B;AAInC,SAAS,kCAAkC,OAKG;AACnD,MAAI;AACJ,MAAI;AACF,YAAQ,eAAe,MAAM,iBAAiB,aAAa;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AAChE,MACE,MAAM,QAAQ,MAAM,iBACpB,QAAQ,MAAM,QAAQ,MAAM,QAAQ,MAAM,kBAAkB,EAC5D,QAAO;AACT,aAAW,YAAY,OAAO,KAAK,MAAM,GAAG,GAAG;AAC7C,UAAM,QAAQ,SAAS,MAAM,uCAAuC,IAAI,CAAC;AACzE,QAAI,UAAU,MAAM,eAAgB;AACpC,UAAM,QAAQ,cAAc,KAAK;AACjC,QAAI,OAAO,SAAS,MAAM,WAAW,MAAM,QAAS,QAAO,EAAE,OAAO,WAAW,MAAM,MAAM;AAAA,EAC7F;AACA,SAAO;AACT;AACO,SAAS,2BAA2B,MAAsD;AAC/F,QAAM,gBAAgB,CAAC,YAAwE;AAC7F,UAAM,OAAO,KAAK,eAAe,OAAO;AACxC,QAAI,aAAa,KAAM,QAAO;AAC9B,WAAO,EAAE,MAAM,KAAK,MAAM,WAAW,KAAK,WAAW,WAAW,KAAK,UAAU;AAAA,EACjF;AACA,QAAM,kBAAkB,CAAC,UAA0B,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC;AACxE,QAAM,qBAAqB,CAAC,YAAyC;AACnE,UAAM,QAAQ,eAAe,QAAQ,iBAAiB,aAAa;AACnE,QACE,MAAM,QAAQ,QAAQ,iBACtB,gBAAgB,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,kBAAkB,EAC9E,QAAO;AACT,WAAO;AAAA,EACT;AACA,QAAM,YAAkC;AAAA,IACtC,IAAI,cAAc;AAChB,YAAM,UAAU,KAAK,mBAAmB;AACxC,aAAO,YAAY,UAAa,QAAQ,SAAS;AAAA,IACnD;AAAA,IACA,aAAa,QAA4E;AACvF,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,aAAa,QAAQ,OAAO,KAAK,eAAe,QAAQ,IAAI,GAAG,QAAQ,IAAI;AACjF,UAAI,eAAe,UAAa,cAAc,KAAK,IAAI,IAAI,4BAA4B;AACrF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,UAAI;AACJ,UAAI;AACF,cAAM,WAAW,mBAAmB,OAAO;AAC3C,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,cAAc;AAC/C,gBAAQ;AAAA,MACV,QAAQ;AACN,eAAO,EAAE,SAAS,cAAc;AAAA,MAClC;AACA,YAAM,cAAc,MAAM,cAAc,OAAO,SAAY,MAAM,YAAY;AAC7E,UAAI,gBAAgB,UAAa,eAAe,KAAK,IAAI,IAAI,4BAA4B;AACvF,eAAO,EAAE,SAAS,mBAAmB;AAAA,MACvC;AACA,YAAM,UAAU,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQF,SAAQ,EAAE,eAAe,KAAK,CAAC,KAC/F,cAAc,MAAM,KAAK,QAAQ,SAAS,QAAQE,UAAS,EAAE,eAAe,KAAK,CAAC;AACpF,UAAI,CAAC,QAAS,QAAO,EAAE,SAAS,cAAc;AAC9C,UAAI,CAAC,wBAAwB,MAAM,KAAK,QAAQ,SAAS,MAAM,GAAG;AAChE,eAAO,EAAE,SAAS,qBAAqB;AAAA,MACzC;AACA,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,QAAQ,EAAE,KAAK,QAAQ,oBAAoB,KAAK,QAAQ,IAAI;AAAA,MAC9D;AAAA,IACF;AAAA,IACA,KAAK,QAAyD;AAC5D,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,QAAO,EAAE,SAAS,mBAAmB;AAChE,YAAM,eAAe,KAAK,aAAa,MAAM;AAC7C,UAAI,EAAE,aAAa,eAAe;AAChC,cAAM,SAAS,mBAAmB,OAAO;AACzC,YAAI,CAAC,UAAU,OAAO,cAAc,KAAM,QAAO,EAAE,SAAS,cAAc;AAC1E,eAAO;AAAA,UACL,MAAM;AAAA,UACN,WAAW,QAAQ;AAAA,UACnB,WAAW,OAAO,YAAY;AAAA,QAChC;AAAA,MACF;AACA,UAAI,UAAU,YAAa,QAAO;AAClC,aAAO,cAAc,mBAAmB,QAAQ,SAAS,MAAM,CAAC;AAAA,IAClE;AAAA,IACA,MAAM,KACJ,WACA,QACA,QACiE;AACjE,UAAI,UAAU,YAAa,OAAM,IAAI,MAAM,qDAAqD;AAChG,YAAM,UAAU,KAAK,mBAAmB;AACxC,UAAI,YAAY,OAAW,OAAM,IAAI,MAAM,oCAAoC;AAC/E,YAAM,UAAU,mBAAmB,QAAQ,SAAS,MAAM;AAC1D,YAAM,OAAO,cAAc,OAAO;AAClC,UAAI,aAAa,MAAM;AACrB,cAAM,OAAO;AAAA,UACX,IAAI,MAAM,2CAA2C,KAAK,OAAO,EAAE;AAAA,UACnE,EAAE,SAAS,KAAK,QAAQ;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,eAAe;AACtB,YAAM,SAAS,MAAM,IAAI,QAA6C,CAAC,SAAS,WAAW;AACzF,cAAM,UAAU,MAAY,OAAO,OAAO,UAAU,IAAI,MAAM,0BAA0B,CAAC;AACzF,eAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,aAAK,eAAe,WAAW,OAAO,EAAE;AAAA,UACtC,CAAC,WAAW;AACV,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,oBAAQ,MAAM;AAAA,UAChB;AAAA,UACA,CAAC,UAAmB;AAClB,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,mBAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,UAClE;AAAA,QACF;AAAA,MACF,CAAC;AACD,aAAO,EAAE,MAAM,OAAO,MAAM,WAAW,KAAK,WAAW,WAAW,OAAO,UAAU;AAAA,IACrF;AAAA,EACF;AACA,SAAO;AACT;","names":["KV","isCapabilitySubset","KV_GET","KV","KV_SYNC","KV_SERVICE","isCapabilitySubset"]}

package/dist/replication/runtime.cjs

@@ -172,6 +172,7 @@ var ReplicationRuntime = class {
         scheduler: this.clock,
         emit,
         fetch: context.fetch,
+        nodeFeatures: input.nodeFeatures,
         previous: previousClose
       });
       this.current = controller;