@tinycloud/node-sdk 3.2.0-beta.4 → 3.2.0-beta.6

package/dist/{WasmKeyProvider-DjfRu9aL.d.cts → WasmKeyProvider-C3NFgOmv.d.cts}

@@ -329,6 +329,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private _address?;
     private _chainId?;
     private _nodeFeatures;
+    private _nodeFeaturesKnown;
     /**
      * `nodeId` from the `GET /info` performed during sign-in/restore, tagged with
      * the host it came from. Callers that need the node DID (encryption-network
@@ -383,7 +384,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     setRestoredTinyCloudSession(session: TinyCloudSession, hosts?: string[]): void;
     /** @internal Atomically adopt the state staged by TinyCloudNode.restoreSession. */
-    installRestoredSession(sessionManager: ISessionManager, session: TinyCloudSession | undefined, hosts?: string[]): void;
+    installRestoredSession(sessionManager: ISessionManager, session: TinyCloudSession | undefined, hosts?: string[], nodeFeatures?: string[]): void;
     /**
      * Ensure `tinycloudHosts` are resolved before a host-needing call.
      *
@@ -403,6 +404,8 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private requireTinyCloudHosts;
     private get primaryTinyCloudHost();
     get nodeFeatures(): string[];
+    get nodeFeaturesKnown(): boolean;
+    refreshNodeInfo(): Promise<void>;
     /**
      * The node DID reported by `GET /info` for `host`, if the sign-in (or
      * restore) that populated it targeted that same host. Returns `undefined`
@@ -895,11 +898,11 @@ interface ValidatedRuntimeDelegation {
     readonly cid: string;
     /** The authority object installed by the node runtime. */
     readonly delegation: PortableDelegation;
-    /** Capabilities read from the signed compact UCAN attenuation. */
+    /** Capabilities read from the signed compact UCAN attenuation or SIWE ReCap. */
     readonly effectivePermissions: readonly PermissionEntry[];
-    /** Expiry read from the signed compact UCAN payload. */
+    /** Expiry read from the signed compact UCAN payload or SIWE. */
     readonly expiry: Date;
-    /** Audience read from the signed compact UCAN payload. */
+    /** Audience read from the signed compact UCAN payload or SIWE. */
     readonly audience: string;
     /** Host selected for, and used by, the runtime activation. */
     readonly host: string;
@@ -979,6 +982,20 @@ declare function activateValidatedRuntimeDelegation(node: RuntimeDelegationActiv
  * derived from signed bytes before `/delegate` is called.
  */
 declare function activateCompactRuntimeDelegation(node: RuntimeDelegationActivator, input: CompactRuntimeDelegationInput): Promise<ValidatedRuntimeDelegation>;
+/**
+ * Project an OpenKey signed-login delegation from the same verified CACAO
+ * authority used when the runtime activates and replays it.
+ */
+declare function siweRuntimeDelegation(node: RuntimeDelegationActivator, input: {
+    readonly authorization: string;
+    readonly cid: string;
+    readonly spaceId: string;
+    readonly ownerAddress: string;
+    readonly chainId: number;
+    readonly siwe: string;
+    readonly signature: string;
+    readonly host: string;
+}): PortableDelegation;
 /**
  * Turn a delegation REQUEST into a signed GRANT.
  *
@@ -1474,6 +1491,7 @@ declare class TinyCloudNode {
      * {@link currentTinyCloudSession} as a fallback for `auth.tinyCloudSession`.
      */
     private _restoredTcSession?;
+    private _restoredNodeFeatures?;
     private _activeServiceSession?;
     /**
      * True when the last signIn() detected an interactive signer and skipped
@@ -1504,6 +1522,7 @@ declare class TinyCloudNode {
         warnings?: BootstrapWarning[];
     };
     private get nodeFeatures();
+    private get replicationNodeFeatures();
     /** SIWE domain — uses config override or defaults to app.tinycloud.xyz */
     private get siweDomain();
     private readonly invokeWithRuntimePermissions;
@@ -2736,4 +2755,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, activateValidatedRuntimeDelegation as G, createWasmKeyProvider as H, InvalidRestoredSessionError as I, defaultSignStrategy as J, deserializeDelegation as K, grantAuthRequest as L, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, serializeDelegation as Q, RUNTIME_DELEGATION_REJECTIONS as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, signedCompactUcanExpiry as X, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RestorableSession as l, type RuntimeDelegationActivator as m, RuntimeDelegationRejectedError as n, type RuntimeDelegationRejection as o, type RuntimePermissionGrantOptions as p, type SecretReadInput as q, type SecretReadResult as r, type SessionGrantProof as s, type SignStrategy as t, type TinyCloudNodeConfig as u, type UnifiedOwnerRootReceipt as v, UnsupportedSessionRestoreError as w, type VerifiedSessionGrant as x, type WasmKeyProviderConfig as y, activateCompactRuntimeDelegation as z };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, activateValidatedRuntimeDelegation as G, createWasmKeyProvider as H, InvalidRestoredSessionError as I, defaultSignStrategy as J, deserializeDelegation as K, grantAuthRequest as L, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, serializeDelegation as Q, RUNTIME_DELEGATION_REJECTIONS as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, signedCompactUcanExpiry as X, siweRuntimeDelegation as Y, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RestorableSession as l, type RuntimeDelegationActivator as m, RuntimeDelegationRejectedError as n, type RuntimeDelegationRejection as o, type RuntimePermissionGrantOptions as p, type SecretReadInput as q, type SecretReadResult as r, type SessionGrantProof as s, type SignStrategy as t, type TinyCloudNodeConfig as u, type UnifiedOwnerRootReceipt as v, UnsupportedSessionRestoreError as w, type VerifiedSessionGrant as x, type WasmKeyProviderConfig as y, activateCompactRuntimeDelegation as z };

package/dist/{WasmKeyProvider-DjfRu9aL.d.ts → WasmKeyProvider-C3NFgOmv.d.ts}

@@ -329,6 +329,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private _address?;
     private _chainId?;
     private _nodeFeatures;
+    private _nodeFeaturesKnown;
     /**
      * `nodeId` from the `GET /info` performed during sign-in/restore, tagged with
      * the host it came from. Callers that need the node DID (encryption-network
@@ -383,7 +384,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     setRestoredTinyCloudSession(session: TinyCloudSession, hosts?: string[]): void;
     /** @internal Atomically adopt the state staged by TinyCloudNode.restoreSession. */
-    installRestoredSession(sessionManager: ISessionManager, session: TinyCloudSession | undefined, hosts?: string[]): void;
+    installRestoredSession(sessionManager: ISessionManager, session: TinyCloudSession | undefined, hosts?: string[], nodeFeatures?: string[]): void;
     /**
      * Ensure `tinycloudHosts` are resolved before a host-needing call.
      *
@@ -403,6 +404,8 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private requireTinyCloudHosts;
     private get primaryTinyCloudHost();
     get nodeFeatures(): string[];
+    get nodeFeaturesKnown(): boolean;
+    refreshNodeInfo(): Promise<void>;
     /**
      * The node DID reported by `GET /info` for `host`, if the sign-in (or
      * restore) that populated it targeted that same host. Returns `undefined`
@@ -895,11 +898,11 @@ interface ValidatedRuntimeDelegation {
     readonly cid: string;
     /** The authority object installed by the node runtime. */
     readonly delegation: PortableDelegation;
-    /** Capabilities read from the signed compact UCAN attenuation. */
+    /** Capabilities read from the signed compact UCAN attenuation or SIWE ReCap. */
     readonly effectivePermissions: readonly PermissionEntry[];
-    /** Expiry read from the signed compact UCAN payload. */
+    /** Expiry read from the signed compact UCAN payload or SIWE. */
     readonly expiry: Date;
-    /** Audience read from the signed compact UCAN payload. */
+    /** Audience read from the signed compact UCAN payload or SIWE. */
     readonly audience: string;
     /** Host selected for, and used by, the runtime activation. */
     readonly host: string;
@@ -979,6 +982,20 @@ declare function activateValidatedRuntimeDelegation(node: RuntimeDelegationActiv
  * derived from signed bytes before `/delegate` is called.
  */
 declare function activateCompactRuntimeDelegation(node: RuntimeDelegationActivator, input: CompactRuntimeDelegationInput): Promise<ValidatedRuntimeDelegation>;
+/**
+ * Project an OpenKey signed-login delegation from the same verified CACAO
+ * authority used when the runtime activates and replays it.
+ */
+declare function siweRuntimeDelegation(node: RuntimeDelegationActivator, input: {
+    readonly authorization: string;
+    readonly cid: string;
+    readonly spaceId: string;
+    readonly ownerAddress: string;
+    readonly chainId: number;
+    readonly siwe: string;
+    readonly signature: string;
+    readonly host: string;
+}): PortableDelegation;
 /**
  * Turn a delegation REQUEST into a signed GRANT.
  *
@@ -1474,6 +1491,7 @@ declare class TinyCloudNode {
      * {@link currentTinyCloudSession} as a fallback for `auth.tinyCloudSession`.
      */
     private _restoredTcSession?;
+    private _restoredNodeFeatures?;
     private _activeServiceSession?;
     /**
      * True when the last signIn() detected an interactive signer and skipped
@@ -1504,6 +1522,7 @@ declare class TinyCloudNode {
         warnings?: BootstrapWarning[];
     };
     private get nodeFeatures();
+    private get replicationNodeFeatures();
     /** SIWE domain — uses config override or defaults to app.tinycloud.xyz */
     private get siweDomain();
     private readonly invokeWithRuntimePermissions;
@@ -2736,4 +2755,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, activateValidatedRuntimeDelegation as G, createWasmKeyProvider as H, InvalidRestoredSessionError as I, defaultSignStrategy as J, deserializeDelegation as K, grantAuthRequest as L, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, serializeDelegation as Q, RUNTIME_DELEGATION_REJECTIONS as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, signedCompactUcanExpiry as X, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RestorableSession as l, type RuntimeDelegationActivator as m, RuntimeDelegationRejectedError as n, type RuntimeDelegationRejection as o, type RuntimePermissionGrantOptions as p, type SecretReadInput as q, type SecretReadResult as r, type SessionGrantProof as s, type SignStrategy as t, type TinyCloudNodeConfig as u, type UnifiedOwnerRootReceipt as v, UnsupportedSessionRestoreError as w, type VerifiedSessionGrant as x, type WasmKeyProviderConfig as y, activateCompactRuntimeDelegation as z };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, activateValidatedRuntimeDelegation as G, createWasmKeyProvider as H, InvalidRestoredSessionError as I, defaultSignStrategy as J, deserializeDelegation as K, grantAuthRequest as L, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, serializeDelegation as Q, RUNTIME_DELEGATION_REJECTIONS as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, signedCompactUcanExpiry as X, siweRuntimeDelegation as Y, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RestorableSession as l, type RuntimeDelegationActivator as m, RuntimeDelegationRejectedError as n, type RuntimeDelegationRejection as o, type RuntimePermissionGrantOptions as p, type SecretReadInput as q, type SecretReadResult as r, type SessionGrantProof as s, type SignStrategy as t, type TinyCloudNodeConfig as u, type UnifiedOwnerRootReceipt as v, UnsupportedSessionRestoreError as w, type VerifiedSessionGrant as x, type WasmKeyProviderConfig as y, activateCompactRuntimeDelegation as z };

package/dist/{authority-mTQEgN56.d.cts → authority-DDGtccBK.d.cts}

@@ -1,5 +1,5 @@
-import { PermissionEntry, ReplicationOptions as ReplicationOptions$1, TinyCloudSession } from '@tinycloud/sdk-core';
-import { ReplicationOptions, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
+import { ReplicationOptions, PermissionEntry, TinyCloudSession } from '@tinycloud/sdk-core';
+import { AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {
@@ -10,7 +10,7 @@ declare function hasUnrestrictedGetCoverage(entries: readonly PermissionEntry[],
 declare function augmentSignInEntriesWithReplication(input: {
     entries: readonly PermissionEntry[];
     primarySpaceId: string;
-    replication?: Pick<ReplicationOptions$1, "prefixes" | "allowSecrets">;
+    replication?: Pick<ReplicationOptions, "prefixes" | "allowSecrets">;
 }): PermissionEntry[];
 
 /**
@@ -29,9 +29,8 @@ declare function augmentSignInEntriesWithReplication(input: {
  */
 
 /**
- * Whether the signed `att` grants `ability` over the selected namespace, with
- * each grant unrestricted (no caveats). A bare selector requires both its
- * exact key and its slash descendants; a trailing-slash selector is one range.
+ * Whether the signed `att` grants `ability` over the folder prefix, with
+ * unrestricted authority unless explicitly asked to ignore caveats.
  */
 declare function ucanAttCovers(att: Record<string, Record<string, unknown>>, space: string, prefix: string, ability: string, options?: {
     ignoreCaveats?: boolean;

package/dist/{authority-mTQEgN56.d.ts → authority-DDGtccBK.d.ts}

@@ -1,5 +1,5 @@
-import { PermissionEntry, ReplicationOptions as ReplicationOptions$1, TinyCloudSession } from '@tinycloud/sdk-core';
-import { ReplicationOptions, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
+import { ReplicationOptions, PermissionEntry, TinyCloudSession } from '@tinycloud/sdk-core';
+import { AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {
@@ -10,7 +10,7 @@ declare function hasUnrestrictedGetCoverage(entries: readonly PermissionEntry[],
 declare function augmentSignInEntriesWithReplication(input: {
     entries: readonly PermissionEntry[];
     primarySpaceId: string;
-    replication?: Pick<ReplicationOptions$1, "prefixes" | "allowSecrets">;
+    replication?: Pick<ReplicationOptions, "prefixes" | "allowSecrets">;
 }): PermissionEntry[];
 
 /**
@@ -29,9 +29,8 @@ declare function augmentSignInEntriesWithReplication(input: {
  */
 
 /**
- * Whether the signed `att` grants `ability` over the selected namespace, with
- * each grant unrestricted (no caveats). A bare selector requires both its
- * exact key and its slash descendants; a trailing-slash selector is one range.
+ * Whether the signed `att` grants `ability` over the folder prefix, with
+ * unrestricted authority unless explicitly asked to ignore caveats.
  */
 declare function ucanAttCovers(att: Record<string, Record<string, unknown>>, space: string, prefix: string, ability: string, options?: {
     ignoreCaveats?: boolean;

package/dist/core.cjs

@@ -347,13 +347,13 @@ var import_sdk_core4 = require("@tinycloud/sdk-core");
 // src/replication/authority-sign-in.ts
 var import_sdk_core2 = require("@tinycloud/sdk-core");
 var import_sdk_services = require("@tinycloud/sdk-services");
+var import_prefix = require("@tinycloud/sdk-services/kv/replication/prefix");
 var KV_GET = import_sdk_core2.KV.GET;
 var KV_SYNC = import_sdk_core2.KV.SYNC;
 var KV_SERVICE = "tinycloud.kv";
 function hasUnrestrictedGetCoverage(entries, spaceId, prefix) {
-  const requiredPaths = (0, import_sdk_core2.grantPathsForSelector)(prefix);
   return (0, import_sdk_core2.isCapabilitySubset)(
-    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),
+    [{ service: KV_SERVICE, space: spaceId, path: prefix, actions: [KV_GET] }],
     [...entries]
   ).subset;
 }
@@ -361,21 +361,33 @@ function augmentSignInEntriesWithReplication(input) {
   const out = [];
   const replication = input.replication;
   if (replication === void 0) return out;
+  const eligiblePaths = [];
   for (const prefix of replication.prefixes) {
+    (0, import_prefix.assertFolderPrefix)(prefix);
+    const path = prefix === "/" ? "" : prefix;
     if ((0, import_sdk_services.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
       continue;
     }
-    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {
+    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, path)) {
       continue;
     }
-    for (const path of (0, import_sdk_core2.grantPathsForSelector)(prefix)) {
-      out.push({
-        service: KV_SERVICE,
-        space: input.primarySpaceId,
-        path,
-        actions: [KV_GET, KV_SYNC]
-      });
-    }
+    eligiblePaths.push(path);
+  }
+  if (eligiblePaths.length === replication.prefixes.length && eligiblePaths.length > 0 && hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, "")) {
+    return [{
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path: "",
+      actions: [KV_GET, KV_SYNC]
+    }];
+  }
+  for (const path of eligiblePaths) {
+    out.push({
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path,
+      actions: [KV_GET, KV_SYNC]
+    });
   }
   return out;
 }
@@ -444,6 +456,7 @@ var NodeUserAuthorization = class {
     this.activeSessionKeyId = "default";
     this.extensions = [];
     this._nodeFeatures = [];
+    this._nodeFeaturesKnown = false;
     this._lastActivationSkippedSpaceIds = [];
     this.wasm = config.wasmBindings;
     this.signer = config.signer;
@@ -567,8 +580,11 @@ var NodeUserAuthorization = class {
     }
   }
   /** @internal Atomically adopt the state staged by TinyCloudNode.restoreSession. */
-  installRestoredSession(sessionManager, session, hosts) {
+  installRestoredSession(sessionManager, session, hosts, nodeFeatures) {
     this.sessionManager = sessionManager;
+    this._nodeFeatures = nodeFeatures === void 0 ? [] : [...nodeFeatures];
+    this._nodeFeaturesKnown = nodeFeatures !== void 0;
+    this._nodeInfoIdentity = void 0;
     this.tinycloudHosts = hosts && hosts.length > 0 ? [...hosts] : void 0;
     this._lastActivationSkippedSpaceIds = [];
     if (!session) {
@@ -643,6 +659,16 @@ var NodeUserAuthorization = class {
   get nodeFeatures() {
     return this._nodeFeatures;
   }
+  get nodeFeaturesKnown() {
+    return this._nodeFeaturesKnown;
+  }
+  async refreshNodeInfo() {
+    const infoHost = this.primaryTinyCloudHost;
+    const nodeInfo = await (0, import_sdk_core4.checkNodeInfo)(infoHost, this.wasm.protocolVersion());
+    this._nodeFeatures = nodeInfo.features;
+    this._nodeFeaturesKnown = true;
+    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+  }
   /**
    * The node DID reported by `GET /info` for `host`, if the sign-in (or
    * restore) that populated it targeted that same host. Returns `undefined`
@@ -1306,13 +1332,7 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await (0, import_sdk_core4.checkNodeInfo)(
-      infoHost,
-      this.wasm.protocolVersion()
-    );
-    this._nodeFeatures = nodeInfo.features;
-    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+    await this.refreshNodeInfo();
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -1478,13 +1498,7 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await (0, import_sdk_core4.checkNodeInfo)(
-      infoHost,
-      this.wasm.protocolVersion()
-    );
-    this._nodeFeatures = nodeInfo.features;
-    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+    await this.refreshNodeInfo();
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -2394,18 +2408,25 @@ async function activateCompactRuntimeDelegation(node, input) {
     throw new Error("Compact runtime delegation CID does not match authorization bytes.");
   }
   const signed = signedAuthorityFromCompactUcan(authorization);
+  return activateValidatedRuntimeDelegation(
+    node,
+    portableFromSignedAuthority(cid, authorization, signed, input),
+    { host: input.host }
+  );
+}
+function portableFromSignedAuthority(cid, authorization, signed, transport) {
   const primary = signed.resources[0];
   const signedSpace = signed.permissions.find(
     (permission) => permission.service !== "tinycloud.encryption"
   )?.space;
-  const delegation = {
+  return {
     cid,
     delegationHeader: { Authorization: authorization },
-    ownerAddress: input.ownerAddress,
-    chainId: input.chainId,
+    ownerAddress: transport.ownerAddress,
+    chainId: transport.chainId,
     delegatorDID: signed.issuer,
     authHeader: authorization,
-    spaceId: signedSpace ?? primary.space,
+    spaceId: signedSpace ?? transport.spaceId ?? primary.space,
     path: primary.path,
     actions: [...primary.actions],
     ...primary.caveats === void 0 ? {} : { caveats: primary.caveats },
@@ -2415,11 +2436,8 @@ async function activateCompactRuntimeDelegation(node, input) {
     })),
     expiry: new Date(signed.expiry),
     delegateDID: signed.audience,
-    host: normalizedHost(input.host)
+    host: normalizedHost(transport.host)
   };
-  return activateValidatedRuntimeDelegation(node, delegation, {
-    host: input.host
-  });
 }
 function serializeDelegation(delegation) {
   return JSON.stringify({
@@ -2437,7 +2455,7 @@ function deserializeDelegation(data) {
 }
 
 // src/replication/config.ts
-var import_sdk_services2 = require("@tinycloud/sdk-services");
+var import_prefix2 = require("@tinycloud/sdk-services/kv/replication/prefix");
 function assertValidReplicationConfig(replication) {
   if (replication === void 0 || replication.enabled !== true) return;
   if (replication.storage === void 0 || replication.storage === null) {
@@ -2447,19 +2465,21 @@ function assertValidReplicationConfig(replication) {
     throw new TypeError("replication.prefixes must be a non-empty array");
   }
   for (const prefix of replication.prefixes) {
-    if (typeof prefix !== "string" || prefix === "") {
-      throw new TypeError("replication.prefixes must not contain an empty prefix");
+    try {
+      (0, import_prefix2.assertFolderPrefix)(prefix);
+    } catch (error) {
+      throw new TypeError(error instanceof Error ? error.message : String(error));
     }
   }
   for (const [index, prefix] of replication.prefixes.entries()) {
     for (const other of replication.prefixes.slice(index + 1)) {
-      if ((0, import_sdk_services2.kvPrefixCovers)(prefix, other) || (0, import_sdk_services2.kvPrefixCovers)(other, prefix)) {
+      if ((0, import_prefix2.kvPrefixCovers)(prefix, other) || (0, import_prefix2.kvPrefixCovers)(other, prefix)) {
         throw new TypeError(
           `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`
         );
       }
     }
-    if (prefix.split("/", 1)[0] === "vault" && replication.allowSecrets !== true) {
+    if ((prefix === "/" || prefix.split("/", 1)[0] === "vault") && replication.allowSecrets !== true) {
       throw new TypeError(
         `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`
       );
@@ -2469,7 +2489,7 @@ function assertValidReplicationConfig(replication) {
 
 // src/TinyCloudNode.ts
 var import_sdk_core10 = require("@tinycloud/sdk-core");
-var import_sdk_services3 = require("@tinycloud/sdk-services");
+var import_sdk_services2 = require("@tinycloud/sdk-services");
 
 // src/account/AccountService.ts
 var import_sdk_core6 = require("@tinycloud/sdk-core");
@@ -3567,7 +3587,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     return this._bootstrapStatus;
   }
   get nodeFeatures() {
-    return this.auth?.nodeFeatures ?? [];
+    return this.auth?.nodeFeatures ?? this._restoredNodeFeatures ?? [];
+  }
+  get replicationNodeFeatures() {
+    if (this.auth) return this.auth.nodeFeaturesKnown ? this.auth.nodeFeatures : void 0;
+    return this._restoredNodeFeatures;
   }
   /** SIWE domain — uses config override or defaults to app.tinycloud.xyz */
   get siweDomain() {
@@ -4920,6 +4944,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       sessionData.chainId
     );
     const stagedHost = resolvedHost ?? this.config.host;
+    let restoredNodeFeatures;
+    if (this.config.replication?.enabled) {
+      try {
+        restoredNodeFeatures = (await (0, import_sdk_core10.checkNodeInfo)(stagedHost, this.wasmBindings.protocolVersion())).features;
+      } catch (error) {
+        if (!(error instanceof import_sdk_core10.VersionCheckError)) throw error;
+      }
+    }
     const stagedAddress = restoredAddress;
     const stagedChainId = sessionData.chainId ?? 1;
     let replicationPrincipal;
@@ -5022,8 +5054,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._recapOperationsCache = stagedPrimary.cache;
     this.runtimePermissionGrants = stagedPrimary.grants;
     this.confirmedHostedSpaceIds.clear();
+    this._restoredNodeFeatures = restoredNodeFeatures;
     if (this.auth) {
-      this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost]);
+      this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost], restoredNodeFeatures);
       this._restoredTcSession = void 0;
     } else {
       this._restoredTcSession = stagedTcSession;
@@ -5853,7 +5886,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         graph.assertActive();
         if (!response.ok) {
-          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services3.parsePermissionHint)({
+          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services2.parsePermissionHint)({
             service: "tinycloud.encryption",
             path: networkId,
             actions: ["tinycloud.encryption/decrypt"]
@@ -6621,7 +6654,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     );
     if (result.status !== "ok") {
       if (result.status === "permission_required") {
-        const hint = (0, import_sdk_services3.parsePermissionHint)(result.hint);
+        const hint = (0, import_sdk_services2.parsePermissionHint)(result.hint);
         if (hint === void 0) return { status: "read_failed" };
         return {
           status: "permission_required",
@@ -7597,6 +7630,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       session,
       principal: identityPrincipal,
       authority,
+      nodeFeatures: this.replicationNodeFeatures,
       primaryKV: [{ space: session.spaceId, kv }]
     });
   }