@tinycloud/node-sdk 3.2.0-beta.4 → 3.2.0-beta.6

package/dist/core.d.cts

@@ -1,7 +1,7 @@
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGrantInfo, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
-import { _ as __authority } from './authority-mTQEgN56.cjs';
-import { _ as __runtime } from './runtime-DyYwHW8j.cjs';
-export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, Q as serializeDelegation } from './WasmKeyProvider-DjfRu9aL.cjs';
+import { _ as __authority } from './authority-DDGtccBK.cjs';
+import { _ as __runtime } from './runtime-B5P5SRpC.cjs';
+export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, Q as serializeDelegation } from './WasmKeyProvider-C3NFgOmv.cjs';
 import '@tinycloud/sdk-services';
 import 'events';
 

package/dist/core.d.ts

@@ -1,7 +1,7 @@
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGrantInfo, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
-import { _ as __authority } from './authority-mTQEgN56.js';
-import { _ as __runtime } from './runtime-DyYwHW8j.js';
-export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, Q as serializeDelegation } from './WasmKeyProvider-DjfRu9aL.js';
+import { _ as __authority } from './authority-DDGtccBK.js';
+import { _ as __runtime } from './runtime-B5P5SRpC.js';
+export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, Q as serializeDelegation } from './WasmKeyProvider-C3NFgOmv.js';
 import '@tinycloud/sdk-services';
 import 'events';
 

package/dist/core.js

@@ -271,18 +271,17 @@ import {
 
 // src/replication/authority-sign-in.ts
 import {
-  grantPathsForSelector,
   KV,
   isCapabilitySubset
 } from "@tinycloud/sdk-core";
 import { requiresSecretsOptIn } from "@tinycloud/sdk-services";
+import { assertFolderPrefix } from "@tinycloud/sdk-services/kv/replication/prefix";
 var KV_GET = KV.GET;
 var KV_SYNC = KV.SYNC;
 var KV_SERVICE = "tinycloud.kv";
 function hasUnrestrictedGetCoverage(entries, spaceId, prefix) {
-  const requiredPaths = grantPathsForSelector(prefix);
   return isCapabilitySubset(
-    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),
+    [{ service: KV_SERVICE, space: spaceId, path: prefix, actions: [KV_GET] }],
     [...entries]
   ).subset;
 }
@@ -290,21 +289,33 @@ function augmentSignInEntriesWithReplication(input) {
   const out = [];
   const replication = input.replication;
   if (replication === void 0) return out;
+  const eligiblePaths = [];
   for (const prefix of replication.prefixes) {
+    assertFolderPrefix(prefix);
+    const path = prefix === "/" ? "" : prefix;
     if (requiresSecretsOptIn(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
       continue;
     }
-    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {
+    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, path)) {
       continue;
     }
-    for (const path of grantPathsForSelector(prefix)) {
-      out.push({
-        service: KV_SERVICE,
-        space: input.primarySpaceId,
-        path,
-        actions: [KV_GET, KV_SYNC]
-      });
-    }
+    eligiblePaths.push(path);
+  }
+  if (eligiblePaths.length === replication.prefixes.length && eligiblePaths.length > 0 && hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, "")) {
+    return [{
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path: "",
+      actions: [KV_GET, KV_SYNC]
+    }];
+  }
+  for (const path of eligiblePaths) {
+    out.push({
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path,
+      actions: [KV_GET, KV_SYNC]
+    });
   }
   return out;
 }
@@ -373,6 +384,7 @@ var NodeUserAuthorization = class {
     this.activeSessionKeyId = "default";
     this.extensions = [];
     this._nodeFeatures = [];
+    this._nodeFeaturesKnown = false;
     this._lastActivationSkippedSpaceIds = [];
     this.wasm = config.wasmBindings;
     this.signer = config.signer;
@@ -496,8 +508,11 @@ var NodeUserAuthorization = class {
     }
   }
   /** @internal Atomically adopt the state staged by TinyCloudNode.restoreSession. */
-  installRestoredSession(sessionManager, session, hosts) {
+  installRestoredSession(sessionManager, session, hosts, nodeFeatures) {
     this.sessionManager = sessionManager;
+    this._nodeFeatures = nodeFeatures === void 0 ? [] : [...nodeFeatures];
+    this._nodeFeaturesKnown = nodeFeatures !== void 0;
+    this._nodeInfoIdentity = void 0;
     this.tinycloudHosts = hosts && hosts.length > 0 ? [...hosts] : void 0;
     this._lastActivationSkippedSpaceIds = [];
     if (!session) {
@@ -572,6 +587,16 @@ var NodeUserAuthorization = class {
   get nodeFeatures() {
     return this._nodeFeatures;
   }
+  get nodeFeaturesKnown() {
+    return this._nodeFeaturesKnown;
+  }
+  async refreshNodeInfo() {
+    const infoHost = this.primaryTinyCloudHost;
+    const nodeInfo = await checkNodeInfo(infoHost, this.wasm.protocolVersion());
+    this._nodeFeatures = nodeInfo.features;
+    this._nodeFeaturesKnown = true;
+    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+  }
   /**
    * The node DID reported by `GET /info` for `host`, if the sign-in (or
    * restore) that populated it targeted that same host. Returns `undefined`
@@ -1235,13 +1260,7 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await checkNodeInfo(
-      infoHost,
-      this.wasm.protocolVersion()
-    );
-    this._nodeFeatures = nodeInfo.features;
-    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+    await this.refreshNodeInfo();
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -1407,13 +1426,7 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await checkNodeInfo(
-      infoHost,
-      this.wasm.protocolVersion()
-    );
-    this._nodeFeatures = nodeInfo.features;
-    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+    await this.refreshNodeInfo();
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -2327,18 +2340,25 @@ async function activateCompactRuntimeDelegation(node, input) {
     throw new Error("Compact runtime delegation CID does not match authorization bytes.");
   }
   const signed = signedAuthorityFromCompactUcan(authorization);
+  return activateValidatedRuntimeDelegation(
+    node,
+    portableFromSignedAuthority(cid, authorization, signed, input),
+    { host: input.host }
+  );
+}
+function portableFromSignedAuthority(cid, authorization, signed, transport) {
   const primary = signed.resources[0];
   const signedSpace = signed.permissions.find(
     (permission) => permission.service !== "tinycloud.encryption"
   )?.space;
-  const delegation = {
+  return {
     cid,
     delegationHeader: { Authorization: authorization },
-    ownerAddress: input.ownerAddress,
-    chainId: input.chainId,
+    ownerAddress: transport.ownerAddress,
+    chainId: transport.chainId,
     delegatorDID: signed.issuer,
     authHeader: authorization,
-    spaceId: signedSpace ?? primary.space,
+    spaceId: signedSpace ?? transport.spaceId ?? primary.space,
     path: primary.path,
     actions: [...primary.actions],
     ...primary.caveats === void 0 ? {} : { caveats: primary.caveats },
@@ -2348,11 +2368,8 @@ async function activateCompactRuntimeDelegation(node, input) {
     })),
     expiry: new Date(signed.expiry),
     delegateDID: signed.audience,
-    host: normalizedHost(input.host)
+    host: normalizedHost(transport.host)
   };
-  return activateValidatedRuntimeDelegation(node, delegation, {
-    host: input.host
-  });
 }
 function serializeDelegation(delegation) {
   return JSON.stringify({
@@ -2370,7 +2387,7 @@ function deserializeDelegation(data) {
 }
 
 // src/replication/config.ts
-import { kvPrefixCovers } from "@tinycloud/sdk-services";
+import { assertFolderPrefix as assertPureFolderPrefix, kvPrefixCovers } from "@tinycloud/sdk-services/kv/replication/prefix";
 function assertValidReplicationConfig(replication) {
   if (replication === void 0 || replication.enabled !== true) return;
   if (replication.storage === void 0 || replication.storage === null) {
@@ -2380,8 +2397,10 @@ function assertValidReplicationConfig(replication) {
     throw new TypeError("replication.prefixes must be a non-empty array");
   }
   for (const prefix of replication.prefixes) {
-    if (typeof prefix !== "string" || prefix === "") {
-      throw new TypeError("replication.prefixes must not contain an empty prefix");
+    try {
+      assertPureFolderPrefix(prefix);
+    } catch (error) {
+      throw new TypeError(error instanceof Error ? error.message : String(error));
     }
   }
   for (const [index, prefix] of replication.prefixes.entries()) {
@@ -2392,7 +2411,7 @@ function assertValidReplicationConfig(replication) {
         );
       }
     }
-    if (prefix.split("/", 1)[0] === "vault" && replication.allowSecrets !== true) {
+    if ((prefix === "/" || prefix.split("/", 1)[0] === "vault") && replication.allowSecrets !== true) {
       throw new TypeError(
         `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`
       );
@@ -2403,6 +2422,8 @@ function assertValidReplicationConfig(replication) {
 // src/TinyCloudNode.ts
 import {
   TinyCloud,
+  checkNodeInfo as checkNodeInfo2,
+  VersionCheckError,
   activateSessionWithHost as activateSessionWithHost2,
   authorizationVerdictOf,
   httpResponseError,
@@ -3584,7 +3605,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     return this._bootstrapStatus;
   }
   get nodeFeatures() {
-    return this.auth?.nodeFeatures ?? [];
+    return this.auth?.nodeFeatures ?? this._restoredNodeFeatures ?? [];
+  }
+  get replicationNodeFeatures() {
+    if (this.auth) return this.auth.nodeFeaturesKnown ? this.auth.nodeFeatures : void 0;
+    return this._restoredNodeFeatures;
   }
   /** SIWE domain — uses config override or defaults to app.tinycloud.xyz */
   get siweDomain() {
@@ -4937,6 +4962,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       sessionData.chainId
     );
     const stagedHost = resolvedHost ?? this.config.host;
+    let restoredNodeFeatures;
+    if (this.config.replication?.enabled) {
+      try {
+        restoredNodeFeatures = (await checkNodeInfo2(stagedHost, this.wasmBindings.protocolVersion())).features;
+      } catch (error) {
+        if (!(error instanceof VersionCheckError)) throw error;
+      }
+    }
     const stagedAddress = restoredAddress;
     const stagedChainId = sessionData.chainId ?? 1;
     let replicationPrincipal;
@@ -5039,8 +5072,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._recapOperationsCache = stagedPrimary.cache;
     this.runtimePermissionGrants = stagedPrimary.grants;
     this.confirmedHostedSpaceIds.clear();
+    this._restoredNodeFeatures = restoredNodeFeatures;
     if (this.auth) {
-      this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost]);
+      this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost], restoredNodeFeatures);
       this._restoredTcSession = void 0;
     } else {
       this._restoredTcSession = stagedTcSession;
@@ -7614,6 +7648,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       session,
       principal: identityPrincipal,
       authority,
+      nodeFeatures: this.replicationNodeFeatures,
       primaryKV: [{ space: session.spaceId, kv }]
     });
   }
@@ -8804,9 +8839,9 @@ import {
 } from "@tinycloud/sdk-core";
 import {
   ProtocolMismatchError,
-  VersionCheckError,
+  VersionCheckError as VersionCheckError2,
   UnsupportedFeatureError as UnsupportedFeatureError2,
-  checkNodeInfo as checkNodeInfo2
+  checkNodeInfo as checkNodeInfo3
 } from "@tinycloud/sdk-core";
 import { ServiceContext as ServiceContext3 } from "@tinycloud/sdk-core";
 export {
@@ -8857,7 +8892,7 @@ export {
   VAULT_PERMISSION_SERVICE,
   VaultHeaders,
   VaultPublicSpaceKVActions,
-  VersionCheckError,
+  VersionCheckError2 as VersionCheckError,
   WasmKeyProvider,
   activateCompactRuntimeDelegation,
   addressStorageKey,
@@ -8867,7 +8902,7 @@ export {
   canonicalizeDidUrl,
   canonicalizeNetworkId,
   canonicalizeSecretScope,
-  checkNodeInfo2 as checkNodeInfo,
+  checkNodeInfo3 as checkNodeInfo,
   clearTinyCloudDebugLogs,
   composeManifestRequest2 as composeManifestRequest,
   createCapabilityKeyRegistry,