@tinycloud/node-sdk 3.2.0-beta.4 → 3.2.0-beta.6

package/dist/index.cjs

@@ -17040,38 +17040,39 @@ function assertValidReplicationConfig(replication) {
     throw new TypeError("replication.prefixes must be a non-empty array");
   }
   for (const prefix of replication.prefixes) {
-    if (typeof prefix !== "string" || prefix === "") {
-      throw new TypeError("replication.prefixes must not contain an empty prefix");
+    try {
+      (0, import_prefix.assertFolderPrefix)(prefix);
+    } catch (error) {
+      throw new TypeError(error instanceof Error ? error.message : String(error));
     }
   }
   for (const [index, prefix] of replication.prefixes.entries()) {
     for (const other of replication.prefixes.slice(index + 1)) {
-      if ((0, import_sdk_services.kvPrefixCovers)(prefix, other) || (0, import_sdk_services.kvPrefixCovers)(other, prefix)) {
+      if ((0, import_prefix.kvPrefixCovers)(prefix, other) || (0, import_prefix.kvPrefixCovers)(other, prefix)) {
         throw new TypeError(
           `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`
         );
       }
     }
-    if (prefix.split("/", 1)[0] === "vault" && replication.allowSecrets !== true) {
+    if ((prefix === "/" || prefix.split("/", 1)[0] === "vault") && replication.allowSecrets !== true) {
       throw new TypeError(
         `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`
       );
     }
   }
 }
-var import_sdk_services;
+var import_prefix;
 var init_config = __esm({
   "src/replication/config.ts"() {
     "use strict";
-    import_sdk_services = require("@tinycloud/sdk-services");
+    import_prefix = require("@tinycloud/sdk-services/kv/replication/prefix");
   }
 });
 
 // src/replication/authority-sign-in.ts
 function hasUnrestrictedGetCoverage(entries, spaceId, prefix) {
-  const requiredPaths = (0, import_sdk_core2.grantPathsForSelector)(prefix);
   return (0, import_sdk_core2.isCapabilitySubset)(
-    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),
+    [{ service: KV_SERVICE, space: spaceId, path: prefix, actions: [KV_GET] }],
     [...entries]
   ).subset;
 }
@@ -17079,30 +17080,43 @@ function augmentSignInEntriesWithReplication(input) {
   const out = [];
   const replication = input.replication;
   if (replication === void 0) return out;
+  const eligiblePaths = [];
   for (const prefix of replication.prefixes) {
-    if ((0, import_sdk_services2.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
+    (0, import_prefix2.assertFolderPrefix)(prefix);
+    const path = prefix === "/" ? "" : prefix;
+    if ((0, import_sdk_services.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
       continue;
     }
-    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {
+    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, path)) {
       continue;
     }
-    for (const path of (0, import_sdk_core2.grantPathsForSelector)(prefix)) {
-      out.push({
-        service: KV_SERVICE,
-        space: input.primarySpaceId,
-        path,
-        actions: [KV_GET, KV_SYNC]
-      });
-    }
+    eligiblePaths.push(path);
+  }
+  if (eligiblePaths.length === replication.prefixes.length && eligiblePaths.length > 0 && hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, "")) {
+    return [{
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path: "",
+      actions: [KV_GET, KV_SYNC]
+    }];
+  }
+  for (const path of eligiblePaths) {
+    out.push({
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path,
+      actions: [KV_GET, KV_SYNC]
+    });
   }
   return out;
 }
-var import_sdk_core2, import_sdk_services2, KV_GET, KV_SYNC, KV_SERVICE;
+var import_sdk_core2, import_sdk_services, import_prefix2, KV_GET, KV_SYNC, KV_SERVICE;
 var init_authority_sign_in = __esm({
   "src/replication/authority-sign-in.ts"() {
     "use strict";
     import_sdk_core2 = require("@tinycloud/sdk-core");
-    import_sdk_services2 = require("@tinycloud/sdk-services");
+    import_sdk_services = require("@tinycloud/sdk-services");
+    import_prefix2 = require("@tinycloud/sdk-services/kv/replication/prefix");
     KV_GET = import_sdk_core2.KV.GET;
     KV_SYNC = import_sdk_core2.KV.SYNC;
     KV_SERVICE = "tinycloud.kv";
@@ -17257,6 +17271,7 @@ var init_runtime = __esm({
             scheduler: this.clock,
             emit,
             fetch: context.fetch,
+            nodeFeatures: input.nodeFeatures,
             previous: previousClose
           });
           this.current = controller;
@@ -17318,12 +17333,12 @@ __export(authority_exports, {
   ucanAttUnconstrainedFor: () => ucanAttUnconstrainedFor
 });
 function replicationEntries(spaceId, prefix) {
-  return (0, import_sdk_core11.grantPathsForSelector)(prefix).map((path) => ({
+  return [{
     service: KV_SERVICE2,
     space: spaceId,
-    path,
+    path: prefix === "/" ? "" : prefix,
     actions: [KV_GET2, KV_SYNC2]
-  }));
+  }];
 }
 function caveatBranchesUnconstrained(value) {
   if (value === void 0 || value === null) return true;
@@ -17338,28 +17353,28 @@ function caveatBranchesUnconstrained(value) {
   }
 }
 function kvPathInResource(resource, space) {
+  for (const root of [`${space}/kv`, `tinycloud://${space}/kv`]) {
+    if (resource === root || resource === `${root}/`) return "/";
+  }
   for (const base2 of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {
     if (resource.startsWith(base2)) return resource.slice(base2.length);
   }
   return void 0;
 }
 function ucanAttCovers(att, space, prefix, ability, options) {
-  const requiredPaths = prefix.endsWith("/") ? [prefix] : [prefix, `${prefix}/`];
-  return requiredPaths.every((requestedPath) => {
-    for (const [resource, abilities] of Object.entries(att)) {
-      const path = kvPathInResource(resource, space);
-      if (path === void 0) continue;
-      for (const [granted, caveats] of Object.entries(abilities)) {
-        if (!(0, import_sdk_core11.actionContains)(granted, ability)) continue;
-        if (!(0, import_sdk_core11.isCapabilitySubset)(
-          [{ service: KV_SERVICE2, space, path: requestedPath, actions: [ability] }],
-          [{ service: KV_SERVICE2, space, path, actions: [granted] }]
-        ).subset) continue;
-        if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;
-      }
+  for (const [resource, abilities] of Object.entries(att)) {
+    const path = kvPathInResource(resource, space);
+    if (path === void 0) continue;
+    for (const [granted, caveats] of Object.entries(abilities)) {
+      if (!(0, import_sdk_core11.actionContains)(granted, ability)) continue;
+      if (!(0, import_sdk_core11.isCapabilitySubset)(
+        [{ service: KV_SERVICE2, space, path: prefix, actions: [ability] }],
+        [{ service: KV_SERVICE2, space, path, actions: [granted] }]
+      ).subset) continue;
+      if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;
     }
-    return false;
-  });
+  }
+  return false;
 }
 function ucanAttUnconstrainedFor(att, space, prefix) {
   return ucanAttCovers(att, space, prefix, KV_GET2) && ucanAttCovers(att, space, prefix, KV_SYNC2);
@@ -17374,7 +17389,7 @@ function replicationScopeFromSignedSession(input) {
   const bareDid = (value) => value.split("#", 1)[0];
   if (grant.cid !== input.delegationCid || bareDid(grant.audience) !== bareDid(input.verificationMethod)) return void 0;
   for (const resource of Object.keys(grant.att)) {
-    const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv\//)?.[1];
+    const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv(?:\/|$)/)?.[1];
     if (space !== input.persistedSpace) continue;
     const owner = (0, import_sdk_core11.parseSpaceUri)(space);
     if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };
@@ -17648,6 +17663,7 @@ __export(src_exports, {
   resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core16.resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation: () => serializeDelegation,
   signedCompactUcanExpiry: () => signedCompactUcanExpiry,
+  siweRuntimeDelegation: () => siweRuntimeDelegation,
   sqliteReplicaStorage: () => sqliteReplicaStorage,
   tinyCloudDebugLogger: () => import_sdk_core15.tinyCloudDebugLogger,
   validateEnvelope: () => import_sdk_core21.validateEnvelope,
@@ -18218,18 +18234,45 @@ async function activateCompactRuntimeDelegation(node, input) {
     throw new Error("Compact runtime delegation CID does not match authorization bytes.");
   }
   const signed2 = signedAuthorityFromCompactUcan(authorization);
+  return activateValidatedRuntimeDelegation(
+    node,
+    portableFromSignedAuthority(cid, authorization, signed2, input),
+    { host: input.host }
+  );
+}
+function siweRuntimeDelegation(node, input) {
+  const cid = node.computeDelegationCid(input.authorization);
+  if (cid !== input.cid) {
+    throw new Error("SIWE runtime delegation CID does not match authorization bytes.");
+  }
+  const proof = { siwe: input.siwe, signature: input.signature };
+  const signed2 = signedAuthorityFromSessionGrant(
+    node,
+    { siweProof: proof, spaceId: input.spaceId, ownerAddress: input.ownerAddress, chainId: input.chainId },
+    input.authorization,
+    cid
+  );
+  if (signed2.expiry.getTime() <= Date.now()) {
+    reject("expired", "Runtime delegation is expired.");
+  }
+  return {
+    ...portableFromSignedAuthority(cid, input.authorization, signed2, input),
+    siweProof: proof
+  };
+}
+function portableFromSignedAuthority(cid, authorization, signed2, transport) {
   const primary = signed2.resources[0];
   const signedSpace = signed2.permissions.find(
     (permission) => permission.service !== "tinycloud.encryption"
   )?.space;
-  const delegation = {
+  return {
     cid,
     delegationHeader: { Authorization: authorization },
-    ownerAddress: input.ownerAddress,
-    chainId: input.chainId,
+    ownerAddress: transport.ownerAddress,
+    chainId: transport.chainId,
     delegatorDID: signed2.issuer,
     authHeader: authorization,
-    spaceId: signedSpace ?? primary.space,
+    spaceId: signedSpace ?? transport.spaceId ?? primary.space,
     path: primary.path,
     actions: [...primary.actions],
     ...primary.caveats === void 0 ? {} : { caveats: primary.caveats },
@@ -18239,11 +18282,8 @@ async function activateCompactRuntimeDelegation(node, input) {
     })),
     expiry: new Date(signed2.expiry),
     delegateDID: signed2.audience,
-    host: normalizedHost(input.host)
+    host: normalizedHost(transport.host)
   };
-  return activateValidatedRuntimeDelegation(node, delegation, {
-    host: input.host
-  });
 }
 async function grantAuthRequest(authority, request, options) {
   if (request.kind !== "tinycloud.auth.request") {
@@ -18303,7 +18343,7 @@ function getNodeReplicationLoaders() {
 
 // src/TinyCloudNode.ts
 var import_sdk_core9 = require("@tinycloud/sdk-core");
-var import_sdk_services3 = require("@tinycloud/sdk-services");
+var import_sdk_services2 = require("@tinycloud/sdk-services");
 
 // src/authorization/NodeUserAuthorization.ts
 var import_node_crypto = require("crypto");
@@ -18446,6 +18486,7 @@ var NodeUserAuthorization = class {
     this.activeSessionKeyId = "default";
     this.extensions = [];
     this._nodeFeatures = [];
+    this._nodeFeaturesKnown = false;
     this._lastActivationSkippedSpaceIds = [];
     this.wasm = config.wasmBindings;
     this.signer = config.signer;
@@ -18569,8 +18610,11 @@ var NodeUserAuthorization = class {
     }
   }
   /** @internal Atomically adopt the state staged by TinyCloudNode.restoreSession. */
-  installRestoredSession(sessionManager, session, hosts) {
+  installRestoredSession(sessionManager, session, hosts, nodeFeatures) {
     this.sessionManager = sessionManager;
+    this._nodeFeatures = nodeFeatures === void 0 ? [] : [...nodeFeatures];
+    this._nodeFeaturesKnown = nodeFeatures !== void 0;
+    this._nodeInfoIdentity = void 0;
     this.tinycloudHosts = hosts && hosts.length > 0 ? [...hosts] : void 0;
     this._lastActivationSkippedSpaceIds = [];
     if (!session) {
@@ -18645,6 +18689,16 @@ var NodeUserAuthorization = class {
   get nodeFeatures() {
     return this._nodeFeatures;
   }
+  get nodeFeaturesKnown() {
+    return this._nodeFeaturesKnown;
+  }
+  async refreshNodeInfo() {
+    const infoHost = this.primaryTinyCloudHost;
+    const nodeInfo = await (0, import_sdk_core4.checkNodeInfo)(infoHost, this.wasm.protocolVersion());
+    this._nodeFeatures = nodeInfo.features;
+    this._nodeFeaturesKnown = true;
+    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+  }
   /**
    * The node DID reported by `GET /info` for `host`, if the sign-in (or
    * restore) that populated it targeted that same host. Returns `undefined`
@@ -19308,13 +19362,7 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await (0, import_sdk_core4.checkNodeInfo)(
-      infoHost,
-      this.wasm.protocolVersion()
-    );
-    this._nodeFeatures = nodeInfo.features;
-    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+    await this.refreshNodeInfo();
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -19480,13 +19528,7 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await (0, import_sdk_core4.checkNodeInfo)(
-      infoHost,
-      this.wasm.protocolVersion()
-    );
-    this._nodeFeatures = nodeInfo.features;
-    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+    await this.refreshNodeInfo();
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -21053,7 +21095,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     return this._bootstrapStatus;
   }
   get nodeFeatures() {
-    return this.auth?.nodeFeatures ?? [];
+    return this.auth?.nodeFeatures ?? this._restoredNodeFeatures ?? [];
+  }
+  get replicationNodeFeatures() {
+    if (this.auth) return this.auth.nodeFeaturesKnown ? this.auth.nodeFeatures : void 0;
+    return this._restoredNodeFeatures;
   }
   /** SIWE domain — uses config override or defaults to app.tinycloud.xyz */
   get siweDomain() {
@@ -22406,6 +22452,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       sessionData.chainId
     );
     const stagedHost = resolvedHost ?? this.config.host;
+    let restoredNodeFeatures;
+    if (this.config.replication?.enabled) {
+      try {
+        restoredNodeFeatures = (await (0, import_sdk_core9.checkNodeInfo)(stagedHost, this.wasmBindings.protocolVersion())).features;
+      } catch (error) {
+        if (!(error instanceof import_sdk_core9.VersionCheckError)) throw error;
+      }
+    }
     const stagedAddress = restoredAddress;
     const stagedChainId = sessionData.chainId ?? 1;
     let replicationPrincipal;
@@ -22508,8 +22562,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._recapOperationsCache = stagedPrimary.cache;
     this.runtimePermissionGrants = stagedPrimary.grants;
     this.confirmedHostedSpaceIds.clear();
+    this._restoredNodeFeatures = restoredNodeFeatures;
     if (this.auth) {
-      this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost]);
+      this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost], restoredNodeFeatures);
       this._restoredTcSession = void 0;
     } else {
       this._restoredTcSession = stagedTcSession;
@@ -23339,7 +23394,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         graph.assertActive();
         if (!response.ok) {
-          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services3.parsePermissionHint)({
+          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services2.parsePermissionHint)({
             service: "tinycloud.encryption",
             path: networkId,
             actions: ["tinycloud.encryption/decrypt"]
@@ -24107,7 +24162,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     );
     if (result.status !== "ok") {
       if (result.status === "permission_required") {
-        const hint = (0, import_sdk_services3.parsePermissionHint)(result.hint);
+        const hint = (0, import_sdk_services2.parsePermissionHint)(result.hint);
         if (hint === void 0) return { status: "read_failed" };
         return {
           status: "permission_required",
@@ -25083,6 +25138,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       session,
       principal: identityPrincipal,
       authority,
+      nodeFeatures: this.replicationNodeFeatures,
       primaryKV: [{ space: session.spaceId, kv }]
     });
   }
@@ -26405,7 +26461,7 @@ var import_node_crypto2 = require("crypto");
 var import_promises = require("fs/promises");
 var import_node_path = require("path");
 var import_sdk_core13 = require("@tinycloud/sdk-core");
-var import_sdk_services4 = require("@tinycloud/sdk-services");
+var import_sdk_services3 = require("@tinycloud/sdk-services");
 init_authority();
 var ReplicaStorageError = class extends Error {
   constructor(code, message, options) {
@@ -26453,7 +26509,7 @@ function sha256Base32(material) {
   return out.slice(0, 26);
 }
 function partitionDirOf(root, identity) {
-  return (0, import_node_path.join)(root, sha256Base32((0, import_sdk_services4.replicationIdentityKey)(identity)));
+  return (0, import_node_path.join)(root, sha256Base32((0, import_sdk_services3.replicationIdentityKey)(identity)));
 }
 function replicaHashOf(prefix, deviceDid) {
   return sha256Base32(`${prefix}
@@ -26527,8 +26583,8 @@ function deviceRecordOf(value) {
 }
 function sameIdentity(a, b) {
   try {
-    const left = (0, import_sdk_services4.canonicalReplicationIdentity)(a);
-    const right = (0, import_sdk_services4.canonicalReplicationIdentity)(b);
+    const left = (0, import_sdk_services3.canonicalReplicationIdentity)(a);
+    const right = (0, import_sdk_services3.canonicalReplicationIdentity)(b);
     return left.host === right.host && left.space === right.space && left.principal === right.principal;
   } catch {
     return false;
@@ -26544,7 +26600,7 @@ async function ensurePartitionIdentity(dir, identity, dirSync) {
   const file = (0, import_node_path.join)(dir, "identity.json");
   const existing = await readJsonFile(file);
   if (existing === void 0) {
-    await writeJsonAtomic(file, { v: 1, ...(0, import_sdk_services4.canonicalReplicationIdentity)(identity) }, dirSync);
+    await writeJsonAtomic(file, { v: 1, ...(0, import_sdk_services3.canonicalReplicationIdentity)(identity) }, dirSync);
     return;
   }
   const record = identityRecordOf(existing);
@@ -27012,7 +27068,7 @@ function createSqliteReplicaStorage(options) {
       // @ts-ignore — same as above.
       import("@tinycloud/replica/sqlite")
     ]);
-    if ((0, import_sdk_services4.requiresSecretsOptIn)(spec.space, spec.prefix) && spec.allowSecrets !== true) {
+    if ((0, import_sdk_services3.requiresSecretsOptIn)(spec.space, spec.prefix) && spec.allowSecrets !== true) {
       throw new replica.ReplicaError(
         replica.ReplicaErrorCode.SECRETS_OPT_IN_REQUIRED,
         `Replicating ${spec.space}/kv/${spec.prefix} copies secret material to disk; pass allowSecrets to opt in.`
@@ -27393,6 +27449,7 @@ function sqliteReplicaStorage(options) {
   resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation,
   signedCompactUcanExpiry,
+  siweRuntimeDelegation,
   sqliteReplicaStorage,
   tinyCloudDebugLogger,
   validateEnvelope,