@tinycloud/node-sdk 3.2.6-beta.6 → 3.3.0-beta.11

package/dist/WasmKeyProvider-5Ee7fcAw.d.cts

@@ -0,0 +1,217 @@
+import { ISessionStorage, PersistedSessionData, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
+
+/**
+ * In-memory session storage for Node.js.
+ *
+ * Sessions are stored in memory and lost when the process exits.
+ * Suitable for:
+ * - Development and testing
+ * - Stateless server deployments
+ * - Short-lived processes
+ *
+ * @example
+ * ```typescript
+ * const storage = new MemorySessionStorage();
+ * await storage.save("0x123...", sessionData);
+ * const session = await storage.load("0x123...");
+ * ```
+ */
+declare class MemorySessionStorage implements ISessionStorage {
+    private sessions;
+    /**
+     * Save a session for an address.
+     */
+    save(address: string, session: PersistedSessionData): Promise<void>;
+    /**
+     * Load a session for an address.
+     */
+    load(address: string): Promise<PersistedSessionData | null>;
+    /**
+     * Clear a session for an address.
+     */
+    clear(address: string): Promise<void>;
+    /**
+     * Check if a session exists for an address.
+     */
+    exists(address: string): boolean;
+    /**
+     * Memory storage is always available.
+     */
+    isAvailable(): boolean;
+    /**
+     * Clear all sessions.
+     */
+    clearAll(): void;
+    /**
+     * Get the number of stored sessions.
+     */
+    size(): number;
+}
+
+/**
+ * File-based session storage for Node.js.
+ *
+ * Sessions are persisted to the file system and survive process restarts.
+ * Suitable for:
+ * - CLI applications
+ * - Long-running server processes
+ * - Development environments
+ *
+ * @example
+ * ```typescript
+ * const storage = new FileSessionStorage("/tmp/tinycloud-sessions");
+ * await storage.save("0x123...", sessionData);
+ * // Session persists across process restarts
+ * ```
+ */
+declare class FileSessionStorage implements ISessionStorage {
+    private readonly baseDir;
+    /**
+     * Create a new FileSessionStorage.
+     *
+     * @param baseDir - Directory to store session files (default: ~/.tinycloud/sessions)
+     */
+    constructor(baseDir?: string);
+    /**
+     * Get the default session storage directory.
+     */
+    private getDefaultDir;
+    /**
+     * Ensure the storage directory exists.
+     */
+    private ensureDirectoryExists;
+    /**
+     * Get the file path for an address.
+     */
+    private getFilePath;
+    /**
+     * Save a session for an address.
+     */
+    save(address: string, session: PersistedSessionData): Promise<void>;
+    /**
+     * Load a session for an address.
+     */
+    load(address: string): Promise<PersistedSessionData | null>;
+    /**
+     * Clear a session for an address.
+     */
+    clear(address: string): Promise<void>;
+    /**
+     * Check if a session exists for an address.
+     */
+    exists(address: string): boolean;
+    /**
+     * Check if file system storage is available.
+     */
+    isAvailable(): boolean;
+}
+
+/**
+ * WasmKeyProvider - KeyProvider implementation using WASM session manager.
+ *
+ * This provider wraps the SessionManager from node-sdk-wasm to provide
+ * cryptographic key operations required by the SharingService.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Extended session manager with optional key listing support.
+ * The base ISessionManager doesn't include listSessionKeys(),
+ * but concrete implementations (e.g., TCWSessionManager) may provide it.
+ */
+interface SessionManagerWithListing extends ISessionManager {
+    listSessionKeys?(): string[];
+}
+/**
+ * Configuration for WasmKeyProvider.
+ */
+interface WasmKeyProviderConfig {
+    /**
+     * The WASM session manager instance.
+     * Must be created before constructing the KeyProvider.
+     */
+    sessionManager: SessionManagerWithListing;
+}
+/**
+ * KeyProvider implementation that wraps the WASM session manager.
+ *
+ * This allows the SharingService to create new session keys for sharing links
+ * using the same cryptographic operations as the main session management.
+ *
+ * @example
+ * ```typescript
+ * // sessionManager from wasmBindings.createSessionManager()
+ * import { WasmKeyProvider } from "@tinycloud/node-sdk";
+ *
+ * const sessionManager = new SessionManager();
+ * const keyProvider = new WasmKeyProvider({ sessionManager });
+ *
+ * // Create a session key for a sharing link
+ * const keyId = await keyProvider.createSessionKey("share:abc123");
+ * const jwk = keyProvider.getJWK(keyId);
+ * const did = await keyProvider.getDID(keyId);
+ * ```
+ */
+declare class WasmKeyProvider implements KeyProvider {
+    private sessionManager;
+    /**
+     * Create a new WasmKeyProvider.
+     *
+     * @param config - Configuration with the WASM session manager
+     */
+    constructor(config: WasmKeyProviderConfig);
+    /**
+     * Generate a new session key with the given name.
+     *
+     * This creates a new Ed25519 key pair in the WASM session manager.
+     * The key can then be used for signing delegations in sharing links.
+     *
+     * @param name - A unique name/ID for the key (e.g., "share:timestamp:random")
+     * @returns The key ID (same as the name provided)
+     */
+    createSessionKey(name: string): Promise<string>;
+    /**
+     * Get the JWK (JSON Web Key) for a key.
+     *
+     * Returns the full JWK including the private key (d parameter),
+     * which is required for signing and for embedding in sharing links.
+     *
+     * @param keyId - The key ID to retrieve
+     * @returns The JWK object with public and private key components
+     * @throws Error if the key is not found
+     */
+    getJWK(keyId: string): JWK;
+    /**
+     * Get the DID (Decentralized Identifier) for a key.
+     *
+     * Returns the did:key format DID derived from the key's public key.
+     * This DID can be used as the delegatee in delegations.
+     *
+     * @param keyId - The key ID to retrieve
+     * @returns The DID in did:key format (e.g., "did:key:z6Mk...")
+     */
+    getDID(keyId: string): Promise<string>;
+    /**
+     * List all session keys currently held by the provider.
+     *
+     * @returns Array of key IDs
+     */
+    listKeys(): string[];
+    /**
+     * Check if a key exists in the provider.
+     *
+     * @param keyId - The key ID to check
+     * @returns True if the key exists
+     */
+    hasKey(keyId: string): boolean;
+}
+/**
+ * Create a new WasmKeyProvider instance.
+ *
+ * @param sessionManager - The WASM session manager
+ * @returns A new WasmKeyProvider instance
+ */
+declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
+
+export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c };

package/dist/WasmKeyProvider-5Ee7fcAw.d.ts

@@ -0,0 +1,217 @@
+import { ISessionStorage, PersistedSessionData, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
+
+/**
+ * In-memory session storage for Node.js.
+ *
+ * Sessions are stored in memory and lost when the process exits.
+ * Suitable for:
+ * - Development and testing
+ * - Stateless server deployments
+ * - Short-lived processes
+ *
+ * @example
+ * ```typescript
+ * const storage = new MemorySessionStorage();
+ * await storage.save("0x123...", sessionData);
+ * const session = await storage.load("0x123...");
+ * ```
+ */
+declare class MemorySessionStorage implements ISessionStorage {
+    private sessions;
+    /**
+     * Save a session for an address.
+     */
+    save(address: string, session: PersistedSessionData): Promise<void>;
+    /**
+     * Load a session for an address.
+     */
+    load(address: string): Promise<PersistedSessionData | null>;
+    /**
+     * Clear a session for an address.
+     */
+    clear(address: string): Promise<void>;
+    /**
+     * Check if a session exists for an address.
+     */
+    exists(address: string): boolean;
+    /**
+     * Memory storage is always available.
+     */
+    isAvailable(): boolean;
+    /**
+     * Clear all sessions.
+     */
+    clearAll(): void;
+    /**
+     * Get the number of stored sessions.
+     */
+    size(): number;
+}
+
+/**
+ * File-based session storage for Node.js.
+ *
+ * Sessions are persisted to the file system and survive process restarts.
+ * Suitable for:
+ * - CLI applications
+ * - Long-running server processes
+ * - Development environments
+ *
+ * @example
+ * ```typescript
+ * const storage = new FileSessionStorage("/tmp/tinycloud-sessions");
+ * await storage.save("0x123...", sessionData);
+ * // Session persists across process restarts
+ * ```
+ */
+declare class FileSessionStorage implements ISessionStorage {
+    private readonly baseDir;
+    /**
+     * Create a new FileSessionStorage.
+     *
+     * @param baseDir - Directory to store session files (default: ~/.tinycloud/sessions)
+     */
+    constructor(baseDir?: string);
+    /**
+     * Get the default session storage directory.
+     */
+    private getDefaultDir;
+    /**
+     * Ensure the storage directory exists.
+     */
+    private ensureDirectoryExists;
+    /**
+     * Get the file path for an address.
+     */
+    private getFilePath;
+    /**
+     * Save a session for an address.
+     */
+    save(address: string, session: PersistedSessionData): Promise<void>;
+    /**
+     * Load a session for an address.
+     */
+    load(address: string): Promise<PersistedSessionData | null>;
+    /**
+     * Clear a session for an address.
+     */
+    clear(address: string): Promise<void>;
+    /**
+     * Check if a session exists for an address.
+     */
+    exists(address: string): boolean;
+    /**
+     * Check if file system storage is available.
+     */
+    isAvailable(): boolean;
+}
+
+/**
+ * WasmKeyProvider - KeyProvider implementation using WASM session manager.
+ *
+ * This provider wraps the SessionManager from node-sdk-wasm to provide
+ * cryptographic key operations required by the SharingService.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Extended session manager with optional key listing support.
+ * The base ISessionManager doesn't include listSessionKeys(),
+ * but concrete implementations (e.g., TCWSessionManager) may provide it.
+ */
+interface SessionManagerWithListing extends ISessionManager {
+    listSessionKeys?(): string[];
+}
+/**
+ * Configuration for WasmKeyProvider.
+ */
+interface WasmKeyProviderConfig {
+    /**
+     * The WASM session manager instance.
+     * Must be created before constructing the KeyProvider.
+     */
+    sessionManager: SessionManagerWithListing;
+}
+/**
+ * KeyProvider implementation that wraps the WASM session manager.
+ *
+ * This allows the SharingService to create new session keys for sharing links
+ * using the same cryptographic operations as the main session management.
+ *
+ * @example
+ * ```typescript
+ * // sessionManager from wasmBindings.createSessionManager()
+ * import { WasmKeyProvider } from "@tinycloud/node-sdk";
+ *
+ * const sessionManager = new SessionManager();
+ * const keyProvider = new WasmKeyProvider({ sessionManager });
+ *
+ * // Create a session key for a sharing link
+ * const keyId = await keyProvider.createSessionKey("share:abc123");
+ * const jwk = keyProvider.getJWK(keyId);
+ * const did = await keyProvider.getDID(keyId);
+ * ```
+ */
+declare class WasmKeyProvider implements KeyProvider {
+    private sessionManager;
+    /**
+     * Create a new WasmKeyProvider.
+     *
+     * @param config - Configuration with the WASM session manager
+     */
+    constructor(config: WasmKeyProviderConfig);
+    /**
+     * Generate a new session key with the given name.
+     *
+     * This creates a new Ed25519 key pair in the WASM session manager.
+     * The key can then be used for signing delegations in sharing links.
+     *
+     * @param name - A unique name/ID for the key (e.g., "share:timestamp:random")
+     * @returns The key ID (same as the name provided)
+     */
+    createSessionKey(name: string): Promise<string>;
+    /**
+     * Get the JWK (JSON Web Key) for a key.
+     *
+     * Returns the full JWK including the private key (d parameter),
+     * which is required for signing and for embedding in sharing links.
+     *
+     * @param keyId - The key ID to retrieve
+     * @returns The JWK object with public and private key components
+     * @throws Error if the key is not found
+     */
+    getJWK(keyId: string): JWK;
+    /**
+     * Get the DID (Decentralized Identifier) for a key.
+     *
+     * Returns the did:key format DID derived from the key's public key.
+     * This DID can be used as the delegatee in delegations.
+     *
+     * @param keyId - The key ID to retrieve
+     * @returns The DID in did:key format (e.g., "did:key:z6Mk...")
+     */
+    getDID(keyId: string): Promise<string>;
+    /**
+     * List all session keys currently held by the provider.
+     *
+     * @returns Array of key IDs
+     */
+    listKeys(): string[];
+    /**
+     * Check if a key exists in the provider.
+     *
+     * @param keyId - The key ID to check
+     * @returns True if the key exists
+     */
+    hasKey(keyId: string): boolean;
+}
+/**
+ * Create a new WasmKeyProvider instance.
+ *
+ * @param sessionManager - The WASM session manager
+ * @returns A new WasmKeyProvider instance
+ */
+declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
+
+export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c };

package/dist/authority-Cwotwza3.d.cts

@@ -0,0 +1,118 @@
+import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
+import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
+import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
+import { T as TinyCloudNode } from './TinyCloudNode-CcNh20QX.cjs';
+
+/** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
+declare function assertValidReplicationConfig(replication: (ReplicationOptions & {
+    storage?: unknown;
+}) | undefined): void;
+
+declare function hasUnrestrictedGetCoverage(entries: readonly PermissionEntry[], spaceId: string, prefix: string): boolean;
+declare function augmentSignInEntriesWithReplication(input: {
+    entries: readonly PermissionEntry[];
+    primarySpaceId: string;
+    replication?: Pick<ReplicationOptions, "prefixes" | "allowSecrets">;
+}): PermissionEntry[];
+
+/** Report a completed deny from the already-loaded authority; delivery was revoked synchronously. */
+declare function reportReplicaDenial(result: {
+    status: string;
+    code?: string;
+    intents?: number;
+}, reason: ReplicaDenyInput["reason"], onEvent: ReplicationOptions["onEvent"], context?: ServiceContext): void;
+/** The verified owner proof is signed, finite, exact-space, and uncaveated on one get+sync scope. */
+declare function verifiedOwnerConsentAnchor(session: TinyCloudSession, wasmBindings: Pick<IWasmBindings, "validatePersistedSession">, exactVerifiedRecap: (verified: {
+    verifiedRecap?: unknown;
+}) => WasmRecapEntry[]): ReplicaConsentAnchor | null;
+/** Fresh sign-in only: the lifecycle creates keys; restore never calls this. */
+declare function establishReplicaSessionStamp(storage: KVReplicaStorage, principal: string, anchor: ReplicaConsentAnchor): Promise<ReplicaSessionStamp>;
+/** Existing persisted stamp only: never manufactures an authority on restore. */
+declare function restoreReplicaSessionStamp(storage: KVReplicaStorage, principal: string, persisted: ReplicaSessionStamp | undefined): Promise<ReplicaSessionStamp>;
+/**
+ * Whether the signed `att` grants `ability` over the folder prefix, with
+ * unrestricted authority unless explicitly asked to ignore caveats.
+ */
+declare function ucanAttCovers(att: Record<string, Record<string, unknown>>, space: string, prefix: string, ability: string, options?: {
+    ignoreCaveats?: boolean;
+}): boolean;
+/** `unconstrained` for `ReplicaGrantInfo` (§2.1): get AND sync on the prefix carry no caveats. */
+declare function ucanAttUnconstrainedFor(att: Record<string, Record<string, unknown>>, space: string, prefix: string): boolean;
+interface DelegationPlanResult {
+    path: "session" | "runtime";
+    parentCid: string;
+    expiresAt: number;
+}
+/**
+ * The `TinyCloudNode` internals the authority needs. `planDelegation` is the
+ * pure extraction of `delegateTo`'s parent selection (§4.3), so `plan` and
+ * `mint` can never disagree about which parent or expiry a delegation gets.
+ */
+type ReplicationAuthoritySession = Pick<TinyCloudSession, "delegationHeader" | "delegationCid" | "spaceId" | "verificationMethod" | "jwk"> & Partial<Pick<TinyCloudSession, "siwe" | "signature" | "address" | "chainId">>;
+interface ReplicationAuthorityHost {
+    replicationSession(): ReplicationAuthoritySession | undefined;
+    /** Validated owner proof only; never infer consent from a compact child UCAN. */
+    verifiedConsentAnchor?(session: ReplicationAuthoritySession): ReplicaConsentAnchor | null;
+    /** The SIWE "Expiration Time" of the session — the delegateTo delegation cap. */
+    siweExpiration(siwe: string): Date | undefined;
+    planDelegation(entries: PermissionEntry[], options?: {
+        expiry?: string | number;
+    }): ({
+        grant?: unknown;
+    } & DelegationPlanResult) | AuthorityRefusal;
+    mintDelegation(deviceDid: string, entries: PermissionEntry[], options?: {
+        expiryMs?: number;
+        renewalOnly?: boolean;
+    }): Promise<{
+        ucan: string;
+        expiresAt: number;
+    }>;
+}
+/** Delegate a replica grant only through the selected owner parent for silent renewal. */
+declare function mintNodeReplicationGrant(deviceDid: string, entries: PermissionEntry[], options: {
+    expiryMs?: number;
+    renewalOnly?: boolean;
+} | undefined, renewalSession: ReplicationAuthoritySession | undefined, node: Pick<TinyCloudNode, "delegateTo">): Promise<{
+    ucan: string;
+    expiresAt: number;
+}>;
+/** Milliseconds of validity a session or parent must have left for authority reuse (delegateTo's margin). */
+declare const AUTHORITY_EXPIRY_MARGIN_MS = 60000;
+/** Verify a compact session delegation before using any persisted space metadata. */
+declare function replicationScopeFromSignedSession(input: {
+    delegationHeader: {
+        Authorization: string;
+    };
+    delegationCid: string;
+    verificationMethod: string;
+    persistedSpace: string;
+}): {
+    space: string;
+    principal: string;
+} | undefined;
+/** Runs before host activation; a replan cannot silently switch a renewal to a runtime parent. */
+declare function assertRenewalParent(authorization: string, session: ReplicationAuthoritySession): void;
+declare function createReplicationAuthority(host: ReplicationAuthorityHost): ReplicationAuthority;
+
+declare const __authority_AUTHORITY_EXPIRY_MARGIN_MS: typeof AUTHORITY_EXPIRY_MARGIN_MS;
+type __authority_DelegationPlanResult = DelegationPlanResult;
+type __authority_ReplicationAuthorityHost = ReplicationAuthorityHost;
+type __authority_ReplicationAuthoritySession = ReplicationAuthoritySession;
+declare const __authority_assertRenewalParent: typeof assertRenewalParent;
+declare const __authority_assertValidReplicationConfig: typeof assertValidReplicationConfig;
+declare const __authority_augmentSignInEntriesWithReplication: typeof augmentSignInEntriesWithReplication;
+declare const __authority_createReplicationAuthority: typeof createReplicationAuthority;
+declare const __authority_establishReplicaSessionStamp: typeof establishReplicaSessionStamp;
+declare const __authority_hasUnrestrictedGetCoverage: typeof hasUnrestrictedGetCoverage;
+declare const __authority_mintNodeReplicationGrant: typeof mintNodeReplicationGrant;
+declare const __authority_replicationScopeFromSignedSession: typeof replicationScopeFromSignedSession;
+declare const __authority_reportReplicaDenial: typeof reportReplicaDenial;
+declare const __authority_restoreReplicaSessionStamp: typeof restoreReplicaSessionStamp;
+declare const __authority_ucanAttCovers: typeof ucanAttCovers;
+declare const __authority_ucanAttUnconstrainedFor: typeof ucanAttUnconstrainedFor;
+declare const __authority_verifiedOwnerConsentAnchor: typeof verifiedOwnerConsentAnchor;
+declare namespace __authority {
+  export { __authority_AUTHORITY_EXPIRY_MARGIN_MS as AUTHORITY_EXPIRY_MARGIN_MS, type __authority_DelegationPlanResult as DelegationPlanResult, type __authority_ReplicationAuthorityHost as ReplicationAuthorityHost, type __authority_ReplicationAuthoritySession as ReplicationAuthoritySession, __authority_assertRenewalParent as assertRenewalParent, __authority_assertValidReplicationConfig as assertValidReplicationConfig, __authority_augmentSignInEntriesWithReplication as augmentSignInEntriesWithReplication, __authority_createReplicationAuthority as createReplicationAuthority, __authority_establishReplicaSessionStamp as establishReplicaSessionStamp, __authority_hasUnrestrictedGetCoverage as hasUnrestrictedGetCoverage, __authority_mintNodeReplicationGrant as mintNodeReplicationGrant, __authority_replicationScopeFromSignedSession as replicationScopeFromSignedSession, __authority_reportReplicaDenial as reportReplicaDenial, __authority_restoreReplicaSessionStamp as restoreReplicaSessionStamp, __authority_ucanAttCovers as ucanAttCovers, __authority_ucanAttUnconstrainedFor as ucanAttUnconstrainedFor, __authority_verifiedOwnerConsentAnchor as verifiedOwnerConsentAnchor };
+}
+
+export { AUTHORITY_EXPIRY_MARGIN_MS as A, type DelegationPlanResult as D, type ReplicationAuthorityHost as R, __authority as _, type ReplicationAuthoritySession as a, assertRenewalParent as b, assertValidReplicationConfig as c, augmentSignInEntriesWithReplication as d, createReplicationAuthority as e, establishReplicaSessionStamp as f, reportReplicaDenial as g, hasUnrestrictedGetCoverage as h, restoreReplicaSessionStamp as i, ucanAttUnconstrainedFor as j, mintNodeReplicationGrant as m, replicationScopeFromSignedSession as r, ucanAttCovers as u, verifiedOwnerConsentAnchor as v };

package/dist/authority-D_u9a7Wl.d.ts

@@ -0,0 +1,118 @@
+import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
+import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
+import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
+import { T as TinyCloudNode } from './TinyCloudNode-CcNh20QX.js';
+
+/** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
+declare function assertValidReplicationConfig(replication: (ReplicationOptions & {
+    storage?: unknown;
+}) | undefined): void;
+
+declare function hasUnrestrictedGetCoverage(entries: readonly PermissionEntry[], spaceId: string, prefix: string): boolean;
+declare function augmentSignInEntriesWithReplication(input: {
+    entries: readonly PermissionEntry[];
+    primarySpaceId: string;
+    replication?: Pick<ReplicationOptions, "prefixes" | "allowSecrets">;
+}): PermissionEntry[];
+
+/** Report a completed deny from the already-loaded authority; delivery was revoked synchronously. */
+declare function reportReplicaDenial(result: {
+    status: string;
+    code?: string;
+    intents?: number;
+}, reason: ReplicaDenyInput["reason"], onEvent: ReplicationOptions["onEvent"], context?: ServiceContext): void;
+/** The verified owner proof is signed, finite, exact-space, and uncaveated on one get+sync scope. */
+declare function verifiedOwnerConsentAnchor(session: TinyCloudSession, wasmBindings: Pick<IWasmBindings, "validatePersistedSession">, exactVerifiedRecap: (verified: {
+    verifiedRecap?: unknown;
+}) => WasmRecapEntry[]): ReplicaConsentAnchor | null;
+/** Fresh sign-in only: the lifecycle creates keys; restore never calls this. */
+declare function establishReplicaSessionStamp(storage: KVReplicaStorage, principal: string, anchor: ReplicaConsentAnchor): Promise<ReplicaSessionStamp>;
+/** Existing persisted stamp only: never manufactures an authority on restore. */
+declare function restoreReplicaSessionStamp(storage: KVReplicaStorage, principal: string, persisted: ReplicaSessionStamp | undefined): Promise<ReplicaSessionStamp>;
+/**
+ * Whether the signed `att` grants `ability` over the folder prefix, with
+ * unrestricted authority unless explicitly asked to ignore caveats.
+ */
+declare function ucanAttCovers(att: Record<string, Record<string, unknown>>, space: string, prefix: string, ability: string, options?: {
+    ignoreCaveats?: boolean;
+}): boolean;
+/** `unconstrained` for `ReplicaGrantInfo` (§2.1): get AND sync on the prefix carry no caveats. */
+declare function ucanAttUnconstrainedFor(att: Record<string, Record<string, unknown>>, space: string, prefix: string): boolean;
+interface DelegationPlanResult {
+    path: "session" | "runtime";
+    parentCid: string;
+    expiresAt: number;
+}
+/**
+ * The `TinyCloudNode` internals the authority needs. `planDelegation` is the
+ * pure extraction of `delegateTo`'s parent selection (§4.3), so `plan` and
+ * `mint` can never disagree about which parent or expiry a delegation gets.
+ */
+type ReplicationAuthoritySession = Pick<TinyCloudSession, "delegationHeader" | "delegationCid" | "spaceId" | "verificationMethod" | "jwk"> & Partial<Pick<TinyCloudSession, "siwe" | "signature" | "address" | "chainId">>;
+interface ReplicationAuthorityHost {
+    replicationSession(): ReplicationAuthoritySession | undefined;
+    /** Validated owner proof only; never infer consent from a compact child UCAN. */
+    verifiedConsentAnchor?(session: ReplicationAuthoritySession): ReplicaConsentAnchor | null;
+    /** The SIWE "Expiration Time" of the session — the delegateTo delegation cap. */
+    siweExpiration(siwe: string): Date | undefined;
+    planDelegation(entries: PermissionEntry[], options?: {
+        expiry?: string | number;
+    }): ({
+        grant?: unknown;
+    } & DelegationPlanResult) | AuthorityRefusal;
+    mintDelegation(deviceDid: string, entries: PermissionEntry[], options?: {
+        expiryMs?: number;
+        renewalOnly?: boolean;
+    }): Promise<{
+        ucan: string;
+        expiresAt: number;
+    }>;
+}
+/** Delegate a replica grant only through the selected owner parent for silent renewal. */
+declare function mintNodeReplicationGrant(deviceDid: string, entries: PermissionEntry[], options: {
+    expiryMs?: number;
+    renewalOnly?: boolean;
+} | undefined, renewalSession: ReplicationAuthoritySession | undefined, node: Pick<TinyCloudNode, "delegateTo">): Promise<{
+    ucan: string;
+    expiresAt: number;
+}>;
+/** Milliseconds of validity a session or parent must have left for authority reuse (delegateTo's margin). */
+declare const AUTHORITY_EXPIRY_MARGIN_MS = 60000;
+/** Verify a compact session delegation before using any persisted space metadata. */
+declare function replicationScopeFromSignedSession(input: {
+    delegationHeader: {
+        Authorization: string;
+    };
+    delegationCid: string;
+    verificationMethod: string;
+    persistedSpace: string;
+}): {
+    space: string;
+    principal: string;
+} | undefined;
+/** Runs before host activation; a replan cannot silently switch a renewal to a runtime parent. */
+declare function assertRenewalParent(authorization: string, session: ReplicationAuthoritySession): void;
+declare function createReplicationAuthority(host: ReplicationAuthorityHost): ReplicationAuthority;
+
+declare const __authority_AUTHORITY_EXPIRY_MARGIN_MS: typeof AUTHORITY_EXPIRY_MARGIN_MS;
+type __authority_DelegationPlanResult = DelegationPlanResult;
+type __authority_ReplicationAuthorityHost = ReplicationAuthorityHost;
+type __authority_ReplicationAuthoritySession = ReplicationAuthoritySession;
+declare const __authority_assertRenewalParent: typeof assertRenewalParent;
+declare const __authority_assertValidReplicationConfig: typeof assertValidReplicationConfig;
+declare const __authority_augmentSignInEntriesWithReplication: typeof augmentSignInEntriesWithReplication;
+declare const __authority_createReplicationAuthority: typeof createReplicationAuthority;
+declare const __authority_establishReplicaSessionStamp: typeof establishReplicaSessionStamp;
+declare const __authority_hasUnrestrictedGetCoverage: typeof hasUnrestrictedGetCoverage;
+declare const __authority_mintNodeReplicationGrant: typeof mintNodeReplicationGrant;
+declare const __authority_replicationScopeFromSignedSession: typeof replicationScopeFromSignedSession;
+declare const __authority_reportReplicaDenial: typeof reportReplicaDenial;
+declare const __authority_restoreReplicaSessionStamp: typeof restoreReplicaSessionStamp;
+declare const __authority_ucanAttCovers: typeof ucanAttCovers;
+declare const __authority_ucanAttUnconstrainedFor: typeof ucanAttUnconstrainedFor;
+declare const __authority_verifiedOwnerConsentAnchor: typeof verifiedOwnerConsentAnchor;
+declare namespace __authority {
+  export { __authority_AUTHORITY_EXPIRY_MARGIN_MS as AUTHORITY_EXPIRY_MARGIN_MS, type __authority_DelegationPlanResult as DelegationPlanResult, type __authority_ReplicationAuthorityHost as ReplicationAuthorityHost, type __authority_ReplicationAuthoritySession as ReplicationAuthoritySession, __authority_assertRenewalParent as assertRenewalParent, __authority_assertValidReplicationConfig as assertValidReplicationConfig, __authority_augmentSignInEntriesWithReplication as augmentSignInEntriesWithReplication, __authority_createReplicationAuthority as createReplicationAuthority, __authority_establishReplicaSessionStamp as establishReplicaSessionStamp, __authority_hasUnrestrictedGetCoverage as hasUnrestrictedGetCoverage, __authority_mintNodeReplicationGrant as mintNodeReplicationGrant, __authority_replicationScopeFromSignedSession as replicationScopeFromSignedSession, __authority_reportReplicaDenial as reportReplicaDenial, __authority_restoreReplicaSessionStamp as restoreReplicaSessionStamp, __authority_ucanAttCovers as ucanAttCovers, __authority_ucanAttUnconstrainedFor as ucanAttUnconstrainedFor, __authority_verifiedOwnerConsentAnchor as verifiedOwnerConsentAnchor };
+}
+
+export { AUTHORITY_EXPIRY_MARGIN_MS as A, type DelegationPlanResult as D, type ReplicationAuthorityHost as R, __authority as _, type ReplicationAuthoritySession as a, assertRenewalParent as b, assertValidReplicationConfig as c, augmentSignInEntriesWithReplication as d, createReplicationAuthority as e, establishReplicaSessionStamp as f, reportReplicaDenial as g, hasUnrestrictedGetCoverage as h, restoreReplicaSessionStamp as i, ucanAttUnconstrainedFor as j, mintNodeReplicationGrant as m, replicationScopeFromSignedSession as r, ucanAttCovers as u, verifiedOwnerConsentAnchor as v };