@tinycloud/node-sdk 3.8.0-beta.0 → 3.8.0-beta.2

package/dist/{TinyCloudNode-BtKzLDJX.d.ts → TinyCloudNode-B6VOBrCb.d.ts}

@@ -1,6 +1,6 @@
 import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
 import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, RegistryPolicy, RegistrySequenceStore, OnNodeNotFound, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, Delegation, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, RetryPolicy, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
-import { ReplicaSessionStamp } from '@tinycloud/sdk-services/kv/replication';
+import { ReplicaPurgeFailedEvent, ReplicaSessionStamp } from '@tinycloud/sdk-services/kv/replication';
 import { InvokeFunction, InvokeAnyFunction, FetchFunction, RequestSink, RequestLogReader } from '@tinycloud/sdk-services';
 import { EventEmitter } from 'events';
 import { P as PortableDelegation, S as SessionGrantProof, g as VerifiedSessionGrant } from './delegation-0LKZkmP2.js';
@@ -275,7 +275,7 @@ interface NodeUserAuthorizationConfig {
      * unrestricted `get` covering it is already requested. Storage and
      * scheduling never reach this layer.
      */
-    replication?: Pick<ReplicationOptions, "enabled" | "prefixes" | "allowSecrets">;
+    replication?: Pick<ReplicationOptions, "enabled" | "prefixes" | "allowSecrets" | "syncScope">;
     /** Extra top-level resource URIs and their abilities added to the sign-in ReCap (e.g. named-key prefixes). */
     additionalRawAbilities?: Record<string, string[]>;
     /**
@@ -1292,6 +1292,7 @@ declare class TinyCloudNode {
     private replicaRestoreGate?;
     private replicaSessionPrincipal?;
     private replicaSessionStamp?;
+    private readonly replicaPurgeFailedHandlers;
     /** Mints the replica session stamp on each fresh sign-in (TC-858 §4.1). Undefined when replication is off. */
     private readonly establishReplicaStamp;
     private readonly replicationControl?;
@@ -1421,6 +1422,12 @@ declare class TinyCloudNode {
      * the unsubscribe function.
      */
     on(event: "storage.full", handler: (event: StorageFullEvent) => void): () => void;
+    /**
+     * Subscribe to `replica.purge.failed`. It fires when the browser local copy could not be erased
+     * after the bounded retries (sign-out, account switch or `purgeLocalCopy()`). The event carries the
+     * typed gate reason and `retryNow`; the SDK retries again on the next load. Returns the unsubscribe function.
+     */
+    on(event: "replica.purge.failed", handler: (event: ReplicaPurgeFailedEvent) => void): () => void;
     /**
      * Storage episode state for the UI mount. @internal
      *
@@ -1611,6 +1618,12 @@ declare class TinyCloudNode {
      */
     signOut(): Promise<void>;
     private endSession;
+    /**
+     * Erases the browser local copy after a deny (retry, event and next-load marker live in the lazy
+     * replication authority). Never rejects; `undefined` when replication is off or the storage keeps
+     * no browser database.
+     */
+    private eraseReplicaLocalCopy;
     /**
      * Step 1 of replica sign-out. Never rejects: failures come back as `unguarded` so the session
      * is still cleared. Returns `undefined` when replication is off.

package/dist/{TinyCloudNode-ggmlnSfI.d.cts → TinyCloudNode-CVO41O12.d.cts}

@@ -1,6 +1,6 @@
 import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
 import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, RegistryPolicy, RegistrySequenceStore, OnNodeNotFound, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, Delegation, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, RetryPolicy, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
-import { ReplicaSessionStamp } from '@tinycloud/sdk-services/kv/replication';
+import { ReplicaPurgeFailedEvent, ReplicaSessionStamp } from '@tinycloud/sdk-services/kv/replication';
 import { InvokeFunction, InvokeAnyFunction, FetchFunction, RequestSink, RequestLogReader } from '@tinycloud/sdk-services';
 import { EventEmitter } from 'events';
 import { P as PortableDelegation, S as SessionGrantProof, g as VerifiedSessionGrant } from './delegation-0LKZkmP2.cjs';
@@ -275,7 +275,7 @@ interface NodeUserAuthorizationConfig {
      * unrestricted `get` covering it is already requested. Storage and
      * scheduling never reach this layer.
      */
-    replication?: Pick<ReplicationOptions, "enabled" | "prefixes" | "allowSecrets">;
+    replication?: Pick<ReplicationOptions, "enabled" | "prefixes" | "allowSecrets" | "syncScope">;
     /** Extra top-level resource URIs and their abilities added to the sign-in ReCap (e.g. named-key prefixes). */
     additionalRawAbilities?: Record<string, string[]>;
     /**
@@ -1292,6 +1292,7 @@ declare class TinyCloudNode {
     private replicaRestoreGate?;
     private replicaSessionPrincipal?;
     private replicaSessionStamp?;
+    private readonly replicaPurgeFailedHandlers;
     /** Mints the replica session stamp on each fresh sign-in (TC-858 §4.1). Undefined when replication is off. */
     private readonly establishReplicaStamp;
     private readonly replicationControl?;
@@ -1421,6 +1422,12 @@ declare class TinyCloudNode {
      * the unsubscribe function.
      */
     on(event: "storage.full", handler: (event: StorageFullEvent) => void): () => void;
+    /**
+     * Subscribe to `replica.purge.failed`. It fires when the browser local copy could not be erased
+     * after the bounded retries (sign-out, account switch or `purgeLocalCopy()`). The event carries the
+     * typed gate reason and `retryNow`; the SDK retries again on the next load. Returns the unsubscribe function.
+     */
+    on(event: "replica.purge.failed", handler: (event: ReplicaPurgeFailedEvent) => void): () => void;
     /**
      * Storage episode state for the UI mount. @internal
      *
@@ -1611,6 +1618,12 @@ declare class TinyCloudNode {
      */
     signOut(): Promise<void>;
     private endSession;
+    /**
+     * Erases the browser local copy after a deny (retry, event and next-load marker live in the lazy
+     * replication authority). Never rejects; `undefined` when replication is off or the storage keeps
+     * no browser database.
+     */
+    private eraseReplicaLocalCopy;
     /**
      * Step 1 of replica sign-out. Never rejects: failures come back as `unguarded` so the session
      * is still cleared. Returns `undefined` when replication is off.

package/dist/{authority-sJ6buHMj.d.ts → authority-DGi1hIMK.d.ts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
-import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-BtKzLDJX.js';
+import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
+import { T as TinyCloudNode } from './TinyCloudNode-B6VOBrCb.js';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {
@@ -12,7 +12,7 @@ declare function hasUnrestrictedGetCoverage(entries: readonly PermissionEntry[],
 declare function augmentSignInEntriesWithReplication(input: {
     entries: readonly PermissionEntry[];
     primarySpaceId: string;
-    replication?: Pick<ReplicationOptions, "prefixes" | "allowSecrets">;
+    replication?: Pick<ReplicationOptions, "prefixes" | "allowSecrets" | "syncScope">;
 }): PermissionEntry[];
 
 /** Report a completed deny from the already-loaded authority; delivery was revoked synchronously. */
@@ -21,6 +21,20 @@ declare function reportReplicaDenial(result: {
     code?: string;
     intents?: number;
 }, reason: ReplicaDenyInput["reason"], onEvent: ReplicationOptions["onEvent"], context?: ServiceContext): void;
+/** What the root needs after a local-copy erase: the outcome, the `purgeLocalCopy()` result and the marker state. */
+interface ReplicaLocalEraseReport {
+    outcome: ReplicaLocalEraseOutcome;
+    purge: ReplicaPurgeLocalCopyResult;
+    /** The logout marker is set: the next load finishes the erase and the replica stays gated meanwhile. */
+    logoutPending?: true;
+}
+/**
+ * Erases the browser local copy after a deny, retrying a `failed` outcome with the delays above. After
+ * the last failure (or a refusal while the deny kept the keys) it notifies `handlers` with
+ * `replica.purge.failed`; the logout marker the lifecycle set makes the next load finish the erase.
+ * Never rejects. `undefined`: this storage has no browser local copy to erase.
+ */
+declare function eraseReplicaLocalCopy(lifecycle: KVReplicaStorage["lifecycle"], trigger: ReplicaPurgeTrigger, denyStatus: string | undefined, handlers: ReadonlySet<(event: ReplicaPurgeFailedEvent) => void>): Promise<ReplicaLocalEraseReport | undefined>;
 /** The verified owner proof is signed, finite, exact-space, and uncaveated on one get+sync scope. */
 declare function verifiedOwnerConsentAnchor(session: TinyCloudSession, wasmBindings: Pick<IWasmBindings, "validatePersistedSession">, exactVerifiedRecap: (verified: {
     verifiedRecap?: unknown;
@@ -96,12 +110,14 @@ declare function createReplicationAuthority(host: ReplicationAuthorityHost): Rep
 
 declare const __authority_AUTHORITY_EXPIRY_MARGIN_MS: typeof AUTHORITY_EXPIRY_MARGIN_MS;
 type __authority_DelegationPlanResult = DelegationPlanResult;
+type __authority_ReplicaLocalEraseReport = ReplicaLocalEraseReport;
 type __authority_ReplicationAuthorityHost = ReplicationAuthorityHost;
 type __authority_ReplicationAuthoritySession = ReplicationAuthoritySession;
 declare const __authority_assertRenewalParent: typeof assertRenewalParent;
 declare const __authority_assertValidReplicationConfig: typeof assertValidReplicationConfig;
 declare const __authority_augmentSignInEntriesWithReplication: typeof augmentSignInEntriesWithReplication;
 declare const __authority_createReplicationAuthority: typeof createReplicationAuthority;
+declare const __authority_eraseReplicaLocalCopy: typeof eraseReplicaLocalCopy;
 declare const __authority_establishReplicaSessionStamp: typeof establishReplicaSessionStamp;
 declare const __authority_hasUnrestrictedGetCoverage: typeof hasUnrestrictedGetCoverage;
 declare const __authority_mintNodeReplicationGrant: typeof mintNodeReplicationGrant;
@@ -112,7 +128,7 @@ declare const __authority_ucanAttCovers: typeof ucanAttCovers;
 declare const __authority_ucanAttUnconstrainedFor: typeof ucanAttUnconstrainedFor;
 declare const __authority_verifiedOwnerConsentAnchor: typeof verifiedOwnerConsentAnchor;
 declare namespace __authority {
-  export { __authority_AUTHORITY_EXPIRY_MARGIN_MS as AUTHORITY_EXPIRY_MARGIN_MS, type __authority_DelegationPlanResult as DelegationPlanResult, type __authority_ReplicationAuthorityHost as ReplicationAuthorityHost, type __authority_ReplicationAuthoritySession as ReplicationAuthoritySession, __authority_assertRenewalParent as assertRenewalParent, __authority_assertValidReplicationConfig as assertValidReplicationConfig, __authority_augmentSignInEntriesWithReplication as augmentSignInEntriesWithReplication, __authority_createReplicationAuthority as createReplicationAuthority, __authority_establishReplicaSessionStamp as establishReplicaSessionStamp, __authority_hasUnrestrictedGetCoverage as hasUnrestrictedGetCoverage, __authority_mintNodeReplicationGrant as mintNodeReplicationGrant, __authority_replicationScopeFromSignedSession as replicationScopeFromSignedSession, __authority_reportReplicaDenial as reportReplicaDenial, __authority_restoreReplicaSessionStamp as restoreReplicaSessionStamp, __authority_ucanAttCovers as ucanAttCovers, __authority_ucanAttUnconstrainedFor as ucanAttUnconstrainedFor, __authority_verifiedOwnerConsentAnchor as verifiedOwnerConsentAnchor };
+  export { __authority_AUTHORITY_EXPIRY_MARGIN_MS as AUTHORITY_EXPIRY_MARGIN_MS, type __authority_DelegationPlanResult as DelegationPlanResult, type __authority_ReplicaLocalEraseReport as ReplicaLocalEraseReport, type __authority_ReplicationAuthorityHost as ReplicationAuthorityHost, type __authority_ReplicationAuthoritySession as ReplicationAuthoritySession, __authority_assertRenewalParent as assertRenewalParent, __authority_assertValidReplicationConfig as assertValidReplicationConfig, __authority_augmentSignInEntriesWithReplication as augmentSignInEntriesWithReplication, __authority_createReplicationAuthority as createReplicationAuthority, __authority_eraseReplicaLocalCopy as eraseReplicaLocalCopy, __authority_establishReplicaSessionStamp as establishReplicaSessionStamp, __authority_hasUnrestrictedGetCoverage as hasUnrestrictedGetCoverage, __authority_mintNodeReplicationGrant as mintNodeReplicationGrant, __authority_replicationScopeFromSignedSession as replicationScopeFromSignedSession, __authority_reportReplicaDenial as reportReplicaDenial, __authority_restoreReplicaSessionStamp as restoreReplicaSessionStamp, __authority_ucanAttCovers as ucanAttCovers, __authority_ucanAttUnconstrainedFor as ucanAttUnconstrainedFor, __authority_verifiedOwnerConsentAnchor as verifiedOwnerConsentAnchor };
 }
 
-export { AUTHORITY_EXPIRY_MARGIN_MS as A, type DelegationPlanResult as D, type ReplicationAuthorityHost as R, __authority as _, type ReplicationAuthoritySession as a, assertRenewalParent as b, assertValidReplicationConfig as c, augmentSignInEntriesWithReplication as d, createReplicationAuthority as e, establishReplicaSessionStamp as f, reportReplicaDenial as g, hasUnrestrictedGetCoverage as h, restoreReplicaSessionStamp as i, ucanAttUnconstrainedFor as j, mintNodeReplicationGrant as m, replicationScopeFromSignedSession as r, ucanAttCovers as u, verifiedOwnerConsentAnchor as v };
+export { AUTHORITY_EXPIRY_MARGIN_MS as A, type DelegationPlanResult as D, type ReplicaLocalEraseReport as R, __authority as _, type ReplicationAuthorityHost as a, type ReplicationAuthoritySession as b, assertRenewalParent as c, assertValidReplicationConfig as d, augmentSignInEntriesWithReplication as e, createReplicationAuthority as f, eraseReplicaLocalCopy as g, establishReplicaSessionStamp as h, hasUnrestrictedGetCoverage as i, reportReplicaDenial as j, restoreReplicaSessionStamp as k, ucanAttUnconstrainedFor as l, mintNodeReplicationGrant as m, replicationScopeFromSignedSession as r, ucanAttCovers as u, verifiedOwnerConsentAnchor as v };

package/dist/{authority-_SYAE-uV.d.cts → authority-DgVV80bI.d.cts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
-import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-ggmlnSfI.cjs';
+import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
+import { T as TinyCloudNode } from './TinyCloudNode-CVO41O12.cjs';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {
@@ -12,7 +12,7 @@ declare function hasUnrestrictedGetCoverage(entries: readonly PermissionEntry[],
 declare function augmentSignInEntriesWithReplication(input: {
     entries: readonly PermissionEntry[];
     primarySpaceId: string;
-    replication?: Pick<ReplicationOptions, "prefixes" | "allowSecrets">;
+    replication?: Pick<ReplicationOptions, "prefixes" | "allowSecrets" | "syncScope">;
 }): PermissionEntry[];
 
 /** Report a completed deny from the already-loaded authority; delivery was revoked synchronously. */
@@ -21,6 +21,20 @@ declare function reportReplicaDenial(result: {
     code?: string;
     intents?: number;
 }, reason: ReplicaDenyInput["reason"], onEvent: ReplicationOptions["onEvent"], context?: ServiceContext): void;
+/** What the root needs after a local-copy erase: the outcome, the `purgeLocalCopy()` result and the marker state. */
+interface ReplicaLocalEraseReport {
+    outcome: ReplicaLocalEraseOutcome;
+    purge: ReplicaPurgeLocalCopyResult;
+    /** The logout marker is set: the next load finishes the erase and the replica stays gated meanwhile. */
+    logoutPending?: true;
+}
+/**
+ * Erases the browser local copy after a deny, retrying a `failed` outcome with the delays above. After
+ * the last failure (or a refusal while the deny kept the keys) it notifies `handlers` with
+ * `replica.purge.failed`; the logout marker the lifecycle set makes the next load finish the erase.
+ * Never rejects. `undefined`: this storage has no browser local copy to erase.
+ */
+declare function eraseReplicaLocalCopy(lifecycle: KVReplicaStorage["lifecycle"], trigger: ReplicaPurgeTrigger, denyStatus: string | undefined, handlers: ReadonlySet<(event: ReplicaPurgeFailedEvent) => void>): Promise<ReplicaLocalEraseReport | undefined>;
 /** The verified owner proof is signed, finite, exact-space, and uncaveated on one get+sync scope. */
 declare function verifiedOwnerConsentAnchor(session: TinyCloudSession, wasmBindings: Pick<IWasmBindings, "validatePersistedSession">, exactVerifiedRecap: (verified: {
     verifiedRecap?: unknown;
@@ -96,12 +110,14 @@ declare function createReplicationAuthority(host: ReplicationAuthorityHost): Rep
 
 declare const __authority_AUTHORITY_EXPIRY_MARGIN_MS: typeof AUTHORITY_EXPIRY_MARGIN_MS;
 type __authority_DelegationPlanResult = DelegationPlanResult;
+type __authority_ReplicaLocalEraseReport = ReplicaLocalEraseReport;
 type __authority_ReplicationAuthorityHost = ReplicationAuthorityHost;
 type __authority_ReplicationAuthoritySession = ReplicationAuthoritySession;
 declare const __authority_assertRenewalParent: typeof assertRenewalParent;
 declare const __authority_assertValidReplicationConfig: typeof assertValidReplicationConfig;
 declare const __authority_augmentSignInEntriesWithReplication: typeof augmentSignInEntriesWithReplication;
 declare const __authority_createReplicationAuthority: typeof createReplicationAuthority;
+declare const __authority_eraseReplicaLocalCopy: typeof eraseReplicaLocalCopy;
 declare const __authority_establishReplicaSessionStamp: typeof establishReplicaSessionStamp;
 declare const __authority_hasUnrestrictedGetCoverage: typeof hasUnrestrictedGetCoverage;
 declare const __authority_mintNodeReplicationGrant: typeof mintNodeReplicationGrant;
@@ -112,7 +128,7 @@ declare const __authority_ucanAttCovers: typeof ucanAttCovers;
 declare const __authority_ucanAttUnconstrainedFor: typeof ucanAttUnconstrainedFor;
 declare const __authority_verifiedOwnerConsentAnchor: typeof verifiedOwnerConsentAnchor;
 declare namespace __authority {
-  export { __authority_AUTHORITY_EXPIRY_MARGIN_MS as AUTHORITY_EXPIRY_MARGIN_MS, type __authority_DelegationPlanResult as DelegationPlanResult, type __authority_ReplicationAuthorityHost as ReplicationAuthorityHost, type __authority_ReplicationAuthoritySession as ReplicationAuthoritySession, __authority_assertRenewalParent as assertRenewalParent, __authority_assertValidReplicationConfig as assertValidReplicationConfig, __authority_augmentSignInEntriesWithReplication as augmentSignInEntriesWithReplication, __authority_createReplicationAuthority as createReplicationAuthority, __authority_establishReplicaSessionStamp as establishReplicaSessionStamp, __authority_hasUnrestrictedGetCoverage as hasUnrestrictedGetCoverage, __authority_mintNodeReplicationGrant as mintNodeReplicationGrant, __authority_replicationScopeFromSignedSession as replicationScopeFromSignedSession, __authority_reportReplicaDenial as reportReplicaDenial, __authority_restoreReplicaSessionStamp as restoreReplicaSessionStamp, __authority_ucanAttCovers as ucanAttCovers, __authority_ucanAttUnconstrainedFor as ucanAttUnconstrainedFor, __authority_verifiedOwnerConsentAnchor as verifiedOwnerConsentAnchor };
+  export { __authority_AUTHORITY_EXPIRY_MARGIN_MS as AUTHORITY_EXPIRY_MARGIN_MS, type __authority_DelegationPlanResult as DelegationPlanResult, type __authority_ReplicaLocalEraseReport as ReplicaLocalEraseReport, type __authority_ReplicationAuthorityHost as ReplicationAuthorityHost, type __authority_ReplicationAuthoritySession as ReplicationAuthoritySession, __authority_assertRenewalParent as assertRenewalParent, __authority_assertValidReplicationConfig as assertValidReplicationConfig, __authority_augmentSignInEntriesWithReplication as augmentSignInEntriesWithReplication, __authority_createReplicationAuthority as createReplicationAuthority, __authority_eraseReplicaLocalCopy as eraseReplicaLocalCopy, __authority_establishReplicaSessionStamp as establishReplicaSessionStamp, __authority_hasUnrestrictedGetCoverage as hasUnrestrictedGetCoverage, __authority_mintNodeReplicationGrant as mintNodeReplicationGrant, __authority_replicationScopeFromSignedSession as replicationScopeFromSignedSession, __authority_reportReplicaDenial as reportReplicaDenial, __authority_restoreReplicaSessionStamp as restoreReplicaSessionStamp, __authority_ucanAttCovers as ucanAttCovers, __authority_ucanAttUnconstrainedFor as ucanAttUnconstrainedFor, __authority_verifiedOwnerConsentAnchor as verifiedOwnerConsentAnchor };
 }
 
-export { AUTHORITY_EXPIRY_MARGIN_MS as A, type DelegationPlanResult as D, type ReplicationAuthorityHost as R, __authority as _, type ReplicationAuthoritySession as a, assertRenewalParent as b, assertValidReplicationConfig as c, augmentSignInEntriesWithReplication as d, createReplicationAuthority as e, establishReplicaSessionStamp as f, reportReplicaDenial as g, hasUnrestrictedGetCoverage as h, restoreReplicaSessionStamp as i, ucanAttUnconstrainedFor as j, mintNodeReplicationGrant as m, replicationScopeFromSignedSession as r, ucanAttCovers as u, verifiedOwnerConsentAnchor as v };
+export { AUTHORITY_EXPIRY_MARGIN_MS as A, type DelegationPlanResult as D, type ReplicaLocalEraseReport as R, __authority as _, type ReplicationAuthorityHost as a, type ReplicationAuthoritySession as b, assertRenewalParent as c, assertValidReplicationConfig as d, augmentSignInEntriesWithReplication as e, createReplicationAuthority as f, eraseReplicaLocalCopy as g, establishReplicaSessionStamp as h, hasUnrestrictedGetCoverage as i, reportReplicaDenial as j, restoreReplicaSessionStamp as k, ucanAttUnconstrainedFor as l, mintNodeReplicationGrant as m, replicationScopeFromSignedSession as r, ucanAttCovers as u, verifiedOwnerConsentAnchor as v };

package/dist/core.cjs

@@ -375,7 +375,7 @@ function augmentSignInEntriesWithReplication(input) {
     }
     eligiblePaths.push(path);
   }
-  if (eligiblePaths.length === replication.prefixes.length && eligiblePaths.length > 0 && hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, "")) {
+  if (replication.syncScope !== "prefixes" && eligiblePaths.length === replication.prefixes.length && eligiblePaths.length > 0 && hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, "")) {
     return [{
       service: KV_SERVICE,
       space: input.primarySpaceId,
@@ -3735,6 +3735,7 @@ function replicaRestoreRefusal(error) {
       case "purge_pending":
       case "logout_pending":
       case "gate_unavailable":
+      case "wallet_provider_required":
         return error.gate;
     }
   }
@@ -3769,6 +3770,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.auth = null;
     this.tc = null;
     this._chainId = 1;
+    this.replicaPurgeFailedHandlers = /* @__PURE__ */ new Set();
     /** Mints the replica session stamp on each fresh sign-in (TC-858 §4.1). Undefined when replication is off. */
     this.establishReplicaStamp = async (session) => {
       const replication = this.config.replication;
@@ -3975,6 +3977,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           return instance ? instance.control.purge(input) : runtime.then((ready) => ready.control.purge(input));
         },
         clearPending: async () => (await runtime).control.clearPending(),
+        purgeLocalCopy: async () => (await this.eraseReplicaLocalCopy("purge_local_copy"))?.purge ?? { ok: false, retryNow: false },
         close: async () => (await runtime).control.close()
       };
     }
@@ -4029,18 +4032,14 @@ var _TinyCloudNode = class _TinyCloudNode {
   get freshEncryptionNetworkCreated() {
     return this._freshEncryptionNetworkCreated;
   }
-  /**
-   * Subscribe to `storage.full`. It fires on the first write any service had
-   * rejected because the owner's TinyCloud storage is full
-   * (`STORAGE_QUOTA_EXCEEDED` or `STORAGE_LIMIT_REACHED`), so an app can show
-   * one read-only banner. Reads keep working. For the signed-in account's own
-   * storage it fires once per episode: the episode ends only when a write to
-   * that storage succeeds, or on sign-out. A `storage.status()` read does not
-   * end it. A rejection on another owner's delegated space fires once per
-   * owner, until that owner's `storage.status()` reports space again. Returns
-   * the unsubscribe function.
-   */
   on(event, handler) {
+    if (event === "replica.purge.failed") {
+      const listener = handler;
+      this.replicaPurgeFailedHandlers.add(listener);
+      return () => {
+        this.replicaPurgeFailedHandlers.delete(listener);
+      };
+    }
     if (event !== "storage.full") {
       throw new Error(`Unknown TinyCloud event: ${String(event)}`);
     }
@@ -4260,7 +4259,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       replication: config.replication?.enabled === true ? {
         enabled: true,
         prefixes: config.replication.prefixes,
-        allowSecrets: config.replication.allowSecrets === true
+        allowSecrets: config.replication.allowSecrets === true,
+        syncScope: config.replication.syncScope
       } : void 0
     });
     this.tc = new import_sdk_core11.TinyCloud(this.auth, {
@@ -4520,6 +4520,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const leavingAuth = this.auth;
     const leavingContext = this._serviceContext;
     let denied;
+    let erased;
     try {
       this.teardownSession();
     } finally {
@@ -4530,6 +4531,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         try {
           await this.accountRegistryTail;
           await this.quiesceReplicaRuntime();
+          if (denied) erased = await this.eraseReplicaLocalCopy("sign_out", denied.status);
         } finally {
           if (leavingAddress) {
             await (leavingAuth ? leavingAuth.clearPersistedSession(leavingAddress) : this.config.sessionStorage?.clear(leavingAddress));
@@ -4537,8 +4539,37 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
       }
     }
-    if (denied?.status === "unguarded") {
-      throw new Error(`Replica gate was not denied (${denied.code ?? "unknown"}); the replica may still be restorable.`);
+    if (denied?.status === "unguarded" && erased?.outcome.status !== "erased") {
+      throw Object.assign(
+        new Error(`Replica gate was not denied (${denied.code ?? "unknown"}); the replica may still be restorable.`),
+        {
+          code: "REPLICA_PURGE_FAILED",
+          reason: "gate_unavailable",
+          retryNow: erased?.outcome.status === "failed"
+        }
+      );
+    }
+  }
+  /**
+   * Erases the browser local copy after a deny (retry, event and next-load marker live in the lazy
+   * replication authority). Never rejects; `undefined` when replication is off or the storage keeps
+   * no browser database.
+   */
+  async eraseReplicaLocalCopy(trigger, denyStatus) {
+    const replication = this.config.replication;
+    if (!replication?.enabled) return void 0;
+    try {
+      const { eraseReplicaLocalCopy } = await getNodeReplicationLoaders().authority();
+      const erased = await eraseReplicaLocalCopy(
+        replication.storage.lifecycle,
+        trigger,
+        denyStatus,
+        this.replicaPurgeFailedHandlers
+      );
+      if (erased?.logoutPending) this.replicaRestoreGate = "logout_pending";
+      return erased;
+    } catch {
+      return void 0;
     }
   }
   /**
@@ -4702,6 +4733,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     const priorPrincipal = this.replicaSessionPrincipal ?? (this.address ? (0, import_sdk_core11.pkhDid)(this.address, this._chainId) : void 0);
     if (this.config.replication?.enabled && priorPrincipal && priorPrincipal !== nextPrincipal) {
       const denial = await this.denyReplicaGate({ reason: "account_switch", principal: priorPrincipal, next: nextPrincipal });
+      if (denial) {
+        await this.quiesceReplicaRuntime();
+        await this.eraseReplicaLocalCopy("account_switch", denial.status);
+      }
       this.replicaRestoreGate = denial?.status === "unguarded" ? "gate_unavailable" : "stamp_stale";
     }
     if (address !== this._address || chainId !== this._chainId) {
@@ -6682,7 +6717,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       replication: this.config.replication?.enabled === true ? {
         enabled: true,
         prefixes: this.config.replication.prefixes,
-        allowSecrets: this.config.replication.allowSecrets === true
+        allowSecrets: this.config.replication.allowSecrets === true,
+        syncScope: this.config.replication.syncScope
       } : void 0
     });
     this.tc = new import_sdk_core11.TinyCloud(this.auth, {
@@ -6744,7 +6780,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       replication: this.config.replication?.enabled === true ? {
         enabled: true,
         prefixes: this.config.replication.prefixes,
-        allowSecrets: this.config.replication.allowSecrets === true
+        allowSecrets: this.config.replication.allowSecrets === true,
+        syncScope: this.config.replication.syncScope
       } : void 0
     });
     this.tc = new import_sdk_core11.TinyCloud(this.auth, {