@tinycloud/node-sdk 3.8.0-beta.1 → 3.8.0-beta.3

package/dist/encryption-keys.d.cts

@@ -1,6 +1,6 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-DDfx8Fx5.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-CVO41O12.cjs';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';

package/dist/encryption-keys.d.ts

@@ -1,6 +1,6 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-Ckqu_fqH.js';
+import { T as TinyCloudNode } from './TinyCloudNode-B6VOBrCb.js';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';

package/dist/index.cjs

@@ -17414,6 +17414,7 @@ __export(authority_exports, {
   assertValidReplicationConfig: () => assertValidReplicationConfig,
   augmentSignInEntriesWithReplication: () => augmentSignInEntriesWithReplication,
   createReplicationAuthority: () => createReplicationAuthority,
+  eraseReplicaLocalCopy: () => eraseReplicaLocalCopy,
   establishReplicaSessionStamp: () => establishReplicaSessionStamp,
   hasUnrestrictedGetCoverage: () => hasUnrestrictedGetCoverage,
   mintNodeReplicationGrant: () => mintNodeReplicationGrant,
@@ -17444,6 +17445,38 @@ function reportReplicaDenial(result, reason, onEvent, context) {
   } catch {
   }
 }
+async function eraseReplicaLocalCopy(lifecycle, trigger, denyStatus, handlers) {
+  if (lifecycle?.kind !== "indexeddb" || lifecycle.eraseLocalCopy === void 0) return void 0;
+  let outcome = { status: "failed", code: "STORAGE_ERROR", marker: false };
+  for (let attempt = 0; attempt <= ERASE_RETRY_DELAYS_MS.length; attempt++) {
+    if (attempt > 0) await new Promise((resolve2) => setTimeout(resolve2, ERASE_RETRY_DELAYS_MS[attempt - 1]));
+    try {
+      outcome = await lifecycle.eraseLocalCopy({ signal: AbortSignal.timeout(ERASE_ATTEMPT_MS) });
+    } catch {
+      outcome = { status: "failed", code: "STORAGE_ERROR", marker: false };
+    }
+    if (outcome.status !== "failed") break;
+  }
+  const keysKept = denyStatus === "marker" || denyStatus === "unguarded";
+  const purge = outcome.status === "erased" ? { ok: true } : { ok: false, retryNow: outcome.status === "failed" };
+  if (outcome.status === "erased" || outcome.status === "refused" && !keysKept) return { outcome, purge };
+  const logoutPending = outcome.status === "failed" && outcome.marker;
+  const event = {
+    type: "replica.purge.failed",
+    trigger,
+    reason: logoutPending ? "logout_pending" : "gate_unavailable",
+    code: outcome.code,
+    retryNow: outcome.status === "failed"
+  };
+  for (const handler of handlers) {
+    try {
+      handler(event);
+    } catch (error) {
+      console.error('Error in "replica.purge.failed" handler:', error);
+    }
+  }
+  return logoutPending ? { outcome, purge, logoutPending } : { outcome, purge };
+}
 function verifiedOwnerConsentAnchor(session, wasmBindings, exactVerifiedRecap2) {
   if (typeof session.siwe !== "string" || typeof session.signature !== "string" || typeof session.address !== "string" || typeof session.chainId !== "number") return null;
   try {
@@ -17702,7 +17735,7 @@ function createReplicationAuthority(host) {
   };
   return authority;
 }
-var import_siwe3, import_sdk_core12, import_replica, parseUcanGrant, KV_GET2, KV_SYNC2, KV_SERVICE2, AUTHORITY_EXPIRY_MARGIN_MS;
+var import_siwe3, import_sdk_core12, import_replica, parseUcanGrant, ERASE_RETRY_DELAYS_MS, ERASE_ATTEMPT_MS, KV_GET2, KV_SYNC2, KV_SERVICE2, AUTHORITY_EXPIRY_MARGIN_MS;
 var init_authority = __esm({
   "src/replication/authority.ts"() {
     "use strict";
@@ -17712,6 +17745,8 @@ var init_authority = __esm({
     init_config();
     init_authority_sign_in();
     parseUcanGrant = import_replica.parseUcanGrant;
+    ERASE_RETRY_DELAYS_MS = [150, 450];
+    ERASE_ATTEMPT_MS = 3e3;
     KV_GET2 = import_sdk_core12.KV.GET;
     KV_SYNC2 = import_sdk_core12.KV.SYNC;
     KV_SERVICE2 = "tinycloud.kv";
@@ -21565,6 +21600,7 @@ function replicaRestoreRefusal(error) {
       case "purge_pending":
       case "logout_pending":
       case "gate_unavailable":
+      case "wallet_provider_required":
         return error.gate;
     }
   }
@@ -21599,6 +21635,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.auth = null;
     this.tc = null;
     this._chainId = 1;
+    this.replicaPurgeFailedHandlers = /* @__PURE__ */ new Set();
     /** Mints the replica session stamp on each fresh sign-in (TC-858 §4.1). Undefined when replication is off. */
     this.establishReplicaStamp = async (session) => {
       const replication = this.config.replication;
@@ -21805,6 +21842,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           return instance ? instance.control.purge(input) : runtime.then((ready) => ready.control.purge(input));
         },
         clearPending: async () => (await runtime).control.clearPending(),
+        purgeLocalCopy: async () => (await this.eraseReplicaLocalCopy("purge_local_copy"))?.purge ?? { ok: false, retryNow: false },
         close: async () => (await runtime).control.close()
       };
     }
@@ -21859,18 +21897,14 @@ var _TinyCloudNode = class _TinyCloudNode {
   get freshEncryptionNetworkCreated() {
     return this._freshEncryptionNetworkCreated;
   }
-  /**
-   * Subscribe to `storage.full`. It fires on the first write any service had
-   * rejected because the owner's TinyCloud storage is full
-   * (`STORAGE_QUOTA_EXCEEDED` or `STORAGE_LIMIT_REACHED`), so an app can show
-   * one read-only banner. Reads keep working. For the signed-in account's own
-   * storage it fires once per episode: the episode ends only when a write to
-   * that storage succeeds, or on sign-out. A `storage.status()` read does not
-   * end it. A rejection on another owner's delegated space fires once per
-   * owner, until that owner's `storage.status()` reports space again. Returns
-   * the unsubscribe function.
-   */
   on(event, handler) {
+    if (event === "replica.purge.failed") {
+      const listener = handler;
+      this.replicaPurgeFailedHandlers.add(listener);
+      return () => {
+        this.replicaPurgeFailedHandlers.delete(listener);
+      };
+    }
     if (event !== "storage.full") {
       throw new Error(`Unknown TinyCloud event: ${String(event)}`);
     }
@@ -22351,6 +22385,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const leavingAuth = this.auth;
     const leavingContext = this._serviceContext;
     let denied;
+    let erased;
     try {
       this.teardownSession();
     } finally {
@@ -22361,6 +22396,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         try {
           await this.accountRegistryTail;
           await this.quiesceReplicaRuntime();
+          if (denied) erased = await this.eraseReplicaLocalCopy("sign_out", denied.status);
         } finally {
           if (leavingAddress) {
             await (leavingAuth ? leavingAuth.clearPersistedSession(leavingAddress) : this.config.sessionStorage?.clear(leavingAddress));
@@ -22368,8 +22404,37 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
       }
     }
-    if (denied?.status === "unguarded") {
-      throw new Error(`Replica gate was not denied (${denied.code ?? "unknown"}); the replica may still be restorable.`);
+    if (denied?.status === "unguarded" && erased?.outcome.status !== "erased") {
+      throw Object.assign(
+        new Error(`Replica gate was not denied (${denied.code ?? "unknown"}); the replica may still be restorable.`),
+        {
+          code: "REPLICA_PURGE_FAILED",
+          reason: "gate_unavailable",
+          retryNow: erased?.outcome.status === "failed"
+        }
+      );
+    }
+  }
+  /**
+   * Erases the browser local copy after a deny (retry, event and next-load marker live in the lazy
+   * replication authority). Never rejects; `undefined` when replication is off or the storage keeps
+   * no browser database.
+   */
+  async eraseReplicaLocalCopy(trigger, denyStatus) {
+    const replication = this.config.replication;
+    if (!replication?.enabled) return void 0;
+    try {
+      const { eraseReplicaLocalCopy: eraseReplicaLocalCopy2 } = await getNodeReplicationLoaders().authority();
+      const erased = await eraseReplicaLocalCopy2(
+        replication.storage.lifecycle,
+        trigger,
+        denyStatus,
+        this.replicaPurgeFailedHandlers
+      );
+      if (erased?.logoutPending) this.replicaRestoreGate = "logout_pending";
+      return erased;
+    } catch {
+      return void 0;
     }
   }
   /**
@@ -22533,6 +22598,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     const priorPrincipal = this.replicaSessionPrincipal ?? (this.address ? (0, import_sdk_core10.pkhDid)(this.address, this._chainId) : void 0);
     if (this.config.replication?.enabled && priorPrincipal && priorPrincipal !== nextPrincipal) {
       const denial = await this.denyReplicaGate({ reason: "account_switch", principal: priorPrincipal, next: nextPrincipal });
+      if (denial) {
+        await this.quiesceReplicaRuntime();
+        await this.eraseReplicaLocalCopy("account_switch", denial.status);
+      }
       this.replicaRestoreGate = denial?.status === "unguarded" ? "gate_unavailable" : "stamp_stale";
     }
     if (address !== this._address || chainId !== this._chainId) {