@tinycloud/replica 0.2.4-beta.2 → 0.3.0-beta.4

package/dist/profile-gate.cjs

@@ -0,0 +1,560 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/profile-gate/index.ts
+var profile_gate_exports = {};
+__export(profile_gate_exports, {
+  REPLICA_DENY_FLOOR_FILE: () => REPLICA_DENY_FLOOR_FILE,
+  advanceInactiveGate: () => advanceInactiveGate,
+  assertGateAccess: () => assertGateAccess,
+  clearGateIntent: () => clearGateIntent,
+  deferredGateToken: () => deferredGateToken,
+  denyGate: () => denyGate,
+  establishSessionStamp: () => establishSessionStamp,
+  grantInstallHashOf: () => grantInstallHashOf,
+  identityHashOf: () => identityHashOf,
+  principalHashOf: () => principalHashOf,
+  readFirstInstall: () => readFirstInstall,
+  readGateSnapshot: () => readGateSnapshot,
+  readLogoutGate: () => readLogoutGate,
+  recordFirstInstall: () => recordFirstInstall,
+  recordGrantInstall: () => recordGrantInstall,
+  restoreSessionStamp: () => restoreSessionStamp,
+  resumeDeferredGate: () => resumeDeferredGate
+});
+module.exports = __toCommonJS(profile_gate_exports);
+
+// src/profile-gate/gateFile.ts
+var import_node_crypto = require("crypto");
+var import_promises = require("fs/promises");
+var import_node_path = require("path");
+
+// ../sdk-services/dist/kv/replication/contractConstants.js
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;
+var REPLICA_GATE_FILE = "replica-gate.json";
+
+// src/errors.ts
+var ReplicaErrorCode = {
+  /** Another process holds the sync lease. */
+  BUSY: "REPLICA_BUSY",
+  /** No replica with this name exists. */
+  NOT_FOUND: "REPLICA_NOT_FOUND",
+  /** The replica exists but its stored configuration differs from the request. */
+  CONFIG_MISMATCH: "REPLICA_CONFIG_MISMATCH",
+  /** The runtime has no supported durable store (e.g. Node < 22.13). */
+  RUNTIME_UNSUPPORTED: "RUNTIME_UNSUPPORTED",
+  /** A required open() argument is missing or malformed (e.g. `principal`). */
+  INVALID_ARGUMENT: "REPLICA_INVALID_ARGUMENT",
+  /** The local store failed (I/O, corruption, schema). */
+  STORAGE_ERROR: "STORAGE_ERROR",
+  /** The local disk is full. */
+  STORAGE_FULL: "STORAGE_FULL",
+  /** The key is outside the replica's prefix. */
+  NOT_COVERED: "NOT_COVERED",
+  /** Syncing the secrets space or the vault namespace needs an explicit opt-in. */
+  SECRETS_OPT_IN_REQUIRED: "SECRETS_OPT_IN_REQUIRED",
+  /** No grant is installed, or none covers the requested scope. */
+  GRANT_MISSING: "GRANT_MISSING",
+  /** The grant bytes are not a verifiable UCAN, or its signature is wrong. */
+  GRANT_INVALID: "GRANT_INVALID",
+  /** SIWE/CACAO and other non-UCAN grants cannot be used for a replica. */
+  GRANT_FORMAT_UNSUPPORTED: "GRANT_FORMAT_UNSUPPORTED",
+  /** The grant was issued to a different device. */
+  GRANT_AUDIENCE_MISMATCH: "GRANT_AUDIENCE_MISMATCH",
+  /** The grant lacks `tinycloud.kv/sync` or `tinycloud.kv/get` on the prefix. */
+  GRANT_NOT_COVERING: "GRANT_NOT_COVERING",
+  GRANT_NOT_YET_VALID: "GRANT_NOT_YET_VALID",
+  GRANT_EXPIRED: "GRANT_EXPIRED",
+  /** The configured node does not advertise whole-space KV sync support. */
+  REPLICATION_ROOT_UNSUPPORTED: "REPLICATION_ROOT_UNSUPPORTED",
+  GRANT_REVOKED: "GRANT_REVOKED",
+  /** The node refused the invocation for a reason other than revocation. */
+  GRANT_UNAUTHORIZED: "GRANT_UNAUTHORIZED",
+  /** The node refused the retention grant. */
+  RETENTION_GRANT_REFUSED: "RETENTION_GRANT_REFUSED",
+  /** The node could not be reached. */
+  NETWORK_ERROR: "NETWORK_ERROR",
+  /** The node answered with an unexpected status. */
+  NODE_ERROR: "NODE_ERROR",
+  /** The node's answer violates the wire contract. */
+  PROTOCOL_ERROR: "PROTOCOL_ERROR",
+  /** The node asked for a fresh bootstrap (410). Handled inside sync. */
+  RESET_REQUIRED: "RESET_REQUIRED",
+  /** The feed now comes from a different node than the one pinned. */
+  SOURCE_CHANGED: "SOURCE_CHANGED",
+  /** The feed delivered a key outside the replica's prefix. */
+  SCOPE_VIOLATION: "SCOPE_VIOLATION",
+  /** Fetched bytes do not hash to the ETag the node attested for them. */
+  CONTENT_MISMATCH: "CONTENT_MISMATCH",
+  /** A stored blob no longer hashes to its name. */
+  INTEGRITY_ERROR: "INTEGRITY_ERROR",
+  /** The replica handle was closed; in-flight calls settle with this code. */
+  CLOSED: "REPLICA_CLOSED",
+  /** The lifecycle gate refused the operation (shared contract `REPLICA_GATED`); `detail.gate` says why. */
+  GATED: "REPLICA_GATED",
+  /** Quota admission refused a page (`maxBytes` or the free-space floor); nothing committed. */
+  STORAGE_BUDGET: "STORAGE_BUDGET",
+  /** The consent deadline passed: the grant is not served until the user consents again. */
+  CONSENT_EXPIRED: "CONSENT_EXPIRED"
+};
+var REPLICA_ERROR = /* @__PURE__ */ Symbol.for("tinycloud.replica.error");
+var ReplicaError = class extends Error {
+  [REPLICA_ERROR] = true;
+  code;
+  detail;
+  constructor(code, message, detail, options) {
+    super(message, options);
+    this.name = "ReplicaError";
+    this.code = code;
+    if (detail !== void 0) this.detail = detail;
+  }
+};
+function gatedError(gate, message) {
+  return Object.assign(new ReplicaError(ReplicaErrorCode.GATED, message, { gate }), { gate });
+}
+
+// src/profile-gate/saltedHash.ts
+function base64UrlBytes(text) {
+  if (!/^[A-Za-z0-9_-]*$/.test(text)) throw new TypeError("The replica gate salt is not base64url.");
+  const padded = text.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((text.length + 3) % 4);
+  return Uint8Array.from(globalThis.atob(padded), (char) => char.charCodeAt(0));
+}
+var saltedHash = async (salt, material) => {
+  const key = await globalThis.crypto.subtle.importKey("raw", base64UrlBytes(salt), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const mac = new Uint8Array(await globalThis.crypto.subtle.sign("HMAC", key, new TextEncoder().encode(material)));
+  let hex = "";
+  for (const byte of mac) hex += byte.toString(16).padStart(2, "0");
+  return hex;
+};
+
+// src/profile-gate/gateFile.ts
+var GATE_FILE_VERSION = 1;
+var REPLICA_DENY_FLOOR_FILE = "replica-deny-floor.json";
+var DENY_FLOOR_FILE = REPLICA_DENY_FLOOR_FILE;
+function gateRefusal(gate, message) {
+  return gatedError(gate, message);
+}
+function principalHashOf(salt, principal) {
+  return saltedHash(salt, principal.toLowerCase());
+}
+function identityHashOf(salt, identityKey) {
+  return saltedHash(salt, identityKey);
+}
+function grantInstallHashOf(salt, identityKeyHash, cid) {
+  return saltedHash(salt, `grantInstall\0${identityKeyHash}\0${cid}`);
+}
+function parseState(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    throw gateRefusal("gate_unavailable", "The replica gate file is not valid JSON.");
+  }
+  if (typeof raw !== "object" || raw === null) throw gateRefusal("gate_unavailable", "The replica gate file is malformed.");
+  const record = raw;
+  if (record.v !== GATE_FILE_VERSION) throw gateRefusal("gate_unavailable", "The replica gate file has an unknown version.");
+  if (typeof record.incarnation !== "string" || record.incarnation.length === 0) {
+    throw gateRefusal("gate_unavailable", "The replica gate file has no incarnation.");
+  }
+  if (typeof record.salt !== "string" || Buffer.from(record.salt, "base64url").toString("base64url") !== record.salt || Buffer.from(record.salt, "base64url").length < 32) {
+    throw gateRefusal("gate_unavailable", "The replica gate file has an invalid salt.");
+  }
+  if (record.principalHash !== null && (typeof record.principalHash !== "string" || !/^[0-9a-f]{64}$/.test(record.principalHash))) {
+    throw gateRefusal("gate_unavailable", "The replica gate file has an invalid principal hash.");
+  }
+  if (typeof record.lifecycleEpoch !== "number" || !Number.isSafeInteger(record.lifecycleEpoch) || record.lifecycleEpoch < 0) {
+    throw gateRefusal("gate_unavailable", "The replica gate file has an invalid lifecycle epoch.");
+  }
+  if (record.deniedAt !== null && (typeof record.deniedAt !== "number" || !Number.isSafeInteger(record.deniedAt) || record.deniedAt < 0)) {
+    throw gateRefusal("gate_unavailable", "The replica gate file has an invalid deniedAt.");
+  }
+  if (!Array.isArray(record.intents)) throw gateRefusal("gate_unavailable", "The replica gate file has no intents list.");
+  for (const intent of record.intents) {
+    if (typeof intent !== "object" || intent === null || typeof intent.id !== "string" || !/^[0-9a-f]{64}$/.test(intent.principalHash) || !Number.isSafeInteger(intent.recordedAt) || intent.recordedAt < 0 || (intent.kind === "pending" ? !/^[0-9a-f]{64}$/.test(intent.identityKeyHash) || intent.id !== `pending:${intent.identityKeyHash}` : intent.kind !== "partition" || typeof intent.partitionId !== "string" || intent.partitionId.length === 0 || intent.id !== intent.partitionId)) {
+      throw gateRefusal("gate_unavailable", "The replica gate file has an invalid purge intent.");
+    }
+  }
+  const firstInstall = record.firstInstall;
+  if (typeof firstInstall !== "object" || firstInstall === null || Array.isArray(firstInstall)) {
+    throw gateRefusal("gate_unavailable", "The replica gate file has no valid firstInstall map.");
+  }
+  for (const [hash, value] of Object.entries(firstInstall)) {
+    if (!/^[0-9a-f]{64}$/.test(hash) || typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+      throw gateRefusal("gate_unavailable", "The replica gate file has an invalid firstInstall entry.");
+    }
+  }
+  const grantInstall = Object.prototype.hasOwnProperty.call(record, "grantInstall") ? record.grantInstall : {};
+  if (typeof grantInstall !== "object" || grantInstall === null || Array.isArray(grantInstall)) {
+    throw gateRefusal("gate_unavailable", "The replica gate has an invalid grantInstall map.");
+  }
+  for (const [hash, installedAt] of Object.entries(grantInstall)) {
+    if (!/^[0-9a-f]{64}$/.test(hash) || !Number.isSafeInteger(installedAt) || installedAt < 0) {
+      throw gateRefusal("gate_unavailable", "The replica gate has an invalid grant install time.");
+    }
+  }
+  const pendingGenerations = record.pendingGenerations;
+  if (typeof pendingGenerations !== "object" || pendingGenerations === null || Array.isArray(pendingGenerations)) {
+    throw gateRefusal("gate_unavailable", "The replica gate file has an invalid pending generation map.");
+  }
+  for (const [hash, generation] of Object.entries(pendingGenerations)) {
+    if (!/^[0-9a-f]{64}$/.test(hash) || typeof generation !== "number" || !Number.isSafeInteger(generation) || generation < 0) {
+      throw gateRefusal("gate_unavailable", "The replica gate file has an invalid pending generation.");
+    }
+  }
+  const eraseDeferred = Object.prototype.hasOwnProperty.call(record, "eraseDeferred") ? record.eraseDeferred : false;
+  const deferredPrincipalHash = Object.prototype.hasOwnProperty.call(record, "deferredPrincipalHash") ? record.deferredPrincipalHash : null;
+  if (typeof eraseDeferred !== "boolean" || deferredPrincipalHash !== null && (typeof deferredPrincipalHash !== "string" || !/^[0-9a-f]{64}$/.test(deferredPrincipalHash)) || eraseDeferred && (record.principalHash !== null || deferredPrincipalHash === null)) {
+    throw gateRefusal("gate_unavailable", "The replica gate has an invalid deferred erase state.");
+  }
+  return {
+    incarnation: record.incarnation,
+    salt: record.salt,
+    principalHash: record.principalHash,
+    lifecycleEpoch: record.lifecycleEpoch,
+    deniedAt: record.deniedAt,
+    intents: record.intents,
+    firstInstall,
+    grantInstall,
+    pendingGenerations,
+    eraseDeferred,
+    deferredPrincipalHash
+  };
+}
+function isNotFound(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+async function readStoredState(profileDir) {
+  let text;
+  try {
+    text = await (0, import_promises.readFile)((0, import_node_path.join)(profileDir, REPLICA_GATE_FILE), "utf8");
+  } catch (error) {
+    if (isNotFound(error)) return void 0;
+    throw gateRefusal("gate_unavailable", "The replica gate file cannot be read.");
+  }
+  return parseState(text);
+}
+async function readDenyFloor(profileDir) {
+  let record;
+  try {
+    record = JSON.parse(await (0, import_promises.readFile)((0, import_node_path.join)(profileDir, DENY_FLOOR_FILE), "utf8"));
+  } catch (error) {
+    if (isNotFound(error)) return void 0;
+    throw gateRefusal("gate_unavailable", "The replica deny floor cannot be read.");
+  }
+  if (typeof record !== "object" || record === null || Array.isArray(record) || Object.keys(record).length !== 2 || !("epoch" in record) || !("deniedAt" in record) || !Number.isSafeInteger(record.epoch) || record.epoch < 1 || !Number.isSafeInteger(record.deniedAt) || record.deniedAt < 0) {
+    throw gateRefusal("gate_unavailable", "The replica deny floor is malformed.");
+  }
+  return { epoch: record.epoch, deniedAt: record.deniedAt };
+}
+var LOST_GATE_RECOVERY = "Local replicas stay disabled for this profile; to start over, delete it (`tc profile delete <name>`; for the default profile, switch the default first with `tc profile switch <other>`) and sign in again.";
+var INTERRUPTED_SIGN_OUT = "A previous sign-out was interrupted; re-running `tc auth logout` completes it.";
+function behindFloor(state, floor) {
+  return state.lifecycleEpoch < floor.epoch || state.deniedAt === null || state.deniedAt < floor.deniedAt;
+}
+async function readState(profileDir) {
+  const state = await readStoredState(profileDir);
+  const floor = await readDenyFloor(profileDir);
+  if (floor === void 0) return state;
+  if (state === void 0) {
+    throw gateRefusal("gate_unavailable", `The replica gate is missing after a sign-out. ${LOST_GATE_RECOVERY}`);
+  }
+  if (behindFloor(state, floor)) {
+    throw gateRefusal("gate_unavailable", `The replica gate is behind its last sign-out. ${INTERRUPTED_SIGN_OUT}`);
+  }
+  return state;
+}
+function readGateSnapshot(profileDir) {
+  return readState(profileDir);
+}
+async function readLogoutGate(profileDir) {
+  const state = await readStoredState(profileDir);
+  const floor = await readDenyFloor(profileDir);
+  if (state === void 0) {
+    if (floor !== void 0) {
+      throw gateRefusal("gate_unavailable", `The replica gate is missing after a sign-out. ${LOST_GATE_RECOVERY}`);
+    }
+    return void 0;
+  }
+  return { state, floorLagging: floor !== void 0 && behindFloor(state, floor) };
+}
+async function advanceInactiveGate(profileDir) {
+  const state = await readStoredState(profileDir);
+  const floor = await readDenyFloor(profileDir);
+  if (state === void 0 || state.principalHash !== null || state.eraseDeferred) {
+    throw gateRefusal("stamp_stale", "Only an inactive replica gate can be advanced past its floor.");
+  }
+  const lifecycleEpoch = Math.max(state.lifecycleEpoch, floor?.epoch ?? 0) + 1;
+  const deniedAt = Math.max(Date.now(), (state.deniedAt ?? -1) + 1, (floor?.deniedAt ?? -1) + 1);
+  if (!Number.isSafeInteger(lifecycleEpoch) || !Number.isSafeInteger(deniedAt)) {
+    throw gateRefusal("gate_unavailable", "The replica deny floor cannot advance.");
+  }
+  const next = { ...state, lifecycleEpoch, deniedAt };
+  await writeAtomic(profileDir, DENY_FLOOR_FILE, JSON.stringify({ epoch: lifecycleEpoch, deniedAt }));
+  await writeState(profileDir, next);
+  return next;
+}
+async function assertGateAccess(profileDir, access, salt) {
+  if (access.stamp === void 0) {
+    throw gateRefusal("not_established", "The replica session has no stamp.");
+  }
+  const state = await readState(profileDir);
+  if (state === void 0 || state.salt !== salt) {
+    throw gateRefusal("gate_unavailable", "The replica gate is unavailable or was replaced.");
+  }
+  if (state.incarnation !== access.incarnation) {
+    throw gateRefusal("stamp_stale", "The replica gate was replaced.");
+  }
+  if (state.lifecycleEpoch !== access.stamp.lifecycleEpoch || state.incarnation !== access.stamp.incarnation) {
+    throw gateRefusal("stamp_stale", "The replica session stamp has changed.");
+  }
+  if (state.principalHash === null || state.principalHash !== access.principalHash) {
+    throw gateRefusal("principal_mismatch", "The replica belongs to a different account.");
+  }
+  if (state.intents.some(
+    (intent) => intent.kind === "partition" && intent.partitionId === access.partitionId || intent.kind === "pending" && intent.identityKeyHash === access.identityKeyHash
+  )) {
+    throw gateRefusal("purge_pending", "This replica has a pending erase.");
+  }
+  return state;
+}
+async function clearGateIntent(profileDir, id) {
+  const state = await readState(profileDir);
+  if (state === void 0 || !state.intents.some((intent) => intent.id === id)) return;
+  if (state.eraseDeferred) throw gateRefusal("purge_pending", "Deferred replica erase has not been resumed.");
+  await writeState(profileDir, { ...state, intents: state.intents.filter((intent) => intent.id !== id) });
+}
+async function writeAtomic(profileDir, name, body) {
+  await (0, import_promises.mkdir)(profileDir, { recursive: true });
+  const target = (0, import_node_path.join)(profileDir, name);
+  const temp = `${target}.${(0, import_node_crypto.randomUUID)()}.tmp`;
+  try {
+    const handle = await (0, import_promises.open)(temp, "w", 384);
+    try {
+      await handle.writeFile(body);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await (0, import_promises.rename)(temp, target);
+    const directory = await (0, import_promises.open)(profileDir, "r");
+    try {
+      await directory.sync();
+    } finally {
+      await directory.close();
+    }
+  } catch (error) {
+    await (0, import_promises.rm)(temp, { force: true });
+    throw error;
+  }
+}
+function writeState(profileDir, state) {
+  return writeAtomic(profileDir, REPLICA_GATE_FILE, JSON.stringify({ v: GATE_FILE_VERSION, ...state }));
+}
+function freshState() {
+  return {
+    incarnation: (0, import_node_crypto.randomUUID)(),
+    salt: (0, import_node_crypto.randomBytes)(32).toString("base64url"),
+    principalHash: null,
+    lifecycleEpoch: 0,
+    deniedAt: null,
+    intents: [],
+    firstInstall: {},
+    grantInstall: {},
+    pendingGenerations: {},
+    eraseDeferred: false,
+    deferredPrincipalHash: null
+  };
+}
+async function readGateState(profileDir) {
+  const existing = await readState(profileDir);
+  if (existing !== void 0) return existing;
+  const created = freshState();
+  await writeState(profileDir, created);
+  return created;
+}
+async function readFirstInstall(profileDir, identityKeyHash) {
+  const state = await readState(profileDir);
+  if (state?.eraseDeferred) throw gateRefusal("purge_pending", "Deferred replica erase has not been resumed.");
+  return state?.firstInstall[identityKeyHash];
+}
+async function recordFirstInstall(profileDir, identityKeyHash, atMs) {
+  if (!/^[0-9a-f]{64}$/.test(identityKeyHash) || !Number.isSafeInteger(atMs) || atMs < 0) {
+    throw gateRefusal("gate_unavailable", "A salted identity hash and finite first-install time are required.");
+  }
+  const state = await readGateState(profileDir);
+  if (state.eraseDeferred) throw gateRefusal("purge_pending", "Deferred replica erase has not been resumed.");
+  const existing = state.firstInstall[identityKeyHash];
+  if (existing !== void 0) return existing;
+  await writeState(profileDir, { ...state, firstInstall: { ...state.firstInstall, [identityKeyHash]: atMs } });
+  return atMs;
+}
+async function recordGrantInstall(profileDir, hash, atMs) {
+  if (!/^[0-9a-f]{64}$/.test(hash) || !Number.isSafeInteger(atMs) || atMs < 0) {
+    throw gateRefusal("gate_unavailable", "A salted grant hash and finite install time are required.");
+  }
+  const state = await readState(profileDir);
+  if (state === void 0 || state.principalHash === null) {
+    throw gateRefusal("gate_unavailable", "The replica account gate is not established.");
+  }
+  if (state.eraseDeferred || state.intents.length > 0) {
+    throw gateRefusal("purge_pending", "A purge is pending for this profile.");
+  }
+  const previous = state.grantInstall[hash];
+  if (previous !== void 0 && previous <= atMs) return previous;
+  await writeState(profileDir, { ...state, grantInstall: { ...state.grantInstall, [hash]: atMs } });
+  return atMs;
+}
+async function establishSessionStamp(profileDir, principal, o) {
+  if (!Number.isSafeInteger(o?.siweIssuedAt) || o.siweIssuedAt < 0) {
+    throw gateRefusal("not_established", "A finite signed SIWE issued-at time is required.");
+  }
+  const issuedAt = Math.min(o.siweIssuedAt, Date.now());
+  const state = await readGateState(profileDir);
+  if (state.eraseDeferred || state.intents.length > 0) throw gateRefusal("purge_pending", "A purge is pending for this profile.");
+  if (state.deniedAt !== null && issuedAt <= state.deniedAt) {
+    throw gateRefusal("stamp_stale", "The sign-in predates the last sign-out.");
+  }
+  const hash = await principalHashOf(state.salt, principal);
+  if (state.principalHash === null) {
+    await writeState(profileDir, { ...state, principalHash: hash, deferredPrincipalHash: null });
+  } else if (state.principalHash !== hash) {
+    throw gateRefusal("principal_mismatch", "The profile belongs to another account.");
+  }
+  return { incarnation: state.incarnation, lifecycleEpoch: state.lifecycleEpoch };
+}
+async function restoreSessionStamp(profileDir, principal, persisted) {
+  const state = await readState(profileDir);
+  if (state !== void 0 && (state.eraseDeferred || state.intents.length > 0)) {
+    throw gateRefusal("purge_pending", "A purge is pending for this profile.");
+  }
+  if (persisted === void 0) throw gateRefusal("not_established", "The session has no replica stamp.");
+  if (typeof persisted !== "object" || persisted === null || Array.isArray(persisted) || Object.keys(persisted).length !== 2 || !Object.prototype.hasOwnProperty.call(persisted, "incarnation") || !Object.prototype.hasOwnProperty.call(persisted, "lifecycleEpoch") || typeof persisted.incarnation !== "string" || persisted.incarnation.length === 0 || !Number.isSafeInteger(persisted.lifecycleEpoch) || persisted.lifecycleEpoch < 0) {
+    throw gateRefusal("stamp_stale", "The persisted replica stamp is malformed.");
+  }
+  if (state === void 0) throw gateRefusal("stamp_stale", "The replica gate no longer exists.");
+  if (persisted.incarnation !== state.incarnation || persisted.lifecycleEpoch !== state.lifecycleEpoch) {
+    throw gateRefusal("stamp_stale", "The session stamp is from an earlier sign-in.");
+  }
+  if (state.principalHash !== await principalHashOf(state.salt, principal)) {
+    throw gateRefusal("principal_mismatch", "The profile belongs to another account.");
+  }
+  return { incarnation: persisted.incarnation, lifecycleEpoch: persisted.lifecycleEpoch };
+}
+async function denyGate(profileDir, input, collectIntents, precomputed, options) {
+  if (input.reason === "account_switch" && input.next === void 0) {
+    throw new TypeError("An account switch needs the incoming principal.");
+  }
+  if (options?.deferErase === true && input.reason !== "sign_out") {
+    throw new TypeError("Deferred erase is only available for sign-out.");
+  }
+  try {
+    const state = await readStoredState(profileDir);
+    const floor = await readDenyFloor(profileDir);
+    if (state === void 0 && floor !== void 0) {
+      throw gateRefusal("gate_unavailable", `The replica gate is missing after a sign-out. ${LOST_GATE_RECOVERY}`);
+    }
+    if (state === void 0 || state.principalHash === null) return { status: "stale" };
+    if (precomputed !== void 0 && state.salt !== precomputed.salt) {
+      throw gateRefusal("gate_unavailable", "The replica gate salt changed before denial.");
+    }
+    if (state.principalHash !== (precomputed?.principalHash ?? await principalHashOf(state.salt, input.principal))) {
+      return { status: "stale" };
+    }
+    const intents = await collectIntents(state.principalHash);
+    const known = new Set(state.intents.map((intent) => intent.id));
+    const added = [];
+    for (const intent of intents) {
+      if (known.has(intent.id)) continue;
+      known.add(intent.id);
+      added.push(intent);
+    }
+    const pendingGenerations = { ...state.pendingGenerations };
+    for (const intent of added) {
+      if (intent.kind !== "pending") continue;
+      const hash = intent.identityKeyHash;
+      if (!/^[0-9a-f]{64}$/.test(hash) || intent.id !== `pending:${hash}` || !Number.isSafeInteger((pendingGenerations[hash] ?? 0) + 1)) {
+        throw gateRefusal("gate_unavailable", "A pending purge intent has an invalid identity generation.");
+      }
+      pendingGenerations[hash] = (pendingGenerations[hash] ?? 0) + 1;
+    }
+    const merged = [...state.intents, ...added];
+    const lifecycleEpoch = Math.max(state.lifecycleEpoch, floor?.epoch ?? 0) + 1;
+    const deniedAt = Math.max(Date.now(), (state.deniedAt ?? -1) + 1, (floor?.deniedAt ?? -1) + 1);
+    if (!Number.isSafeInteger(lifecycleEpoch) || !Number.isSafeInteger(deniedAt)) {
+      throw gateRefusal("gate_unavailable", "The replica deny floor cannot advance.");
+    }
+    const next = {
+      ...state,
+      principalHash: null,
+      lifecycleEpoch,
+      deniedAt,
+      intents: merged,
+      firstInstall: {},
+      grantInstall: {},
+      pendingGenerations,
+      eraseDeferred: options?.deferErase === true,
+      deferredPrincipalHash: options?.deferErase === true ? state.principalHash : null
+    };
+    await writeAtomic(profileDir, DENY_FLOOR_FILE, JSON.stringify({ epoch: lifecycleEpoch, deniedAt }));
+    await writeState(profileDir, next);
+    return { status: "denied", lifecycleEpoch: next.lifecycleEpoch, intents: merged.length };
+  } catch (error) {
+    const code = typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : "STORAGE_ERROR";
+    return { status: "unguarded", code };
+  }
+}
+async function deferredGateToken(profileDir) {
+  const state = await readState(profileDir);
+  return state?.eraseDeferred ? { deniedEpoch: state.lifecycleEpoch, principalHash: state.deferredPrincipalHash } : null;
+}
+async function resumeDeferredGate(profileDir, token) {
+  const state = await readState(profileDir);
+  if (state === void 0) throw gateRefusal("gate_unavailable", "The replica gate no longer exists.");
+  if (!Number.isSafeInteger(token?.deniedEpoch) || token.deniedEpoch < 0 || typeof token.principalHash !== "string" || !/^[0-9a-f]{64}$/.test(token.principalHash) || state.lifecycleEpoch !== token.deniedEpoch || state.deferredPrincipalHash !== token.principalHash || state.principalHash !== null) {
+    throw gateRefusal("stamp_stale", "The deferred erase token is stale or belongs to another account.");
+  }
+  if (!state.eraseDeferred) return false;
+  await writeState(profileDir, { ...state, eraseDeferred: false });
+  return true;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  REPLICA_DENY_FLOOR_FILE,
+  advanceInactiveGate,
+  assertGateAccess,
+  clearGateIntent,
+  deferredGateToken,
+  denyGate,
+  establishSessionStamp,
+  grantInstallHashOf,
+  identityHashOf,
+  principalHashOf,
+  readFirstInstall,
+  readGateSnapshot,
+  readLogoutGate,
+  recordFirstInstall,
+  recordGrantInstall,
+  restoreSessionStamp,
+  resumeDeferredGate
+});
+//# sourceMappingURL=profile-gate.cjs.map