@tinycloud/sdk-services 3.2.6-beta.2 → 3.2.6-beta.4

package/dist/kv/replication/contractConstants.cjs

@@ -0,0 +1,115 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/kv/replication/contractConstants.ts
+var contractConstants_exports = {};
+__export(contractConstants_exports, {
+  CONSENT_WINDOW_MS: () => CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS: () => DEFAULT_GRANT_TTL_MS,
+  DEFAULT_MIN_FREE_BYTES: () => DEFAULT_MIN_FREE_BYTES,
+  MAX_GRANT_TTL_MS: () => MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION: () => RENEW_BELOW_FRACTION,
+  REPLICA_DENY_TOMBSTONE: () => REPLICA_DENY_TOMBSTONE,
+  REPLICA_GATE_FILE: () => REPLICA_GATE_FILE,
+  REPLICA_KV_CHANNEL: () => REPLICA_KV_CHANNEL,
+  REPLICA_KV_DATABASE: () => REPLICA_KV_DATABASE,
+  REPLICA_KV_SCHEMA_VERSION: () => REPLICA_KV_SCHEMA_VERSION,
+  REPLICA_KV_STORES: () => REPLICA_KV_STORES,
+  REPLICA_LOGOUT_MARKER: () => REPLICA_LOGOUT_MARKER,
+  REPLICA_PENDING_LOCK_PREFIX: () => REPLICA_PENDING_LOCK_PREFIX,
+  ReplicaContractCode: () => ReplicaContractCode
+});
+module.exports = __toCommonJS(contractConstants_exports);
+
+// src/kv/replication/grantPolicyConstants.ts
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var DEFAULT_GRANT_TTL_MS = DAY_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var RENEW_BELOW_FRACTION = 0.25;
+
+// src/kv/replication/contractConstants.ts
+var ReplicaContractCode = {
+  /**
+   * The lifecycle gate refused the operation: the handle's session stamp or principal no longer
+   * matches the gate, a purge intent covers the partition, or the logout marker is set. The error
+   * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.
+   */
+  REPLICA_GATED: "REPLICA_GATED",
+  /**
+   * Reserved for handles whose partition was erased (purge or revocation) after they opened. The
+   * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.
+   */
+  RESET_REQUIRED: "RESET_REQUIRED",
+  /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */
+  STORAGE_BUDGET: "STORAGE_BUDGET",
+  /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */
+  STORAGE_FULL: "STORAGE_FULL",
+  /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */
+  CONSENT_EXPIRED: "CONSENT_EXPIRED",
+  /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */
+  GRANT_EXPIRED: "GRANT_EXPIRED"
+};
+var DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;
+var REPLICA_KV_DATABASE = "tinycloud-replica-kv";
+var REPLICA_KV_SCHEMA_VERSION = 2;
+var REPLICA_KV_STORES = {
+  /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */
+  meta: "meta",
+  /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */
+  entries: "entries",
+  /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */
+  blobs: "blobs",
+  /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */
+  pending: "pending",
+  /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */
+  device: "device",
+  /** Control: the account gate, singleton key `"account"`, value `ReplicaAccountGate`. */
+  gate: "gate",
+  /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */
+  partitions: "partitions",
+  /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */
+  purgeIntents: "purgeIntents",
+  /** Control: quota ledger, keys owned by the ledger (S5). */
+  quota: "quota"
+};
+var REPLICA_LOGOUT_MARKER = "tinycloud-replica:logout-pending";
+var REPLICA_DENY_TOMBSTONE = "tinycloud-replica:deny-tombstone";
+var REPLICA_KV_CHANNEL = "tinycloud-replica-kv";
+var REPLICA_PENDING_LOCK_PREFIX = "tinycloud-replica-kv:pending:";
+var REPLICA_GATE_FILE = "replica-gate.json";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS,
+  DEFAULT_MIN_FREE_BYTES,
+  MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION,
+  REPLICA_DENY_TOMBSTONE,
+  REPLICA_GATE_FILE,
+  REPLICA_KV_CHANNEL,
+  REPLICA_KV_DATABASE,
+  REPLICA_KV_SCHEMA_VERSION,
+  REPLICA_KV_STORES,
+  REPLICA_LOGOUT_MARKER,
+  REPLICA_PENDING_LOCK_PREFIX,
+  ReplicaContractCode
+});
+//# sourceMappingURL=contractConstants.cjs.map

package/dist/kv/replication/contractConstants.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/contractConstants.ts","../../../src/kv/replication/grantPolicyConstants.ts"],"sourcesContent":["/**\n * Frozen constants of the shared replica contract (TC-858 Phase 2, see CONTRACT.md).\n *\n * Exported via `@tinycloud/sdk-services/kv/replication/contractConstants`, never from the\n * package root. Runtime grant policy imports the numeric-only `grantPolicyConstants` subpath\n * instead, so the default web bundle does not carry browser storage identifiers.\n */\nexport {\n  DEFAULT_GRANT_TTL_MS,\n  MAX_GRANT_TTL_MS,\n  CONSENT_WINDOW_MS,\n  RENEW_BELOW_FRACTION,\n} from \"./grantPolicyConstants\";\n\n/** Error codes the contract adds or gives new meaning. Values equal keys. */\nexport const ReplicaContractCode = {\n  /**\n   * The lifecycle gate refused the operation: the handle's session stamp or principal no longer\n   * matches the gate, a purge intent covers the partition, or the logout marker is set. The error\n   * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.\n   */\n  REPLICA_GATED: \"REPLICA_GATED\",\n  /**\n   * Reserved for handles whose partition was erased (purge or revocation) after they opened. The\n   * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.\n   */\n  RESET_REQUIRED: \"RESET_REQUIRED\",\n  /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */\n  STORAGE_BUDGET: \"STORAGE_BUDGET\",\n  /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */\n  STORAGE_FULL: \"STORAGE_FULL\",\n  /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */\n  CONSENT_EXPIRED: \"CONSENT_EXPIRED\",\n  /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */\n  GRANT_EXPIRED: \"GRANT_EXPIRED\",\n} as const;\nexport type ReplicaContractCode = (typeof ReplicaContractCode)[keyof typeof ReplicaContractCode];\n\n/** Browser free-space floor in bytes (64 MiB, `navigator.storage.estimate()`); not applied on node/CLI. */\nexport const DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;\n\n/** The single per-origin IndexedDB database of the browser `KVReplicaStorage` adapter. */\nexport const REPLICA_KV_DATABASE = \"tinycloud-replica-kv\";\n/** Origin database schema: v2 destructively replaces v1 plaintext replica-owned stores. */\nexport const REPLICA_KV_SCHEMA_VERSION = 2;\n\n/**\n * Object-store names in {@link REPLICA_KV_DATABASE}. Every store uses out-of-line keys (no\n * `keyPath`, no autoIncrement) so the schema upgrade can create control stores without knowing\n * their record shapes. Data stores are owned by the adapter (S1); control stores by the lifecycle\n * gate (S3) and quota ledger (S5).\n */\nexport const REPLICA_KV_STORES = {\n  /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */\n  meta: \"meta\",\n  /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */\n  entries: \"entries\",\n  /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */\n  blobs: \"blobs\",\n  /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */\n  pending: \"pending\",\n  /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */\n  device: \"device\",\n  /** Control: the account gate, singleton key `\"account\"`, value `ReplicaAccountGate`. */\n  gate: \"gate\",\n  /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */\n  partitions: \"partitions\",\n  /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */\n  purgeIntents: \"purgeIntents\",\n  /** Control: quota ledger, keys owned by the ledger (S5). */\n  quota: \"quota\",\n} as const;\n\n/** Synchronous, cross-tab `localStorage` marker set when the deny transaction and fallback delete both failed. */\nexport const REPLICA_LOGOUT_MARKER = \"tinycloud-replica:logout-pending\";\n\n/** Origin-wide deny floor outside the deletable replica database; JSON `{ epoch, deniedAt }`. */\nexport const REPLICA_DENY_TOMBSTONE = \"tinycloud-replica:deny-tombstone\";\n\n/** BroadcastChannel name used for lifecycle nudges and peer-commit notifications. */\nexport const REPLICA_KV_CHANNEL = \"tinycloud-replica-kv\";\n\n/** Web Lock name prefix for pending-write read-modify-write; suffix is the private gate-HMAC identity id. */\nexport const REPLICA_PENDING_LOCK_PREFIX = \"tinycloud-replica-kv:pending:\";\n\n/** Node/CLI gate file name. CLI places it at `<profile>/replica-gate.json`. */\nexport const REPLICA_GATE_FILE = \"replica-gate.json\";\n","/** Grant lifetime constants without browser storage identifiers. */\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */\nexport const DEFAULT_GRANT_TTL_MS = DAY_MS;\n/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */\nexport const MAX_GRANT_TTL_MS = 7 * DAY_MS;\n/** Consent deadline = consent anchor + this window (7 d). */\nexport const CONSENT_WINDOW_MS = 7 * DAY_MS;\n/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */\nexport const RENEW_BELOW_FRACTION = 0.25;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACCA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAGb,IAAM,uBAAuB;AAE7B,IAAM,mBAAmB,IAAI;AAE7B,IAAM,oBAAoB,IAAI;AAE9B,IAAM,uBAAuB;;;ADI7B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjC,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA,EAKf,gBAAgB;AAAA;AAAA,EAEhB,gBAAgB;AAAA;AAAA,EAEhB,cAAc;AAAA;AAAA,EAEd,iBAAiB;AAAA;AAAA,EAEjB,eAAe;AACjB;AAIO,IAAM,yBAAyB,KAAK,OAAO;AAG3C,IAAM,sBAAsB;AAE5B,IAAM,4BAA4B;AAQlC,IAAM,oBAAoB;AAAA;AAAA,EAE/B,MAAM;AAAA;AAAA,EAEN,SAAS;AAAA;AAAA,EAET,OAAO;AAAA;AAAA,EAEP,SAAS;AAAA;AAAA,EAET,QAAQ;AAAA;AAAA,EAER,MAAM;AAAA;AAAA,EAEN,YAAY;AAAA;AAAA,EAEZ,cAAc;AAAA;AAAA,EAEd,OAAO;AACT;AAGO,IAAM,wBAAwB;AAG9B,IAAM,yBAAyB;AAG/B,IAAM,qBAAqB;AAG3B,IAAM,8BAA8B;AAGpC,IAAM,oBAAoB;","names":[]}

package/dist/kv/replication/contractConstants.d.cts

@@ -0,0 +1,77 @@
+export { CONSENT_WINDOW_MS, DEFAULT_GRANT_TTL_MS, MAX_GRANT_TTL_MS, RENEW_BELOW_FRACTION } from './grantPolicyConstants.cjs';
+
+/**
+ * Frozen constants of the shared replica contract (TC-858 Phase 2, see CONTRACT.md).
+ *
+ * Exported via `@tinycloud/sdk-services/kv/replication/contractConstants`, never from the
+ * package root. Runtime grant policy imports the numeric-only `grantPolicyConstants` subpath
+ * instead, so the default web bundle does not carry browser storage identifiers.
+ */
+
+/** Error codes the contract adds or gives new meaning. Values equal keys. */
+declare const ReplicaContractCode: {
+    /**
+     * The lifecycle gate refused the operation: the handle's session stamp or principal no longer
+     * matches the gate, a purge intent covers the partition, or the logout marker is set. The error
+     * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.
+     */
+    readonly REPLICA_GATED: "REPLICA_GATED";
+    /**
+     * Reserved for handles whose partition was erased (purge or revocation) after they opened. The
+     * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.
+     */
+    readonly RESET_REQUIRED: "RESET_REQUIRED";
+    /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */
+    readonly STORAGE_BUDGET: "STORAGE_BUDGET";
+    /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */
+    readonly STORAGE_FULL: "STORAGE_FULL";
+    /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */
+    readonly CONSENT_EXPIRED: "CONSENT_EXPIRED";
+    /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */
+    readonly GRANT_EXPIRED: "GRANT_EXPIRED";
+};
+type ReplicaContractCode = (typeof ReplicaContractCode)[keyof typeof ReplicaContractCode];
+/** Browser free-space floor in bytes (64 MiB, `navigator.storage.estimate()`); not applied on node/CLI. */
+declare const DEFAULT_MIN_FREE_BYTES: number;
+/** The single per-origin IndexedDB database of the browser `KVReplicaStorage` adapter. */
+declare const REPLICA_KV_DATABASE = "tinycloud-replica-kv";
+/** Origin database schema: v2 destructively replaces v1 plaintext replica-owned stores. */
+declare const REPLICA_KV_SCHEMA_VERSION = 2;
+/**
+ * Object-store names in {@link REPLICA_KV_DATABASE}. Every store uses out-of-line keys (no
+ * `keyPath`, no autoIncrement) so the schema upgrade can create control stores without knowing
+ * their record shapes. Data stores are owned by the adapter (S1); control stores by the lifecycle
+ * gate (S3) and quota ledger (S5).
+ */
+declare const REPLICA_KV_STORES: {
+    /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */
+    readonly meta: "meta";
+    /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */
+    readonly entries: "entries";
+    /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */
+    readonly blobs: "blobs";
+    /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */
+    readonly pending: "pending";
+    /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */
+    readonly device: "device";
+    /** Control: the account gate, singleton key `"account"`, value `ReplicaAccountGate`. */
+    readonly gate: "gate";
+    /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */
+    readonly partitions: "partitions";
+    /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */
+    readonly purgeIntents: "purgeIntents";
+    /** Control: quota ledger, keys owned by the ledger (S5). */
+    readonly quota: "quota";
+};
+/** Synchronous, cross-tab `localStorage` marker set when the deny transaction and fallback delete both failed. */
+declare const REPLICA_LOGOUT_MARKER = "tinycloud-replica:logout-pending";
+/** Origin-wide deny floor outside the deletable replica database; JSON `{ epoch, deniedAt }`. */
+declare const REPLICA_DENY_TOMBSTONE = "tinycloud-replica:deny-tombstone";
+/** BroadcastChannel name used for lifecycle nudges and peer-commit notifications. */
+declare const REPLICA_KV_CHANNEL = "tinycloud-replica-kv";
+/** Web Lock name prefix for pending-write read-modify-write; suffix is the private gate-HMAC identity id. */
+declare const REPLICA_PENDING_LOCK_PREFIX = "tinycloud-replica-kv:pending:";
+/** Node/CLI gate file name. CLI places it at `<profile>/replica-gate.json`. */
+declare const REPLICA_GATE_FILE = "replica-gate.json";
+
+export { DEFAULT_MIN_FREE_BYTES, REPLICA_DENY_TOMBSTONE, REPLICA_GATE_FILE, REPLICA_KV_CHANNEL, REPLICA_KV_DATABASE, REPLICA_KV_SCHEMA_VERSION, REPLICA_KV_STORES, REPLICA_LOGOUT_MARKER, REPLICA_PENDING_LOCK_PREFIX, ReplicaContractCode };

package/dist/kv/replication/contractConstants.d.ts

@@ -0,0 +1,77 @@
+export { CONSENT_WINDOW_MS, DEFAULT_GRANT_TTL_MS, MAX_GRANT_TTL_MS, RENEW_BELOW_FRACTION } from './grantPolicyConstants.js';
+
+/**
+ * Frozen constants of the shared replica contract (TC-858 Phase 2, see CONTRACT.md).
+ *
+ * Exported via `@tinycloud/sdk-services/kv/replication/contractConstants`, never from the
+ * package root. Runtime grant policy imports the numeric-only `grantPolicyConstants` subpath
+ * instead, so the default web bundle does not carry browser storage identifiers.
+ */
+
+/** Error codes the contract adds or gives new meaning. Values equal keys. */
+declare const ReplicaContractCode: {
+    /**
+     * The lifecycle gate refused the operation: the handle's session stamp or principal no longer
+     * matches the gate, a purge intent covers the partition, or the logout marker is set. The error
+     * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.
+     */
+    readonly REPLICA_GATED: "REPLICA_GATED";
+    /**
+     * Reserved for handles whose partition was erased (purge or revocation) after they opened. The
+     * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.
+     */
+    readonly RESET_REQUIRED: "RESET_REQUIRED";
+    /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */
+    readonly STORAGE_BUDGET: "STORAGE_BUDGET";
+    /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */
+    readonly STORAGE_FULL: "STORAGE_FULL";
+    /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */
+    readonly CONSENT_EXPIRED: "CONSENT_EXPIRED";
+    /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */
+    readonly GRANT_EXPIRED: "GRANT_EXPIRED";
+};
+type ReplicaContractCode = (typeof ReplicaContractCode)[keyof typeof ReplicaContractCode];
+/** Browser free-space floor in bytes (64 MiB, `navigator.storage.estimate()`); not applied on node/CLI. */
+declare const DEFAULT_MIN_FREE_BYTES: number;
+/** The single per-origin IndexedDB database of the browser `KVReplicaStorage` adapter. */
+declare const REPLICA_KV_DATABASE = "tinycloud-replica-kv";
+/** Origin database schema: v2 destructively replaces v1 plaintext replica-owned stores. */
+declare const REPLICA_KV_SCHEMA_VERSION = 2;
+/**
+ * Object-store names in {@link REPLICA_KV_DATABASE}. Every store uses out-of-line keys (no
+ * `keyPath`, no autoIncrement) so the schema upgrade can create control stores without knowing
+ * their record shapes. Data stores are owned by the adapter (S1); control stores by the lifecycle
+ * gate (S3) and quota ledger (S5).
+ */
+declare const REPLICA_KV_STORES: {
+    /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */
+    readonly meta: "meta";
+    /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */
+    readonly entries: "entries";
+    /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */
+    readonly blobs: "blobs";
+    /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */
+    readonly pending: "pending";
+    /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */
+    readonly device: "device";
+    /** Control: the account gate, singleton key `"account"`, value `ReplicaAccountGate`. */
+    readonly gate: "gate";
+    /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */
+    readonly partitions: "partitions";
+    /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */
+    readonly purgeIntents: "purgeIntents";
+    /** Control: quota ledger, keys owned by the ledger (S5). */
+    readonly quota: "quota";
+};
+/** Synchronous, cross-tab `localStorage` marker set when the deny transaction and fallback delete both failed. */
+declare const REPLICA_LOGOUT_MARKER = "tinycloud-replica:logout-pending";
+/** Origin-wide deny floor outside the deletable replica database; JSON `{ epoch, deniedAt }`. */
+declare const REPLICA_DENY_TOMBSTONE = "tinycloud-replica:deny-tombstone";
+/** BroadcastChannel name used for lifecycle nudges and peer-commit notifications. */
+declare const REPLICA_KV_CHANNEL = "tinycloud-replica-kv";
+/** Web Lock name prefix for pending-write read-modify-write; suffix is the private gate-HMAC identity id. */
+declare const REPLICA_PENDING_LOCK_PREFIX = "tinycloud-replica-kv:pending:";
+/** Node/CLI gate file name. CLI places it at `<profile>/replica-gate.json`. */
+declare const REPLICA_GATE_FILE = "replica-gate.json";
+
+export { DEFAULT_MIN_FREE_BYTES, REPLICA_DENY_TOMBSTONE, REPLICA_GATE_FILE, REPLICA_KV_CHANNEL, REPLICA_KV_DATABASE, REPLICA_KV_SCHEMA_VERSION, REPLICA_KV_STORES, REPLICA_LOGOUT_MARKER, REPLICA_PENDING_LOCK_PREFIX, ReplicaContractCode };

package/dist/kv/replication/contractConstants.js

@@ -0,0 +1,75 @@
+// src/kv/replication/grantPolicyConstants.ts
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var DEFAULT_GRANT_TTL_MS = DAY_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var RENEW_BELOW_FRACTION = 0.25;
+
+// src/kv/replication/contractConstants.ts
+var ReplicaContractCode = {
+  /**
+   * The lifecycle gate refused the operation: the handle's session stamp or principal no longer
+   * matches the gate, a purge intent covers the partition, or the logout marker is set. The error
+   * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.
+   */
+  REPLICA_GATED: "REPLICA_GATED",
+  /**
+   * Reserved for handles whose partition was erased (purge or revocation) after they opened. The
+   * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.
+   */
+  RESET_REQUIRED: "RESET_REQUIRED",
+  /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */
+  STORAGE_BUDGET: "STORAGE_BUDGET",
+  /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */
+  STORAGE_FULL: "STORAGE_FULL",
+  /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */
+  CONSENT_EXPIRED: "CONSENT_EXPIRED",
+  /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */
+  GRANT_EXPIRED: "GRANT_EXPIRED"
+};
+var DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;
+var REPLICA_KV_DATABASE = "tinycloud-replica-kv";
+var REPLICA_KV_SCHEMA_VERSION = 2;
+var REPLICA_KV_STORES = {
+  /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */
+  meta: "meta",
+  /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */
+  entries: "entries",
+  /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */
+  blobs: "blobs",
+  /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */
+  pending: "pending",
+  /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */
+  device: "device",
+  /** Control: the account gate, singleton key `"account"`, value `ReplicaAccountGate`. */
+  gate: "gate",
+  /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */
+  partitions: "partitions",
+  /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */
+  purgeIntents: "purgeIntents",
+  /** Control: quota ledger, keys owned by the ledger (S5). */
+  quota: "quota"
+};
+var REPLICA_LOGOUT_MARKER = "tinycloud-replica:logout-pending";
+var REPLICA_DENY_TOMBSTONE = "tinycloud-replica:deny-tombstone";
+var REPLICA_KV_CHANNEL = "tinycloud-replica-kv";
+var REPLICA_PENDING_LOCK_PREFIX = "tinycloud-replica-kv:pending:";
+var REPLICA_GATE_FILE = "replica-gate.json";
+export {
+  CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS,
+  DEFAULT_MIN_FREE_BYTES,
+  MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION,
+  REPLICA_DENY_TOMBSTONE,
+  REPLICA_GATE_FILE,
+  REPLICA_KV_CHANNEL,
+  REPLICA_KV_DATABASE,
+  REPLICA_KV_SCHEMA_VERSION,
+  REPLICA_KV_STORES,
+  REPLICA_LOGOUT_MARKER,
+  REPLICA_PENDING_LOCK_PREFIX,
+  ReplicaContractCode
+};
+//# sourceMappingURL=contractConstants.js.map

package/dist/kv/replication/contractConstants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/grantPolicyConstants.ts","../../../src/kv/replication/contractConstants.ts"],"sourcesContent":["/** Grant lifetime constants without browser storage identifiers. */\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */\nexport const DEFAULT_GRANT_TTL_MS = DAY_MS;\n/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */\nexport const MAX_GRANT_TTL_MS = 7 * DAY_MS;\n/** Consent deadline = consent anchor + this window (7 d). */\nexport const CONSENT_WINDOW_MS = 7 * DAY_MS;\n/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */\nexport const RENEW_BELOW_FRACTION = 0.25;\n","/**\n * Frozen constants of the shared replica contract (TC-858 Phase 2, see CONTRACT.md).\n *\n * Exported via `@tinycloud/sdk-services/kv/replication/contractConstants`, never from the\n * package root. Runtime grant policy imports the numeric-only `grantPolicyConstants` subpath\n * instead, so the default web bundle does not carry browser storage identifiers.\n */\nexport {\n  DEFAULT_GRANT_TTL_MS,\n  MAX_GRANT_TTL_MS,\n  CONSENT_WINDOW_MS,\n  RENEW_BELOW_FRACTION,\n} from \"./grantPolicyConstants\";\n\n/** Error codes the contract adds or gives new meaning. Values equal keys. */\nexport const ReplicaContractCode = {\n  /**\n   * The lifecycle gate refused the operation: the handle's session stamp or principal no longer\n   * matches the gate, a purge intent covers the partition, or the logout marker is set. The error\n   * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.\n   */\n  REPLICA_GATED: \"REPLICA_GATED\",\n  /**\n   * Reserved for handles whose partition was erased (purge or revocation) after they opened. The\n   * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.\n   */\n  RESET_REQUIRED: \"RESET_REQUIRED\",\n  /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */\n  STORAGE_BUDGET: \"STORAGE_BUDGET\",\n  /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */\n  STORAGE_FULL: \"STORAGE_FULL\",\n  /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */\n  CONSENT_EXPIRED: \"CONSENT_EXPIRED\",\n  /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */\n  GRANT_EXPIRED: \"GRANT_EXPIRED\",\n} as const;\nexport type ReplicaContractCode = (typeof ReplicaContractCode)[keyof typeof ReplicaContractCode];\n\n/** Browser free-space floor in bytes (64 MiB, `navigator.storage.estimate()`); not applied on node/CLI. */\nexport const DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;\n\n/** The single per-origin IndexedDB database of the browser `KVReplicaStorage` adapter. */\nexport const REPLICA_KV_DATABASE = \"tinycloud-replica-kv\";\n/** Origin database schema: v2 destructively replaces v1 plaintext replica-owned stores. */\nexport const REPLICA_KV_SCHEMA_VERSION = 2;\n\n/**\n * Object-store names in {@link REPLICA_KV_DATABASE}. Every store uses out-of-line keys (no\n * `keyPath`, no autoIncrement) so the schema upgrade can create control stores without knowing\n * their record shapes. Data stores are owned by the adapter (S1); control stores by the lifecycle\n * gate (S3) and quota ledger (S5).\n */\nexport const REPLICA_KV_STORES = {\n  /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */\n  meta: \"meta\",\n  /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */\n  entries: \"entries\",\n  /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */\n  blobs: \"blobs\",\n  /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */\n  pending: \"pending\",\n  /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */\n  device: \"device\",\n  /** Control: the account gate, singleton key `\"account\"`, value `ReplicaAccountGate`. */\n  gate: \"gate\",\n  /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */\n  partitions: \"partitions\",\n  /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */\n  purgeIntents: \"purgeIntents\",\n  /** Control: quota ledger, keys owned by the ledger (S5). */\n  quota: \"quota\",\n} as const;\n\n/** Synchronous, cross-tab `localStorage` marker set when the deny transaction and fallback delete both failed. */\nexport const REPLICA_LOGOUT_MARKER = \"tinycloud-replica:logout-pending\";\n\n/** Origin-wide deny floor outside the deletable replica database; JSON `{ epoch, deniedAt }`. */\nexport const REPLICA_DENY_TOMBSTONE = \"tinycloud-replica:deny-tombstone\";\n\n/** BroadcastChannel name used for lifecycle nudges and peer-commit notifications. */\nexport const REPLICA_KV_CHANNEL = \"tinycloud-replica-kv\";\n\n/** Web Lock name prefix for pending-write read-modify-write; suffix is the private gate-HMAC identity id. */\nexport const REPLICA_PENDING_LOCK_PREFIX = \"tinycloud-replica-kv:pending:\";\n\n/** Node/CLI gate file name. CLI places it at `<profile>/replica-gate.json`. */\nexport const REPLICA_GATE_FILE = \"replica-gate.json\";\n"],"mappings":";AACA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAGb,IAAM,uBAAuB;AAE7B,IAAM,mBAAmB,IAAI;AAE7B,IAAM,oBAAoB,IAAI;AAE9B,IAAM,uBAAuB;;;ACI7B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjC,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA,EAKf,gBAAgB;AAAA;AAAA,EAEhB,gBAAgB;AAAA;AAAA,EAEhB,cAAc;AAAA;AAAA,EAEd,iBAAiB;AAAA;AAAA,EAEjB,eAAe;AACjB;AAIO,IAAM,yBAAyB,KAAK,OAAO;AAG3C,IAAM,sBAAsB;AAE5B,IAAM,4BAA4B;AAQlC,IAAM,oBAAoB;AAAA;AAAA,EAE/B,MAAM;AAAA;AAAA,EAEN,SAAS;AAAA;AAAA,EAET,OAAO;AAAA;AAAA,EAEP,SAAS;AAAA;AAAA,EAET,QAAQ;AAAA;AAAA,EAER,MAAM;AAAA;AAAA,EAEN,YAAY;AAAA;AAAA,EAEZ,cAAc;AAAA;AAAA,EAEd,OAAO;AACT;AAGO,IAAM,wBAAwB;AAG9B,IAAM,yBAAyB;AAG/B,IAAM,qBAAqB;AAG3B,IAAM,8BAA8B;AAGpC,IAAM,oBAAoB;","names":[]}

package/dist/kv/replication/grantPolicyConstants.cjs

@@ -0,0 +1,42 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/kv/replication/grantPolicyConstants.ts
+var grantPolicyConstants_exports = {};
+__export(grantPolicyConstants_exports, {
+  CONSENT_WINDOW_MS: () => CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS: () => DEFAULT_GRANT_TTL_MS,
+  MAX_GRANT_TTL_MS: () => MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION: () => RENEW_BELOW_FRACTION
+});
+module.exports = __toCommonJS(grantPolicyConstants_exports);
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var DEFAULT_GRANT_TTL_MS = DAY_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var RENEW_BELOW_FRACTION = 0.25;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS,
+  MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION
+});
+//# sourceMappingURL=grantPolicyConstants.cjs.map

package/dist/kv/replication/grantPolicyConstants.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/grantPolicyConstants.ts"],"sourcesContent":["/** Grant lifetime constants without browser storage identifiers. */\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */\nexport const DEFAULT_GRANT_TTL_MS = DAY_MS;\n/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */\nexport const MAX_GRANT_TTL_MS = 7 * DAY_MS;\n/** Consent deadline = consent anchor + this window (7 d). */\nexport const CONSENT_WINDOW_MS = 7 * DAY_MS;\n/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */\nexport const RENEW_BELOW_FRACTION = 0.25;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAGb,IAAM,uBAAuB;AAE7B,IAAM,mBAAmB,IAAI;AAE7B,IAAM,oBAAoB,IAAI;AAE9B,IAAM,uBAAuB;","names":[]}

package/dist/kv/replication/grantPolicyConstants.d.cts

@@ -0,0 +1,10 @@
+/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */
+declare const DEFAULT_GRANT_TTL_MS: number;
+/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */
+declare const MAX_GRANT_TTL_MS: number;
+/** Consent deadline = consent anchor + this window (7 d). */
+declare const CONSENT_WINDOW_MS: number;
+/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */
+declare const RENEW_BELOW_FRACTION = 0.25;
+
+export { CONSENT_WINDOW_MS, DEFAULT_GRANT_TTL_MS, MAX_GRANT_TTL_MS, RENEW_BELOW_FRACTION };

package/dist/kv/replication/grantPolicyConstants.d.ts

@@ -0,0 +1,10 @@
+/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */
+declare const DEFAULT_GRANT_TTL_MS: number;
+/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */
+declare const MAX_GRANT_TTL_MS: number;
+/** Consent deadline = consent anchor + this window (7 d). */
+declare const CONSENT_WINDOW_MS: number;
+/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */
+declare const RENEW_BELOW_FRACTION = 0.25;
+
+export { CONSENT_WINDOW_MS, DEFAULT_GRANT_TTL_MS, MAX_GRANT_TTL_MS, RENEW_BELOW_FRACTION };

package/dist/kv/replication/grantPolicyConstants.js

@@ -0,0 +1,14 @@
+// src/kv/replication/grantPolicyConstants.ts
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var DEFAULT_GRANT_TTL_MS = DAY_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var RENEW_BELOW_FRACTION = 0.25;
+export {
+  CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS,
+  MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION
+};
+//# sourceMappingURL=grantPolicyConstants.js.map

package/dist/kv/replication/grantPolicyConstants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/grantPolicyConstants.ts"],"sourcesContent":["/** Grant lifetime constants without browser storage identifiers. */\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */\nexport const DEFAULT_GRANT_TTL_MS = DAY_MS;\n/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */\nexport const MAX_GRANT_TTL_MS = 7 * DAY_MS;\n/** Consent deadline = consent anchor + this window (7 d). */\nexport const CONSENT_WINDOW_MS = 7 * DAY_MS;\n/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */\nexport const RENEW_BELOW_FRACTION = 0.25;\n"],"mappings":";AACA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAGb,IAAM,uBAAuB;AAE7B,IAAM,mBAAmB,IAAI;AAE7B,IAAM,oBAAoB,IAAI;AAE9B,IAAM,uBAAuB;","names":[]}

package/dist/kv/replication/grantPolicyTypes.cjs

@@ -0,0 +1,19 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/kv/replication/grantPolicyTypes.ts
+var grantPolicyTypes_exports = {};
+module.exports = __toCommonJS(grantPolicyTypes_exports);
+//# sourceMappingURL=grantPolicyTypes.cjs.map

package/dist/kv/replication/grantPolicyTypes.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/grantPolicyTypes.ts"],"sourcesContent":["/**\n * Grant lifetime and renewal contract (TC-858 Phase 2, CONTRACT.md §3). Types only; S4 implements\n * these signatures in `grantPolicy.ts` using the constants in `contractConstants.ts`.\n * All instants are milliseconds since epoch; all durations are milliseconds.\n */\n\n/** Verified source selected by session form; `first_install` is expiry-only. */\nexport type ReplicaConsentSource =\n  /** Verified owner SIWE `issuedAt` with finite signed expiration and exact-space KV witness. */\n  | \"siwe\"\n  /** `iat` of the oldest independently verified owner-authorizing proof, never a child leaf. */\n  | \"delegation_iat\"\n  /** `nbf` of that same oldest owner proof; a leaf signature alone is insufficient. */\n  | \"delegation_nbf\"\n  /** Neither: persisted first grant install time, for expiry only; never session establishment. */\n  | \"first_install\";\n\n/**\n * Invariants: `at` is finite milliseconds and clamped to ≤ now by `clampConsentAnchor`. Second-based\n * sources (UCAN `iat`/`nbf`) are converted ×1000 exactly once, at the authority; SIWE `issuedAt`\n * is parsed as an ISO date. Renewals never re-anchor: only a fresh sign-in yields a new anchor.\n */\nexport interface ReplicaConsentAnchor {\n  at: number;\n  source: ReplicaConsentSource;\n}\n\n/**\n * Returns the eligible anchor with `at` clamped to ≤ now, or null when it is not finite.\n * A full SIWE session with missing/invalid signed expiration or issuedAt remains unanchored;\n * never fall through to a compact leaf or first-install timestamp. Compact-only sessions\n * may try the same independently verified oldest owner proof's `nbf` after invalid `iat`.\n * S4 implements this as `clampConsentAnchor` in `grantPolicy.ts`.\n */\nexport type ClampConsentAnchor = (anchor: ReplicaConsentAnchor, now: number) => ReplicaConsentAnchor | null;\n\n/**\n * Policy the controller passes to storage in `KVReplicaSpec.grantPolicy`. Storage stores the\n * resulting effective expiry with the installed grant and recomputes it at open.\n */\nexport interface ReplicaGrantPolicy {\n  /** Validated: 0 < grantTtlMs ≤ MAX_GRANT_TTL_MS. */\n  grantTtlMs: number;\n  /**\n   * From `ReplicationAuthority.consentAnchor()`: a full SIWE session requires an\n   * independently verified signed owner `issuedAt`, finite signed expiration and\n   * exact-space KV get+sync witness. A compact-only session instead needs the oldest\n   * independently verified owner-authorizing proof's `iat`, then its `nbf` (never a\n   * fresh child leaf minted under an old owner grant). Invalid SIWE does not fall\n   * through to compact/first-install sources.\n   * Null means no verified source; storage uses its persisted first-install time only\n   * to bound grant expiry, never as freshness proof for a session stamp. That anchor\n   * survives partition reset, purge and reinstall, and is cleared only by `deny`.\n   */\n  consentAnchor: ReplicaConsentAnchor | null;\n}\n\nexport interface EffectiveGrantExpiryInput {\n  /** The grant's signed `exp` in ms; null when it has none. */\n  signedExpiresAt: number | null;\n  installedAt: number;\n  grantTtlMs: number;\n  /** `min(consentDeadlineMs(policyAnchor), durableGateDeadline)` when browser gate is active. */\n  consentDeadline: number;\n}\n\n/** effective expiry = min(signed exp, installedAt + grantTtlMs, consentDeadline). */\nexport type EffectiveGrantExpiry = (input: EffectiveGrantExpiryInput) => number;\n\n/** anchor.at + CONSENT_WINDOW_MS. */\nexport type ConsentDeadlineMs = (anchor: ReplicaConsentAnchor) => number;\n\n/**\n * Duration passed to `ReplicationAuthority.mint` as `expiryMs`:\n * min(grantTtlMs, consentDeadline − now). The caller MUST NOT mint when the result is ≤ 0.\n */\nexport type MintRemainingMs = (input: { now: number; grantTtlMs: number; consentDeadline: number }) => number;\n\n/**\n * True when online-renewal should run: remaining = effectiveExpiresAt − now is STRICTLY below\n * RENEW_BELOW_FRACTION × (effectiveExpiresAt − installedAt) (exactly 25% remaining does not\n * renew), and now < consentDeadline. All inputs finite; otherwise false.\n * Checked on a timer, before each sync, and at open.\n */\nexport type NeedsSilentRenewal = (input: {\n  now: number;\n  installedAt: number;\n  effectiveExpiresAt: number;\n  consentDeadline: number;\n}) => boolean;\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/kv/replication/grantPolicyTypes.d.cts

@@ -0,0 +1,87 @@
+/**
+ * Grant lifetime and renewal contract (TC-858 Phase 2, CONTRACT.md §3). Types only; S4 implements
+ * these signatures in `grantPolicy.ts` using the constants in `contractConstants.ts`.
+ * All instants are milliseconds since epoch; all durations are milliseconds.
+ */
+/** Verified source selected by session form; `first_install` is expiry-only. */
+type ReplicaConsentSource = 
+/** Verified owner SIWE `issuedAt` with finite signed expiration and exact-space KV witness. */
+"siwe"
+/** `iat` of the oldest independently verified owner-authorizing proof, never a child leaf. */
+ | "delegation_iat"
+/** `nbf` of that same oldest owner proof; a leaf signature alone is insufficient. */
+ | "delegation_nbf"
+/** Neither: persisted first grant install time, for expiry only; never session establishment. */
+ | "first_install";
+/**
+ * Invariants: `at` is finite milliseconds and clamped to ≤ now by `clampConsentAnchor`. Second-based
+ * sources (UCAN `iat`/`nbf`) are converted ×1000 exactly once, at the authority; SIWE `issuedAt`
+ * is parsed as an ISO date. Renewals never re-anchor: only a fresh sign-in yields a new anchor.
+ */
+interface ReplicaConsentAnchor {
+    at: number;
+    source: ReplicaConsentSource;
+}
+/**
+ * Returns the eligible anchor with `at` clamped to ≤ now, or null when it is not finite.
+ * A full SIWE session with missing/invalid signed expiration or issuedAt remains unanchored;
+ * never fall through to a compact leaf or first-install timestamp. Compact-only sessions
+ * may try the same independently verified oldest owner proof's `nbf` after invalid `iat`.
+ * S4 implements this as `clampConsentAnchor` in `grantPolicy.ts`.
+ */
+type ClampConsentAnchor = (anchor: ReplicaConsentAnchor, now: number) => ReplicaConsentAnchor | null;
+/**
+ * Policy the controller passes to storage in `KVReplicaSpec.grantPolicy`. Storage stores the
+ * resulting effective expiry with the installed grant and recomputes it at open.
+ */
+interface ReplicaGrantPolicy {
+    /** Validated: 0 < grantTtlMs ≤ MAX_GRANT_TTL_MS. */
+    grantTtlMs: number;
+    /**
+     * From `ReplicationAuthority.consentAnchor()`: a full SIWE session requires an
+     * independently verified signed owner `issuedAt`, finite signed expiration and
+     * exact-space KV get+sync witness. A compact-only session instead needs the oldest
+     * independently verified owner-authorizing proof's `iat`, then its `nbf` (never a
+     * fresh child leaf minted under an old owner grant). Invalid SIWE does not fall
+     * through to compact/first-install sources.
+     * Null means no verified source; storage uses its persisted first-install time only
+     * to bound grant expiry, never as freshness proof for a session stamp. That anchor
+     * survives partition reset, purge and reinstall, and is cleared only by `deny`.
+     */
+    consentAnchor: ReplicaConsentAnchor | null;
+}
+interface EffectiveGrantExpiryInput {
+    /** The grant's signed `exp` in ms; null when it has none. */
+    signedExpiresAt: number | null;
+    installedAt: number;
+    grantTtlMs: number;
+    /** `min(consentDeadlineMs(policyAnchor), durableGateDeadline)` when browser gate is active. */
+    consentDeadline: number;
+}
+/** effective expiry = min(signed exp, installedAt + grantTtlMs, consentDeadline). */
+type EffectiveGrantExpiry = (input: EffectiveGrantExpiryInput) => number;
+/** anchor.at + CONSENT_WINDOW_MS. */
+type ConsentDeadlineMs = (anchor: ReplicaConsentAnchor) => number;
+/**
+ * Duration passed to `ReplicationAuthority.mint` as `expiryMs`:
+ * min(grantTtlMs, consentDeadline − now). The caller MUST NOT mint when the result is ≤ 0.
+ */
+type MintRemainingMs = (input: {
+    now: number;
+    grantTtlMs: number;
+    consentDeadline: number;
+}) => number;
+/**
+ * True when online-renewal should run: remaining = effectiveExpiresAt − now is STRICTLY below
+ * RENEW_BELOW_FRACTION × (effectiveExpiresAt − installedAt) (exactly 25% remaining does not
+ * renew), and now < consentDeadline. All inputs finite; otherwise false.
+ * Checked on a timer, before each sync, and at open.
+ */
+type NeedsSilentRenewal = (input: {
+    now: number;
+    installedAt: number;
+    effectiveExpiresAt: number;
+    consentDeadline: number;
+}) => boolean;
+
+export type { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy };