@tinycloud/sdk-services 3.2.6-beta.2 → 3.3.0-beta.11

package/dist/kv/replication/grantPolicyConstants.d.ts

@@ -0,0 +1,10 @@
+/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */
+declare const DEFAULT_GRANT_TTL_MS: number;
+/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */
+declare const MAX_GRANT_TTL_MS: number;
+/** Consent deadline = consent anchor + this window (7 d). */
+declare const CONSENT_WINDOW_MS: number;
+/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */
+declare const RENEW_BELOW_FRACTION = 0.25;
+
+export { CONSENT_WINDOW_MS, DEFAULT_GRANT_TTL_MS, MAX_GRANT_TTL_MS, RENEW_BELOW_FRACTION };

package/dist/kv/replication/grantPolicyConstants.js

@@ -0,0 +1,14 @@
+// src/kv/replication/grantPolicyConstants.ts
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var DEFAULT_GRANT_TTL_MS = DAY_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var RENEW_BELOW_FRACTION = 0.25;
+export {
+  CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS,
+  MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION
+};
+//# sourceMappingURL=grantPolicyConstants.js.map

package/dist/kv/replication/grantPolicyConstants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/grantPolicyConstants.ts"],"sourcesContent":["/** Grant lifetime constants without browser storage identifiers. */\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */\nexport const DEFAULT_GRANT_TTL_MS = DAY_MS;\n/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */\nexport const MAX_GRANT_TTL_MS = 7 * DAY_MS;\n/** Consent deadline = consent anchor + this window (7 d). */\nexport const CONSENT_WINDOW_MS = 7 * DAY_MS;\n/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */\nexport const RENEW_BELOW_FRACTION = 0.25;\n"],"mappings":";AACA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAGb,IAAM,uBAAuB;AAE7B,IAAM,mBAAmB,IAAI;AAE7B,IAAM,oBAAoB,IAAI;AAE9B,IAAM,uBAAuB;","names":[]}

package/dist/kv/replication/grantPolicyTypes.cjs

@@ -0,0 +1,19 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/kv/replication/grantPolicyTypes.ts
+var grantPolicyTypes_exports = {};
+module.exports = __toCommonJS(grantPolicyTypes_exports);
+//# sourceMappingURL=grantPolicyTypes.cjs.map

package/dist/kv/replication/grantPolicyTypes.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/grantPolicyTypes.ts"],"sourcesContent":["/**\n * Grant lifetime and renewal contract (TC-858 Phase 2, CONTRACT.md §3). Types only; S4 implements\n * these signatures in `grantPolicy.ts` using the constants in `contractConstants.ts`.\n * All instants are milliseconds since epoch; all durations are milliseconds.\n */\n\n/** Verified source selected by session form; `first_install` is expiry-only. */\nexport type ReplicaConsentSource =\n  /** Verified owner SIWE `issuedAt` with finite signed expiration and exact-space KV witness. */\n  | \"siwe\"\n  /** `iat` of the oldest independently verified owner-authorizing proof, never a child leaf. */\n  | \"delegation_iat\"\n  /** `nbf` of that same oldest owner proof; a leaf signature alone is insufficient. */\n  | \"delegation_nbf\"\n  /** Neither: persisted first grant install time, for expiry only; never session establishment. */\n  | \"first_install\";\n\n/**\n * Invariants: `at` is finite milliseconds and clamped to ≤ now by `clampConsentAnchor`. Second-based\n * sources (UCAN `iat`/`nbf`) are converted ×1000 exactly once, at the authority; SIWE `issuedAt`\n * is parsed as an ISO date. Renewals never re-anchor: only a fresh sign-in yields a new anchor.\n */\nexport interface ReplicaConsentAnchor {\n  at: number;\n  source: ReplicaConsentSource;\n}\n\n/**\n * Returns the eligible anchor with `at` clamped to ≤ now, or null when it is not finite.\n * A full SIWE session with missing/invalid signed expiration or issuedAt remains unanchored;\n * never fall through to a compact leaf or first-install timestamp. Compact-only sessions\n * may try the same independently verified oldest owner proof's `nbf` after invalid `iat`.\n * S4 implements this as `clampConsentAnchor` in `grantPolicy.ts`.\n */\nexport type ClampConsentAnchor = (anchor: ReplicaConsentAnchor, now: number) => ReplicaConsentAnchor | null;\n\n/**\n * Policy the controller passes to storage in `KVReplicaSpec.grantPolicy`. Storage stores the\n * resulting effective expiry with the installed grant and recomputes it at open.\n */\nexport interface ReplicaGrantPolicy {\n  /** Validated: 0 < grantTtlMs ≤ MAX_GRANT_TTL_MS. */\n  grantTtlMs: number;\n  /**\n   * From `ReplicationAuthority.consentAnchor()`: a full SIWE session requires an\n   * independently verified signed owner `issuedAt`, finite signed expiration and\n   * exact-space KV get+sync witness. A compact-only session instead needs the oldest\n   * independently verified owner-authorizing proof's `iat`, then its `nbf` (never a\n   * fresh child leaf minted under an old owner grant). Invalid SIWE does not fall\n   * through to compact/first-install sources.\n   * Null means no verified source; storage uses its persisted first-install time only\n   * to bound grant expiry, never as freshness proof for a session stamp. That anchor\n   * survives partition reset, purge and reinstall, and is cleared only by `deny`.\n   */\n  consentAnchor: ReplicaConsentAnchor | null;\n}\n\nexport interface EffectiveGrantExpiryInput {\n  /** The grant's signed `exp` in ms; null when it has none. */\n  signedExpiresAt: number | null;\n  installedAt: number;\n  grantTtlMs: number;\n  /** `min(consentDeadlineMs(policyAnchor), durableGateDeadline)` when browser gate is active. */\n  consentDeadline: number;\n}\n\n/** effective expiry = min(signed exp, installedAt + grantTtlMs, consentDeadline). */\nexport type EffectiveGrantExpiry = (input: EffectiveGrantExpiryInput) => number;\n\n/** anchor.at + CONSENT_WINDOW_MS. */\nexport type ConsentDeadlineMs = (anchor: ReplicaConsentAnchor) => number;\n\n/**\n * Duration passed to `ReplicationAuthority.mint` as `expiryMs`:\n * min(grantTtlMs, consentDeadline − now). The caller MUST NOT mint when the result is ≤ 0.\n */\nexport type MintRemainingMs = (input: { now: number; grantTtlMs: number; consentDeadline: number }) => number;\n\n/**\n * True when online-renewal should run: remaining = effectiveExpiresAt − now is STRICTLY below\n * RENEW_BELOW_FRACTION × (effectiveExpiresAt − installedAt) (exactly 25% remaining does not\n * renew), and now < consentDeadline. All inputs finite; otherwise false.\n * Checked on a timer, before each sync, and at open.\n */\nexport type NeedsSilentRenewal = (input: {\n  now: number;\n  installedAt: number;\n  effectiveExpiresAt: number;\n  consentDeadline: number;\n}) => boolean;\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/kv/replication/grantPolicyTypes.d.cts

@@ -0,0 +1,87 @@
+/**
+ * Grant lifetime and renewal contract (TC-858 Phase 2, CONTRACT.md §3). Types only; S4 implements
+ * these signatures in `grantPolicy.ts` using the constants in `contractConstants.ts`.
+ * All instants are milliseconds since epoch; all durations are milliseconds.
+ */
+/** Verified source selected by session form; `first_install` is expiry-only. */
+type ReplicaConsentSource = 
+/** Verified owner SIWE `issuedAt` with finite signed expiration and exact-space KV witness. */
+"siwe"
+/** `iat` of the oldest independently verified owner-authorizing proof, never a child leaf. */
+ | "delegation_iat"
+/** `nbf` of that same oldest owner proof; a leaf signature alone is insufficient. */
+ | "delegation_nbf"
+/** Neither: persisted first grant install time, for expiry only; never session establishment. */
+ | "first_install";
+/**
+ * Invariants: `at` is finite milliseconds and clamped to ≤ now by `clampConsentAnchor`. Second-based
+ * sources (UCAN `iat`/`nbf`) are converted ×1000 exactly once, at the authority; SIWE `issuedAt`
+ * is parsed as an ISO date. Renewals never re-anchor: only a fresh sign-in yields a new anchor.
+ */
+interface ReplicaConsentAnchor {
+    at: number;
+    source: ReplicaConsentSource;
+}
+/**
+ * Returns the eligible anchor with `at` clamped to ≤ now, or null when it is not finite.
+ * A full SIWE session with missing/invalid signed expiration or issuedAt remains unanchored;
+ * never fall through to a compact leaf or first-install timestamp. Compact-only sessions
+ * may try the same independently verified oldest owner proof's `nbf` after invalid `iat`.
+ * S4 implements this as `clampConsentAnchor` in `grantPolicy.ts`.
+ */
+type ClampConsentAnchor = (anchor: ReplicaConsentAnchor, now: number) => ReplicaConsentAnchor | null;
+/**
+ * Policy the controller passes to storage in `KVReplicaSpec.grantPolicy`. Storage stores the
+ * resulting effective expiry with the installed grant and recomputes it at open.
+ */
+interface ReplicaGrantPolicy {
+    /** Validated: 0 < grantTtlMs ≤ MAX_GRANT_TTL_MS. */
+    grantTtlMs: number;
+    /**
+     * From `ReplicationAuthority.consentAnchor()`: a full SIWE session requires an
+     * independently verified signed owner `issuedAt`, finite signed expiration and
+     * exact-space KV get+sync witness. A compact-only session instead needs the oldest
+     * independently verified owner-authorizing proof's `iat`, then its `nbf` (never a
+     * fresh child leaf minted under an old owner grant). Invalid SIWE does not fall
+     * through to compact/first-install sources.
+     * Null means no verified source; storage uses its persisted first-install time only
+     * to bound grant expiry, never as freshness proof for a session stamp. That anchor
+     * survives partition reset, purge and reinstall, and is cleared only by `deny`.
+     */
+    consentAnchor: ReplicaConsentAnchor | null;
+}
+interface EffectiveGrantExpiryInput {
+    /** The grant's signed `exp` in ms; null when it has none. */
+    signedExpiresAt: number | null;
+    installedAt: number;
+    grantTtlMs: number;
+    /** `min(consentDeadlineMs(policyAnchor), durableGateDeadline)` when browser gate is active. */
+    consentDeadline: number;
+}
+/** effective expiry = min(signed exp, installedAt + grantTtlMs, consentDeadline). */
+type EffectiveGrantExpiry = (input: EffectiveGrantExpiryInput) => number;
+/** anchor.at + CONSENT_WINDOW_MS. */
+type ConsentDeadlineMs = (anchor: ReplicaConsentAnchor) => number;
+/**
+ * Duration passed to `ReplicationAuthority.mint` as `expiryMs`:
+ * min(grantTtlMs, consentDeadline − now). The caller MUST NOT mint when the result is ≤ 0.
+ */
+type MintRemainingMs = (input: {
+    now: number;
+    grantTtlMs: number;
+    consentDeadline: number;
+}) => number;
+/**
+ * True when online-renewal should run: remaining = effectiveExpiresAt − now is STRICTLY below
+ * RENEW_BELOW_FRACTION × (effectiveExpiresAt − installedAt) (exactly 25% remaining does not
+ * renew), and now < consentDeadline. All inputs finite; otherwise false.
+ * Checked on a timer, before each sync, and at open.
+ */
+type NeedsSilentRenewal = (input: {
+    now: number;
+    installedAt: number;
+    effectiveExpiresAt: number;
+    consentDeadline: number;
+}) => boolean;
+
+export type { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy };

package/dist/kv/replication/grantPolicyTypes.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Grant lifetime and renewal contract (TC-858 Phase 2, CONTRACT.md §3). Types only; S4 implements
+ * these signatures in `grantPolicy.ts` using the constants in `contractConstants.ts`.
+ * All instants are milliseconds since epoch; all durations are milliseconds.
+ */
+/** Verified source selected by session form; `first_install` is expiry-only. */
+type ReplicaConsentSource = 
+/** Verified owner SIWE `issuedAt` with finite signed expiration and exact-space KV witness. */
+"siwe"
+/** `iat` of the oldest independently verified owner-authorizing proof, never a child leaf. */
+ | "delegation_iat"
+/** `nbf` of that same oldest owner proof; a leaf signature alone is insufficient. */
+ | "delegation_nbf"
+/** Neither: persisted first grant install time, for expiry only; never session establishment. */
+ | "first_install";
+/**
+ * Invariants: `at` is finite milliseconds and clamped to ≤ now by `clampConsentAnchor`. Second-based
+ * sources (UCAN `iat`/`nbf`) are converted ×1000 exactly once, at the authority; SIWE `issuedAt`
+ * is parsed as an ISO date. Renewals never re-anchor: only a fresh sign-in yields a new anchor.
+ */
+interface ReplicaConsentAnchor {
+    at: number;
+    source: ReplicaConsentSource;
+}
+/**
+ * Returns the eligible anchor with `at` clamped to ≤ now, or null when it is not finite.
+ * A full SIWE session with missing/invalid signed expiration or issuedAt remains unanchored;
+ * never fall through to a compact leaf or first-install timestamp. Compact-only sessions
+ * may try the same independently verified oldest owner proof's `nbf` after invalid `iat`.
+ * S4 implements this as `clampConsentAnchor` in `grantPolicy.ts`.
+ */
+type ClampConsentAnchor = (anchor: ReplicaConsentAnchor, now: number) => ReplicaConsentAnchor | null;
+/**
+ * Policy the controller passes to storage in `KVReplicaSpec.grantPolicy`. Storage stores the
+ * resulting effective expiry with the installed grant and recomputes it at open.
+ */
+interface ReplicaGrantPolicy {
+    /** Validated: 0 < grantTtlMs ≤ MAX_GRANT_TTL_MS. */
+    grantTtlMs: number;
+    /**
+     * From `ReplicationAuthority.consentAnchor()`: a full SIWE session requires an
+     * independently verified signed owner `issuedAt`, finite signed expiration and
+     * exact-space KV get+sync witness. A compact-only session instead needs the oldest
+     * independently verified owner-authorizing proof's `iat`, then its `nbf` (never a
+     * fresh child leaf minted under an old owner grant). Invalid SIWE does not fall
+     * through to compact/first-install sources.
+     * Null means no verified source; storage uses its persisted first-install time only
+     * to bound grant expiry, never as freshness proof for a session stamp. That anchor
+     * survives partition reset, purge and reinstall, and is cleared only by `deny`.
+     */
+    consentAnchor: ReplicaConsentAnchor | null;
+}
+interface EffectiveGrantExpiryInput {
+    /** The grant's signed `exp` in ms; null when it has none. */
+    signedExpiresAt: number | null;
+    installedAt: number;
+    grantTtlMs: number;
+    /** `min(consentDeadlineMs(policyAnchor), durableGateDeadline)` when browser gate is active. */
+    consentDeadline: number;
+}
+/** effective expiry = min(signed exp, installedAt + grantTtlMs, consentDeadline). */
+type EffectiveGrantExpiry = (input: EffectiveGrantExpiryInput) => number;
+/** anchor.at + CONSENT_WINDOW_MS. */
+type ConsentDeadlineMs = (anchor: ReplicaConsentAnchor) => number;
+/**
+ * Duration passed to `ReplicationAuthority.mint` as `expiryMs`:
+ * min(grantTtlMs, consentDeadline − now). The caller MUST NOT mint when the result is ≤ 0.
+ */
+type MintRemainingMs = (input: {
+    now: number;
+    grantTtlMs: number;
+    consentDeadline: number;
+}) => number;
+/**
+ * True when online-renewal should run: remaining = effectiveExpiresAt − now is STRICTLY below
+ * RENEW_BELOW_FRACTION × (effectiveExpiresAt − installedAt) (exactly 25% remaining does not
+ * renew), and now < consentDeadline. All inputs finite; otherwise false.
+ * Checked on a timer, before each sync, and at open.
+ */
+type NeedsSilentRenewal = (input: {
+    now: number;
+    installedAt: number;
+    effectiveExpiresAt: number;
+    consentDeadline: number;
+}) => boolean;
+
+export type { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy };

package/dist/kv/replication/grantPolicyTypes.js

@@ -0,0 +1 @@
+//# sourceMappingURL=grantPolicyTypes.js.map

package/dist/kv/replication/grantPolicyTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}