@tinycloud/sdk-services 3.2.6-beta.2 → 3.3.0-beta.7

package/dist/kv/replication/contractConstants.cjs

@@ -0,0 +1,115 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/kv/replication/contractConstants.ts
+var contractConstants_exports = {};
+__export(contractConstants_exports, {
+  CONSENT_WINDOW_MS: () => CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS: () => DEFAULT_GRANT_TTL_MS,
+  DEFAULT_MIN_FREE_BYTES: () => DEFAULT_MIN_FREE_BYTES,
+  MAX_GRANT_TTL_MS: () => MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION: () => RENEW_BELOW_FRACTION,
+  REPLICA_DENY_TOMBSTONE: () => REPLICA_DENY_TOMBSTONE,
+  REPLICA_GATE_FILE: () => REPLICA_GATE_FILE,
+  REPLICA_KV_CHANNEL: () => REPLICA_KV_CHANNEL,
+  REPLICA_KV_DATABASE: () => REPLICA_KV_DATABASE,
+  REPLICA_KV_SCHEMA_VERSION: () => REPLICA_KV_SCHEMA_VERSION,
+  REPLICA_KV_STORES: () => REPLICA_KV_STORES,
+  REPLICA_LOGOUT_MARKER: () => REPLICA_LOGOUT_MARKER,
+  REPLICA_PENDING_LOCK_PREFIX: () => REPLICA_PENDING_LOCK_PREFIX,
+  ReplicaContractCode: () => ReplicaContractCode
+});
+module.exports = __toCommonJS(contractConstants_exports);
+
+// src/kv/replication/grantPolicyConstants.ts
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var DEFAULT_GRANT_TTL_MS = DAY_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var RENEW_BELOW_FRACTION = 0.25;
+
+// src/kv/replication/contractConstants.ts
+var ReplicaContractCode = {
+  /**
+   * The lifecycle gate refused the operation: the handle's session stamp or principal no longer
+   * matches the gate, a purge intent covers the partition, or the logout marker is set. The error
+   * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.
+   */
+  REPLICA_GATED: "REPLICA_GATED",
+  /**
+   * Reserved for handles whose partition was erased (purge or revocation) after they opened. The
+   * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.
+   */
+  RESET_REQUIRED: "RESET_REQUIRED",
+  /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */
+  STORAGE_BUDGET: "STORAGE_BUDGET",
+  /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */
+  STORAGE_FULL: "STORAGE_FULL",
+  /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */
+  CONSENT_EXPIRED: "CONSENT_EXPIRED",
+  /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */
+  GRANT_EXPIRED: "GRANT_EXPIRED"
+};
+var DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;
+var REPLICA_KV_DATABASE = "tinycloud-replica-kv";
+var REPLICA_KV_SCHEMA_VERSION = 2;
+var REPLICA_KV_STORES = {
+  /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */
+  meta: "meta",
+  /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */
+  entries: "entries",
+  /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */
+  blobs: "blobs",
+  /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */
+  pending: "pending",
+  /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */
+  device: "device",
+  /** Control: the account gate, singleton key `"account"`, value `ReplicaAccountGate`. */
+  gate: "gate",
+  /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */
+  partitions: "partitions",
+  /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */
+  purgeIntents: "purgeIntents",
+  /** Control: quota ledger, keys owned by the ledger (S5). */
+  quota: "quota"
+};
+var REPLICA_LOGOUT_MARKER = "tinycloud-replica:logout-pending";
+var REPLICA_DENY_TOMBSTONE = "tinycloud-replica:deny-tombstone";
+var REPLICA_KV_CHANNEL = "tinycloud-replica-kv";
+var REPLICA_PENDING_LOCK_PREFIX = "tinycloud-replica-kv:pending:";
+var REPLICA_GATE_FILE = "replica-gate.json";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS,
+  DEFAULT_MIN_FREE_BYTES,
+  MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION,
+  REPLICA_DENY_TOMBSTONE,
+  REPLICA_GATE_FILE,
+  REPLICA_KV_CHANNEL,
+  REPLICA_KV_DATABASE,
+  REPLICA_KV_SCHEMA_VERSION,
+  REPLICA_KV_STORES,
+  REPLICA_LOGOUT_MARKER,
+  REPLICA_PENDING_LOCK_PREFIX,
+  ReplicaContractCode
+});
+//# sourceMappingURL=contractConstants.cjs.map

package/dist/kv/replication/contractConstants.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/contractConstants.ts","../../../src/kv/replication/grantPolicyConstants.ts"],"sourcesContent":["/**\n * Frozen constants of the shared replica contract (TC-858 Phase 2, see CONTRACT.md).\n *\n * Exported via `@tinycloud/sdk-services/kv/replication/contractConstants`, never from the\n * package root. Runtime grant policy imports the numeric-only `grantPolicyConstants` subpath\n * instead, so the default web bundle does not carry browser storage identifiers.\n */\nexport {\n  DEFAULT_GRANT_TTL_MS,\n  MAX_GRANT_TTL_MS,\n  CONSENT_WINDOW_MS,\n  RENEW_BELOW_FRACTION,\n} from \"./grantPolicyConstants\";\n\n/** Error codes the contract adds or gives new meaning. Values equal keys. */\nexport const ReplicaContractCode = {\n  /**\n   * The lifecycle gate refused the operation: the handle's session stamp or principal no longer\n   * matches the gate, a purge intent covers the partition, or the logout marker is set. The error\n   * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.\n   */\n  REPLICA_GATED: \"REPLICA_GATED\",\n  /**\n   * Reserved for handles whose partition was erased (purge or revocation) after they opened. The\n   * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.\n   */\n  RESET_REQUIRED: \"RESET_REQUIRED\",\n  /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */\n  STORAGE_BUDGET: \"STORAGE_BUDGET\",\n  /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */\n  STORAGE_FULL: \"STORAGE_FULL\",\n  /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */\n  CONSENT_EXPIRED: \"CONSENT_EXPIRED\",\n  /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */\n  GRANT_EXPIRED: \"GRANT_EXPIRED\",\n} as const;\nexport type ReplicaContractCode = (typeof ReplicaContractCode)[keyof typeof ReplicaContractCode];\n\n/** Browser free-space floor in bytes (64 MiB, `navigator.storage.estimate()`); not applied on node/CLI. */\nexport const DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;\n\n/** The single per-origin IndexedDB database of the browser `KVReplicaStorage` adapter. */\nexport const REPLICA_KV_DATABASE = \"tinycloud-replica-kv\";\n/** Origin database schema: v2 destructively replaces v1 plaintext replica-owned stores. */\nexport const REPLICA_KV_SCHEMA_VERSION = 2;\n\n/**\n * Object-store names in {@link REPLICA_KV_DATABASE}. Every store uses out-of-line keys (no\n * `keyPath`, no autoIncrement) so the schema upgrade can create control stores without knowing\n * their record shapes. Data stores are owned by the adapter (S1); control stores by the lifecycle\n * gate (S3) and quota ledger (S5).\n */\nexport const REPLICA_KV_STORES = {\n  /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */\n  meta: \"meta\",\n  /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */\n  entries: \"entries\",\n  /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */\n  blobs: \"blobs\",\n  /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */\n  pending: \"pending\",\n  /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */\n  device: \"device\",\n  /** Control: the account gate, singleton key `\"account\"`, value `ReplicaAccountGate`. */\n  gate: \"gate\",\n  /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */\n  partitions: \"partitions\",\n  /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */\n  purgeIntents: \"purgeIntents\",\n  /** Control: quota ledger, keys owned by the ledger (S5). */\n  quota: \"quota\",\n} as const;\n\n/** Synchronous, cross-tab `localStorage` marker set when the deny transaction and fallback delete both failed. */\nexport const REPLICA_LOGOUT_MARKER = \"tinycloud-replica:logout-pending\";\n\n/** Origin-wide deny floor outside the deletable replica database; JSON `{ epoch, deniedAt }`. */\nexport const REPLICA_DENY_TOMBSTONE = \"tinycloud-replica:deny-tombstone\";\n\n/** BroadcastChannel name used for lifecycle nudges and peer-commit notifications. */\nexport const REPLICA_KV_CHANNEL = \"tinycloud-replica-kv\";\n\n/** Web Lock name prefix for pending-write read-modify-write; suffix is the private gate-HMAC identity id. */\nexport const REPLICA_PENDING_LOCK_PREFIX = \"tinycloud-replica-kv:pending:\";\n\n/** Node/CLI gate file name. CLI places it at `<profile>/replica-gate.json`. */\nexport const REPLICA_GATE_FILE = \"replica-gate.json\";\n","/** Grant lifetime constants without browser storage identifiers. */\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */\nexport const DEFAULT_GRANT_TTL_MS = DAY_MS;\n/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */\nexport const MAX_GRANT_TTL_MS = 7 * DAY_MS;\n/** Consent deadline = consent anchor + this window (7 d). */\nexport const CONSENT_WINDOW_MS = 7 * DAY_MS;\n/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */\nexport const RENEW_BELOW_FRACTION = 0.25;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACCA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAGb,IAAM,uBAAuB;AAE7B,IAAM,mBAAmB,IAAI;AAE7B,IAAM,oBAAoB,IAAI;AAE9B,IAAM,uBAAuB;;;ADI7B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjC,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA,EAKf,gBAAgB;AAAA;AAAA,EAEhB,gBAAgB;AAAA;AAAA,EAEhB,cAAc;AAAA;AAAA,EAEd,iBAAiB;AAAA;AAAA,EAEjB,eAAe;AACjB;AAIO,IAAM,yBAAyB,KAAK,OAAO;AAG3C,IAAM,sBAAsB;AAE5B,IAAM,4BAA4B;AAQlC,IAAM,oBAAoB;AAAA;AAAA,EAE/B,MAAM;AAAA;AAAA,EAEN,SAAS;AAAA;AAAA,EAET,OAAO;AAAA;AAAA,EAEP,SAAS;AAAA;AAAA,EAET,QAAQ;AAAA;AAAA,EAER,MAAM;AAAA;AAAA,EAEN,YAAY;AAAA;AAAA,EAEZ,cAAc;AAAA;AAAA,EAEd,OAAO;AACT;AAGO,IAAM,wBAAwB;AAG9B,IAAM,yBAAyB;AAG/B,IAAM,qBAAqB;AAG3B,IAAM,8BAA8B;AAGpC,IAAM,oBAAoB;","names":[]}

package/dist/kv/replication/contractConstants.d.cts

@@ -0,0 +1,77 @@
+export { CONSENT_WINDOW_MS, DEFAULT_GRANT_TTL_MS, MAX_GRANT_TTL_MS, RENEW_BELOW_FRACTION } from './grantPolicyConstants.cjs';
+
+/**
+ * Frozen constants of the shared replica contract (TC-858 Phase 2, see CONTRACT.md).
+ *
+ * Exported via `@tinycloud/sdk-services/kv/replication/contractConstants`, never from the
+ * package root. Runtime grant policy imports the numeric-only `grantPolicyConstants` subpath
+ * instead, so the default web bundle does not carry browser storage identifiers.
+ */
+
+/** Error codes the contract adds or gives new meaning. Values equal keys. */
+declare const ReplicaContractCode: {
+    /**
+     * The lifecycle gate refused the operation: the handle's session stamp or principal no longer
+     * matches the gate, a purge intent covers the partition, or the logout marker is set. The error
+     * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.
+     */
+    readonly REPLICA_GATED: "REPLICA_GATED";
+    /**
+     * Reserved for handles whose partition was erased (purge or revocation) after they opened. The
+     * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.
+     */
+    readonly RESET_REQUIRED: "RESET_REQUIRED";
+    /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */
+    readonly STORAGE_BUDGET: "STORAGE_BUDGET";
+    /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */
+    readonly STORAGE_FULL: "STORAGE_FULL";
+    /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */
+    readonly CONSENT_EXPIRED: "CONSENT_EXPIRED";
+    /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */
+    readonly GRANT_EXPIRED: "GRANT_EXPIRED";
+};
+type ReplicaContractCode = (typeof ReplicaContractCode)[keyof typeof ReplicaContractCode];
+/** Browser free-space floor in bytes (64 MiB, `navigator.storage.estimate()`); not applied on node/CLI. */
+declare const DEFAULT_MIN_FREE_BYTES: number;
+/** The single per-origin IndexedDB database of the browser `KVReplicaStorage` adapter. */
+declare const REPLICA_KV_DATABASE = "tinycloud-replica-kv";
+/** Origin database schema: v2 destructively replaces v1 plaintext replica-owned stores. */
+declare const REPLICA_KV_SCHEMA_VERSION = 2;
+/**
+ * Object-store names in {@link REPLICA_KV_DATABASE}. Every store uses out-of-line keys (no
+ * `keyPath`, no autoIncrement) so the schema upgrade can create control stores without knowing
+ * their record shapes. Data stores are owned by the adapter (S1); control stores by the lifecycle
+ * gate (S3) and quota ledger (S5).
+ */
+declare const REPLICA_KV_STORES: {
+    /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */
+    readonly meta: "meta";
+    /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */
+    readonly entries: "entries";
+    /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */
+    readonly blobs: "blobs";
+    /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */
+    readonly pending: "pending";
+    /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */
+    readonly device: "device";
+    /** Control: the account gate, singleton key `"account"`, value `ReplicaAccountGate`. */
+    readonly gate: "gate";
+    /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */
+    readonly partitions: "partitions";
+    /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */
+    readonly purgeIntents: "purgeIntents";
+    /** Control: quota ledger, keys owned by the ledger (S5). */
+    readonly quota: "quota";
+};
+/** Synchronous, cross-tab `localStorage` marker set when the deny transaction and fallback delete both failed. */
+declare const REPLICA_LOGOUT_MARKER = "tinycloud-replica:logout-pending";
+/** Origin-wide deny floor outside the deletable replica database; JSON `{ epoch, deniedAt }`. */
+declare const REPLICA_DENY_TOMBSTONE = "tinycloud-replica:deny-tombstone";
+/** BroadcastChannel name used for lifecycle nudges and peer-commit notifications. */
+declare const REPLICA_KV_CHANNEL = "tinycloud-replica-kv";
+/** Web Lock name prefix for pending-write read-modify-write; suffix is the private gate-HMAC identity id. */
+declare const REPLICA_PENDING_LOCK_PREFIX = "tinycloud-replica-kv:pending:";
+/** Node/CLI gate file name. CLI places it at `<profile>/replica-gate.json`. */
+declare const REPLICA_GATE_FILE = "replica-gate.json";
+
+export { DEFAULT_MIN_FREE_BYTES, REPLICA_DENY_TOMBSTONE, REPLICA_GATE_FILE, REPLICA_KV_CHANNEL, REPLICA_KV_DATABASE, REPLICA_KV_SCHEMA_VERSION, REPLICA_KV_STORES, REPLICA_LOGOUT_MARKER, REPLICA_PENDING_LOCK_PREFIX, ReplicaContractCode };

package/dist/kv/replication/contractConstants.d.ts

@@ -0,0 +1,77 @@
+export { CONSENT_WINDOW_MS, DEFAULT_GRANT_TTL_MS, MAX_GRANT_TTL_MS, RENEW_BELOW_FRACTION } from './grantPolicyConstants.js';
+
+/**
+ * Frozen constants of the shared replica contract (TC-858 Phase 2, see CONTRACT.md).
+ *
+ * Exported via `@tinycloud/sdk-services/kv/replication/contractConstants`, never from the
+ * package root. Runtime grant policy imports the numeric-only `grantPolicyConstants` subpath
+ * instead, so the default web bundle does not carry browser storage identifiers.
+ */
+
+/** Error codes the contract adds or gives new meaning. Values equal keys. */
+declare const ReplicaContractCode: {
+    /**
+     * The lifecycle gate refused the operation: the handle's session stamp or principal no longer
+     * matches the gate, a purge intent covers the partition, or the logout marker is set. The error
+     * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.
+     */
+    readonly REPLICA_GATED: "REPLICA_GATED";
+    /**
+     * Reserved for handles whose partition was erased (purge or revocation) after they opened. The
+     * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.
+     */
+    readonly RESET_REQUIRED: "RESET_REQUIRED";
+    /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */
+    readonly STORAGE_BUDGET: "STORAGE_BUDGET";
+    /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */
+    readonly STORAGE_FULL: "STORAGE_FULL";
+    /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */
+    readonly CONSENT_EXPIRED: "CONSENT_EXPIRED";
+    /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */
+    readonly GRANT_EXPIRED: "GRANT_EXPIRED";
+};
+type ReplicaContractCode = (typeof ReplicaContractCode)[keyof typeof ReplicaContractCode];
+/** Browser free-space floor in bytes (64 MiB, `navigator.storage.estimate()`); not applied on node/CLI. */
+declare const DEFAULT_MIN_FREE_BYTES: number;
+/** The single per-origin IndexedDB database of the browser `KVReplicaStorage` adapter. */
+declare const REPLICA_KV_DATABASE = "tinycloud-replica-kv";
+/** Origin database schema: v2 destructively replaces v1 plaintext replica-owned stores. */
+declare const REPLICA_KV_SCHEMA_VERSION = 2;
+/**
+ * Object-store names in {@link REPLICA_KV_DATABASE}. Every store uses out-of-line keys (no
+ * `keyPath`, no autoIncrement) so the schema upgrade can create control stores without knowing
+ * their record shapes. Data stores are owned by the adapter (S1); control stores by the lifecycle
+ * gate (S3) and quota ledger (S5).
+ */
+declare const REPLICA_KV_STORES: {
+    /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */
+    readonly meta: "meta";
+    /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */
+    readonly entries: "entries";
+    /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */
+    readonly blobs: "blobs";
+    /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */
+    readonly pending: "pending";
+    /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */
+    readonly device: "device";
+    /** Control: the account gate, singleton key `"account"`, value `ReplicaAccountGate`. */
+    readonly gate: "gate";
+    /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */
+    readonly partitions: "partitions";
+    /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */
+    readonly purgeIntents: "purgeIntents";
+    /** Control: quota ledger, keys owned by the ledger (S5). */
+    readonly quota: "quota";
+};
+/** Synchronous, cross-tab `localStorage` marker set when the deny transaction and fallback delete both failed. */
+declare const REPLICA_LOGOUT_MARKER = "tinycloud-replica:logout-pending";
+/** Origin-wide deny floor outside the deletable replica database; JSON `{ epoch, deniedAt }`. */
+declare const REPLICA_DENY_TOMBSTONE = "tinycloud-replica:deny-tombstone";
+/** BroadcastChannel name used for lifecycle nudges and peer-commit notifications. */
+declare const REPLICA_KV_CHANNEL = "tinycloud-replica-kv";
+/** Web Lock name prefix for pending-write read-modify-write; suffix is the private gate-HMAC identity id. */
+declare const REPLICA_PENDING_LOCK_PREFIX = "tinycloud-replica-kv:pending:";
+/** Node/CLI gate file name. CLI places it at `<profile>/replica-gate.json`. */
+declare const REPLICA_GATE_FILE = "replica-gate.json";
+
+export { DEFAULT_MIN_FREE_BYTES, REPLICA_DENY_TOMBSTONE, REPLICA_GATE_FILE, REPLICA_KV_CHANNEL, REPLICA_KV_DATABASE, REPLICA_KV_SCHEMA_VERSION, REPLICA_KV_STORES, REPLICA_LOGOUT_MARKER, REPLICA_PENDING_LOCK_PREFIX, ReplicaContractCode };

package/dist/kv/replication/contractConstants.js

@@ -0,0 +1,75 @@
+// src/kv/replication/grantPolicyConstants.ts
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var DEFAULT_GRANT_TTL_MS = DAY_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var RENEW_BELOW_FRACTION = 0.25;
+
+// src/kv/replication/contractConstants.ts
+var ReplicaContractCode = {
+  /**
+   * The lifecycle gate refused the operation: the handle's session stamp or principal no longer
+   * matches the gate, a purge intent covers the partition, or the logout marker is set. The error
+   * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.
+   */
+  REPLICA_GATED: "REPLICA_GATED",
+  /**
+   * Reserved for handles whose partition was erased (purge or revocation) after they opened. The
+   * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.
+   */
+  RESET_REQUIRED: "RESET_REQUIRED",
+  /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */
+  STORAGE_BUDGET: "STORAGE_BUDGET",
+  /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */
+  STORAGE_FULL: "STORAGE_FULL",
+  /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */
+  CONSENT_EXPIRED: "CONSENT_EXPIRED",
+  /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */
+  GRANT_EXPIRED: "GRANT_EXPIRED"
+};
+var DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;
+var REPLICA_KV_DATABASE = "tinycloud-replica-kv";
+var REPLICA_KV_SCHEMA_VERSION = 2;
+var REPLICA_KV_STORES = {
+  /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */
+  meta: "meta",
+  /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */
+  entries: "entries",
+  /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */
+  blobs: "blobs",
+  /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */
+  pending: "pending",
+  /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */
+  device: "device",
+  /** Control: the account gate, singleton key `"account"`, value `ReplicaAccountGate`. */
+  gate: "gate",
+  /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */
+  partitions: "partitions",
+  /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */
+  purgeIntents: "purgeIntents",
+  /** Control: quota ledger, keys owned by the ledger (S5). */
+  quota: "quota"
+};
+var REPLICA_LOGOUT_MARKER = "tinycloud-replica:logout-pending";
+var REPLICA_DENY_TOMBSTONE = "tinycloud-replica:deny-tombstone";
+var REPLICA_KV_CHANNEL = "tinycloud-replica-kv";
+var REPLICA_PENDING_LOCK_PREFIX = "tinycloud-replica-kv:pending:";
+var REPLICA_GATE_FILE = "replica-gate.json";
+export {
+  CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS,
+  DEFAULT_MIN_FREE_BYTES,
+  MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION,
+  REPLICA_DENY_TOMBSTONE,
+  REPLICA_GATE_FILE,
+  REPLICA_KV_CHANNEL,
+  REPLICA_KV_DATABASE,
+  REPLICA_KV_SCHEMA_VERSION,
+  REPLICA_KV_STORES,
+  REPLICA_LOGOUT_MARKER,
+  REPLICA_PENDING_LOCK_PREFIX,
+  ReplicaContractCode
+};
+//# sourceMappingURL=contractConstants.js.map

package/dist/kv/replication/contractConstants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/grantPolicyConstants.ts","../../../src/kv/replication/contractConstants.ts"],"sourcesContent":["/** Grant lifetime constants without browser storage identifiers. */\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */\nexport const DEFAULT_GRANT_TTL_MS = DAY_MS;\n/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */\nexport const MAX_GRANT_TTL_MS = 7 * DAY_MS;\n/** Consent deadline = consent anchor + this window (7 d). */\nexport const CONSENT_WINDOW_MS = 7 * DAY_MS;\n/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */\nexport const RENEW_BELOW_FRACTION = 0.25;\n","/**\n * Frozen constants of the shared replica contract (TC-858 Phase 2, see CONTRACT.md).\n *\n * Exported via `@tinycloud/sdk-services/kv/replication/contractConstants`, never from the\n * package root. Runtime grant policy imports the numeric-only `grantPolicyConstants` subpath\n * instead, so the default web bundle does not carry browser storage identifiers.\n */\nexport {\n  DEFAULT_GRANT_TTL_MS,\n  MAX_GRANT_TTL_MS,\n  CONSENT_WINDOW_MS,\n  RENEW_BELOW_FRACTION,\n} from \"./grantPolicyConstants\";\n\n/** Error codes the contract adds or gives new meaning. Values equal keys. */\nexport const ReplicaContractCode = {\n  /**\n   * The lifecycle gate refused the operation: the handle's session stamp or principal no longer\n   * matches the gate, a purge intent covers the partition, or the logout marker is set. The error\n   * carries `gate: ReplicaGateReason`. Read-through answers from the network; nothing is erased.\n   */\n  REPLICA_GATED: \"REPLICA_GATED\",\n  /**\n   * Reserved for handles whose partition was erased (purge or revocation) after they opened. The\n   * gate check runs first, so a handle that is both gated and erased reports REPLICA_GATED.\n   */\n  RESET_REQUIRED: \"RESET_REQUIRED\",\n  /** A page was refused by quota admission (`maxBytes` or the free-space floor). Nothing committed. */\n  STORAGE_BUDGET: \"STORAGE_BUDGET\",\n  /** The platform store refused the write (IndexedDB `QuotaExceededError`, ENOSPC). Nothing committed. */\n  STORAGE_FULL: \"STORAGE_FULL\",\n  /** The consent deadline has passed: no grant may be minted, renewed or served until re-consent. */\n  CONSENT_EXPIRED: \"CONSENT_EXPIRED\",\n  /** The installed grant's effective expiry (not necessarily its signed `exp`) has passed. */\n  GRANT_EXPIRED: \"GRANT_EXPIRED\",\n} as const;\nexport type ReplicaContractCode = (typeof ReplicaContractCode)[keyof typeof ReplicaContractCode];\n\n/** Browser free-space floor in bytes (64 MiB, `navigator.storage.estimate()`); not applied on node/CLI. */\nexport const DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;\n\n/** The single per-origin IndexedDB database of the browser `KVReplicaStorage` adapter. */\nexport const REPLICA_KV_DATABASE = \"tinycloud-replica-kv\";\n/** Origin database schema: v2 destructively replaces v1 plaintext replica-owned stores. */\nexport const REPLICA_KV_SCHEMA_VERSION = 2;\n\n/**\n * Object-store names in {@link REPLICA_KV_DATABASE}. Every store uses out-of-line keys (no\n * `keyPath`, no autoIncrement) so the schema upgrade can create control stores without knowing\n * their record shapes. Data stores are owned by the adapter (S1); control stores by the lifecycle\n * gate (S3) and quota ledger (S5).\n */\nexport const REPLICA_KV_STORES = {\n  /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */\n  meta: \"meta\",\n  /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */\n  entries: \"entries\",\n  /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */\n  blobs: \"blobs\",\n  /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */\n  pending: \"pending\",\n  /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */\n  device: \"device\",\n  /** Control: the account gate, singleton key `\"account\"`, value `ReplicaAccountGate`. */\n  gate: \"gate\",\n  /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */\n  partitions: \"partitions\",\n  /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */\n  purgeIntents: \"purgeIntents\",\n  /** Control: quota ledger, keys owned by the ledger (S5). */\n  quota: \"quota\",\n} as const;\n\n/** Synchronous, cross-tab `localStorage` marker set when the deny transaction and fallback delete both failed. */\nexport const REPLICA_LOGOUT_MARKER = \"tinycloud-replica:logout-pending\";\n\n/** Origin-wide deny floor outside the deletable replica database; JSON `{ epoch, deniedAt }`. */\nexport const REPLICA_DENY_TOMBSTONE = \"tinycloud-replica:deny-tombstone\";\n\n/** BroadcastChannel name used for lifecycle nudges and peer-commit notifications. */\nexport const REPLICA_KV_CHANNEL = \"tinycloud-replica-kv\";\n\n/** Web Lock name prefix for pending-write read-modify-write; suffix is the private gate-HMAC identity id. */\nexport const REPLICA_PENDING_LOCK_PREFIX = \"tinycloud-replica-kv:pending:\";\n\n/** Node/CLI gate file name. CLI places it at `<profile>/replica-gate.json`. */\nexport const REPLICA_GATE_FILE = \"replica-gate.json\";\n"],"mappings":";AACA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAGb,IAAM,uBAAuB;AAE7B,IAAM,mBAAmB,IAAI;AAE7B,IAAM,oBAAoB,IAAI;AAE9B,IAAM,uBAAuB;;;ACI7B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjC,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA,EAKf,gBAAgB;AAAA;AAAA,EAEhB,gBAAgB;AAAA;AAAA,EAEhB,cAAc;AAAA;AAAA,EAEd,iBAAiB;AAAA;AAAA,EAEjB,eAAe;AACjB;AAIO,IAAM,yBAAyB,KAAK,OAAO;AAG3C,IAAM,sBAAsB;AAE5B,IAAM,4BAA4B;AAQlC,IAAM,oBAAoB;AAAA;AAAA,EAE/B,MAAM;AAAA;AAAA,EAEN,SAAS;AAAA;AAAA,EAET,OAAO;AAAA;AAAA,EAEP,SAAS;AAAA;AAAA,EAET,QAAQ;AAAA;AAAA,EAER,MAAM;AAAA;AAAA,EAEN,YAAY;AAAA;AAAA,EAEZ,cAAc;AAAA;AAAA,EAEd,OAAO;AACT;AAGO,IAAM,wBAAwB;AAG9B,IAAM,yBAAyB;AAG/B,IAAM,qBAAqB;AAG3B,IAAM,8BAA8B;AAGpC,IAAM,oBAAoB;","names":[]}

package/dist/kv/replication/grantPolicy.cjs

@@ -0,0 +1,82 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/kv/replication/grantPolicy.ts
+var grantPolicy_exports = {};
+__export(grantPolicy_exports, {
+  MAX_GRANT_TTL_MS: () => MAX_GRANT_TTL_MS,
+  clampConsentAnchor: () => clampConsentAnchor,
+  consentDeadlineMs: () => consentDeadlineMs,
+  effectiveGrantExpiry: () => effectiveGrantExpiry,
+  mintRemainingMs: () => mintRemainingMs,
+  needsSilentRenewal: () => needsSilentRenewal
+});
+module.exports = __toCommonJS(grantPolicy_exports);
+
+// src/kv/replication/grantPolicyConstants.ts
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var RENEW_BELOW_FRACTION = 0.25;
+
+// src/kv/replication/grantPolicy.ts
+var EXPIRED = Number.NEGATIVE_INFINITY;
+var consentDeadlineMs = (anchor) => Number.isFinite(anchor.at) ? anchor.at + CONSENT_WINDOW_MS : EXPIRED;
+var clampConsentAnchor = (anchor, now) => {
+  if (anchor === null || !Number.isFinite(anchor.at) || !Number.isFinite(now)) return null;
+  return anchor.at > now ? { at: now, source: anchor.source } : anchor;
+};
+var effectiveGrantExpiry = ({
+  signedExpiresAt,
+  installedAt,
+  grantTtlMs,
+  consentDeadline
+}) => {
+  const signedValid = signedExpiresAt === null || Number.isFinite(signedExpiresAt);
+  if (!signedValid || !Number.isFinite(installedAt) || !Number.isFinite(grantTtlMs) || !Number.isFinite(consentDeadline)) {
+    return EXPIRED;
+  }
+  const ttl = Math.min(grantTtlMs, MAX_GRANT_TTL_MS);
+  const localBound = Math.min(installedAt + ttl, consentDeadline);
+  return signedExpiresAt === null ? localBound : Math.min(signedExpiresAt, localBound);
+};
+var mintRemainingMs = ({ now, grantTtlMs, consentDeadline }) => {
+  if (!Number.isFinite(now) || !Number.isFinite(grantTtlMs) || !Number.isFinite(consentDeadline)) return 0;
+  return Math.min(Math.min(grantTtlMs, MAX_GRANT_TTL_MS), consentDeadline - now);
+};
+var needsSilentRenewal = ({ now, installedAt, effectiveExpiresAt, consentDeadline }) => {
+  if (!Number.isFinite(now) || !Number.isFinite(installedAt) || !Number.isFinite(effectiveExpiresAt) || !Number.isFinite(consentDeadline)) {
+    return false;
+  }
+  if (!(now < consentDeadline)) return false;
+  const remaining = effectiveExpiresAt - now;
+  const lifetime = effectiveExpiresAt - installedAt;
+  return remaining < lifetime * RENEW_BELOW_FRACTION;
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MAX_GRANT_TTL_MS,
+  clampConsentAnchor,
+  consentDeadlineMs,
+  effectiveGrantExpiry,
+  mintRemainingMs,
+  needsSilentRenewal
+});
+//# sourceMappingURL=grantPolicy.cjs.map

package/dist/kv/replication/grantPolicy.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/grantPolicy.ts","../../../src/kv/replication/grantPolicyConstants.ts"],"sourcesContent":["/**\n * Grant lifetime policy (TC-858 plan §6, CONTRACT.md §3). Pure functions over epoch\n * milliseconds. Types and constants come from the shared contract; this file only implements them.\n *\n * Every function fails closed: a non-finite input yields a value that refuses the mint, renewal or\n * read, never a permissive one.\n */\nimport { CONSENT_WINDOW_MS, MAX_GRANT_TTL_MS, RENEW_BELOW_FRACTION } from \"./grantPolicyConstants\";\nexport { MAX_GRANT_TTL_MS } from \"./grantPolicyConstants\";\nimport type {\n  ConsentDeadlineMs,\n  EffectiveGrantExpiry,\n  MintRemainingMs,\n  NeedsSilentRenewal,\n  ReplicaConsentAnchor,\n} from \"./grantPolicyTypes\";\n\n/** An instant that has already passed: nothing is minted, renewed or served against it. */\nconst EXPIRED = Number.NEGATIVE_INFINITY;\n\n/**\n * Caller contract: clamp the anchor with {@link clampConsentAnchor} first. A non-finite anchor\n * yields an already-passed deadline.\n */\nexport const consentDeadlineMs: ConsentDeadlineMs = (anchor) =>\n  Number.isFinite(anchor.at) ? anchor.at + CONSENT_WINDOW_MS : EXPIRED;\n\n/**\n * Returns the anchor the deadline may be computed from. A non-finite anchor or clock yields\n * `null` (no anchor, so no mint). An anchor dated after `now` is pulled back to `now`, so a\n * future-dated anchor cannot extend the 7 d window.\n */\nexport const clampConsentAnchor = (\n  anchor: ReplicaConsentAnchor | null,\n  now: number,\n): ReplicaConsentAnchor | null => {\n  if (anchor === null || !Number.isFinite(anchor.at) || !Number.isFinite(now)) return null;\n  return anchor.at > now ? { at: now, source: anchor.source } : anchor;\n};\n\nexport const effectiveGrantExpiry: EffectiveGrantExpiry = ({\n  signedExpiresAt,\n  installedAt,\n  grantTtlMs,\n  consentDeadline,\n}) => {\n  const signedValid = signedExpiresAt === null || Number.isFinite(signedExpiresAt);\n  if (!signedValid || !Number.isFinite(installedAt) || !Number.isFinite(grantTtlMs) || !Number.isFinite(consentDeadline)) {\n    return EXPIRED;\n  }\n  const ttl = Math.min(grantTtlMs, MAX_GRANT_TTL_MS);\n  const localBound = Math.min(installedAt + ttl, consentDeadline);\n  return signedExpiresAt === null ? localBound : Math.min(signedExpiresAt, localBound);\n};\n\nexport const mintRemainingMs: MintRemainingMs = ({ now, grantTtlMs, consentDeadline }) => {\n  if (!Number.isFinite(now) || !Number.isFinite(grantTtlMs) || !Number.isFinite(consentDeadline)) return 0;\n  return Math.min(Math.min(grantTtlMs, MAX_GRANT_TTL_MS), consentDeadline - now);\n};\n\nexport const needsSilentRenewal: NeedsSilentRenewal = ({ now, installedAt, effectiveExpiresAt, consentDeadline }) => {\n  if (\n    !Number.isFinite(now) ||\n    !Number.isFinite(installedAt) ||\n    !Number.isFinite(effectiveExpiresAt) ||\n    !Number.isFinite(consentDeadline)\n  ) {\n    return false;\n  }\n  if (!(now < consentDeadline)) return false;\n  const remaining = effectiveExpiresAt - now;\n  const lifetime = effectiveExpiresAt - installedAt;\n  return remaining < lifetime * RENEW_BELOW_FRACTION;\n};\n","/** Grant lifetime constants without browser storage identifiers. */\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */\nexport const DEFAULT_GRANT_TTL_MS = DAY_MS;\n/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */\nexport const MAX_GRANT_TTL_MS = 7 * DAY_MS;\n/** Consent deadline = consent anchor + this window (7 d). */\nexport const CONSENT_WINDOW_MS = 7 * DAY_MS;\n/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */\nexport const RENEW_BELOW_FRACTION = 0.25;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACCA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAKb,IAAM,mBAAmB,IAAI;AAE7B,IAAM,oBAAoB,IAAI;AAE9B,IAAM,uBAAuB;;;ADOpC,IAAM,UAAU,OAAO;AAMhB,IAAM,oBAAuC,CAAC,WACnD,OAAO,SAAS,OAAO,EAAE,IAAI,OAAO,KAAK,oBAAoB;AAOxD,IAAM,qBAAqB,CAChC,QACA,QACgC;AAChC,MAAI,WAAW,QAAQ,CAAC,OAAO,SAAS,OAAO,EAAE,KAAK,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO;AACpF,SAAO,OAAO,KAAK,MAAM,EAAE,IAAI,KAAK,QAAQ,OAAO,OAAO,IAAI;AAChE;AAEO,IAAM,uBAA6C,CAAC;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MAAM;AACJ,QAAM,cAAc,oBAAoB,QAAQ,OAAO,SAAS,eAAe;AAC/E,MAAI,CAAC,eAAe,CAAC,OAAO,SAAS,WAAW,KAAK,CAAC,OAAO,SAAS,UAAU,KAAK,CAAC,OAAO,SAAS,eAAe,GAAG;AACtH,WAAO;AAAA,EACT;AACA,QAAM,MAAM,KAAK,IAAI,YAAY,gBAAgB;AACjD,QAAM,aAAa,KAAK,IAAI,cAAc,KAAK,eAAe;AAC9D,SAAO,oBAAoB,OAAO,aAAa,KAAK,IAAI,iBAAiB,UAAU;AACrF;AAEO,IAAM,kBAAmC,CAAC,EAAE,KAAK,YAAY,gBAAgB,MAAM;AACxF,MAAI,CAAC,OAAO,SAAS,GAAG,KAAK,CAAC,OAAO,SAAS,UAAU,KAAK,CAAC,OAAO,SAAS,eAAe,EAAG,QAAO;AACvG,SAAO,KAAK,IAAI,KAAK,IAAI,YAAY,gBAAgB,GAAG,kBAAkB,GAAG;AAC/E;AAEO,IAAM,qBAAyC,CAAC,EAAE,KAAK,aAAa,oBAAoB,gBAAgB,MAAM;AACnH,MACE,CAAC,OAAO,SAAS,GAAG,KACpB,CAAC,OAAO,SAAS,WAAW,KAC5B,CAAC,OAAO,SAAS,kBAAkB,KACnC,CAAC,OAAO,SAAS,eAAe,GAChC;AACA,WAAO;AAAA,EACT;AACA,MAAI,EAAE,MAAM,iBAAkB,QAAO;AACrC,QAAM,YAAY,qBAAqB;AACvC,QAAM,WAAW,qBAAqB;AACtC,SAAO,YAAY,WAAW;AAChC;","names":[]}

package/dist/kv/replication/grantPolicy.d.cts

@@ -0,0 +1,19 @@
+export { MAX_GRANT_TTL_MS } from './grantPolicyConstants.cjs';
+import { ReplicaConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, MintRemainingMs, NeedsSilentRenewal } from './grantPolicyTypes.cjs';
+
+/**
+ * Caller contract: clamp the anchor with {@link clampConsentAnchor} first. A non-finite anchor
+ * yields an already-passed deadline.
+ */
+declare const consentDeadlineMs: ConsentDeadlineMs;
+/**
+ * Returns the anchor the deadline may be computed from. A non-finite anchor or clock yields
+ * `null` (no anchor, so no mint). An anchor dated after `now` is pulled back to `now`, so a
+ * future-dated anchor cannot extend the 7 d window.
+ */
+declare const clampConsentAnchor: (anchor: ReplicaConsentAnchor | null, now: number) => ReplicaConsentAnchor | null;
+declare const effectiveGrantExpiry: EffectiveGrantExpiry;
+declare const mintRemainingMs: MintRemainingMs;
+declare const needsSilentRenewal: NeedsSilentRenewal;
+
+export { clampConsentAnchor, consentDeadlineMs, effectiveGrantExpiry, mintRemainingMs, needsSilentRenewal };

package/dist/kv/replication/grantPolicy.d.ts

@@ -0,0 +1,19 @@
+export { MAX_GRANT_TTL_MS } from './grantPolicyConstants.js';
+import { ReplicaConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, MintRemainingMs, NeedsSilentRenewal } from './grantPolicyTypes.js';
+
+/**
+ * Caller contract: clamp the anchor with {@link clampConsentAnchor} first. A non-finite anchor
+ * yields an already-passed deadline.
+ */
+declare const consentDeadlineMs: ConsentDeadlineMs;
+/**
+ * Returns the anchor the deadline may be computed from. A non-finite anchor or clock yields
+ * `null` (no anchor, so no mint). An anchor dated after `now` is pulled back to `now`, so a
+ * future-dated anchor cannot extend the 7 d window.
+ */
+declare const clampConsentAnchor: (anchor: ReplicaConsentAnchor | null, now: number) => ReplicaConsentAnchor | null;
+declare const effectiveGrantExpiry: EffectiveGrantExpiry;
+declare const mintRemainingMs: MintRemainingMs;
+declare const needsSilentRenewal: NeedsSilentRenewal;
+
+export { clampConsentAnchor, consentDeadlineMs, effectiveGrantExpiry, mintRemainingMs, needsSilentRenewal };

package/dist/kv/replication/grantPolicy.js

@@ -0,0 +1,50 @@
+// src/kv/replication/grantPolicyConstants.ts
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var RENEW_BELOW_FRACTION = 0.25;
+
+// src/kv/replication/grantPolicy.ts
+var EXPIRED = Number.NEGATIVE_INFINITY;
+var consentDeadlineMs = (anchor) => Number.isFinite(anchor.at) ? anchor.at + CONSENT_WINDOW_MS : EXPIRED;
+var clampConsentAnchor = (anchor, now) => {
+  if (anchor === null || !Number.isFinite(anchor.at) || !Number.isFinite(now)) return null;
+  return anchor.at > now ? { at: now, source: anchor.source } : anchor;
+};
+var effectiveGrantExpiry = ({
+  signedExpiresAt,
+  installedAt,
+  grantTtlMs,
+  consentDeadline
+}) => {
+  const signedValid = signedExpiresAt === null || Number.isFinite(signedExpiresAt);
+  if (!signedValid || !Number.isFinite(installedAt) || !Number.isFinite(grantTtlMs) || !Number.isFinite(consentDeadline)) {
+    return EXPIRED;
+  }
+  const ttl = Math.min(grantTtlMs, MAX_GRANT_TTL_MS);
+  const localBound = Math.min(installedAt + ttl, consentDeadline);
+  return signedExpiresAt === null ? localBound : Math.min(signedExpiresAt, localBound);
+};
+var mintRemainingMs = ({ now, grantTtlMs, consentDeadline }) => {
+  if (!Number.isFinite(now) || !Number.isFinite(grantTtlMs) || !Number.isFinite(consentDeadline)) return 0;
+  return Math.min(Math.min(grantTtlMs, MAX_GRANT_TTL_MS), consentDeadline - now);
+};
+var needsSilentRenewal = ({ now, installedAt, effectiveExpiresAt, consentDeadline }) => {
+  if (!Number.isFinite(now) || !Number.isFinite(installedAt) || !Number.isFinite(effectiveExpiresAt) || !Number.isFinite(consentDeadline)) {
+    return false;
+  }
+  if (!(now < consentDeadline)) return false;
+  const remaining = effectiveExpiresAt - now;
+  const lifetime = effectiveExpiresAt - installedAt;
+  return remaining < lifetime * RENEW_BELOW_FRACTION;
+};
+export {
+  MAX_GRANT_TTL_MS,
+  clampConsentAnchor,
+  consentDeadlineMs,
+  effectiveGrantExpiry,
+  mintRemainingMs,
+  needsSilentRenewal
+};
+//# sourceMappingURL=grantPolicy.js.map

package/dist/kv/replication/grantPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/grantPolicyConstants.ts","../../../src/kv/replication/grantPolicy.ts"],"sourcesContent":["/** Grant lifetime constants without browser storage identifiers. */\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */\nexport const DEFAULT_GRANT_TTL_MS = DAY_MS;\n/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */\nexport const MAX_GRANT_TTL_MS = 7 * DAY_MS;\n/** Consent deadline = consent anchor + this window (7 d). */\nexport const CONSENT_WINDOW_MS = 7 * DAY_MS;\n/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */\nexport const RENEW_BELOW_FRACTION = 0.25;\n","/**\n * Grant lifetime policy (TC-858 plan §6, CONTRACT.md §3). Pure functions over epoch\n * milliseconds. Types and constants come from the shared contract; this file only implements them.\n *\n * Every function fails closed: a non-finite input yields a value that refuses the mint, renewal or\n * read, never a permissive one.\n */\nimport { CONSENT_WINDOW_MS, MAX_GRANT_TTL_MS, RENEW_BELOW_FRACTION } from \"./grantPolicyConstants\";\nexport { MAX_GRANT_TTL_MS } from \"./grantPolicyConstants\";\nimport type {\n  ConsentDeadlineMs,\n  EffectiveGrantExpiry,\n  MintRemainingMs,\n  NeedsSilentRenewal,\n  ReplicaConsentAnchor,\n} from \"./grantPolicyTypes\";\n\n/** An instant that has already passed: nothing is minted, renewed or served against it. */\nconst EXPIRED = Number.NEGATIVE_INFINITY;\n\n/**\n * Caller contract: clamp the anchor with {@link clampConsentAnchor} first. A non-finite anchor\n * yields an already-passed deadline.\n */\nexport const consentDeadlineMs: ConsentDeadlineMs = (anchor) =>\n  Number.isFinite(anchor.at) ? anchor.at + CONSENT_WINDOW_MS : EXPIRED;\n\n/**\n * Returns the anchor the deadline may be computed from. A non-finite anchor or clock yields\n * `null` (no anchor, so no mint). An anchor dated after `now` is pulled back to `now`, so a\n * future-dated anchor cannot extend the 7 d window.\n */\nexport const clampConsentAnchor = (\n  anchor: ReplicaConsentAnchor | null,\n  now: number,\n): ReplicaConsentAnchor | null => {\n  if (anchor === null || !Number.isFinite(anchor.at) || !Number.isFinite(now)) return null;\n  return anchor.at > now ? { at: now, source: anchor.source } : anchor;\n};\n\nexport const effectiveGrantExpiry: EffectiveGrantExpiry = ({\n  signedExpiresAt,\n  installedAt,\n  grantTtlMs,\n  consentDeadline,\n}) => {\n  const signedValid = signedExpiresAt === null || Number.isFinite(signedExpiresAt);\n  if (!signedValid || !Number.isFinite(installedAt) || !Number.isFinite(grantTtlMs) || !Number.isFinite(consentDeadline)) {\n    return EXPIRED;\n  }\n  const ttl = Math.min(grantTtlMs, MAX_GRANT_TTL_MS);\n  const localBound = Math.min(installedAt + ttl, consentDeadline);\n  return signedExpiresAt === null ? localBound : Math.min(signedExpiresAt, localBound);\n};\n\nexport const mintRemainingMs: MintRemainingMs = ({ now, grantTtlMs, consentDeadline }) => {\n  if (!Number.isFinite(now) || !Number.isFinite(grantTtlMs) || !Number.isFinite(consentDeadline)) return 0;\n  return Math.min(Math.min(grantTtlMs, MAX_GRANT_TTL_MS), consentDeadline - now);\n};\n\nexport const needsSilentRenewal: NeedsSilentRenewal = ({ now, installedAt, effectiveExpiresAt, consentDeadline }) => {\n  if (\n    !Number.isFinite(now) ||\n    !Number.isFinite(installedAt) ||\n    !Number.isFinite(effectiveExpiresAt) ||\n    !Number.isFinite(consentDeadline)\n  ) {\n    return false;\n  }\n  if (!(now < consentDeadline)) return false;\n  const remaining = effectiveExpiresAt - now;\n  const lifetime = effectiveExpiresAt - installedAt;\n  return remaining < lifetime * RENEW_BELOW_FRACTION;\n};\n"],"mappings":";AACA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAKb,IAAM,mBAAmB,IAAI;AAE7B,IAAM,oBAAoB,IAAI;AAE9B,IAAM,uBAAuB;;;ACOpC,IAAM,UAAU,OAAO;AAMhB,IAAM,oBAAuC,CAAC,WACnD,OAAO,SAAS,OAAO,EAAE,IAAI,OAAO,KAAK,oBAAoB;AAOxD,IAAM,qBAAqB,CAChC,QACA,QACgC;AAChC,MAAI,WAAW,QAAQ,CAAC,OAAO,SAAS,OAAO,EAAE,KAAK,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO;AACpF,SAAO,OAAO,KAAK,MAAM,EAAE,IAAI,KAAK,QAAQ,OAAO,OAAO,IAAI;AAChE;AAEO,IAAM,uBAA6C,CAAC;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MAAM;AACJ,QAAM,cAAc,oBAAoB,QAAQ,OAAO,SAAS,eAAe;AAC/E,MAAI,CAAC,eAAe,CAAC,OAAO,SAAS,WAAW,KAAK,CAAC,OAAO,SAAS,UAAU,KAAK,CAAC,OAAO,SAAS,eAAe,GAAG;AACtH,WAAO;AAAA,EACT;AACA,QAAM,MAAM,KAAK,IAAI,YAAY,gBAAgB;AACjD,QAAM,aAAa,KAAK,IAAI,cAAc,KAAK,eAAe;AAC9D,SAAO,oBAAoB,OAAO,aAAa,KAAK,IAAI,iBAAiB,UAAU;AACrF;AAEO,IAAM,kBAAmC,CAAC,EAAE,KAAK,YAAY,gBAAgB,MAAM;AACxF,MAAI,CAAC,OAAO,SAAS,GAAG,KAAK,CAAC,OAAO,SAAS,UAAU,KAAK,CAAC,OAAO,SAAS,eAAe,EAAG,QAAO;AACvG,SAAO,KAAK,IAAI,KAAK,IAAI,YAAY,gBAAgB,GAAG,kBAAkB,GAAG;AAC/E;AAEO,IAAM,qBAAyC,CAAC,EAAE,KAAK,aAAa,oBAAoB,gBAAgB,MAAM;AACnH,MACE,CAAC,OAAO,SAAS,GAAG,KACpB,CAAC,OAAO,SAAS,WAAW,KAC5B,CAAC,OAAO,SAAS,kBAAkB,KACnC,CAAC,OAAO,SAAS,eAAe,GAChC;AACA,WAAO;AAAA,EACT;AACA,MAAI,EAAE,MAAM,iBAAkB,QAAO;AACrC,QAAM,YAAY,qBAAqB;AACvC,QAAM,WAAW,qBAAqB;AACtC,SAAO,YAAY,WAAW;AAChC;","names":[]}

package/dist/kv/replication/grantPolicyConstants.cjs

@@ -0,0 +1,42 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/kv/replication/grantPolicyConstants.ts
+var grantPolicyConstants_exports = {};
+__export(grantPolicyConstants_exports, {
+  CONSENT_WINDOW_MS: () => CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS: () => DEFAULT_GRANT_TTL_MS,
+  MAX_GRANT_TTL_MS: () => MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION: () => RENEW_BELOW_FRACTION
+});
+module.exports = __toCommonJS(grantPolicyConstants_exports);
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var DEFAULT_GRANT_TTL_MS = DAY_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var RENEW_BELOW_FRACTION = 0.25;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CONSENT_WINDOW_MS,
+  DEFAULT_GRANT_TTL_MS,
+  MAX_GRANT_TTL_MS,
+  RENEW_BELOW_FRACTION
+});
+//# sourceMappingURL=grantPolicyConstants.cjs.map

package/dist/kv/replication/grantPolicyConstants.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/kv/replication/grantPolicyConstants.ts"],"sourcesContent":["/** Grant lifetime constants without browser storage identifiers. */\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */\nexport const DEFAULT_GRANT_TTL_MS = DAY_MS;\n/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */\nexport const MAX_GRANT_TTL_MS = 7 * DAY_MS;\n/** Consent deadline = consent anchor + this window (7 d). */\nexport const CONSENT_WINDOW_MS = 7 * DAY_MS;\n/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */\nexport const RENEW_BELOW_FRACTION = 0.25;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAGb,IAAM,uBAAuB;AAE7B,IAAM,mBAAmB,IAAI;AAE7B,IAAM,oBAAoB,IAAI;AAE9B,IAAM,uBAAuB;","names":[]}

package/dist/kv/replication/grantPolicyConstants.d.cts

@@ -0,0 +1,10 @@
+/** Default device-grant lifetime from install (24 h). All durations are milliseconds. */
+declare const DEFAULT_GRANT_TTL_MS: number;
+/** `grantTtlMs` above this (7 d) is a config error: TypeError at construction. */
+declare const MAX_GRANT_TTL_MS: number;
+/** Consent deadline = consent anchor + this window (7 d). */
+declare const CONSENT_WINDOW_MS: number;
+/** Silent renewal starts when remaining effective lifetime < this fraction of the effective lifetime. */
+declare const RENEW_BELOW_FRACTION = 0.25;
+
+export { CONSENT_WINDOW_MS, DEFAULT_GRANT_TTL_MS, MAX_GRANT_TTL_MS, RENEW_BELOW_FRACTION };