@qoniai/qoni 0.5.0 → 0.5.2

package/dist/index.d.cts

@@ -1253,7 +1253,6 @@ declare class Qoni {
     private readonly secretKey;
     private readonly host;
     private runtimeConfigPromise?;
-    private readonly productTokenCache;
     private genAuthAdminTokenCache?;
     readonly gumem: ReturnType<typeof createGumemNamespace>;
     readonly genauth: ReturnType<typeof createGenAuthNamespace>;
@@ -1310,7 +1309,7 @@ declare class Qoni {
  * while still giving literal autocomplete and letting you write an exhaustive
  * `switch (err.code)` over the known set.
  */
-type QoniErrorCode = "qoni_error" | "auth.failed" | "delegation.required" | "permission_denied" | "token.expired" | "validation.failed" | "rate_limit.exceeded" | "upstream.failed" | "timeout" | "not_found" | "conflict" | "eak.delegation.user_not_bound" | "eak.genauth.userpool_binding_missing" | "eak.genauth.userpool_owner_missing" | "eak.genauth.no_bound_users" | "eak.token_exchange.upstream_failed" | (string & {});
+type QoniErrorCode = "qoni_error" | "auth.failed" | "delegation.required" | "permission_denied" | "token.expired" | "validation.failed" | "rate_limit.exceeded" | "upstream.failed" | "timeout" | "not_found" | "conflict" | "eak.delegation.user_not_bound" | "eak.delegation.no_allowed_scopes" | "eak.delegation.scope_not_allowed" | "eak.genauth.userpool_binding_missing" | "eak.genauth.userpool_owner_missing" | "eak.genauth.no_bound_users" | "eak.token_exchange.upstream_failed" | (string & {});
 interface QoniErrorOptions {
     code?: QoniErrorCode;
     status?: number;

package/dist/index.d.ts

@@ -1253,7 +1253,6 @@ declare class Qoni {
     private readonly secretKey;
     private readonly host;
     private runtimeConfigPromise?;
-    private readonly productTokenCache;
     private genAuthAdminTokenCache?;
     readonly gumem: ReturnType<typeof createGumemNamespace>;
     readonly genauth: ReturnType<typeof createGenAuthNamespace>;
@@ -1310,7 +1309,7 @@ declare class Qoni {
  * while still giving literal autocomplete and letting you write an exhaustive
  * `switch (err.code)` over the known set.
  */
-type QoniErrorCode = "qoni_error" | "auth.failed" | "delegation.required" | "permission_denied" | "token.expired" | "validation.failed" | "rate_limit.exceeded" | "upstream.failed" | "timeout" | "not_found" | "conflict" | "eak.delegation.user_not_bound" | "eak.genauth.userpool_binding_missing" | "eak.genauth.userpool_owner_missing" | "eak.genauth.no_bound_users" | "eak.token_exchange.upstream_failed" | (string & {});
+type QoniErrorCode = "qoni_error" | "auth.failed" | "delegation.required" | "permission_denied" | "token.expired" | "validation.failed" | "rate_limit.exceeded" | "upstream.failed" | "timeout" | "not_found" | "conflict" | "eak.delegation.user_not_bound" | "eak.delegation.no_allowed_scopes" | "eak.delegation.scope_not_allowed" | "eak.genauth.userpool_binding_missing" | "eak.genauth.userpool_owner_missing" | "eak.genauth.no_bound_users" | "eak.token_exchange.upstream_failed" | (string & {});
 interface QoniErrorOptions {
     code?: QoniErrorCode;
     status?: number;

package/dist/index.js

@@ -56,81 +56,6 @@ function buildSignedHeaders(credentials, method, pathname, payload) {
   return headers;
 }
 
-// src/scopes.ts
-var QoniScopes = {
-  GUMEM_SESSION_CREATE: "gumem.session:create",
-  GUMEM_MESSAGE_WRITE: "gumem.message:write",
-  GUMEM_MEMORY_READ: "gumem.memory:read",
-  GUMEM_MEMORY_WRITE: "gumem.memory:write",
-  GUMEM_MEMORY_DELETE: "gumem.memory:delete",
-  GUMEM_SEARCH_RUN: "gumem.search:run",
-  GUMEM_ADMIN_MANAGE: "gumem.admin:manage",
-  GUMEM_RESOURCE_WRITE: "gumem.resource:write",
-  GUMEM_ACTION_WRITE: "gumem.action:write",
-  GUMEM_ACTION_READ: "gumem.action:read",
-  GUMEM_PROFILE_READ: "gumem.profile:read",
-  // WebAgent products: exactly two verbs per product — `read` (observe) and
-  // `manage` (anything that changes execution state). See
-  // wa/docs/qoni-sdk-public-surface.md §3.
-  DO_ANYTHING_READ: "webagent.do_anything:read",
-  DO_ANYTHING_MANAGE: "webagent.do_anything:manage",
-  WEB_SEARCH_READ: "webagent.web_search:read",
-  WEB_SEARCH_MANAGE: "webagent.web_search:manage",
-  DEEP_RESEARCH_READ: "webagent.deep_research:read",
-  DEEP_RESEARCH_MANAGE: "webagent.deep_research:manage",
-  TRACK_READ: "webagent.track:read",
-  TRACK_MANAGE: "webagent.track:manage"
-};
-var QoniProductScopes = {
-  doAnything: [
-    QoniScopes.DO_ANYTHING_READ,
-    QoniScopes.DO_ANYTHING_MANAGE
-  ],
-  webSearch: [
-    QoniScopes.WEB_SEARCH_READ,
-    QoniScopes.WEB_SEARCH_MANAGE
-  ],
-  deepResearch: [
-    QoniScopes.DEEP_RESEARCH_READ,
-    QoniScopes.DEEP_RESEARCH_MANAGE
-  ],
-  track: [
-    QoniScopes.TRACK_READ,
-    QoniScopes.TRACK_MANAGE
-  ]
-};
-var KNOWN_SCOPES = Object.values(QoniScopes);
-var QoniScopeBundles = {
-  GUMEM_READONLY: [QoniScopes.GUMEM_MEMORY_READ, QoniScopes.GUMEM_PROFILE_READ],
-  GUMEM_SESSION_RECALL: [
-    QoniScopes.GUMEM_MEMORY_READ,
-    QoniScopes.GUMEM_MEMORY_WRITE,
-    QoniScopes.GUMEM_MESSAGE_WRITE
-  ],
-  GUMEM_WRITE: [
-    QoniScopes.GUMEM_SESSION_CREATE,
-    QoniScopes.GUMEM_MESSAGE_WRITE,
-    QoniScopes.GUMEM_ACTION_WRITE
-  ],
-  // One bundle per WebAgent product = [read, manage].
-  DO_ANYTHING: [
-    QoniScopes.DO_ANYTHING_READ,
-    QoniScopes.DO_ANYTHING_MANAGE
-  ],
-  WEB_SEARCH: [
-    QoniScopes.WEB_SEARCH_READ,
-    QoniScopes.WEB_SEARCH_MANAGE
-  ],
-  DEEP_RESEARCH: [
-    QoniScopes.DEEP_RESEARCH_READ,
-    QoniScopes.DEEP_RESEARCH_MANAGE
-  ],
-  TRACK: [
-    QoniScopes.TRACK_READ,
-    QoniScopes.TRACK_MANAGE
-  ]
-};
-
 // src/types.ts
 function isJsonObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -214,7 +139,7 @@ function errorFromPayload(status, payload, fallbackMessage) {
   const source = detailObject || (isJsonObject(payload) ? payload : {});
   const code = stringField(source, "code") || stringField(source, "apiCode") || statusCodeToCode(status);
   const rawMessage = stringField(source, "message") || stringField(source, "detail") || fallbackMessage;
-  const message = appendOnboardingHint(
+  const message = code === "eak.delegation.no_allowed_scopes" ? "This AccessKey has no permission scopes. In Qoni Console, open its Permission scope settings, enable the policy needed for this call, then retry." : appendOnboardingHint(
     appendDeniedScopes(appendUpstreamDescription(rawMessage, source), source),
     code
   );
@@ -231,7 +156,7 @@ function errorFromPayload(status, payload, fallbackMessage) {
   if (isDelegationRequired(code)) return new QoniDelegationRequiredError(message, options);
   if (status === 401) return new QoniAuthError(message, options);
   if (status === 403 || isPermissionDenied(code)) {
-    return new QoniPermissionDeniedError(appendKnownScopes(message), options);
+    return new QoniPermissionDeniedError(message, options);
   }
   if (status === 400 || status === 422) return new QoniValidationError(message, options);
   if (status === 429) return new QoniRateLimitError(message, options);
@@ -266,17 +191,14 @@ function appendUpstreamDescription(message, source) {
 }
 var ONBOARDING_HINTS = {
   "eak.delegation.user_not_bound": "Hint: the userId is not in the GenAuth userpool bound to this credential. Resolve a real user with qoni.resolveAnyBoundUser() (demo/smoke) or qoni.currentUser({ accessToken }).",
-  "eak.genauth.userpool_binding_missing": "Hint: bind the Qoni credential to a GenAuth userpool before calling genauth.users.*."
+  "eak.genauth.userpool_binding_missing": "Hint: bind the Qoni credential to a GenAuth userpool before calling genauth.users.*.",
+  "eak.delegation.scope_not_allowed": "Hint: enable the denied scopes in this AccessKey's Permission scope settings in Qoni Console."
 };
 function appendOnboardingHint(message, code) {
   const hint = ONBOARDING_HINTS[code];
   if (!hint || message.includes(hint)) return message;
   return `${message} ${hint}`;
 }
-function appendKnownScopes(message) {
-  if (message.includes("Known scopes:")) return message;
-  return `${message} (Known scopes: ${KNOWN_SCOPES.join(", ")})`;
-}
 function statusCodeToCode(status) {
   if (status === 401) return "auth.failed";
   if (status === 403) return "permission_denied";
@@ -1440,6 +1362,81 @@ function createQoniNamespace(_transport, delegateToken, completeDelegateToken) {
   };
 }
 
+// src/scopes.ts
+var QoniScopes = {
+  GUMEM_SESSION_CREATE: "gumem.session:create",
+  GUMEM_MESSAGE_WRITE: "gumem.message:write",
+  GUMEM_MEMORY_READ: "gumem.memory:read",
+  GUMEM_MEMORY_WRITE: "gumem.memory:write",
+  GUMEM_MEMORY_DELETE: "gumem.memory:delete",
+  GUMEM_SEARCH_RUN: "gumem.search:run",
+  GUMEM_ADMIN_MANAGE: "gumem.admin:manage",
+  GUMEM_RESOURCE_WRITE: "gumem.resource:write",
+  GUMEM_ACTION_WRITE: "gumem.action:write",
+  GUMEM_ACTION_READ: "gumem.action:read",
+  GUMEM_PROFILE_READ: "gumem.profile:read",
+  // WebAgent products: exactly two verbs per product — `read` (observe) and
+  // `manage` (anything that changes execution state). See
+  // wa/docs/qoni-sdk-public-surface.md §3.
+  DO_ANYTHING_READ: "webagent.do_anything:read",
+  DO_ANYTHING_MANAGE: "webagent.do_anything:manage",
+  WEB_SEARCH_READ: "webagent.web_search:read",
+  WEB_SEARCH_MANAGE: "webagent.web_search:manage",
+  DEEP_RESEARCH_READ: "webagent.deep_research:read",
+  DEEP_RESEARCH_MANAGE: "webagent.deep_research:manage",
+  TRACK_READ: "webagent.track:read",
+  TRACK_MANAGE: "webagent.track:manage"
+};
+var QoniProductScopes = {
+  doAnything: [
+    QoniScopes.DO_ANYTHING_READ,
+    QoniScopes.DO_ANYTHING_MANAGE
+  ],
+  webSearch: [
+    QoniScopes.WEB_SEARCH_READ,
+    QoniScopes.WEB_SEARCH_MANAGE
+  ],
+  deepResearch: [
+    QoniScopes.DEEP_RESEARCH_READ,
+    QoniScopes.DEEP_RESEARCH_MANAGE
+  ],
+  track: [
+    QoniScopes.TRACK_READ,
+    QoniScopes.TRACK_MANAGE
+  ]
+};
+var KNOWN_SCOPES = Object.values(QoniScopes);
+var QoniScopeBundles = {
+  GUMEM_READONLY: [QoniScopes.GUMEM_MEMORY_READ, QoniScopes.GUMEM_PROFILE_READ],
+  GUMEM_SESSION_RECALL: [
+    QoniScopes.GUMEM_MEMORY_READ,
+    QoniScopes.GUMEM_MEMORY_WRITE,
+    QoniScopes.GUMEM_MESSAGE_WRITE
+  ],
+  GUMEM_WRITE: [
+    QoniScopes.GUMEM_SESSION_CREATE,
+    QoniScopes.GUMEM_MESSAGE_WRITE,
+    QoniScopes.GUMEM_ACTION_WRITE
+  ],
+  // One bundle per WebAgent product = [read, manage].
+  DO_ANYTHING: [
+    QoniScopes.DO_ANYTHING_READ,
+    QoniScopes.DO_ANYTHING_MANAGE
+  ],
+  WEB_SEARCH: [
+    QoniScopes.WEB_SEARCH_READ,
+    QoniScopes.WEB_SEARCH_MANAGE
+  ],
+  DEEP_RESEARCH: [
+    QoniScopes.DEEP_RESEARCH_READ,
+    QoniScopes.DEEP_RESEARCH_MANAGE
+  ],
+  TRACK: [
+    QoniScopes.TRACK_READ,
+    QoniScopes.TRACK_MANAGE
+  ]
+};
+
 // src/genauth.ts
 function createGenAuthNamespace(transport, options = {}) {
   return {
@@ -2066,7 +2063,6 @@ var Qoni = class {
   secretKey;
   host;
   runtimeConfigPromise;
-  productTokenCache = /* @__PURE__ */ new Map();
   genAuthAdminTokenCache;
   gumem;
   genauth;
@@ -2537,9 +2533,6 @@ var Qoni = class {
     const runtimeToken = requiredRuntimeToken(token);
     if (!isQoniDelegationToken(runtimeToken)) return runtimeToken;
     const scopes = [...requiredScopes || []].sort();
-    const cacheKey = [service, runtimeToken, scopes.join(" ")].join(":");
-    const cached = this.productTokenCache.get(cacheKey);
-    if (cached && cached.expiresAt > Date.now() + 3e4) return cached.token;
     const response = await this.signedPost("/api/v3/eak/token-exchange", {
       subjectToken: runtimeToken,
       resource: service === "gumem" ? "gumem" : "webagent",
@@ -2554,10 +2547,6 @@ var Qoni = class {
         "Qoni product token exchange response did not include an access token"
       );
     }
-    this.productTokenCache.set(cacheKey, {
-      token: accessToken,
-      expiresAt: Date.now() + Math.max(0, readExpiresIn(payload) ?? 3600) * 1e3
-    });
     return accessToken;
   }
   async genauthAdminTokenFor() {