@tinycloud/operations 0.3.2-beta.1 → 0.3.2-beta.10

package/dist/artifacts.js

@@ -164,10 +164,10 @@ var require_decrypt_transport_response_error = __commonJS({
     var __toCommonJS = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
     var DecryptTransportResponseError_exports = {};
     __export(DecryptTransportResponseError_exports, {
-      DecryptTransportResponseError: () => DecryptTransportResponseError4
+      DecryptTransportResponseError: () => DecryptTransportResponseError2
     });
     module.exports = __toCommonJS(DecryptTransportResponseError_exports);
-    var DecryptTransportResponseError4 = class extends Error {
+    var DecryptTransportResponseError2 = class extends Error {
       constructor(status, permissionHint) {
         super("Node decrypt request failed");
         this.status = status;
@@ -185,9 +185,6 @@ import { z as z2 } from "zod";
 // ../sdk-core/src/manifest.ts
 var import_ms = __toESM(require_ms(), 1);
 
-// ../sdk-services/dist/index.js
-import { z } from "zod";
-
 // ../bootstrap/dist/index.js
 var CAPABILITIES = [
   { urn: "tinycloud.kv/get", service: "tinycloud.kv", status: "active" },
@@ -596,28 +593,6 @@ function withCapabilitiesReadForSpaces(resources) {
     }))
   ]);
 }
-function accountRegistryPermissions() {
-  return [
-    {
-      service: "tinycloud.kv",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: ACCOUNT_REGISTRY_PATH,
-      actions: [KV.GET, KV.PUT, KV.LIST]
-    },
-    {
-      service: "tinycloud.kv",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "spaces/",
-      actions: [KV.GET, KV.PUT, KV.LIST]
-    },
-    {
-      service: "tinycloud.sql",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "account",
-      actions: [SQL.READ, SQL.WRITE, SQL.SCHEMA]
-    }
-  ];
-}
 function composeManifestRequest(inputs, options = {}) {
   if (!Array.isArray(inputs) || inputs.length === 0) {
     throw new Error("composeManifestRequest requires at least one manifest");
@@ -631,7 +606,12 @@ function composeManifestRequest(inputs, options = {}) {
     return explicit.flatMap((entry) => expandPermissionEntry(entry, prefix, space));
   });
   if (includeAccountRegistryPermissions) {
-    resources.push(...accountRegistryPermissions());
+    resources.push(
+      ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
+        ...resource,
+        actions: [...resource.actions]
+      }))
+    );
   }
   const manifestsByAppId = /* @__PURE__ */ new Map();
   for (const manifest of manifests) {
@@ -659,11 +639,60 @@ function composeBootstrapSpaceManifest(space) {
     includeAccountRegistryPermissions: false
   });
 }
+var ACCOUNT_MANIFEST_PERMISSIONS = Object.freeze([
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: ACCOUNT_REGISTRY_PATH,
+    actions: [KV.GET, KV.PUT, KV.LIST]
+  },
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "spaces/",
+    actions: [KV.GET, KV.PUT, KV.LIST]
+  },
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "system/bootstrap/complete",
+    actions: [KV.GET, KV.PUT]
+  },
+  {
+    service: "tinycloud.delegation",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "",
+    actions: ["tinycloud.delegation/list"]
+  },
+  {
+    service: "tinycloud.sql",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "account",
+    actions: [SQL.READ, SQL.WRITE, SQL.SCHEMA]
+  },
+  {
+    service: "tinycloud.capabilities",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "",
+    actions: [CAPABILITIES2.READ]
+  }
+]);
+var BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST = composeBootstrapSpaceManifest(BOOTSTRAP_DEFAULT_SPACE);
+var BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST = {
+  ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST,
+  resources: [
+    ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST.resources,
+    ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
+      ...resource,
+      actions: [...resource.actions]
+    }))
+  ]
+};
 var BOOTSTRAP_SESSION_REQUESTS = Object.freeze(
   Object.fromEntries(
     BOOTSTRAP_SPACE_NAMES.map((space) => [
       space,
-      composeBootstrapSpaceManifest(space)
+      space === BOOTSTRAP_DEFAULT_SPACE ? BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST : composeBootstrapSpaceManifest(space)
     ])
   )
 );
@@ -694,9 +723,8 @@ var BOOTSTRAP_ALLOWLIST = Object.freeze(
 );
 
 // ../sdk-services/dist/index.js
+import { z } from "zod";
 var import_decrypt_transport_response_error = __toESM(require_decrypt_transport_response_error(), 1);
-var import_decrypt_transport_response_error2 = __toESM(require_decrypt_transport_response_error(), 1);
-var import_decrypt_transport_response_error3 = __toESM(require_decrypt_transport_response_error(), 1);
 var ErrorCodes = {
   // Common errors
   NOT_FOUND: "NOT_FOUND",
@@ -2237,6 +2265,7 @@ var KVService = class extends BaseService {
         }
         seen.add(path);
       }
+      let requestMayHaveDispatched = false;
       try {
         const body = new FormData();
         for (let index = 0; index < items.length; index++) {
@@ -2254,14 +2283,31 @@ var KVService = class extends BaseService {
             action: KVAction.PUT
           }))
         );
-        const response = await this.context.fetch(`${this.host}/invoke`, {
+        const url = `${this.host}/invoke`;
+        const init = {
           method: "POST",
           headers,
           body,
           signal: this.combineSignals(options?.signal)
-        });
+        };
+        const fetchFn = this.context.fetch;
+        requestMayHaveDispatched = true;
+        const response = await fetchFn(url, init);
         if (!response.ok) {
-          const errorText = await response.text();
+          let errorText;
+          try {
+            errorText = await response.text();
+          } catch (textError) {
+            const cause = textError instanceof Error ? textError : new Error(String(textError));
+            return err(
+              serviceError(
+                ErrorCodes.KV_WRITE_FAILED,
+                `Failed to batch put ${items.length} key(s): ${response.status} - <response body could not be read: ${cause.message}>`,
+                "kv",
+                { cause, meta: { status: response.status, statusText: response.statusText } }
+              )
+            );
+          }
           if (response.status === 401 || response.status === 403) {
             const { resource, action } = parseAuthError(errorText);
             return err(authUnauthorizedError("kv", errorText, {
@@ -2287,19 +2333,73 @@ var KVService = class extends BaseService {
             )
           );
         }
-        const batchResponse = this.normalizeBatchPutResponse(await response.json());
-        if (!batchResponse || batchResponse.count !== batchResponse.written.length) {
+        let rawBody;
+        try {
+          rawBody = await response.json();
+        } catch (jsonError) {
+          const cause = jsonError instanceof Error ? jsonError : new Error(String(jsonError));
+          return err(
+            serviceError(
+              ErrorCodes.NETWORK_ERROR,
+              `KV batchPut response was not valid JSON: ${cause.message}`,
+              "kv",
+              {
+                cause,
+                meta: {
+                  requestMayHaveDispatched: true,
+                  responseReceived: true,
+                  status: response.status,
+                  outcome: "batch-unconfirmed"
+                }
+              }
+            )
+          );
+        }
+        const batchResponse = this.normalizeBatchPutResponse(rawBody);
+        if (!batchResponse) {
           return err(
             serviceError(
               ErrorCodes.NETWORK_ERROR,
               "KV batchPut response did not include matching written keys and count",
-              "kv"
+              "kv",
+              {
+                meta: {
+                  requestMayHaveDispatched: true,
+                  responseReceived: true,
+                  status: response.status,
+                  outcome: "batch-unconfirmed"
+                }
+              }
+            )
+          );
+        }
+        const requestedPaths = new Set(paths);
+        const writtenPaths = new Set(batchResponse.written);
+        const matchesRequest = batchResponse.count === paths.length && batchResponse.written.length === paths.length && writtenPaths.size === paths.length && batchResponse.written.every((key) => requestedPaths.has(key));
+        if (!matchesRequest) {
+          return err(
+            serviceError(
+              ErrorCodes.NETWORK_ERROR,
+              `KV batchPut response did not confirm all ${paths.length} requested key(s) were written`,
+              "kv",
+              {
+                meta: {
+                  requestMayHaveDispatched: true,
+                  responseReceived: true,
+                  status: response.status,
+                  outcome: "batch-unconfirmed"
+                }
+              }
             )
           );
         }
         return ok(batchResponse);
       } catch (error) {
-        return err(wrapError("kv", error));
+        const wrapped = wrapError("kv", error);
+        return err({
+          ...wrapped,
+          meta: { ...wrapped.meta, requestMayHaveDispatched }
+        });
       }
     });
   }
@@ -6637,15 +6737,28 @@ function normalizeSpace(space) {
 function isCapabilitySubset(requested, granted) {
   const missing = [];
   for (const req of requested) {
-    const match = granted.find((g) => canonicalizeEntryMatches(req, g));
-    if (match === void 0) {
+    const matchingScope = granted.filter(
+      (entry) => canonicalizeEntryScopeMatches(req, entry)
+    );
+    const requestedActions = expandActionShortNames(
+      req.service,
+      req.actions
+    );
+    const grantedActions = matchingScope.flatMap(
+      (entry) => expandActionShortNames(entry.service, entry.actions)
+    );
+    const covered = requestedActions.every(
+      (requestedAction) => grantedActions.some(
+        (grantedAction) => actionContains(grantedAction, requestedAction)
+      )
+    );
+    if (!covered) {
       missing.push(cloneEntry(req));
-      continue;
     }
   }
   return { subset: missing.length === 0, missing };
 }
-function canonicalizeEntryMatches(requested, granted) {
+function canonicalizeEntryScopeMatches(requested, granted) {
   if (requested.service !== granted.service) {
     return false;
   }
@@ -6655,15 +6768,6 @@ function canonicalizeEntryMatches(requested, granted) {
   if (!pathContains(granted.path, requested.path)) {
     return false;
   }
-  const reqActions = new Set(
-    expandActionShortNames(requested.service, requested.actions)
-  );
-  const grantedActions = expandActionShortNames(granted.service, granted.actions);
-  for (const a of reqActions) {
-    if (!grantedActions.some((grantedAction) => actionContains(grantedAction, a))) {
-      return false;
-    }
-  }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
     return false;
   }