@tinycloud/operations 0.3.2-beta.1 → 0.3.2-beta.10

package/dist/cli-runtime.cjs

@@ -335,28 +335,6 @@ function withCapabilitiesReadForSpaces(resources) {
     }))
   ]);
 }
-function accountRegistryPermissions() {
-  return [
-    {
-      service: "tinycloud.kv",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: ACCOUNT_REGISTRY_PATH,
-      actions: [KV.GET, KV.PUT, KV.LIST]
-    },
-    {
-      service: "tinycloud.kv",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "spaces/",
-      actions: [KV.GET, KV.PUT, KV.LIST]
-    },
-    {
-      service: "tinycloud.sql",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "account",
-      actions: [SQL.READ, SQL.WRITE, SQL.SCHEMA]
-    }
-  ];
-}
 function composeManifestRequest(inputs, options = {}) {
   if (!Array.isArray(inputs) || inputs.length === 0) {
     throw new Error("composeManifestRequest requires at least one manifest");
@@ -370,7 +348,12 @@ function composeManifestRequest(inputs, options = {}) {
     return explicit.flatMap((entry) => expandPermissionEntry(entry, prefix, space));
   });
   if (includeAccountRegistryPermissions) {
-    resources.push(...accountRegistryPermissions());
+    resources.push(
+      ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
+        ...resource,
+        actions: [...resource.actions]
+      }))
+    );
   }
   const manifestsByAppId = /* @__PURE__ */ new Map();
   for (const manifest of manifests) {
@@ -398,7 +381,7 @@ function composeBootstrapSpaceManifest(space) {
     includeAccountRegistryPermissions: false
   });
 }
-var CAPABILITIES, KV, SQL, DUCKDB, CAPABILITIES2, HOOKS, ENCRYPTION, SPACE, DEFAULT_MANIFEST_SPACE, ACCOUNT_REGISTRY_SPACE, ACCOUNT_REGISTRY_PATH, SECRETS_SPACE, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, DEFAULT_EXPIRY_MS, VAULT_PERMISSION_SERVICE, ENCRYPTION_PERMISSION_SERVICE, ENCRYPTION_MANIFEST_SPACE, NETWORK_CREATE_ACTION, BOOTSTRAP_SPACE_NAMES, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, ACCOUNT_INDEX_SCHEMA, SECRET_RECORDS_SCHEMA, BOOTSTRAP_MANIFEST, BOOTSTRAP_SESSION_REQUESTS, ACCOUNT_SESSION_RAW_ALLOWLIST, BOOTSTRAP_ALLOWLIST;
+var CAPABILITIES, KV, SQL, DUCKDB, CAPABILITIES2, HOOKS, ENCRYPTION, SPACE, DEFAULT_MANIFEST_SPACE, ACCOUNT_REGISTRY_SPACE, ACCOUNT_REGISTRY_PATH, SECRETS_SPACE, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, DEFAULT_EXPIRY_MS, VAULT_PERMISSION_SERVICE, ENCRYPTION_PERMISSION_SERVICE, ENCRYPTION_MANIFEST_SPACE, NETWORK_CREATE_ACTION, BOOTSTRAP_SPACE_NAMES, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, ACCOUNT_INDEX_SCHEMA, SECRET_RECORDS_SCHEMA, BOOTSTRAP_MANIFEST, ACCOUNT_MANIFEST_PERMISSIONS, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST, BOOTSTRAP_SESSION_REQUESTS, ACCOUNT_SESSION_RAW_ALLOWLIST, BOOTSTRAP_ALLOWLIST;
 var init_dist = __esm({
   "../bootstrap/dist/index.js"() {
     "use strict";
@@ -703,11 +686,60 @@ var init_dist = __esm({
         name: BOOTSTRAP_ENCRYPTION_NETWORK_NAME
       }
     };
+    ACCOUNT_MANIFEST_PERMISSIONS = Object.freeze([
+      {
+        service: "tinycloud.kv",
+        space: ACCOUNT_REGISTRY_SPACE,
+        path: ACCOUNT_REGISTRY_PATH,
+        actions: [KV.GET, KV.PUT, KV.LIST]
+      },
+      {
+        service: "tinycloud.kv",
+        space: ACCOUNT_REGISTRY_SPACE,
+        path: "spaces/",
+        actions: [KV.GET, KV.PUT, KV.LIST]
+      },
+      {
+        service: "tinycloud.kv",
+        space: ACCOUNT_REGISTRY_SPACE,
+        path: "system/bootstrap/complete",
+        actions: [KV.GET, KV.PUT]
+      },
+      {
+        service: "tinycloud.delegation",
+        space: ACCOUNT_REGISTRY_SPACE,
+        path: "",
+        actions: ["tinycloud.delegation/list"]
+      },
+      {
+        service: "tinycloud.sql",
+        space: ACCOUNT_REGISTRY_SPACE,
+        path: "account",
+        actions: [SQL.READ, SQL.WRITE, SQL.SCHEMA]
+      },
+      {
+        service: "tinycloud.capabilities",
+        space: ACCOUNT_REGISTRY_SPACE,
+        path: "",
+        actions: [CAPABILITIES2.READ]
+      }
+    ]);
+    BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST = composeBootstrapSpaceManifest(BOOTSTRAP_DEFAULT_SPACE);
+    BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST = {
+      ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST,
+      resources: [
+        ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST.resources,
+        ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
+          ...resource,
+          actions: [...resource.actions]
+        }))
+      ]
+    };
     BOOTSTRAP_SESSION_REQUESTS = Object.freeze(
       Object.fromEntries(
         BOOTSTRAP_SPACE_NAMES.map((space) => [
           space,
-          composeBootstrapSpaceManifest(space)
+          space === BOOTSTRAP_DEFAULT_SPACE ? BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST : composeBootstrapSpaceManifest(space)
         ])
       )
     );
@@ -762,10 +794,10 @@ var require_decrypt_transport_response_error = __commonJS({
     var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
     var DecryptTransportResponseError_exports = {};
     __export2(DecryptTransportResponseError_exports, {
-      DecryptTransportResponseError: () => DecryptTransportResponseError4
+      DecryptTransportResponseError: () => DecryptTransportResponseError2
     });
     module2.exports = __toCommonJS2(DecryptTransportResponseError_exports);
-    var DecryptTransportResponseError4 = class extends Error {
+    var DecryptTransportResponseError2 = class extends Error {
       constructor(status, permissionHint) {
         super("Node decrypt request failed");
         this.status = status;
@@ -2397,7 +2429,7 @@ function encOk(data) {
 function encErr(error) {
   return { ok: false, error };
 }
-var import_zod, import_decrypt_transport_response_error, import_decrypt_transport_response_error2, import_decrypt_transport_response_error3, ErrorCodes, defaultRetryPolicy, TelemetryEvents, REDACTED, SAFE_NUMBER_FIELDS, SAFE_BOOLEAN_FIELDS, DEBUG_FLAG, MAX_EVENTS, TinyCloudDebugLogger, tinyCloudDebugLogger, ServiceErrorSchema, GenericResultSchema, KVResponseHeadersSchema, GenericKVResponseSchema, KVListResponseSchema, KVListResultSchema, ServiceRequestEventSchema, ServiceResponseEventSchema, ServiceErrorEventSchema, ServiceRetryEventSchema, TelemetrySpanEventSchema, RetryPolicySchema, ServiceSessionSchema, BaseService, PrefixedKVService, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, KVAction, MAX_KV_BATCH_READ_ITEMS, KVService, SQLMigrations, DatabaseHandle, SQLAction, DDL_TOKENS, MIGRATIONS_TABLE, MIGRATIONS_SCHEMA, MIGRATIONS_META_NAMESPACE, MIGRATIONS_META_ID, SQLService, DuckDbDatabaseHandle, DuckDbAction, DuckDbService, AsyncQueue, HooksService, VaultVersionConfig, CURRENT_VAULT_VERSION, VaultHeaders, DB_NAME, DB_VERSION, STORE_NAME, WRAP_KEY_ID, DataVaultService, HEX, URN_PREFIX, NETWORK_NAME_RE, PKH_EIP155_DID_RE, NetworkIdError, DEFAULT_ENCRYPTION_ALG, ENVELOPE_VERSION, DEFAULT_KEY_VERSION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, EncryptionService;
+var import_zod, import_decrypt_transport_response_error, ErrorCodes, defaultRetryPolicy, TelemetryEvents, REDACTED, SAFE_NUMBER_FIELDS, SAFE_BOOLEAN_FIELDS, DEBUG_FLAG, MAX_EVENTS, TinyCloudDebugLogger, tinyCloudDebugLogger, ServiceErrorSchema, GenericResultSchema, KVResponseHeadersSchema, GenericKVResponseSchema, KVListResponseSchema, KVListResultSchema, ServiceRequestEventSchema, ServiceResponseEventSchema, ServiceErrorEventSchema, ServiceRetryEventSchema, TelemetrySpanEventSchema, RetryPolicySchema, ServiceSessionSchema, BaseService, PrefixedKVService, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, KVAction, MAX_KV_BATCH_READ_ITEMS, KVService, SQLMigrations, DatabaseHandle, SQLAction, DDL_TOKENS, MIGRATIONS_TABLE, MIGRATIONS_SCHEMA, MIGRATIONS_META_NAMESPACE, MIGRATIONS_META_ID, SQLService, DuckDbDatabaseHandle, DuckDbAction, DuckDbService, AsyncQueue, HooksService, VaultVersionConfig, CURRENT_VAULT_VERSION, VaultHeaders, DB_NAME, DB_VERSION, STORE_NAME, WRAP_KEY_ID, DataVaultService, HEX, URN_PREFIX, NETWORK_NAME_RE, PKH_EIP155_DID_RE, NetworkIdError, DEFAULT_ENCRYPTION_ALG, ENVELOPE_VERSION, DEFAULT_KEY_VERSION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, EncryptionService;
 var init_dist2 = __esm({
   "../sdk-services/dist/index.js"() {
     "use strict";
@@ -2405,8 +2437,6 @@ var init_dist2 = __esm({
     init_dist();
     init_dist();
     import_decrypt_transport_response_error = __toESM(require_decrypt_transport_response_error(), 1);
-    import_decrypt_transport_response_error2 = __toESM(require_decrypt_transport_response_error(), 1);
-    import_decrypt_transport_response_error3 = __toESM(require_decrypt_transport_response_error(), 1);
     ErrorCodes = {
       // Common errors
       NOT_FOUND: "NOT_FOUND",
@@ -3678,6 +3708,7 @@ var init_dist2 = __esm({
             }
             seen.add(path);
           }
+          let requestMayHaveDispatched = false;
           try {
             const body = new FormData();
             for (let index = 0; index < items.length; index++) {
@@ -3695,14 +3726,31 @@ var init_dist2 = __esm({
                 action: KVAction.PUT
               }))
             );
-            const response = await this.context.fetch(`${this.host}/invoke`, {
+            const url = `${this.host}/invoke`;
+            const init = {
               method: "POST",
               headers,
               body,
               signal: this.combineSignals(options?.signal)
-            });
+            };
+            const fetchFn = this.context.fetch;
+            requestMayHaveDispatched = true;
+            const response = await fetchFn(url, init);
             if (!response.ok) {
-              const errorText = await response.text();
+              let errorText;
+              try {
+                errorText = await response.text();
+              } catch (textError) {
+                const cause = textError instanceof Error ? textError : new Error(String(textError));
+                return err(
+                  serviceError(
+                    ErrorCodes.KV_WRITE_FAILED,
+                    `Failed to batch put ${items.length} key(s): ${response.status} - <response body could not be read: ${cause.message}>`,
+                    "kv",
+                    { cause, meta: { status: response.status, statusText: response.statusText } }
+                  )
+                );
+              }
               if (response.status === 401 || response.status === 403) {
                 const { resource, action } = parseAuthError(errorText);
                 return err(authUnauthorizedError("kv", errorText, {
@@ -3728,19 +3776,73 @@ var init_dist2 = __esm({
                 )
               );
             }
-            const batchResponse = this.normalizeBatchPutResponse(await response.json());
-            if (!batchResponse || batchResponse.count !== batchResponse.written.length) {
+            let rawBody;
+            try {
+              rawBody = await response.json();
+            } catch (jsonError) {
+              const cause = jsonError instanceof Error ? jsonError : new Error(String(jsonError));
+              return err(
+                serviceError(
+                  ErrorCodes.NETWORK_ERROR,
+                  `KV batchPut response was not valid JSON: ${cause.message}`,
+                  "kv",
+                  {
+                    cause,
+                    meta: {
+                      requestMayHaveDispatched: true,
+                      responseReceived: true,
+                      status: response.status,
+                      outcome: "batch-unconfirmed"
+                    }
+                  }
+                )
+              );
+            }
+            const batchResponse = this.normalizeBatchPutResponse(rawBody);
+            if (!batchResponse) {
               return err(
                 serviceError(
                   ErrorCodes.NETWORK_ERROR,
                   "KV batchPut response did not include matching written keys and count",
-                  "kv"
+                  "kv",
+                  {
+                    meta: {
+                      requestMayHaveDispatched: true,
+                      responseReceived: true,
+                      status: response.status,
+                      outcome: "batch-unconfirmed"
+                    }
+                  }
+                )
+              );
+            }
+            const requestedPaths = new Set(paths);
+            const writtenPaths = new Set(batchResponse.written);
+            const matchesRequest = batchResponse.count === paths.length && batchResponse.written.length === paths.length && writtenPaths.size === paths.length && batchResponse.written.every((key) => requestedPaths.has(key));
+            if (!matchesRequest) {
+              return err(
+                serviceError(
+                  ErrorCodes.NETWORK_ERROR,
+                  `KV batchPut response did not confirm all ${paths.length} requested key(s) were written`,
+                  "kv",
+                  {
+                    meta: {
+                      requestMayHaveDispatched: true,
+                      responseReceived: true,
+                      status: response.status,
+                      outcome: "batch-unconfirmed"
+                    }
+                  }
                 )
               );
             }
             return ok(batchResponse);
           } catch (error) {
-            return err(wrapError("kv", error));
+            const wrapped = wrapError("kv", error);
+            return err({
+              ...wrapped,
+              meta: { ...wrapped.meta, requestMayHaveDispatched }
+            });
           }
         });
       }
@@ -6737,15 +6839,28 @@ function normalizeSpace(space) {
 function isCapabilitySubset(requested, granted) {
   const missing = [];
   for (const req of requested) {
-    const match = granted.find((g) => canonicalizeEntryMatches(req, g));
-    if (match === void 0) {
+    const matchingScope = granted.filter(
+      (entry) => canonicalizeEntryScopeMatches(req, entry)
+    );
+    const requestedActions = expandActionShortNames(
+      req.service,
+      req.actions
+    );
+    const grantedActions = matchingScope.flatMap(
+      (entry) => expandActionShortNames(entry.service, entry.actions)
+    );
+    const covered = requestedActions.every(
+      (requestedAction) => grantedActions.some(
+        (grantedAction) => actionContains(grantedAction, requestedAction)
+      )
+    );
+    if (!covered) {
       missing.push(cloneEntry(req));
-      continue;
     }
   }
   return { subset: missing.length === 0, missing };
 }
-function canonicalizeEntryMatches(requested, granted) {
+function canonicalizeEntryScopeMatches(requested, granted) {
   if (requested.service !== granted.service) {
     return false;
   }
@@ -6755,15 +6870,6 @@ function canonicalizeEntryMatches(requested, granted) {
   if (!pathContains(granted.path, requested.path)) {
     return false;
   }
-  const reqActions = new Set(
-    expandActionShortNames(requested.service, requested.actions)
-  );
-  const grantedActions = expandActionShortNames(granted.service, granted.actions);
-  for (const a of reqActions) {
-    if (!grantedActions.some((grantedAction) => actionContains(grantedAction, a))) {
-      return false;
-    }
-  }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
     return false;
   }