@tinycloud/operations 0.3.4-beta.1 → 0.3.4-beta.3

package/dist/index.cjs

@@ -1051,6 +1051,18 @@ function storageLimitReachedError(service, message, meta) {
     meta
   };
 }
+function parseStorageQuotaBytes(responseText) {
+  const match = responseText.match(/Used:\s*(\d+)\s*bytes,\s*Limit:\s*(\d+)\s*bytes/i);
+  if (!match) return void 0;
+  return {
+    usedBytes: parseInt(match[1], 10),
+    limitBytes: parseInt(match[2], 10)
+  };
+}
+function storageRejectionError(service, status, meta, responseText) {
+  const quotaMeta = { ...meta, ...parseStorageQuotaBytes(responseText) };
+  return status === 402 ? storageQuotaExceededError(service, STORAGE_FULL_MESSAGE, quotaMeta) : storageLimitReachedError(service, STORAGE_WRITE_TOO_LARGE_MESSAGE, quotaMeta);
+}
 function wrapError(service, error, defaultCode = ErrorCodes.NETWORK_ERROR) {
   if (error instanceof Error) {
     if (error.name === "AbortError") {
@@ -1180,6 +1192,9 @@ function serializeSqlValues(values) {
     (value) => value instanceof Uint8Array ? Array.from(value) : value
   );
 }
+function isMissingTableError(message) {
+  return /no such table/i.test(message);
+}
 function migrationKey(namespace, id) {
   return `${encodeURIComponent(namespace)}:${encodeURIComponent(id)}`;
 }
@@ -1256,10 +1271,14 @@ async function responseError(service, message, response) {
     }
   } catch {
   }
-  return wrapError(
+  const error = wrapError(
     service,
     new Error(`${message}: ${response.status} ${detail}`)
   );
+  return {
+    ...error,
+    meta: { ...error.meta, status: response.status, statusText: response.statusText }
+  };
 }
 function isAbortError(error) {
   return error instanceof DOMException && error.name === "AbortError";
@@ -1661,6 +1680,9 @@ function defaultVaultMessage(input) {
       return input.message ?? `Public key not found for ${input.did}`;
     case "STORAGE_ERROR":
       return input.message ?? input.cause.message;
+    case "STORAGE_QUOTA_EXCEEDED":
+    case "STORAGE_LIMIT_REACHED":
+      return input.message;
   }
 }
 function vaultError(input) {
@@ -1671,6 +1693,15 @@ function vaultError(input) {
   };
   return { ok: false, error };
 }
+function kvWriteError(context, error) {
+  if (error.code === ErrorCodes.STORAGE_QUOTA_EXCEEDED || error.code === ErrorCodes.STORAGE_LIMIT_REACHED) {
+    return vaultError({ code: error.code, message: error.message, meta: error.meta });
+  }
+  return vaultError({
+    code: "STORAGE_ERROR",
+    cause: new Error(`${context}: ${error.message}`)
+  });
+}
 function canonicalize(value) {
   if (value === void 0) {
     return "";
@@ -2429,7 +2460,7 @@ function encOk(data) {
 function encErr(error) {
   return { ok: false, error };
 }
-var import_zod, import_decrypt_transport_response_error, ErrorCodes, defaultRetryPolicy, TelemetryEvents, REDACTED, SAFE_NUMBER_FIELDS, SAFE_BOOLEAN_FIELDS, DEBUG_FLAG, MAX_EVENTS, TinyCloudDebugLogger, tinyCloudDebugLogger, ServiceErrorSchema, GenericResultSchema, KVResponseHeadersSchema, GenericKVResponseSchema, KVListResponseSchema, KVListResultSchema, ServiceRequestEventSchema, ServiceResponseEventSchema, ServiceErrorEventSchema, ServiceRetryEventSchema, TelemetrySpanEventSchema, RetryPolicySchema, ServiceSessionSchema, BaseService, PrefixedKVService, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, KVAction, MAX_KV_BATCH_READ_ITEMS, KVService, SQLMigrations, DatabaseHandle, SQLAction, DDL_TOKENS, MIGRATIONS_TABLE, MIGRATIONS_SCHEMA, MIGRATIONS_META_NAMESPACE, MIGRATIONS_META_ID, SQLService, DuckDbDatabaseHandle, DuckDbAction, DuckDbService, AsyncQueue, HooksService, VaultVersionConfig, CURRENT_VAULT_VERSION, VaultHeaders, DB_NAME, DB_VERSION, STORE_NAME, WRAP_KEY_ID, DataVaultService, HEX, URN_PREFIX, NETWORK_NAME_RE, PKH_EIP155_DID_RE, NetworkIdError, DEFAULT_ENCRYPTION_ALG, ENVELOPE_VERSION, DEFAULT_KEY_VERSION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, EncryptionService;
+var import_zod, import_decrypt_transport_response_error, ErrorCodes, defaultRetryPolicy, TelemetryEvents, REDACTED, SAFE_NUMBER_FIELDS, SAFE_BOOLEAN_FIELDS, DEBUG_FLAG, MAX_EVENTS, TinyCloudDebugLogger, tinyCloudDebugLogger, ServiceErrorSchema, GenericResultSchema, KVResponseHeadersSchema, GenericKVResponseSchema, KVListResponseSchema, KVListResultSchema, ServiceRequestEventSchema, ServiceResponseEventSchema, ServiceErrorEventSchema, ServiceRetryEventSchema, TelemetrySpanEventSchema, RetryPolicySchema, ServiceSessionSchema, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, BaseService, PrefixedKVService, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, KVAction, MAX_KV_BATCH_READ_ITEMS, KVService, SQLMigrations, DatabaseHandle, SQLAction, DDL_TOKENS, MIGRATIONS_TABLE, MIGRATIONS_SCHEMA, MIGRATIONS_META_NAMESPACE, MIGRATIONS_META_ID, SQLService, DuckDbDatabaseHandle, DuckDbAction, DuckDbService, AsyncQueue, HooksService, VaultVersionConfig, CURRENT_VAULT_VERSION, VaultHeaders, DB_NAME, DB_VERSION, STORE_NAME, WRAP_KEY_ID, DataVaultService, HEX, URN_PREFIX, NETWORK_NAME_RE, PKH_EIP155_DID_RE, NetworkIdError, DEFAULT_ENCRYPTION_ALG, ENVELOPE_VERSION, DEFAULT_KEY_VERSION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, EncryptionService;
 var init_dist2 = __esm({
   "../sdk-services/dist/index.js"() {
     "use strict";
@@ -2712,6 +2743,8 @@ var init_dist2 = __esm({
       /** The session key JWK (required for invoke) */
       jwk: import_zod.z.object({}).passthrough()
     });
+    STORAGE_FULL_MESSAGE = "TinyCloud storage is full, so this change was not saved. Reading still works. Free up space or upgrade your plan to save again.";
+    STORAGE_WRITE_TOO_LARGE_MESSAGE = "This change is larger than the TinyCloud storage you have left, so it was not saved. Reading still works. Free up space or upgrade your plan to save it.";
     BaseService = class {
       constructor() {
         this.abortController = new AbortController();
@@ -3060,47 +3093,21 @@ var init_dist2 = __esm({
       get config() {
         return this._config;
       }
-      // Parses "Used: X bytes, Limit: Y bytes" from tinycloud-node error responses
-      parseQuotaInfo(errorText) {
-        const match = errorText.match(
-          /Used:\s*(\d+)\s*bytes,\s*Limit:\s*(\d+)\s*bytes/i
-        );
-        if (match) {
-          return {
-            usedBytes: parseInt(match[1], 10),
-            limitBytes: parseInt(match[2], 10)
-          };
-        }
-        return void 0;
-      }
       handleQuotaErrorResponse(response, errorText, key) {
-        if (response.status === 402) {
-          const quotaInfo = this.parseQuotaInfo(errorText);
-          return err(
-            storageQuotaExceededError(
-              "kv",
-              `Storage quota exceeded for key "${key}": ${errorText}`,
-              {
-                status: response.status,
-                ...quotaInfo ? { usedBytes: quotaInfo.usedBytes, limitBytes: quotaInfo.limitBytes } : {}
-              }
-            )
-          );
+        if (response.status !== 402 && response.status !== 413) {
+          return void 0;
         }
-        if (response.status === 413) {
-          const quotaInfo = this.parseQuotaInfo(errorText);
-          return err(
-            storageLimitReachedError(
-              "kv",
-              `Storage limit reached for key "${key}": ${errorText}`,
-              {
-                status: response.status,
-                ...quotaInfo ? { usedBytes: quotaInfo.usedBytes, limitBytes: quotaInfo.limitBytes } : {}
-              }
-            )
-          );
+        if (response.status === 413 && !parseStorageQuotaBytes(errorText)) {
+          return void 0;
         }
-        return void 0;
+        return err(
+          storageRejectionError(
+            "kv",
+            response.status,
+            { status: response.status, statusText: response.statusText, key },
+            errorText
+          )
+        );
       }
       /**
        * Classify a KV 404 by reading the response body once.
@@ -3378,12 +3385,11 @@ var init_dist2 = __esm({
           if (!response.ok) {
             const errorText = await response.text();
             if (response.status === 401 || response.status === 403) {
-              const { resource, action: requiredAction } = parseAuthError(errorText);
-              return err(authUnauthorizedError("kv", errorText, {
-                status: response.status,
-                ...requiredAction && { requiredAction },
-                ...resource && { resource }
-              }));
+              return this.authorizationFailure(
+                `Failed to batch read ${keys.length} key(s)`,
+                response,
+                errorText
+              );
             }
             if (response.status === 413) {
               return err(serviceError(
@@ -3482,23 +3488,39 @@ var init_dist2 = __esm({
         } catch {
         }
         if (response.status === 401 || response.status === 403) {
-          const { resource, action } = parseAuthError(errorText);
-          return err(authUnauthorizedError("kv", errorText, {
-            status: response.status,
-            ...action && { requiredAction: action },
-            ...resource && { resource }
-          }));
+          return this.authorizationFailure(
+            `Failed to create signed read URL for key ${JSON.stringify(key)}`,
+            response,
+            errorText
+          );
         }
         const code = response.status === 400 ? ErrorCodes.INVALID_INPUT : ErrorCodes.NETWORK_ERROR;
         return err(
           serviceError(
             code,
-            `Failed to create signed read URL for key "${key}": ${response.status} - ${errorText}`,
+            `Failed to create signed read URL for key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
             "kv",
             { meta: { status: response.status, statusText: response.statusText } }
           )
         );
       }
+      /**
+       * AUTH_UNAUTHORIZED for a 401/403 response. The message keeps the HTTP
+       * status and the server text (`<context>: <status> - <text>`, the same
+       * shape as every other KV failure) so callers that rethrow only the message
+       * still see the status; `meta.status` carries it for typed callers.
+       * Resource/ability hints are parsed from the raw body, never the message.
+       */
+      authorizationFailure(context, response, errorText, extraMeta = {}) {
+        const { resource, action } = parseAuthError(errorText);
+        const detail = errorText.trim().length > 0 ? errorText : response.statusText || "authorization failed";
+        return err(authUnauthorizedError("kv", `${context}: ${response.status} - ${detail}`, {
+          status: response.status,
+          ...action && { requiredAction: action },
+          ...resource && { resource },
+          ...extraMeta
+        }));
+      }
       normalizeSignedReadUrlResponse(data) {
         if (!data || typeof data !== "object") {
           return void 0;
@@ -3541,14 +3563,13 @@ var init_dist2 = __esm({
             if (!response.ok) {
               if (response.status === 401 || response.status === 403) {
                 const errorText2 = await response.text();
-                const { resource, action } = parseAuthError(errorText2);
                 const permissionHint = parsePermissionHintFromErrorText(errorText2);
-                return err(authUnauthorizedError("kv", errorText2, {
-                  status: response.status,
-                  ...action && { requiredAction: action },
-                  ...resource && { resource },
-                  ...permissionHint === void 0 ? {} : { permissionHint }
-                }));
+                return this.authorizationFailure(
+                  `Failed to get key ${JSON.stringify(key)}`,
+                  response,
+                  errorText2,
+                  permissionHint === void 0 ? {} : { permissionHint }
+                );
               }
               if (response.status === 404) {
                 return this.classifyNotFound(response, key);
@@ -3557,7 +3578,7 @@ var init_dist2 = __esm({
               if (response.status === 413) {
                 return err(serviceError(
                   ErrorCodes.KV_RESPONSE_TOO_LARGE,
-                  `KV value at key "${key}" exceeds the requested response limit`,
+                  `KV value at key ${JSON.stringify(key)} exceeds the requested response limit`,
                   "kv",
                   { meta: { status: response.status, statusText: response.statusText } }
                 ));
@@ -3565,7 +3586,7 @@ var init_dist2 = __esm({
               return err(
                 serviceError(
                   ErrorCodes.NETWORK_ERROR,
-                  `Failed to get key "${key}": ${response.status} - ${errorText}`,
+                  `Failed to get key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
                   "kv",
                   { meta: { status: response.status, statusText: response.statusText } }
                 )
@@ -3621,21 +3642,18 @@ var init_dist2 = __esm({
               }
             );
             if (response.status === 401 || response.status === 403) {
-              const errorText = await response.text();
-              const message = errorText.trim().length > 0 ? errorText : `Failed to put key "${key}": ${response.status} - ${response.statusText || "authorization failed"}`;
-              const { resource, action: requiredAction } = parseAuthError(errorText);
-              return err(authUnauthorizedError("kv", message, {
-                status: response.status,
-                ...requiredAction && { requiredAction },
-                ...resource && { resource }
-              }));
+              return this.authorizationFailure(
+                `Failed to put key ${JSON.stringify(key)}`,
+                response,
+                await response.text()
+              );
             }
             if (!response.ok) {
               const errorText = await response.text();
               if (response.status === 412) {
                 return err(serviceError(
                   ErrorCodes.KV_PRECONDITION_FAILED,
-                  `KV precondition failed for key "${key}"`,
+                  `KV precondition failed for key ${JSON.stringify(key)}`,
                   "kv",
                   { meta: { status: response.status, statusText: response.statusText } }
                 ));
@@ -3643,7 +3661,7 @@ var init_dist2 = __esm({
               if (response.status === 503 && (options?.ifMatch !== void 0 || options?.ifNoneMatch !== void 0)) {
                 return err(serviceError(
                   ErrorCodes.KV_CONFLICT,
-                  `Concurrent KV update conflicted for key "${key}"`,
+                  `Concurrent KV update conflicted for key ${JSON.stringify(key)}`,
                   "kv",
                   { meta: { status: response.status, statusText: response.statusText } }
                 ));
@@ -3659,7 +3677,7 @@ var init_dist2 = __esm({
               return err(
                 serviceError(
                   ErrorCodes.KV_WRITE_FAILED,
-                  `Failed to put key "${key}": ${response.status} - ${errorText}`,
+                  `Failed to put key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
                   "kv",
                   { meta: { status: response.status, statusText: response.statusText } }
                 )
@@ -3753,12 +3771,11 @@ var init_dist2 = __esm({
                 );
               }
               if (response.status === 401 || response.status === 403) {
-                const { resource, action } = parseAuthError(errorText);
-                return err(authUnauthorizedError("kv", errorText, {
-                  status: response.status,
-                  ...action && { requiredAction: action },
-                  ...resource && { resource }
-                }));
+                return this.authorizationFailure(
+                  `Failed to batch put ${items.length} key(s)`,
+                  response,
+                  errorText
+                );
               }
               const quotaError = this.handleQuotaErrorResponse(
                 response,
@@ -3879,13 +3896,11 @@ var init_dist2 = __esm({
             );
             if (!response.ok) {
               if (response.status === 401) {
-                const errorText2 = await response.text();
-                const { resource, action } = parseAuthError(errorText2);
-                return err(authUnauthorizedError("kv", errorText2, {
-                  status: response.status,
-                  ...action && { requiredAction: action },
-                  ...resource && { resource }
-                }));
+                return this.authorizationFailure(
+                  "Failed to list keys",
+                  response,
+                  await response.text()
+                );
               }
               const errorText = await response.text();
               return err(
@@ -3934,13 +3949,11 @@ var init_dist2 = __esm({
             );
             if (!response.ok) {
               if (response.status === 401) {
-                const errorText2 = await response.text();
-                const { resource, action } = parseAuthError(errorText2);
-                return err(authUnauthorizedError("kv", errorText2, {
-                  status: response.status,
-                  ...action && { requiredAction: action },
-                  ...resource && { resource }
-                }));
+                return this.authorizationFailure(
+                  `Failed to delete key ${JSON.stringify(key)}`,
+                  response,
+                  await response.text()
+                );
               }
               if (response.status === 404) {
                 return this.classifyNotFound(response, key);
@@ -3949,7 +3962,7 @@ var init_dist2 = __esm({
               if (response.status === 412) {
                 return err(serviceError(
                   ErrorCodes.KV_PRECONDITION_FAILED,
-                  `KV precondition failed for key "${key}"`,
+                  `KV precondition failed for key ${JSON.stringify(key)}`,
                   "kv",
                   { meta: { status: response.status, statusText: response.statusText } }
                 ));
@@ -3957,7 +3970,7 @@ var init_dist2 = __esm({
               if (response.status === 503 && options?.ifMatch !== void 0) {
                 return err(serviceError(
                   ErrorCodes.KV_CONFLICT,
-                  `Concurrent KV delete conflicted for key "${key}"`,
+                  `Concurrent KV delete conflicted for key ${JSON.stringify(key)}`,
                   "kv",
                   { meta: { status: response.status, statusText: response.statusText } }
                 ));
@@ -3965,7 +3978,7 @@ var init_dist2 = __esm({
               return err(
                 serviceError(
                   ErrorCodes.NETWORK_ERROR,
-                  `Failed to delete key "${key}": ${response.status} - ${errorText}`,
+                  `Failed to delete key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
                   "kv",
                   { meta: { status: response.status, statusText: response.statusText } }
                 )
@@ -3998,13 +4011,11 @@ var init_dist2 = __esm({
             );
             if (!response.ok) {
               if (response.status === 401) {
-                const errorText2 = await response.text();
-                const { resource, action } = parseAuthError(errorText2);
-                return err(authUnauthorizedError("kv", errorText2, {
-                  status: response.status,
-                  ...action && { requiredAction: action },
-                  ...resource && { resource }
-                }));
+                return this.authorizationFailure(
+                  `Failed to get metadata for key ${JSON.stringify(key)}`,
+                  response,
+                  await response.text()
+                );
               }
               if (response.status === 404) {
                 return this.classifyNotFound(response, key);
@@ -4013,7 +4024,7 @@ var init_dist2 = __esm({
               return err(
                 serviceError(
                   ErrorCodes.NETWORK_ERROR,
-                  `Failed to get metadata for key "${key}": ${response.status} - ${errorText}`,
+                  `Failed to get metadata for key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
                   "kv",
                   { meta: { status: response.status, statusText: response.statusText } }
                 )
@@ -4385,21 +4396,24 @@ var init_dist2 = __esm({
       }
       async applyMigrationsOnDbUnlocked(dbName, options) {
         return this.withTelemetry("migrations.apply", dbName, async () => {
-          const created = await this.ensureMigrationsTable(dbName, options.signal);
-          if (!created.ok) return created;
           const listed = await this.queryOnDb(
             dbName,
             `SELECT id FROM ${MIGRATIONS_TABLE} WHERE namespace = ? ORDER BY applied_at, id`,
             [options.namespace],
             { signal: options.signal }
           );
-          if (!listed.ok) return listed;
+          const tableMissing = !listed.ok && (listed.error.code === ErrorCodes.SQL_DATABASE_NOT_FOUND || isMissingTableError(listed.error.message));
+          if (!listed.ok && !tableMissing) return listed;
           const appliedIds = new Set(
-            listed.data.rows.map((row) => rowValue(row, 0)).filter((id) => typeof id === "string")
+            (listed.ok ? listed.data.rows : []).map((row) => rowValue(row, 0)).filter((id) => typeof id === "string")
           );
           const skipped = options.migrations.filter((migration) => appliedIds.has(migration.id)).map((migration) => migration.id);
           const pending = options.migrations.filter((migration) => !appliedIds.has(migration.id));
           const applied = [];
+          if (pending.length > 0 && tableMissing) {
+            const created = await this.ensureMigrationsTable(dbName, options.signal);
+            if (!created.ok) return created;
+          }
           for (const migration of pending) {
             const result = await this.applyOneMigration(dbName, options.namespace, migration, options.signal);
             if (!result.ok) return result;
@@ -4502,6 +4516,10 @@ var init_dist2 = __esm({
       }
       async handleErrorResponse(response, operation) {
         const errorText = await response.text();
+        const meta = responseErrorMeta(response.status, response.statusText, errorText);
+        if (response.status === 402) {
+          return err(storageRejectionError("sql", 402, meta, errorText));
+        }
         const errorBody = parseServiceErrorBody(errorText);
         const errorCode = this.mapHttpStatusToErrorCode(
           response.status,
@@ -4514,7 +4532,6 @@ var init_dist2 = __esm({
           errorText,
           errorBody
         );
-        const meta = responseErrorMeta(response.status, response.statusText, errorText);
         if (response.status === 401) {
           const { resource, action } = parseAuthError(errorText);
           if (action) meta.requiredAction = action;
@@ -4850,6 +4867,10 @@ var init_dist2 = __esm({
       }
       async handleErrorResponse(response, operation) {
         const errorText = await response.text();
+        const meta = responseErrorMeta(response.status, response.statusText, errorText);
+        if (response.status === 402) {
+          return err(storageRejectionError("duckdb", 402, meta, errorText));
+        }
         const errorBody = parseServiceErrorBody(errorText);
         const errorCode = this.mapHttpStatusToErrorCode(
           response.status,
@@ -4862,7 +4883,6 @@ var init_dist2 = __esm({
           errorText,
           errorBody
         );
-        const meta = responseErrorMeta(response.status, response.statusText, errorText);
         if (response.status === 401) {
           const { resource, action } = parseAuthError(errorText);
           if (action) meta.requiredAction = action;
@@ -5597,12 +5617,7 @@ var init_dist2 = __esm({
             JSON.stringify(envelopeResult.data)
           );
           if (!valuePutResult.ok) {
-            return vaultError({
-              code: "STORAGE_ERROR",
-              cause: new Error(
-                `Failed to store encrypted value: ${valuePutResult.error.message}`
-              )
-            });
+            return kvWriteError("Failed to store encrypted value", valuePutResult.error);
           }
           return { ok: true, data: void 0 };
         } catch (error) {
@@ -5820,12 +5835,7 @@ var init_dist2 = __esm({
               keyPayload
             );
             if (!keyPutResult.ok) {
-              return vaultError({
-                code: "STORAGE_ERROR",
-                cause: new Error(
-                  `Failed to store key blob: ${keyPutResult.error.message}`
-                )
-              });
+              return kvWriteError("Failed to store key blob", keyPutResult.error);
             }
             const valuePayload = JSON.stringify({
               data: base64Encode(encrypted),
@@ -5836,12 +5846,7 @@ var init_dist2 = __esm({
               valuePayload
             );
             if (!valuePutResult.ok) {
-              return vaultError({
-                code: "STORAGE_ERROR",
-                cause: new Error(
-                  `Failed to store encrypted value: ${valuePutResult.error.message}`
-                )
-              });
+              return kvWriteError("Failed to store encrypted value", valuePutResult.error);
             }
             return ok(void 0);
           } catch (error) {
@@ -6172,12 +6177,7 @@ var init_dist2 = __esm({
               grantPayload
             );
             if (!grantPutResult.ok) {
-              return vaultError({
-                code: "STORAGE_ERROR",
-                cause: new Error(
-                  `Failed to store grant: ${grantPutResult.error.message}`
-                )
-              });
+              return kvWriteError("Failed to store grant", grantPutResult.error);
             }
             return ok(void 0);
           } catch (error) {
@@ -6522,12 +6522,7 @@ var init_dist2 = __esm({
               keyPayload
             );
             if (!keyPutResult.ok) {
-              return vaultError({
-                code: "STORAGE_ERROR",
-                cause: new Error(
-                  `Failed to store rotated key blob: ${keyPutResult.error.message}`
-                )
-              });
+              return kvWriteError("Failed to store rotated key blob", keyPutResult.error);
             }
             const valuePayload = JSON.stringify({
               data: base64Encode(encrypted),
@@ -6538,12 +6533,7 @@ var init_dist2 = __esm({
               valuePayload
             );
             if (!valuePutResult.ok) {
-              return vaultError({
-                code: "STORAGE_ERROR",
-                cause: new Error(
-                  `Failed to store re-encrypted value: ${valuePutResult.error.message}`
-                )
-              });
+              return kvWriteError("Failed to store re-encrypted value", valuePutResult.error);
             }
             for (const did of remainingGrantees) {
               const grantResult = await this.reencrypt(key, did);