@tinycloud/operations 0.4.0-beta.11 → 0.4.0-beta.13

package/dist/index.cjs

@@ -357,8 +357,13 @@ function canonicalizeRecapCaveats(caveats) {
   }
   return `[${branches.join(",")}]`;
 }
+function isExplicitOnlyAction(action) {
+  return Object.prototype.hasOwnProperty.call(EXPLICIT_ONLY_ACTIONS, action);
+}
 function actionContains(grantedAction, requestedAction) {
-  if (grantedAction === "*" || grantedAction === requestedAction) return true;
+  if (grantedAction === requestedAction) return true;
+  if (isExplicitOnlyAction(requestedAction)) return false;
+  if (grantedAction === "*") return true;
   if (!grantedAction.endsWith("/*")) return false;
   const service = grantedAction.slice(0, -2);
   return requestedAction === service || requestedAction.startsWith(`${service}/`);
@@ -383,10 +388,15 @@ function cloneEntry(entry) {
     ...entry.expiry !== void 0 ? { expiry: entry.expiry } : {}
   };
 }
+var EXPLICIT_ONLY_ACTIONS;
 var init_capabilities = __esm({
   "../sdk-core/src/capabilities.ts"() {
     "use strict";
     init_manifest();
+    EXPLICIT_ONLY_ACTIONS = {
+      "tinycloud.kv/sync": true,
+      "tinycloud.kv/retain": true
+    };
   }
 });
 
@@ -3615,6 +3625,32 @@ ORDER BY type, name`;
   }
 });
 
+// src/contract.ts
+var STORED_GRANT_SKIP_REASONS, DELEGATION_CID_PATTERN;
+var init_contract = __esm({
+  "src/contract.ts"() {
+    "use strict";
+    STORED_GRANT_SKIP_REASONS = [
+      "malformed",
+      "unbound",
+      "outside_request",
+      "host_mismatch",
+      "expired",
+      "cid_mismatch",
+      "authority_invalid",
+      "proof_missing",
+      "proof_invalid",
+      "owner_mismatch",
+      "audience_mismatch",
+      "resources_mismatch",
+      "unsupported",
+      "activation_rejected",
+      "invalid"
+    ];
+    DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
+  }
+});
+
 // src/delegation-binding.ts
 function bindingMigrationPath(profile) {
   return (0, import_node_path2.join)(profilePath(profile), "delegation-binding-migration.json");
@@ -3638,12 +3674,12 @@ function replayLimit(entry, migrated) {
   if (binding.success) return binding.data.requested;
   return !migrated && kind === "compact" && !("authorityRequest" in entry) ? "signed" : void 0;
 }
-function bindToSignedCapabilities(record, signed, source, recordedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+function bindToRequest(record, requested, source, recordedAt = (/* @__PURE__ */ new Date()).toISOString()) {
   return {
     ...record,
     authorityRequest: DelegationRequestBindingSchema.parse({
       requestId: `${REQUEST_ID_PREFIX[source]}:${record.delegation.cid}`,
-      requested: structuredClone(signed)
+      requested: structuredClone(requested)
     }),
     authorityRequestAudit: { source, recordedAt, note: BINDING_NOTES[source] }
   };
@@ -3699,23 +3735,40 @@ async function migratedRecord(node, entry, host, recordedAt) {
   const signed = await signedCapabilities(node, delegation, host);
   if (signed === void 0) return void 0;
   try {
-    return bindToSignedCapabilities({ ...entry, delegation: { ...entry.delegation, cid: delegation.cid } }, signed, "migration", recordedAt);
+    return bindToRequest({ ...entry, delegation: { ...entry.delegation, cid: delegation.cid } }, signed, "migration", recordedAt);
   } catch {
     return void 0;
   }
 }
+function skipped(reason) {
+  return { status: "skipped", reason };
+}
 async function replayStoredDelegation(node, entry, options) {
+  const kind = storedDelegationKind(entry);
   const delegation = normalizeStoredDelegation(entry);
-  if (delegation === void 0 || delegation.expiry.getTime() <= Date.now()) return void 0;
+  if (kind === "refused" || delegation === void 0) return skipped("malformed");
+  if (delegation.expiry.getTime() <= Date.now()) return NOT_REPLAYED;
+  if (kind === "other") return skipped("proof_missing");
   const limit = replayLimit(entry, options.migrated);
-  if (limit === void 0) return void 0;
-  const authorize = limit === "signed" ? () => true : (effective) => delegationWithinRequest(limit, effective, options.resolveSpace);
+  if (limit === void 0) return skipped("unbound");
+  let outsideRequest = false;
+  const authorize = limit === "signed" ? () => true : (effective) => {
+    outsideRequest = !delegationWithinRequest(limit, effective, options.resolveSpace);
+    return !outsideRequest;
+  };
   try {
-    return await nodeSdk3.activateValidatedRuntimeDelegation(node, delegation, { host: options.host, authorize });
-  } catch {
-    return void 0;
+    return {
+      status: "installed",
+      delegation: await nodeSdk3.activateValidatedRuntimeDelegation(node, delegation, { host: options.host, authorize })
+    };
+  } catch (error) {
+    return skipped(outsideRequest ? "outside_request" : rejectionReason(error));
   }
 }
+function rejectionReason(error) {
+  const reason = isRecord4(error) ? error.reason : void 0;
+  return typeof reason === "string" && STORED_GRANT_SKIP_REASONS.includes(reason) ? reason : "invalid";
+}
 async function bindingMigrationRecorded(profile) {
   try {
     return await readJson(bindingMigrationPath(profile)) !== null;
@@ -3760,7 +3813,7 @@ function recordKey(entry) {
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var import_node_path2, nodeSdk3, REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS;
+var import_node_path2, nodeSdk3, REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS, NOT_REPLAYED;
 var init_delegation_binding = __esm({
   "src/delegation-binding.ts"() {
     "use strict";
@@ -3768,17 +3821,21 @@ var init_delegation_binding = __esm({
     nodeSdk3 = __toESM(require("@tinycloud/node-sdk"), 1);
     init_artifacts();
     init_authority();
+    init_contract();
     init_state();
     init_secrets();
     REQUEST_ID_PREFIX = {
       migration: "migrated",
-      "unbound-import": "unbound-import"
+      "unbound-import": "unbound-import",
+      "cli-grant": "cli-grant"
     };
     BINDING_NOTES = {
       migration: "Stored without a request binding before bindings were required. Bound at migration to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them.",
-      "unbound-import": "Imported by `tc auth import` without a stored request. Bound to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them."
+      "unbound-import": "Imported by `tc auth import` without a stored request. Bound to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them.",
+      "cli-grant": "Granted to this CLI by `tc auth request --grant` or a permission escalation, and checked against the request it answered. Bound to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them."
     };
     MIGRATION_LOCK_TIMEOUT_MS = 250;
+    NOT_REPLAYED = { status: "not-replayed" };
   }
 });
 
@@ -4190,7 +4247,18 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
         ));
       }
     } else {
-      await node.restoreSession(activeSession);
+      try {
+        await node.restoreSession(activeSession);
+      } catch (error) {
+        if (isRecord7(error) && error.code === "AUTH_EXPIRED") {
+          return failed(summary, operationError(
+            "AUTH_REQUIRED",
+            "The stored session has expired or is no longer valid. Sign in again.",
+            { retryable: false }
+          ));
+        }
+        throw error;
+      }
     }
     const activeSessionDid = normalizeDid(node.sessionDid);
     const livePrincipalDid = normalizeDid(node.did);
@@ -4198,6 +4266,7 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
     const livePermissions = [...node.getVerifiedSessionCapabilities()];
     const resolveSpace2 = operationSpaceResolver(node, authenticatedSpace ?? summary.space);
     const seenCids = /* @__PURE__ */ new Set();
+    const warnings = [];
     if (!explicitPrivateKeyOverride) {
       const activator = node;
       const migrated = await prepareStoredDelegationReplay(profileName, activator, {
@@ -4207,20 +4276,25 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
         migrate: activeSession !== void 0
       });
       for (const entry of await readAdditionalDelegations(profileName)) {
-        const activated = await replayStoredDelegation(activator, entry, {
+        const replay = await replayStoredDelegation(activator, entry, {
           host: summary.host,
           migrated,
           resolveSpace: resolveSpace2
         });
-        if (activated !== void 0 && !seenCids.has(activated.cid)) {
-          seenCids.add(activated.cid);
-          livePermissions.push(...activated.effectivePermissions);
+        if (replay.status === "installed") {
+          if (!seenCids.has(replay.delegation.cid)) {
+            seenCids.add(replay.delegation.cid);
+            livePermissions.push(...replay.delegation.effectivePermissions);
+          }
+        } else if (replay.status === "skipped") {
+          warnings.push(skippedGrantWarning(node, entry, replay.reason));
         }
       }
     }
     const runtime = {
       node,
-      granted: canonicalizeCapabilities(livePermissions)
+      granted: canonicalizeCapabilities(livePermissions),
+      ...warnings.length === 0 ? {} : { warnings }
     };
     return {
       ok: true,
@@ -4244,6 +4318,24 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
     ));
   }
 }
+function skippedGrantWarning(node, entry, reason) {
+  const grantCid = verifiedStoredCid(node, entry);
+  return { code: "STORED_GRANT_SKIPPED", reason, ...grantCid === void 0 ? {} : { grantCid } };
+}
+function verifiedStoredCid(node, entry) {
+  const delegation = isRecord7(entry) && isRecord7(entry.delegation) ? entry.delegation : void 0;
+  const header = isRecord7(delegation?.delegationHeader) ? delegation.delegationHeader : void 0;
+  const cid = delegation?.cid;
+  const computeDelegationCid = isRecord7(node) ? node.computeDelegationCid : void 0;
+  if (typeof cid !== "string" || typeof header?.Authorization !== "string" || typeof computeDelegationCid !== "function") {
+    return void 0;
+  }
+  try {
+    return computeDelegationCid.call(node, header.Authorization) === cid && DELEGATION_CID.test(cid) ? cid : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function spaceForAuthenticatedPrincipal(principal2) {
   if (principal2 === void 0) return void 0;
   try {
@@ -4292,17 +4384,19 @@ function unresolvedSummary(target) {
     posture: "unauthenticated"
   };
 }
-var nodeSdk4;
+var nodeSdk4, DELEGATION_CID;
 var init_runtime = __esm({
   "src/runtime.ts"() {
     "use strict";
     nodeSdk4 = __toESM(require("@tinycloud/node-sdk"), 1);
+    init_contract();
     init_authority();
     init_errors();
     init_profile();
     init_secrets();
     init_state();
     init_delegation_binding();
+    DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);
   }
 });
 
@@ -4685,9 +4779,13 @@ async function invokeOperation(operationId, operationVersion, invocationTarget,
       unknownInput
     );
     if (isPreparedError(prepared)) return prepared.result;
-    return executePreparedInvocation(prepared);
+    return withRuntimeWarnings(await executePreparedInvocation(prepared), prepared);
   });
 }
+function withRuntimeWarnings(result, prepared) {
+  const warnings = prepared.runtimeResolution.context.runtime?.warnings;
+  return warnings === void 0 || warnings.length === 0 ? result : { ...result, warnings: [...warnings] };
+}
 function isPreparedError(prepared) {
   return "status" in prepared;
 }