@tinycloud/operations 0.4.0-beta.11 → 0.4.0-beta.13

package/dist/cli-runtime.d.cts

@@ -1,4 +1,4 @@
-import { I as InvocationTarget, a as OperationResult } from './contract-eWtDSMeI.cjs';
+import { I as InvocationTarget, a as OperationResult } from './contract-BRwWJpPs.cjs';
 
 /**
  * The only published CLI acquisition helper. Its fixed operation identity is

package/dist/cli-runtime.d.ts

@@ -1,4 +1,4 @@
-import { I as InvocationTarget, a as OperationResult } from './contract-eWtDSMeI.js';
+import { I as InvocationTarget, a as OperationResult } from './contract-BRwWJpPs.js';
 
 /**
  * The only published CLI acquisition helper. Its fixed operation identity is

package/dist/cli-runtime.js

@@ -355,8 +355,13 @@ function canonicalizeRecapCaveats(caveats) {
   }
   return `[${branches.join(",")}]`;
 }
+function isExplicitOnlyAction(action) {
+  return Object.prototype.hasOwnProperty.call(EXPLICIT_ONLY_ACTIONS, action);
+}
 function actionContains(grantedAction, requestedAction) {
-  if (grantedAction === "*" || grantedAction === requestedAction) return true;
+  if (grantedAction === requestedAction) return true;
+  if (isExplicitOnlyAction(requestedAction)) return false;
+  if (grantedAction === "*") return true;
   if (!grantedAction.endsWith("/*")) return false;
   const service = grantedAction.slice(0, -2);
   return requestedAction === service || requestedAction.startsWith(`${service}/`);
@@ -381,10 +386,15 @@ function cloneEntry(entry) {
     ...entry.expiry !== void 0 ? { expiry: entry.expiry } : {}
   };
 }
+var EXPLICIT_ONLY_ACTIONS;
 var init_capabilities = __esm({
   "../sdk-core/src/capabilities.ts"() {
     "use strict";
     init_manifest();
+    EXPLICIT_ONLY_ACTIONS = {
+      "tinycloud.kv/sync": true,
+      "tinycloud.kv/retain": true
+    };
   }
 });
 
@@ -3626,6 +3636,32 @@ ORDER BY type, name`;
   }
 });
 
+// src/contract.ts
+var STORED_GRANT_SKIP_REASONS, DELEGATION_CID_PATTERN;
+var init_contract = __esm({
+  "src/contract.ts"() {
+    "use strict";
+    STORED_GRANT_SKIP_REASONS = [
+      "malformed",
+      "unbound",
+      "outside_request",
+      "host_mismatch",
+      "expired",
+      "cid_mismatch",
+      "authority_invalid",
+      "proof_missing",
+      "proof_invalid",
+      "owner_mismatch",
+      "audience_mismatch",
+      "resources_mismatch",
+      "unsupported",
+      "activation_rejected",
+      "invalid"
+    ];
+    DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
+  }
+});
+
 // src/delegation-binding.ts
 import { join as join2 } from "path";
 import * as nodeSdk3 from "@tinycloud/node-sdk";
@@ -3651,12 +3687,12 @@ function replayLimit(entry, migrated) {
   if (binding.success) return binding.data.requested;
   return !migrated && kind === "compact" && !("authorityRequest" in entry) ? "signed" : void 0;
 }
-function bindToSignedCapabilities(record, signed, source, recordedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+function bindToRequest(record, requested, source, recordedAt = (/* @__PURE__ */ new Date()).toISOString()) {
   return {
     ...record,
     authorityRequest: DelegationRequestBindingSchema.parse({
       requestId: `${REQUEST_ID_PREFIX[source]}:${record.delegation.cid}`,
-      requested: structuredClone(signed)
+      requested: structuredClone(requested)
     }),
     authorityRequestAudit: { source, recordedAt, note: BINDING_NOTES[source] }
   };
@@ -3712,23 +3748,40 @@ async function migratedRecord(node, entry, host, recordedAt) {
   const signed = await signedCapabilities(node, delegation, host);
   if (signed === void 0) return void 0;
   try {
-    return bindToSignedCapabilities({ ...entry, delegation: { ...entry.delegation, cid: delegation.cid } }, signed, "migration", recordedAt);
+    return bindToRequest({ ...entry, delegation: { ...entry.delegation, cid: delegation.cid } }, signed, "migration", recordedAt);
   } catch {
     return void 0;
   }
 }
+function skipped(reason) {
+  return { status: "skipped", reason };
+}
 async function replayStoredDelegation(node, entry, options) {
+  const kind = storedDelegationKind(entry);
   const delegation = normalizeStoredDelegation(entry);
-  if (delegation === void 0 || delegation.expiry.getTime() <= Date.now()) return void 0;
+  if (kind === "refused" || delegation === void 0) return skipped("malformed");
+  if (delegation.expiry.getTime() <= Date.now()) return NOT_REPLAYED;
+  if (kind === "other") return skipped("proof_missing");
   const limit = replayLimit(entry, options.migrated);
-  if (limit === void 0) return void 0;
-  const authorize = limit === "signed" ? () => true : (effective) => delegationWithinRequest(limit, effective, options.resolveSpace);
+  if (limit === void 0) return skipped("unbound");
+  let outsideRequest = false;
+  const authorize = limit === "signed" ? () => true : (effective) => {
+    outsideRequest = !delegationWithinRequest(limit, effective, options.resolveSpace);
+    return !outsideRequest;
+  };
   try {
-    return await nodeSdk3.activateValidatedRuntimeDelegation(node, delegation, { host: options.host, authorize });
-  } catch {
-    return void 0;
+    return {
+      status: "installed",
+      delegation: await nodeSdk3.activateValidatedRuntimeDelegation(node, delegation, { host: options.host, authorize })
+    };
+  } catch (error) {
+    return skipped(outsideRequest ? "outside_request" : rejectionReason(error));
   }
 }
+function rejectionReason(error) {
+  const reason = isRecord4(error) ? error.reason : void 0;
+  return typeof reason === "string" && STORED_GRANT_SKIP_REASONS.includes(reason) ? reason : "invalid";
+}
 async function bindingMigrationRecorded(profile) {
   try {
     return await readJson(bindingMigrationPath(profile)) !== null;
@@ -3773,23 +3826,27 @@ function recordKey(entry) {
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS;
+var REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS, NOT_REPLAYED;
 var init_delegation_binding = __esm({
   "src/delegation-binding.ts"() {
     "use strict";
     init_artifacts();
     init_authority();
+    init_contract();
     init_state();
     init_secrets();
     REQUEST_ID_PREFIX = {
       migration: "migrated",
-      "unbound-import": "unbound-import"
+      "unbound-import": "unbound-import",
+      "cli-grant": "cli-grant"
     };
     BINDING_NOTES = {
       migration: "Stored without a request binding before bindings were required. Bound at migration to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them.",
-      "unbound-import": "Imported by `tc auth import` without a stored request. Bound to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them."
+      "unbound-import": "Imported by `tc auth import` without a stored request. Bound to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them.",
+      "cli-grant": "Granted to this CLI by `tc auth request --grant` or a permission escalation, and checked against the request it answered. Bound to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them."
     };
     MIGRATION_LOCK_TIMEOUT_MS = 250;
+    NOT_REPLAYED = { status: "not-replayed" };
   }
 });
 
@@ -4202,7 +4259,18 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
         ));
       }
     } else {
-      await node.restoreSession(activeSession);
+      try {
+        await node.restoreSession(activeSession);
+      } catch (error) {
+        if (isRecord7(error) && error.code === "AUTH_EXPIRED") {
+          return failed(summary, operationError(
+            "AUTH_REQUIRED",
+            "The stored session has expired or is no longer valid. Sign in again.",
+            { retryable: false }
+          ));
+        }
+        throw error;
+      }
     }
     const activeSessionDid = normalizeDid(node.sessionDid);
     const livePrincipalDid = normalizeDid(node.did);
@@ -4210,6 +4278,7 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
     const livePermissions = [...node.getVerifiedSessionCapabilities()];
     const resolveSpace2 = operationSpaceResolver(node, authenticatedSpace ?? summary.space);
     const seenCids = /* @__PURE__ */ new Set();
+    const warnings = [];
     if (!explicitPrivateKeyOverride) {
       const activator = node;
       const migrated = await prepareStoredDelegationReplay(profileName, activator, {
@@ -4219,20 +4288,25 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
         migrate: activeSession !== void 0
       });
       for (const entry of await readAdditionalDelegations(profileName)) {
-        const activated = await replayStoredDelegation(activator, entry, {
+        const replay = await replayStoredDelegation(activator, entry, {
           host: summary.host,
           migrated,
           resolveSpace: resolveSpace2
         });
-        if (activated !== void 0 && !seenCids.has(activated.cid)) {
-          seenCids.add(activated.cid);
-          livePermissions.push(...activated.effectivePermissions);
+        if (replay.status === "installed") {
+          if (!seenCids.has(replay.delegation.cid)) {
+            seenCids.add(replay.delegation.cid);
+            livePermissions.push(...replay.delegation.effectivePermissions);
+          }
+        } else if (replay.status === "skipped") {
+          warnings.push(skippedGrantWarning(node, entry, replay.reason));
         }
       }
     }
     const runtime = {
       node,
-      granted: canonicalizeCapabilities(livePermissions)
+      granted: canonicalizeCapabilities(livePermissions),
+      ...warnings.length === 0 ? {} : { warnings }
     };
     return {
       ok: true,
@@ -4256,6 +4330,24 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
     ));
   }
 }
+function skippedGrantWarning(node, entry, reason) {
+  const grantCid = verifiedStoredCid(node, entry);
+  return { code: "STORED_GRANT_SKIPPED", reason, ...grantCid === void 0 ? {} : { grantCid } };
+}
+function verifiedStoredCid(node, entry) {
+  const delegation = isRecord7(entry) && isRecord7(entry.delegation) ? entry.delegation : void 0;
+  const header = isRecord7(delegation?.delegationHeader) ? delegation.delegationHeader : void 0;
+  const cid = delegation?.cid;
+  const computeDelegationCid = isRecord7(node) ? node.computeDelegationCid : void 0;
+  if (typeof cid !== "string" || typeof header?.Authorization !== "string" || typeof computeDelegationCid !== "function") {
+    return void 0;
+  }
+  try {
+    return computeDelegationCid.call(node, header.Authorization) === cid && DELEGATION_CID.test(cid) ? cid : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function spaceForAuthenticatedPrincipal(principal2) {
   if (principal2 === void 0) return void 0;
   try {
@@ -4304,15 +4396,18 @@ function unresolvedSummary(target) {
     posture: "unauthenticated"
   };
 }
+var DELEGATION_CID;
 var init_runtime = __esm({
   "src/runtime.ts"() {
     "use strict";
+    init_contract();
     init_authority();
     init_errors();
     init_profile();
     init_secrets();
     init_state();
     init_delegation_binding();
+    DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);
   }
 });
 
@@ -4712,6 +4807,9 @@ async function invokeLocalAuthorityRetry(operationId, operationVersion, target,
     unknownInput
   );
   if (isPreparedError(prepared)) return prepared.result;
+  return withRuntimeWarnings(await retryWithLocalAuthority(prepared), prepared);
+}
+async function retryWithLocalAuthority(prepared) {
   if (prepared.operation.operationId !== "tinycloud.secrets.get" || prepared.operation.operationVersion !== 1) {
     return errorResult(
       prepared.operation,
@@ -4810,6 +4908,10 @@ async function invokeLocalAuthorityRetry(operationId, operationVersion, target,
     return localAuthorityFailure(prepared);
   }
 }
+function withRuntimeWarnings(result, prepared) {
+  const warnings = prepared.runtimeResolution.context.runtime?.warnings;
+  return warnings === void 0 || warnings.length === 0 ? result : { ...result, warnings: [...warnings] };
+}
 function isPreparedError(prepared) {
   return "status" in prepared;
 }