@tinycloud/operations 0.4.0-beta.9 → 0.4.0

package/dist/cli-runtime.d.cts

@@ -1,4 +1,4 @@
-import { I as InvocationTarget, a as OperationResult } from './contract-CjuEjE-M.cjs';
+import { I as InvocationTarget, a as OperationResult } from './contract-BRwWJpPs.cjs';
 
 /**
  * The only published CLI acquisition helper. Its fixed operation identity is

package/dist/cli-runtime.d.ts

@@ -1,4 +1,4 @@
-import { I as InvocationTarget, a as OperationResult } from './contract-CjuEjE-M.js';
+import { I as InvocationTarget, a as OperationResult } from './contract-BRwWJpPs.js';
 
 /**
  * The only published CLI acquisition helper. Its fixed operation identity is

package/dist/cli-runtime.js

@@ -40,6 +40,17 @@ function operationError(code, message, options = {}) {
     ...options.details === void 0 ? {} : { details: options.details }
   };
 }
+function storageFullOperationError(error) {
+  if (typeof error !== "object" || error === null) return void 0;
+  const { code, meta } = error;
+  if (code !== "STORAGE_QUOTA_EXCEEDED" && code !== "STORAGE_LIMIT_REACHED") return void 0;
+  const account = typeof meta === "object" && meta !== null ? meta.account : void 0;
+  return operationError(
+    "STORAGE_QUOTA_EXCEEDED",
+    code === "STORAGE_LIMIT_REACHED" ? `This write is larger than the TinyCloud storage left, so nothing was written. Reading still works. ${MANAGE_STORAGE}` : `TinyCloud storage is full, so nothing was written. Reading still works. ${MANAGE_STORAGE}`,
+    { retryable: false, ...account === void 0 ? {} : { details: { account } } }
+  );
+}
 function isOperationErrorCode(value) {
   return typeof value === "string" && OPERATION_ERROR_CODES.includes(value);
 }
@@ -65,7 +76,7 @@ function sanitizeOperationError(error) {
     ...candidate.details === void 0 ? {} : { details: candidate.details }
   });
 }
-var OPERATION_ERROR_CODES, OperationInvocationError;
+var OPERATION_ERROR_CODES, MANAGE_STORAGE, OperationInvocationError;
 var init_errors = __esm({
   "src/errors.ts"() {
     "use strict";
@@ -88,6 +99,7 @@ var init_errors = __esm({
       "ENCRYPTION_NETWORK_UNRESOLVED",
       "NODE_UNREACHABLE",
       "NODE_ERROR",
+      "STORAGE_QUOTA_EXCEEDED",
       "KV_NOT_FOUND",
       "KV_PRECONDITION_FAILED",
       "KV_CONFLICT",
@@ -101,6 +113,7 @@ var init_errors = __esm({
       "OUTPUT_INVALID",
       "INTERNAL_ERROR"
     ];
+    MANAGE_STORAGE = "Do not retry: the owner must free up space or upgrade at https://account.tinycloud.xyz/billing.";
     OperationInvocationError = class extends Error {
       constructor(operationError2) {
         super(operationError2.message);
@@ -342,8 +355,13 @@ function canonicalizeRecapCaveats(caveats) {
   }
   return `[${branches.join(",")}]`;
 }
+function isExplicitOnlyAction(action) {
+  return Object.prototype.hasOwnProperty.call(EXPLICIT_ONLY_ACTIONS, action);
+}
 function actionContains(grantedAction, requestedAction) {
-  if (grantedAction === "*" || grantedAction === requestedAction) return true;
+  if (grantedAction === requestedAction) return true;
+  if (isExplicitOnlyAction(requestedAction)) return false;
+  if (grantedAction === "*") return true;
   if (!grantedAction.endsWith("/*")) return false;
   const service = grantedAction.slice(0, -2);
   return requestedAction === service || requestedAction.startsWith(`${service}/`);
@@ -368,10 +386,15 @@ function cloneEntry(entry) {
     ...entry.expiry !== void 0 ? { expiry: entry.expiry } : {}
   };
 }
+var EXPLICIT_ONLY_ACTIONS;
 var init_capabilities = __esm({
   "../sdk-core/src/capabilities.ts"() {
     "use strict";
     init_manifest();
+    EXPLICIT_ONLY_ACTIONS = {
+      "tinycloud.kv/sync": true,
+      "tinycloud.kv/retain": true
+    };
   }
 });
 
@@ -714,7 +737,8 @@ async function acquireProfileLock(profile, options) {
   const lockPath = profileLockPath(profile);
   const turnDirectory = profileTurnLockPath(profile);
   const directory = profilePath(profile);
-  await mkdir(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
+  if (options.requireProfile && !await exists(profileConfigPath(profile))) throw new ProfileDeletedError(profile);
+  if (!options.requireProfile) await mkdir(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
   await mkdir(dirname(turnDirectory), { recursive: true, mode: PRIVATE_DIR_MODE });
   for (const path of [tinycloudHomePath(), profilesPath(), directory]) {
     await chmod(path, PRIVATE_DIR_MODE).catch((error) => {
@@ -723,11 +747,15 @@ async function acquireProfileLock(profile, options) {
   }
   const { turn, firstWaitedTurn } = await acquireTurn(profile, turnDirectory, deadline);
   try {
+    if (options.requireProfile && !await exists(profileConfigPath(profile))) {
+      await rmdir(directory).catch(() => void 0);
+      throw new ProfileDeletedError(profile);
+    }
     const deletion = await readJson(join(turnDirectory, "deleted.json")).catch(() => null);
     const deletedWhileWaiting = typeof deletion?.slot === "number" && deletion.slot >= firstWaitedTurn;
     while (true) {
       const token = randomUUID();
-      if (await publishProfileLock(profile, lockPath, token)) {
+      if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true)) {
         return {
           deletedWhileWaiting,
           turnSlot: turn.slot,
@@ -972,12 +1000,13 @@ async function collectTurns(profile, turn) {
     }
   }
 }
-async function publishProfileLock(profile, lockPath, token) {
+async function publishProfileLock(profile, lockPath, token, requireProfile) {
   try {
     await mkdir(lockPath, { mode: PRIVATE_DIR_MODE });
   } catch (error) {
     if (isErrno(error, "EEXIST")) return false;
     if (!isErrno(error, "ENOENT")) throw error;
+    if (requireProfile) throw new ProfileDeletedError(profile);
     await mkdir(profilePath(profile), { recursive: true, mode: PRIVATE_DIR_MODE });
     return false;
   }
@@ -2545,6 +2574,8 @@ function kvFailure(error, action) {
   if (error.code === "KV_RESPONSE_TOO_LARGE") {
     return { status: "error", error: operationError("KV_RESPONSE_TOO_LARGE", `The TinyCloud KV value exceeds ${MAX_KV_VALUE_BYTES} bytes.`) };
   }
+  const storageFull = storageFullOperationError(error);
+  if (storageFull) return { status: "error", error: storageFull };
   return nodeFailure(action);
 }
 function nodeFailure(action) {
@@ -3163,7 +3194,7 @@ async function executeSqlDml(context, input) {
     const runtime = runtimeContext2(context);
     const space = resolveSqlSpace(runtime, input.space);
     const result = await runtimeNode2(runtime).sqlForSpace(space).db(input.database).execute(input.sql, input.params.map(decodeSqlInputValue));
-    if (!result.ok) return authorizationFailure(result.error, "execute the SQLite statement") ?? sqlMutationFailure();
+    if (!result.ok) return authorizationFailure(result.error, "execute the SQLite statement") ?? sqlMutationFailure(result.error);
     const normalized = normalizeExecuteResult(result.data);
     return {
       status: "ok",
@@ -3177,7 +3208,7 @@ async function executeSqlDml(context, input) {
     };
   } catch (error) {
     if (error instanceof OperationInvocationError) return { status: "error", error: error.operationError };
-    return authorizationFailure(error, "execute the SQLite statement") ?? sqlMutationFailure();
+    return authorizationFailure(error, "execute the SQLite statement") ?? sqlMutationFailure(error);
   }
 }
 function isSingleReadQuery(sql) {
@@ -3354,7 +3385,9 @@ function sqlServiceFailure(error, action) {
   }
   return nodeFailure2(action);
 }
-function sqlMutationFailure() {
+function sqlMutationFailure(error) {
+  const storageFull = storageFullOperationError(error);
+  if (storageFull) return { status: "error", error: storageFull };
   return {
     status: "error",
     error: operationError(
@@ -3609,6 +3642,32 @@ ORDER BY type, name`;
   }
 });
 
+// src/contract.ts
+var STORED_GRANT_SKIP_REASONS, DELEGATION_CID_PATTERN;
+var init_contract = __esm({
+  "src/contract.ts"() {
+    "use strict";
+    STORED_GRANT_SKIP_REASONS = [
+      "malformed",
+      "unbound",
+      "outside_request",
+      "host_mismatch",
+      "expired",
+      "cid_mismatch",
+      "authority_invalid",
+      "proof_missing",
+      "proof_invalid",
+      "owner_mismatch",
+      "audience_mismatch",
+      "resources_mismatch",
+      "unsupported",
+      "activation_rejected",
+      "invalid"
+    ];
+    DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
+  }
+});
+
 // src/delegation-binding.ts
 import { join as join2 } from "path";
 import * as nodeSdk3 from "@tinycloud/node-sdk";
@@ -3634,12 +3693,12 @@ function replayLimit(entry, migrated) {
   if (binding.success) return binding.data.requested;
   return !migrated && kind === "compact" && !("authorityRequest" in entry) ? "signed" : void 0;
 }
-function bindToSignedCapabilities(record, signed, source, recordedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+function bindToRequest(record, requested, source, recordedAt = (/* @__PURE__ */ new Date()).toISOString()) {
   return {
     ...record,
     authorityRequest: DelegationRequestBindingSchema.parse({
       requestId: `${REQUEST_ID_PREFIX[source]}:${record.delegation.cid}`,
-      requested: structuredClone(signed)
+      requested: structuredClone(requested)
     }),
     authorityRequestAudit: { source, recordedAt, note: BINDING_NOTES[source] }
   };
@@ -3695,23 +3754,40 @@ async function migratedRecord(node, entry, host, recordedAt) {
   const signed = await signedCapabilities(node, delegation, host);
   if (signed === void 0) return void 0;
   try {
-    return bindToSignedCapabilities({ ...entry, delegation: { ...entry.delegation, cid: delegation.cid } }, signed, "migration", recordedAt);
+    return bindToRequest({ ...entry, delegation: { ...entry.delegation, cid: delegation.cid } }, signed, "migration", recordedAt);
   } catch {
     return void 0;
   }
 }
+function skipped(reason) {
+  return { status: "skipped", reason };
+}
 async function replayStoredDelegation(node, entry, options) {
+  const kind = storedDelegationKind(entry);
   const delegation = normalizeStoredDelegation(entry);
-  if (delegation === void 0 || delegation.expiry.getTime() <= Date.now()) return void 0;
+  if (kind === "refused" || delegation === void 0) return skipped("malformed");
+  if (delegation.expiry.getTime() <= Date.now()) return NOT_REPLAYED;
+  if (kind === "other") return skipped("proof_missing");
   const limit = replayLimit(entry, options.migrated);
-  if (limit === void 0) return void 0;
-  const authorize = limit === "signed" ? () => true : (effective) => delegationWithinRequest(limit, effective, options.resolveSpace);
+  if (limit === void 0) return skipped("unbound");
+  let outsideRequest = false;
+  const authorize = limit === "signed" ? () => true : (effective) => {
+    outsideRequest = !delegationWithinRequest(limit, effective, options.resolveSpace);
+    return !outsideRequest;
+  };
   try {
-    return await nodeSdk3.activateValidatedRuntimeDelegation(node, delegation, { host: options.host, authorize });
-  } catch {
-    return void 0;
+    return {
+      status: "installed",
+      delegation: await nodeSdk3.activateValidatedRuntimeDelegation(node, delegation, { host: options.host, authorize })
+    };
+  } catch (error) {
+    return skipped(outsideRequest ? "outside_request" : rejectionReason(error));
   }
 }
+function rejectionReason(error) {
+  const reason = isRecord4(error) ? error.reason : void 0;
+  return typeof reason === "string" && STORED_GRANT_SKIP_REASONS.includes(reason) ? reason : "invalid";
+}
 async function bindingMigrationRecorded(profile) {
   try {
     return await readJson(bindingMigrationPath(profile)) !== null;
@@ -3756,23 +3832,27 @@ function recordKey(entry) {
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS;
+var REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS, NOT_REPLAYED;
 var init_delegation_binding = __esm({
   "src/delegation-binding.ts"() {
     "use strict";
     init_artifacts();
     init_authority();
+    init_contract();
     init_state();
     init_secrets();
     REQUEST_ID_PREFIX = {
       migration: "migrated",
-      "unbound-import": "unbound-import"
+      "unbound-import": "unbound-import",
+      "cli-grant": "cli-grant"
     };
     BINDING_NOTES = {
       migration: "Stored without a request binding before bindings were required. Bound at migration to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them.",
-      "unbound-import": "Imported by `tc auth import` without a stored request. Bound to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them."
+      "unbound-import": "Imported by `tc auth import` without a stored request. Bound to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them.",
+      "cli-grant": "Granted to this CLI by `tc auth request --grant` or a permission escalation, and checked against the request it answered. Bound to exactly its own signed capabilities, so replay refuses any delegation in this record that exceeds them."
     };
     MIGRATION_LOCK_TIMEOUT_MS = 250;
+    NOT_REPLAYED = { status: "not-replayed" };
   }
 });
 
@@ -4185,7 +4265,18 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
         ));
       }
     } else {
-      await node.restoreSession(activeSession);
+      try {
+        await node.restoreSession(activeSession);
+      } catch (error) {
+        if (isRecord7(error) && error.code === "AUTH_EXPIRED") {
+          return failed(summary, operationError(
+            "AUTH_REQUIRED",
+            "The stored session has expired or is no longer valid. Sign in again.",
+            { retryable: false }
+          ));
+        }
+        throw error;
+      }
     }
     const activeSessionDid = normalizeDid(node.sessionDid);
     const livePrincipalDid = normalizeDid(node.did);
@@ -4193,6 +4284,7 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
     const livePermissions = [...node.getVerifiedSessionCapabilities()];
     const resolveSpace2 = operationSpaceResolver(node, authenticatedSpace ?? summary.space);
     const seenCids = /* @__PURE__ */ new Set();
+    const warnings = [];
     if (!explicitPrivateKeyOverride) {
       const activator = node;
       const migrated = await prepareStoredDelegationReplay(profileName, activator, {
@@ -4202,20 +4294,25 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
         migrate: activeSession !== void 0
       });
       for (const entry of await readAdditionalDelegations(profileName)) {
-        const activated = await replayStoredDelegation(activator, entry, {
+        const replay = await replayStoredDelegation(activator, entry, {
           host: summary.host,
           migrated,
           resolveSpace: resolveSpace2
         });
-        if (activated !== void 0 && !seenCids.has(activated.cid)) {
-          seenCids.add(activated.cid);
-          livePermissions.push(...activated.effectivePermissions);
+        if (replay.status === "installed") {
+          if (!seenCids.has(replay.delegation.cid)) {
+            seenCids.add(replay.delegation.cid);
+            livePermissions.push(...replay.delegation.effectivePermissions);
+          }
+        } else if (replay.status === "skipped") {
+          warnings.push(skippedGrantWarning(node, entry, replay.reason));
         }
       }
     }
     const runtime = {
       node,
-      granted: canonicalizeCapabilities(livePermissions)
+      granted: canonicalizeCapabilities(livePermissions),
+      ...warnings.length === 0 ? {} : { warnings }
     };
     return {
       ok: true,
@@ -4239,6 +4336,24 @@ async function createInvocationRuntime(target, requirement = "authenticated") {
     ));
   }
 }
+function skippedGrantWarning(node, entry, reason) {
+  const grantCid = verifiedStoredCid(node, entry);
+  return { code: "STORED_GRANT_SKIPPED", reason, ...grantCid === void 0 ? {} : { grantCid } };
+}
+function verifiedStoredCid(node, entry) {
+  const delegation = isRecord7(entry) && isRecord7(entry.delegation) ? entry.delegation : void 0;
+  const header = isRecord7(delegation?.delegationHeader) ? delegation.delegationHeader : void 0;
+  const cid = delegation?.cid;
+  const computeDelegationCid = isRecord7(node) ? node.computeDelegationCid : void 0;
+  if (typeof cid !== "string" || typeof header?.Authorization !== "string" || typeof computeDelegationCid !== "function") {
+    return void 0;
+  }
+  try {
+    return computeDelegationCid.call(node, header.Authorization) === cid && DELEGATION_CID.test(cid) ? cid : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function spaceForAuthenticatedPrincipal(principal2) {
   if (principal2 === void 0) return void 0;
   try {
@@ -4287,15 +4402,18 @@ function unresolvedSummary(target) {
     posture: "unauthenticated"
   };
 }
+var DELEGATION_CID;
 var init_runtime = __esm({
   "src/runtime.ts"() {
     "use strict";
+    init_contract();
     init_authority();
     init_errors();
     init_profile();
     init_secrets();
     init_state();
     init_delegation_binding();
+    DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);
   }
 });
 
@@ -4597,8 +4715,19 @@ var SAFE_ERROR_DETAIL_POLICIES = {
   DELEGATION_HOST_MISMATCH: {
     expectedHost: safeOriginHost,
     artifactHost: safeOriginHost
+  },
+  STORAGE_QUOTA_EXCEEDED: {
+    account: safeStorageAccount
   }
 };
+function safeStorageAccount(value) {
+  if (!isRecord(value)) return void 0;
+  const { usedBytes, limitBytes, plan } = value;
+  if (!Number.isSafeInteger(usedBytes) || usedBytes < 0 || !Number.isSafeInteger(limitBytes) || limitBytes <= 0) {
+    return void 0;
+  }
+  return typeof plan === "string" && /^[A-Za-z0-9][A-Za-z0-9 _.-]{0,31}$/.test(plan) ? { usedBytes, limitBytes, plan } : { usedBytes, limitBytes };
+}
 function redactSafeErrorDetails(code, details) {
   const policy = SAFE_ERROR_DETAIL_POLICIES[code];
   if (policy === void 0) return void 0;
@@ -4684,6 +4813,9 @@ async function invokeLocalAuthorityRetry(operationId, operationVersion, target,
     unknownInput
   );
   if (isPreparedError(prepared)) return prepared.result;
+  return withRuntimeWarnings(await retryWithLocalAuthority(prepared), prepared);
+}
+async function retryWithLocalAuthority(prepared) {
   if (prepared.operation.operationId !== "tinycloud.secrets.get" || prepared.operation.operationVersion !== 1) {
     return errorResult(
       prepared.operation,
@@ -4782,6 +4914,10 @@ async function invokeLocalAuthorityRetry(operationId, operationVersion, target,
     return localAuthorityFailure(prepared);
   }
 }
+function withRuntimeWarnings(result, prepared) {
+  const warnings = prepared.runtimeResolution.context.runtime?.warnings;
+  return warnings === void 0 || warnings.length === 0 ? result : { ...result, warnings: [...warnings] };
+}
 function isPreparedError(prepared) {
   return "status" in prepared;
 }