@tinycloud/operations 0.4.0-beta.9 → 0.5.0-beta.0

package/dist/artifacts.d.cts

@@ -2,7 +2,7 @@ import { PermissionEntry } from '@tinycloud/sdk-core';
 import { z } from 'zod';
 import { O as OperationSpaceResolver } from './authority-ofwbEqmj.cjs';
 export { e as evaluateAuthority } from './authority-ofwbEqmj.cjs';
-import { T as TinyCloudPosture, O as OperationOperatorType } from './contract-CjuEjE-M.cjs';
+import { T as TinyCloudPosture, O as OperationOperatorType } from './contract-DfyrluLB.cjs';
 
 /** The shared wire schema for SDK PermissionEntry values, including signed ReCap caveats. */
 declare const PermissionEntrySchema: z.ZodObject<{

package/dist/artifacts.d.ts

@@ -2,7 +2,7 @@ import { PermissionEntry } from '@tinycloud/sdk-core';
 import { z } from 'zod';
 import { O as OperationSpaceResolver } from './authority-ofwbEqmj.js';
 export { e as evaluateAuthority } from './authority-ofwbEqmj.js';
-import { T as TinyCloudPosture, O as OperationOperatorType } from './contract-CjuEjE-M.js';
+import { T as TinyCloudPosture, O as OperationOperatorType } from './contract-DfyrluLB.js';
 
 /** The shared wire schema for SDK PermissionEntry values, including signed ReCap caveats. */
 declare const PermissionEntrySchema: z.ZodObject<{

package/dist/artifacts.js

@@ -253,8 +253,17 @@ function canonicalizeRecapCaveats(caveats) {
   }
   return `[${branches.join(",")}]`;
 }
+var EXPLICIT_ONLY_ACTIONS = {
+  "tinycloud.kv/sync": true,
+  "tinycloud.kv/retain": true
+};
+function isExplicitOnlyAction(action) {
+  return Object.prototype.hasOwnProperty.call(EXPLICIT_ONLY_ACTIONS, action);
+}
 function actionContains(grantedAction, requestedAction) {
-  if (grantedAction === "*" || grantedAction === requestedAction) return true;
+  if (grantedAction === requestedAction) return true;
+  if (isExplicitOnlyAction(requestedAction)) return false;
+  if (grantedAction === "*") return true;
   if (!grantedAction.endsWith("/*")) return false;
   const service = grantedAction.slice(0, -2);
   return requestedAction === service || requestedAction.startsWith(`${service}/`);
@@ -568,7 +577,8 @@ async function acquireProfileLock(profile, options) {
   const lockPath = profileLockPath(profile);
   const turnDirectory = profileTurnLockPath(profile);
   const directory = profilePath(profile);
-  await mkdir(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
+  if (options.requireProfile && !await exists(profileConfigPath(profile))) throw new ProfileDeletedError(profile);
+  if (!options.requireProfile) await mkdir(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
   await mkdir(dirname(turnDirectory), { recursive: true, mode: PRIVATE_DIR_MODE });
   for (const path of [tinycloudHomePath(), profilesPath(), directory]) {
     await chmod(path, PRIVATE_DIR_MODE).catch((error) => {
@@ -577,11 +587,15 @@ async function acquireProfileLock(profile, options) {
   }
   const { turn, firstWaitedTurn } = await acquireTurn(profile, turnDirectory, deadline);
   try {
+    if (options.requireProfile && !await exists(profileConfigPath(profile))) {
+      await rmdir(directory).catch(() => void 0);
+      throw new ProfileDeletedError(profile);
+    }
     const deletion = await readJson(join(turnDirectory, "deleted.json")).catch(() => null);
     const deletedWhileWaiting = typeof deletion?.slot === "number" && deletion.slot >= firstWaitedTurn;
     while (true) {
       const token = randomUUID();
-      if (await publishProfileLock(profile, lockPath, token)) {
+      if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true)) {
         return {
           deletedWhileWaiting,
           turnSlot: turn.slot,
@@ -832,12 +846,13 @@ async function collectTurns(profile, turn) {
     }
   }
 }
-async function publishProfileLock(profile, lockPath, token) {
+async function publishProfileLock(profile, lockPath, token, requireProfile) {
   try {
     await mkdir(lockPath, { mode: PRIVATE_DIR_MODE });
   } catch (error) {
     if (isErrno(error, "EEXIST")) return false;
     if (!isErrno(error, "ENOENT")) throw error;
+    if (requireProfile) throw new ProfileDeletedError(profile);
     await mkdir(profilePath(profile), { recursive: true, mode: PRIVATE_DIR_MODE });
     return false;
   }