@tinycloud/operations 0.7.0-beta.31 → 0.7.0-beta.33

package/dist/index.cjs

@@ -5847,17 +5847,47 @@ var init_rules_generated = __esm({
   }
 });
 
+// src/revoked-grant.ts
+function isRevokedGrantRefusal(error) {
+  if ((0, import_sdk_services2.authorizationVerdictOf)(error) !== "unauthenticated") return false;
+  const seen = /* @__PURE__ */ new Set();
+  let node = error;
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
+    seen.add(node);
+    const { code, message, cause } = node;
+    if (REVOKED_GRANT_CODES.has(code)) return true;
+    if (typeof message === "string" && REVOKED_GRANT_BODY.test(message)) return true;
+    node = cause;
+  }
+  return false;
+}
+var import_sdk_services2, MAX_CAUSE_DEPTH, REVOKED_GRANT_BODY, REVOKED_GRANT_CODES, REVOKED_GRANT_MESSAGE;
+var init_revoked_grant = __esm({
+  "src/revoked-grant.ts"() {
+    "use strict";
+    import_sdk_services2 = require("@tinycloud/sdk-services");
+    init_cli_name();
+    MAX_CAUSE_DEPTH = 8;
+    REVOKED_GRANT_BODY = /\b401 - (?:Invalid invocation: )?delegation-(?:revoked: [A-Za-z0-9]+|ancestor-revoked: ancestor=[A-Za-z0-9]+ invoked=[A-Za-z0-9]+)\s*$/;
+    REVOKED_GRANT_CODES = /* @__PURE__ */ new Set(["AUTH_DELEGATION_REVOKED", "AUTH_DELEGATION_ANCESTOR_REVOKED"]);
+    REVOKED_GRANT_MESSAGE = `This grant was revoked. Ask the owner for a new grant (\`${CLI_NAME} auth request ...\`).`;
+  }
+});
+
 // src/kv-failure.ts
 function kvRefusal(error) {
-  const verdict = (0, import_sdk_services2.authorizationVerdictOf)(error);
+  const verdict = (0, import_sdk_services3.authorizationVerdictOf)(error);
   if (verdict === "unauthenticated") {
-    return (0, import_sdk_services2.validatedCapabilityOf)(error) === void 0 ? "auth_required" : "permission_denied";
+    return (0, import_sdk_services3.validatedCapabilityOf)(error) === void 0 ? "auth_required" : "permission_denied";
   }
   return verdict === "forbidden" ? "permission_denied" : void 0;
 }
 function authorizationFailure(error, action) {
   switch (kvRefusal(error)) {
     case "auth_required":
+      if (isRevokedGrantRefusal(error)) {
+        return { status: "error", error: operationError("AUTH_REQUIRED", REVOKED_GRANT_MESSAGE) };
+      }
       return { status: "error", error: operationError("AUTH_REQUIRED", `Authentication is required to ${action}.`) };
     case "permission_denied":
       return { status: "error", error: operationError("PERMISSION_DENIED", `Permission is denied to ${action}.`) };
@@ -5865,12 +5895,13 @@ function authorizationFailure(error, action) {
       return void 0;
   }
 }
-var import_sdk_services2;
+var import_sdk_services3;
 var init_kv_failure = __esm({
   "src/kv-failure.ts"() {
     "use strict";
-    import_sdk_services2 = require("@tinycloud/sdk-services");
+    import_sdk_services3 = require("@tinycloud/sdk-services");
     init_errors2();
+    init_revoked_grant();
   }
 });