@tinycloud/operations 0.7.0-beta.31 → 0.7.0-beta.33

package/dist/revoked-grant.cjs

@@ -0,0 +1,56 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/revoked-grant.ts
+var revoked_grant_exports = {};
+__export(revoked_grant_exports, {
+  REVOKED_GRANT_MESSAGE: () => REVOKED_GRANT_MESSAGE,
+  isRevokedGrantRefusal: () => isRevokedGrantRefusal
+});
+module.exports = __toCommonJS(revoked_grant_exports);
+var import_sdk_services = require("@tinycloud/sdk-services");
+
+// src/cli-name.ts
+var import_node_path = require("path");
+var CLI_NAME = (0, import_node_path.basename)(process.argv[1] ?? "") === "tinycloud" ? "tinycloud" : "tc";
+
+// src/revoked-grant.ts
+var MAX_CAUSE_DEPTH = 8;
+var REVOKED_GRANT_BODY = /\b401 - (?:Invalid invocation: )?delegation-(?:revoked: [A-Za-z0-9]+|ancestor-revoked: ancestor=[A-Za-z0-9]+ invoked=[A-Za-z0-9]+)\s*$/;
+var REVOKED_GRANT_CODES = /* @__PURE__ */ new Set(["AUTH_DELEGATION_REVOKED", "AUTH_DELEGATION_ANCESTOR_REVOKED"]);
+var REVOKED_GRANT_MESSAGE = `This grant was revoked. Ask the owner for a new grant (\`${CLI_NAME} auth request ...\`).`;
+function isRevokedGrantRefusal(error) {
+  if ((0, import_sdk_services.authorizationVerdictOf)(error) !== "unauthenticated") return false;
+  const seen = /* @__PURE__ */ new Set();
+  let node = error;
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
+    seen.add(node);
+    const { code, message, cause } = node;
+    if (REVOKED_GRANT_CODES.has(code)) return true;
+    if (typeof message === "string" && REVOKED_GRANT_BODY.test(message)) return true;
+    node = cause;
+  }
+  return false;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  REVOKED_GRANT_MESSAGE,
+  isRevokedGrantRefusal
+});
+//# sourceMappingURL=revoked-grant.cjs.map

package/dist/revoked-grant.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/revoked-grant.ts","../src/cli-name.ts"],"sourcesContent":["import { authorizationVerdictOf } from \"@tinycloud/sdk-services\";\nimport { CLI_NAME } from \"./cli-name.js\";\n\n/** Cause links read for the node's refusal; the SDK wraps it, so it is rarely the outermost error. */\nconst MAX_CAUSE_DEPTH = 8;\n/**\n * The node's whole 401 body for a revoked chain (`delegation-revoked: <cid>`, or\n * `delegation-ancestor-revoked: ancestor=<cid> invoked=<cid>`; older nodes prefix `Invalid invocation: `),\n * as it ends an SDK error message (`<what failed>: 401 - <body>`). The match starts at the `401 - ` separator\n * and runs to the end of the message, and only letters and digits may follow the error kind (the CIDs are not\n * checked beyond that), so a key or path in another 401 body (`Unauthorized Action: <space>/kv/…/delegation-revoked/ / …`)\n * or any other text that mentions \"revoked\" does not match.\n */\nconst REVOKED_GRANT_BODY =\n  /\\b401 - (?:Invalid invocation: )?delegation-(?:revoked: [A-Za-z0-9]+|ancestor-revoked: ancestor=[A-Za-z0-9]+ invoked=[A-Za-z0-9]+)\\s*$/;\n/** The KV service's own typed codes for the same two bodies. */\nconst REVOKED_GRANT_CODES: ReadonlySet<unknown> = new Set([\"AUTH_DELEGATION_REVOKED\", \"AUTH_DELEGATION_ANCESTOR_REVOKED\"]);\n\nexport const REVOKED_GRANT_MESSAGE =\n  `This grant was revoked. Ask the owner for a new grant (\\`${CLI_NAME} auth request ...\\`).`;\n\n/**\n * Whether a node refusal says the presented grant (or one it was derived from) was revoked.\n * Status alone cannot tell this from a stale session, so it also needs the typed code or the node's own\n * `delegation-revoked` / `delegation-ancestor-revoked` 401 body; any other 401 keeps its meaning.\n */\nexport function isRevokedGrantRefusal(error: unknown): boolean {\n  if (authorizationVerdictOf(error) !== \"unauthenticated\") return false;\n  const seen = new Set<unknown>();\n  let node: unknown = error;\n  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === \"object\" && node !== null && !seen.has(node); depth += 1) {\n    seen.add(node);\n    const { code, message, cause } = node as { code?: unknown; message?: unknown; cause?: unknown };\n    if (REVOKED_GRANT_CODES.has(code)) return true;\n    if (typeof message === \"string\" && REVOKED_GRANT_BODY.test(message)) return true;\n    node = cause;\n  }\n  return false;\n}\n","import { basename } from \"node:path\";\n\n/**\n * The command name hints and messages tell users to run. The CLI installs as\n * both `tc` and `tinycloud` (Ubuntu's iproute2 ships `/usr/sbin/tc`), so the\n * name follows the invoked bin. Any other host process, such as the MCP server,\n * gets `tc`.\n */\nexport const CLI_NAME = basename(process.argv[1] ?? \"\") === \"tinycloud\" ? \"tinycloud\" : \"tc\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAuC;;;ACAvC,uBAAyB;AAQlB,IAAM,eAAW,2BAAS,QAAQ,KAAK,CAAC,KAAK,EAAE,MAAM,cAAc,cAAc;;;ADJxF,IAAM,kBAAkB;AASxB,IAAM,qBACJ;AAEF,IAAM,sBAA4C,oBAAI,IAAI,CAAC,2BAA2B,kCAAkC,CAAC;AAElH,IAAM,wBACX,4DAA4D,QAAQ;AAO/D,SAAS,sBAAsB,OAAyB;AAC7D,UAAI,4CAAuB,KAAK,MAAM,kBAAmB,QAAO;AAChE,QAAM,OAAO,oBAAI,IAAa;AAC9B,MAAI,OAAgB;AACpB,WAAS,QAAQ,GAAG,QAAQ,mBAAmB,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,KAAK,IAAI,IAAI,GAAG,SAAS,GAAG;AACvH,SAAK,IAAI,IAAI;AACb,UAAM,EAAE,MAAM,SAAS,MAAM,IAAI;AACjC,QAAI,oBAAoB,IAAI,IAAI,EAAG,QAAO;AAC1C,QAAI,OAAO,YAAY,YAAY,mBAAmB,KAAK,OAAO,EAAG,QAAO;AAC5E,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}

package/dist/revoked-grant.d.cts

@@ -0,0 +1,9 @@
+declare const REVOKED_GRANT_MESSAGE: string;
+/**
+ * Whether a node refusal says the presented grant (or one it was derived from) was revoked.
+ * Status alone cannot tell this from a stale session, so it also needs the typed code or the node's own
+ * `delegation-revoked` / `delegation-ancestor-revoked` 401 body; any other 401 keeps its meaning.
+ */
+declare function isRevokedGrantRefusal(error: unknown): boolean;
+
+export { REVOKED_GRANT_MESSAGE, isRevokedGrantRefusal };

package/dist/revoked-grant.d.ts

@@ -0,0 +1,9 @@
+declare const REVOKED_GRANT_MESSAGE: string;
+/**
+ * Whether a node refusal says the presented grant (or one it was derived from) was revoked.
+ * Status alone cannot tell this from a stale session, so it also needs the typed code or the node's own
+ * `delegation-revoked` / `delegation-ancestor-revoked` 401 body; any other 401 keeps its meaning.
+ */
+declare function isRevokedGrantRefusal(error: unknown): boolean;
+
+export { REVOKED_GRANT_MESSAGE, isRevokedGrantRefusal };

package/dist/revoked-grant.js

@@ -0,0 +1,30 @@
+// src/revoked-grant.ts
+import { authorizationVerdictOf } from "@tinycloud/sdk-services";
+
+// src/cli-name.ts
+import { basename } from "path";
+var CLI_NAME = basename(process.argv[1] ?? "") === "tinycloud" ? "tinycloud" : "tc";
+
+// src/revoked-grant.ts
+var MAX_CAUSE_DEPTH = 8;
+var REVOKED_GRANT_BODY = /\b401 - (?:Invalid invocation: )?delegation-(?:revoked: [A-Za-z0-9]+|ancestor-revoked: ancestor=[A-Za-z0-9]+ invoked=[A-Za-z0-9]+)\s*$/;
+var REVOKED_GRANT_CODES = /* @__PURE__ */ new Set(["AUTH_DELEGATION_REVOKED", "AUTH_DELEGATION_ANCESTOR_REVOKED"]);
+var REVOKED_GRANT_MESSAGE = `This grant was revoked. Ask the owner for a new grant (\`${CLI_NAME} auth request ...\`).`;
+function isRevokedGrantRefusal(error) {
+  if (authorizationVerdictOf(error) !== "unauthenticated") return false;
+  const seen = /* @__PURE__ */ new Set();
+  let node = error;
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
+    seen.add(node);
+    const { code, message, cause } = node;
+    if (REVOKED_GRANT_CODES.has(code)) return true;
+    if (typeof message === "string" && REVOKED_GRANT_BODY.test(message)) return true;
+    node = cause;
+  }
+  return false;
+}
+export {
+  REVOKED_GRANT_MESSAGE,
+  isRevokedGrantRefusal
+};
+//# sourceMappingURL=revoked-grant.js.map

package/dist/revoked-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/revoked-grant.ts","../src/cli-name.ts"],"sourcesContent":["import { authorizationVerdictOf } from \"@tinycloud/sdk-services\";\nimport { CLI_NAME } from \"./cli-name.js\";\n\n/** Cause links read for the node's refusal; the SDK wraps it, so it is rarely the outermost error. */\nconst MAX_CAUSE_DEPTH = 8;\n/**\n * The node's whole 401 body for a revoked chain (`delegation-revoked: <cid>`, or\n * `delegation-ancestor-revoked: ancestor=<cid> invoked=<cid>`; older nodes prefix `Invalid invocation: `),\n * as it ends an SDK error message (`<what failed>: 401 - <body>`). The match starts at the `401 - ` separator\n * and runs to the end of the message, and only letters and digits may follow the error kind (the CIDs are not\n * checked beyond that), so a key or path in another 401 body (`Unauthorized Action: <space>/kv/…/delegation-revoked/ / …`)\n * or any other text that mentions \"revoked\" does not match.\n */\nconst REVOKED_GRANT_BODY =\n  /\\b401 - (?:Invalid invocation: )?delegation-(?:revoked: [A-Za-z0-9]+|ancestor-revoked: ancestor=[A-Za-z0-9]+ invoked=[A-Za-z0-9]+)\\s*$/;\n/** The KV service's own typed codes for the same two bodies. */\nconst REVOKED_GRANT_CODES: ReadonlySet<unknown> = new Set([\"AUTH_DELEGATION_REVOKED\", \"AUTH_DELEGATION_ANCESTOR_REVOKED\"]);\n\nexport const REVOKED_GRANT_MESSAGE =\n  `This grant was revoked. Ask the owner for a new grant (\\`${CLI_NAME} auth request ...\\`).`;\n\n/**\n * Whether a node refusal says the presented grant (or one it was derived from) was revoked.\n * Status alone cannot tell this from a stale session, so it also needs the typed code or the node's own\n * `delegation-revoked` / `delegation-ancestor-revoked` 401 body; any other 401 keeps its meaning.\n */\nexport function isRevokedGrantRefusal(error: unknown): boolean {\n  if (authorizationVerdictOf(error) !== \"unauthenticated\") return false;\n  const seen = new Set<unknown>();\n  let node: unknown = error;\n  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === \"object\" && node !== null && !seen.has(node); depth += 1) {\n    seen.add(node);\n    const { code, message, cause } = node as { code?: unknown; message?: unknown; cause?: unknown };\n    if (REVOKED_GRANT_CODES.has(code)) return true;\n    if (typeof message === \"string\" && REVOKED_GRANT_BODY.test(message)) return true;\n    node = cause;\n  }\n  return false;\n}\n","import { basename } from \"node:path\";\n\n/**\n * The command name hints and messages tell users to run. The CLI installs as\n * both `tc` and `tinycloud` (Ubuntu's iproute2 ships `/usr/sbin/tc`), so the\n * name follows the invoked bin. Any other host process, such as the MCP server,\n * gets `tc`.\n */\nexport const CLI_NAME = basename(process.argv[1] ?? \"\") === \"tinycloud\" ? \"tinycloud\" : \"tc\";\n"],"mappings":";AAAA,SAAS,8BAA8B;;;ACAvC,SAAS,gBAAgB;AAQlB,IAAM,WAAW,SAAS,QAAQ,KAAK,CAAC,KAAK,EAAE,MAAM,cAAc,cAAc;;;ADJxF,IAAM,kBAAkB;AASxB,IAAM,qBACJ;AAEF,IAAM,sBAA4C,oBAAI,IAAI,CAAC,2BAA2B,kCAAkC,CAAC;AAElH,IAAM,wBACX,4DAA4D,QAAQ;AAO/D,SAAS,sBAAsB,OAAyB;AAC7D,MAAI,uBAAuB,KAAK,MAAM,kBAAmB,QAAO;AAChE,QAAM,OAAO,oBAAI,IAAa;AAC9B,MAAI,OAAgB;AACpB,WAAS,QAAQ,GAAG,QAAQ,mBAAmB,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,KAAK,IAAI,IAAI,GAAG,SAAS,GAAG;AACvH,SAAK,IAAI,IAAI;AACb,UAAM,EAAE,MAAM,SAAS,MAAM,IAAI;AACjC,QAAI,oBAAoB,IAAI,IAAI,EAAG,QAAO;AAC1C,QAAI,OAAO,YAAY,YAAY,mBAAmB,KAAK,OAAO,EAAG,QAAO;AAC5E,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/operations",
-  "version": "0.7.0-beta.31",
+  "version": "0.7.0-beta.33",
   "description": "TinyCloud shared operations contracts and runtime",
   "author": "TinyCloud, Inc.",
   "license": "EGPL",
@@ -54,6 +54,11 @@
       "import": "./dist/recovery.js",
       "require": "./dist/recovery.cjs"
     },
+    "./revoked-grant": {
+      "types": "./dist/revoked-grant.d.ts",
+      "import": "./dist/revoked-grant.js",
+      "require": "./dist/revoked-grant.cjs"
+    },
     "./cli-name": {
       "types": "./dist/cli-name.d.ts",
       "import": "./dist/cli-name.js",
@@ -75,7 +80,7 @@
     "coverage.json"
   ],
   "scripts": {
-    "build": "tsup --entry src/index.ts --entry src/state.ts --entry src/artifacts.ts --entry src/cli-runtime.ts --entry src/profile.ts --entry src/secret-capabilities.ts --entry src/delegation-binding.ts --entry src/secret-request.ts --entry src/recovery.ts --entry src/cli-name.ts --entry src/tc-apps.ts",
+    "build": "tsup --entry src/index.ts --entry src/state.ts --entry src/artifacts.ts --entry src/cli-runtime.ts --entry src/profile.ts --entry src/secret-capabilities.ts --entry src/delegation-binding.ts --entry src/secret-request.ts --entry src/recovery.ts --entry src/cli-name.ts --entry src/revoked-grant.ts --entry src/tc-apps.ts",
     "clean": "rm -rf dist",
     "test": "bun scripts/test.ts",
     "typecheck": "tsc -p tsconfig.typecheck.json",
@@ -84,7 +89,7 @@
     "check:generated": "bun scripts/generate.ts --check"
   },
   "dependencies": {
-    "@tinycloud/node-sdk": "3.3.0-beta.34",
+    "@tinycloud/node-sdk": "3.3.0-beta.35",
     "@tinycloud/sdk-core": "3.3.0-beta.31",
     "@tinycloud/sdk-services": "3.3.0-beta.25",
     "node-sql-parser": "5.4.0",