@tinycloud/operations 0.7.0-beta.33 → 0.7.0-beta.35

package/dist/artifacts.d.cts

@@ -2,7 +2,7 @@ import { PermissionEntry } from '@tinycloud/sdk-core';
 import { z } from 'zod';
 import { O as OperationSpaceResolver } from './authority-ofwbEqmj.cjs';
 export { e as evaluateAuthority } from './authority-ofwbEqmj.cjs';
-import { T as TinyCloudPosture, O as OperationOperatorType } from './contract-zRklonbR.cjs';
+import { T as TinyCloudPosture, O as OperationOperatorType } from './contract-DrtFhVsg.cjs';
 
 /** The shared wire schema for SDK PermissionEntry values, including signed ReCap caveats. */
 declare const PermissionEntrySchema: z.ZodObject<{

package/dist/artifacts.d.ts

@@ -2,7 +2,7 @@ import { PermissionEntry } from '@tinycloud/sdk-core';
 import { z } from 'zod';
 import { O as OperationSpaceResolver } from './authority-ofwbEqmj.js';
 export { e as evaluateAuthority } from './authority-ofwbEqmj.js';
-import { T as TinyCloudPosture, O as OperationOperatorType } from './contract-zRklonbR.js';
+import { T as TinyCloudPosture, O as OperationOperatorType } from './contract-DrtFhVsg.js';
 
 /** The shared wire schema for SDK PermissionEntry values, including signed ReCap caveats. */
 declare const PermissionEntrySchema: z.ZodObject<{

package/dist/cli-runtime.cjs

@@ -5655,6 +5655,34 @@ var init_artifacts = __esm({
   }
 });
 
+// src/contract.ts
+var STORED_GRANT_SKIP_REASONS, DELEGATION_CID_PATTERN;
+var init_contract = __esm({
+  "src/contract.ts"() {
+    "use strict";
+    STORED_GRANT_SKIP_REASONS = [
+      "malformed",
+      "unbound",
+      "outside_request",
+      "host_mismatch",
+      "expired",
+      "cid_mismatch",
+      "authority_invalid",
+      "proof_missing",
+      "proof_invalid",
+      "owner_mismatch",
+      "audience_mismatch",
+      "resources_mismatch",
+      "unsupported",
+      "activation_rejected",
+      "activation_unavailable",
+      "activation_unauthenticated",
+      "invalid"
+    ];
+    DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
+  }
+});
+
 // src/recovery.ts
 function signInRecovery(profile, posture) {
   if (!SAFE_PROFILE_TOKEN.test(profile)) return { action: "sign_in" };
@@ -5875,6 +5903,26 @@ var init_revoked_grant = __esm({
 });
 
 // src/kv-failure.ts
+function nodeRevocationOf(error) {
+  if (typeof error !== "object" || error === null || !("service" in error) || error.service !== "kv" || !("code" in error) || error.code !== "AUTH_UNAUTHORIZED" && error.code !== "AUTH_DELEGATION_REVOKED" && error.code !== "AUTH_DELEGATION_ANCESTOR_REVOKED" || !("message" in error) || typeof error.message !== "string" || !("meta" in error) || typeof error.meta !== "object" || error.meta === null || !("status" in error.meta) || error.meta.status !== 401 || (0, import_sdk_services3.authorizationVerdictOf)(error) !== "unauthenticated") return void 0;
+  const { code, message } = error;
+  const separator = ": 401 - ";
+  const start = message.indexOf(separator);
+  if (start < 0) return void 0;
+  const body = message.slice(start + separator.length);
+  const match = NODE_REVOCATION_BODY.exec(body);
+  if (match === null || match[0] !== body) return void 0;
+  if (match[1] !== void 0 && code !== "AUTH_DELEGATION_ANCESTOR_REVOKED") {
+    const revokedCid = match[2];
+    return DELEGATION_CID2.test(revokedCid) ? { reason: "delegation_revoked", revokedCid } : void 0;
+  }
+  if (match[3] !== void 0 && code !== "AUTH_DELEGATION_REVOKED") {
+    const ancestorCid = match[4];
+    const revokedCid = match[5];
+    return DELEGATION_CID2.test(ancestorCid) && DELEGATION_CID2.test(revokedCid) ? { reason: "delegation_ancestor_revoked", revokedCid, ancestorCid } : void 0;
+  }
+  return void 0;
+}
 function kvRefusal(error) {
   const verdict = (0, import_sdk_services3.authorizationVerdictOf)(error);
   if (verdict === "unauthenticated") {
@@ -5884,24 +5932,31 @@ function kvRefusal(error) {
 }
 function authorizationFailure(error, action) {
   switch (kvRefusal(error)) {
-    case "auth_required":
-      if (isRevokedGrantRefusal(error)) {
-        return { status: "error", error: operationError("AUTH_REQUIRED", REVOKED_GRANT_MESSAGE) };
-      }
-      return { status: "error", error: operationError("AUTH_REQUIRED", `Authentication is required to ${action}.`) };
+    case "auth_required": {
+      const revocation = nodeRevocationOf(error);
+      return {
+        status: "error",
+        error: operationError("AUTH_REQUIRED", isRevokedGrantRefusal(error) ? REVOKED_GRANT_MESSAGE : `Authentication is required to ${action}.`, {
+          ...revocation === void 0 ? {} : { details: revocation }
+        })
+      };
+    }
     case "permission_denied":
       return { status: "error", error: operationError("PERMISSION_DENIED", `Permission is denied to ${action}.`) };
     case void 0:
       return void 0;
   }
 }
-var import_sdk_services3;
+var import_sdk_services3, DELEGATION_CID2, NODE_REVOCATION_BODY;
 var init_kv_failure = __esm({
   "src/kv-failure.ts"() {
     "use strict";
     import_sdk_services3 = require("@tinycloud/sdk-services");
+    init_contract();
     init_errors2();
     init_revoked_grant();
+    DELEGATION_CID2 = new RegExp(DELEGATION_CID_PATTERN);
+    NODE_REVOCATION_BODY = /^(?:Invalid invocation: )?delegation-(?:(revoked): ([A-Za-z0-9]+)|(ancestor-revoked): ancestor=([A-Za-z0-9]+) invoked=([A-Za-z0-9]+))$/;
   }
 });
 
@@ -9489,34 +9544,6 @@ var init_secrets_status = __esm({
   }
 });
 
-// src/contract.ts
-var STORED_GRANT_SKIP_REASONS, DELEGATION_CID_PATTERN;
-var init_contract = __esm({
-  "src/contract.ts"() {
-    "use strict";
-    STORED_GRANT_SKIP_REASONS = [
-      "malformed",
-      "unbound",
-      "outside_request",
-      "host_mismatch",
-      "expired",
-      "cid_mismatch",
-      "authority_invalid",
-      "proof_missing",
-      "proof_invalid",
-      "owner_mismatch",
-      "audience_mismatch",
-      "resources_mismatch",
-      "unsupported",
-      "activation_rejected",
-      "activation_unavailable",
-      "activation_unauthenticated",
-      "invalid"
-    ];
-    DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
-  }
-});
-
 // src/delegation-binding.ts
 function bindingMigrationPath(profile) {
   return (0, import_node_path4.join)(profilePath(profile), "delegation-binding-migration.json");
@@ -9667,7 +9694,7 @@ function verifiedStoredCid(node, entry) {
   const cid = delegation?.cid;
   if (typeof cid !== "string" || typeof header?.Authorization !== "string" || typeof node.computeDelegationCid !== "function") return void 0;
   try {
-    return node.computeDelegationCid(header.Authorization) === cid && DELEGATION_CID.test(cid) ? cid : void 0;
+    return node.computeDelegationCid(header.Authorization) === cid && DELEGATION_CID3.test(cid) ? cid : void 0;
   } catch {
     return void 0;
   }
@@ -9774,7 +9801,7 @@ function recordKey(entry) {
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var import_node_path4, nodeSdk5, REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS, NOT_REPLAYED, DELEGATION_CID;
+var import_node_path4, nodeSdk5, REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS, NOT_REPLAYED, DELEGATION_CID3;
 var init_delegation_binding = __esm({
   "src/delegation-binding.ts"() {
     "use strict";
@@ -9799,7 +9826,7 @@ var init_delegation_binding = __esm({
     };
     MIGRATION_LOCK_TIMEOUT_MS = 250;
     NOT_REPLAYED = { status: "not-replayed" };
-    DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);
+    DELEGATION_CID3 = new RegExp(DELEGATION_CID_PATTERN);
   }
 });
 
@@ -10485,6 +10512,7 @@ init_artifacts();
 
 // src/redaction.ts
 var import_node_sdk = require("@tinycloud/node-sdk");
+init_contract();
 init_recovery();
 
 // src/safe-values.ts
@@ -10550,6 +10578,7 @@ function decodeBase58(value) {
 }
 
 // src/redaction.ts
+var DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);
 function redactOperationError(_definition, error) {
   const details = error.details === void 0 ? void 0 : redactSafeErrorDetails(error.code, error.details);
   return {
@@ -10622,6 +10651,19 @@ function redactSafeErrorDetails(code, details) {
     const value = sanitize(details[key]);
     if (value !== void 0) safeDetails[key] = value;
   }
+  if (code === "AUTH_REQUIRED") {
+    const { reason, revokedCid, ancestorCid } = details;
+    if (typeof revokedCid === "string" && DELEGATION_CID.exec(revokedCid)?.[0] === revokedCid) {
+      if (reason === "delegation_revoked") {
+        safeDetails.reason = reason;
+        safeDetails.revokedCid = revokedCid;
+      } else if (reason === "delegation_ancestor_revoked" && typeof ancestorCid === "string" && DELEGATION_CID.exec(ancestorCid)?.[0] === ancestorCid) {
+        safeDetails.reason = reason;
+        safeDetails.revokedCid = revokedCid;
+        safeDetails.ancestorCid = ancestorCid;
+      }
+    }
+  }
   return Object.keys(safeDetails).length === 0 ? void 0 : safeDetails;
 }
 function safeIssueCodes(value) {
@@ -11108,7 +11150,7 @@ async function executePreparedInvocation(prepared, options = {}) {
           operation,
           context: runtimeResolution.context.summary,
           setup: outcome.setup,
-          retry: retryDescriptor(
+          retry: operationRetryDescriptor(
             operation,
             parsedInput.data,
             outcome.requiresCallerInput ?? false
@@ -11183,7 +11225,7 @@ function unresolvedContextSummary(target = {}) {
 function errorResult(operation, context, error) {
   return { status: "error", operation, context, error };
 }
-function retryDescriptor(operation, input, requiresCallerInput) {
+function operationRetryDescriptor(operation, input, requiresCallerInput = false) {
   return {
     operationId: operation.operationId,
     operationVersion: operation.operationVersion,
@@ -11253,7 +11295,7 @@ function authorityRequiredResult(operation, context, input, request, missing, no
     missing,
     request,
     approval: approvalAction(request, node),
-    retry: retryDescriptor(operation, input, requiresCallerInput)
+    retry: operationRetryDescriptor(operation, input, requiresCallerInput)
   };
 }
 function approvalAction(request, node) {