@tinycloud/operations 0.7.0-beta.33 → 0.7.0-beta.35

package/dist/cli-runtime.d.cts

@@ -1,4 +1,4 @@
-import { I as InvocationTarget, a as OperationResult } from './contract-zRklonbR.cjs';
+import { I as InvocationTarget, a as OperationResult } from './contract-DrtFhVsg.cjs';
 
 /**
  * The only published CLI acquisition helper. Its fixed operation identity is

package/dist/cli-runtime.d.ts

@@ -1,4 +1,4 @@
-import { I as InvocationTarget, a as OperationResult } from './contract-zRklonbR.js';
+import { I as InvocationTarget, a as OperationResult } from './contract-DrtFhVsg.js';
 
 /**
  * The only published CLI acquisition helper. Its fixed operation identity is

package/dist/cli-runtime.js

@@ -5668,6 +5668,34 @@ var init_artifacts = __esm({
   }
 });
 
+// src/contract.ts
+var STORED_GRANT_SKIP_REASONS, DELEGATION_CID_PATTERN;
+var init_contract = __esm({
+  "src/contract.ts"() {
+    "use strict";
+    STORED_GRANT_SKIP_REASONS = [
+      "malformed",
+      "unbound",
+      "outside_request",
+      "host_mismatch",
+      "expired",
+      "cid_mismatch",
+      "authority_invalid",
+      "proof_missing",
+      "proof_invalid",
+      "owner_mismatch",
+      "audience_mismatch",
+      "resources_mismatch",
+      "unsupported",
+      "activation_rejected",
+      "activation_unavailable",
+      "activation_unauthenticated",
+      "invalid"
+    ];
+    DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
+  }
+});
+
 // src/recovery.ts
 function signInRecovery(profile, posture) {
   if (!SAFE_PROFILE_TOKEN.test(profile)) return { action: "sign_in" };
@@ -5889,6 +5917,26 @@ var init_revoked_grant = __esm({
 
 // src/kv-failure.ts
 import { authorizationVerdictOf as authorizationVerdictOf2, validatedCapabilityOf } from "@tinycloud/sdk-services";
+function nodeRevocationOf(error) {
+  if (typeof error !== "object" || error === null || !("service" in error) || error.service !== "kv" || !("code" in error) || error.code !== "AUTH_UNAUTHORIZED" && error.code !== "AUTH_DELEGATION_REVOKED" && error.code !== "AUTH_DELEGATION_ANCESTOR_REVOKED" || !("message" in error) || typeof error.message !== "string" || !("meta" in error) || typeof error.meta !== "object" || error.meta === null || !("status" in error.meta) || error.meta.status !== 401 || authorizationVerdictOf2(error) !== "unauthenticated") return void 0;
+  const { code, message } = error;
+  const separator = ": 401 - ";
+  const start = message.indexOf(separator);
+  if (start < 0) return void 0;
+  const body = message.slice(start + separator.length);
+  const match = NODE_REVOCATION_BODY.exec(body);
+  if (match === null || match[0] !== body) return void 0;
+  if (match[1] !== void 0 && code !== "AUTH_DELEGATION_ANCESTOR_REVOKED") {
+    const revokedCid = match[2];
+    return DELEGATION_CID2.test(revokedCid) ? { reason: "delegation_revoked", revokedCid } : void 0;
+  }
+  if (match[3] !== void 0 && code !== "AUTH_DELEGATION_REVOKED") {
+    const ancestorCid = match[4];
+    const revokedCid = match[5];
+    return DELEGATION_CID2.test(ancestorCid) && DELEGATION_CID2.test(revokedCid) ? { reason: "delegation_ancestor_revoked", revokedCid, ancestorCid } : void 0;
+  }
+  return void 0;
+}
 function kvRefusal(error) {
   const verdict = authorizationVerdictOf2(error);
   if (verdict === "unauthenticated") {
@@ -5898,22 +5946,30 @@ function kvRefusal(error) {
 }
 function authorizationFailure(error, action) {
   switch (kvRefusal(error)) {
-    case "auth_required":
-      if (isRevokedGrantRefusal(error)) {
-        return { status: "error", error: operationError("AUTH_REQUIRED", REVOKED_GRANT_MESSAGE) };
-      }
-      return { status: "error", error: operationError("AUTH_REQUIRED", `Authentication is required to ${action}.`) };
+    case "auth_required": {
+      const revocation = nodeRevocationOf(error);
+      return {
+        status: "error",
+        error: operationError("AUTH_REQUIRED", isRevokedGrantRefusal(error) ? REVOKED_GRANT_MESSAGE : `Authentication is required to ${action}.`, {
+          ...revocation === void 0 ? {} : { details: revocation }
+        })
+      };
+    }
     case "permission_denied":
       return { status: "error", error: operationError("PERMISSION_DENIED", `Permission is denied to ${action}.`) };
     case void 0:
       return void 0;
   }
 }
+var DELEGATION_CID2, NODE_REVOCATION_BODY;
 var init_kv_failure = __esm({
   "src/kv-failure.ts"() {
     "use strict";
+    init_contract();
     init_errors2();
     init_revoked_grant();
+    DELEGATION_CID2 = new RegExp(DELEGATION_CID_PATTERN);
+    NODE_REVOCATION_BODY = /^(?:Invalid invocation: )?delegation-(?:(revoked): ([A-Za-z0-9]+)|(ancestor-revoked): ancestor=([A-Za-z0-9]+) invoked=([A-Za-z0-9]+))$/;
   }
 });
 
@@ -9500,34 +9556,6 @@ var init_secrets_status = __esm({
   }
 });
 
-// src/contract.ts
-var STORED_GRANT_SKIP_REASONS, DELEGATION_CID_PATTERN;
-var init_contract = __esm({
-  "src/contract.ts"() {
-    "use strict";
-    STORED_GRANT_SKIP_REASONS = [
-      "malformed",
-      "unbound",
-      "outside_request",
-      "host_mismatch",
-      "expired",
-      "cid_mismatch",
-      "authority_invalid",
-      "proof_missing",
-      "proof_invalid",
-      "owner_mismatch",
-      "audience_mismatch",
-      "resources_mismatch",
-      "unsupported",
-      "activation_rejected",
-      "activation_unavailable",
-      "activation_unauthenticated",
-      "invalid"
-    ];
-    DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
-  }
-});
-
 // src/delegation-binding.ts
 import { join as join3 } from "path";
 import * as nodeSdk5 from "@tinycloud/node-sdk";
@@ -9680,7 +9708,7 @@ function verifiedStoredCid(node, entry) {
   const cid = delegation?.cid;
   if (typeof cid !== "string" || typeof header?.Authorization !== "string" || typeof node.computeDelegationCid !== "function") return void 0;
   try {
-    return node.computeDelegationCid(header.Authorization) === cid && DELEGATION_CID.test(cid) ? cid : void 0;
+    return node.computeDelegationCid(header.Authorization) === cid && DELEGATION_CID3.test(cid) ? cid : void 0;
   } catch {
     return void 0;
   }
@@ -9787,7 +9815,7 @@ function recordKey(entry) {
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS, NOT_REPLAYED, DELEGATION_CID;
+var REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS, NOT_REPLAYED, DELEGATION_CID3;
 var init_delegation_binding = __esm({
   "src/delegation-binding.ts"() {
     "use strict";
@@ -9810,7 +9838,7 @@ var init_delegation_binding = __esm({
     };
     MIGRATION_LOCK_TIMEOUT_MS = 250;
     NOT_REPLAYED = { status: "not-replayed" };
-    DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);
+    DELEGATION_CID3 = new RegExp(DELEGATION_CID_PATTERN);
   }
 });
 
@@ -10491,6 +10519,7 @@ import {
 } from "@tinycloud/node-sdk";
 
 // src/redaction.ts
+init_contract();
 init_recovery();
 import { RUNTIME_DELEGATION_REJECTIONS } from "@tinycloud/node-sdk";
 
@@ -10557,6 +10586,7 @@ function decodeBase58(value) {
 }
 
 // src/redaction.ts
+var DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);
 function redactOperationError(_definition, error) {
   const details = error.details === void 0 ? void 0 : redactSafeErrorDetails(error.code, error.details);
   return {
@@ -10629,6 +10659,19 @@ function redactSafeErrorDetails(code, details) {
     const value = sanitize(details[key]);
     if (value !== void 0) safeDetails[key] = value;
   }
+  if (code === "AUTH_REQUIRED") {
+    const { reason, revokedCid, ancestorCid } = details;
+    if (typeof revokedCid === "string" && DELEGATION_CID.exec(revokedCid)?.[0] === revokedCid) {
+      if (reason === "delegation_revoked") {
+        safeDetails.reason = reason;
+        safeDetails.revokedCid = revokedCid;
+      } else if (reason === "delegation_ancestor_revoked" && typeof ancestorCid === "string" && DELEGATION_CID.exec(ancestorCid)?.[0] === ancestorCid) {
+        safeDetails.reason = reason;
+        safeDetails.revokedCid = revokedCid;
+        safeDetails.ancestorCid = ancestorCid;
+      }
+    }
+  }
   return Object.keys(safeDetails).length === 0 ? void 0 : safeDetails;
 }
 function safeIssueCodes(value) {
@@ -11115,7 +11158,7 @@ async function executePreparedInvocation(prepared, options = {}) {
           operation,
           context: runtimeResolution.context.summary,
           setup: outcome.setup,
-          retry: retryDescriptor(
+          retry: operationRetryDescriptor(
             operation,
             parsedInput.data,
             outcome.requiresCallerInput ?? false
@@ -11190,7 +11233,7 @@ function unresolvedContextSummary(target = {}) {
 function errorResult(operation, context, error) {
   return { status: "error", operation, context, error };
 }
-function retryDescriptor(operation, input, requiresCallerInput) {
+function operationRetryDescriptor(operation, input, requiresCallerInput = false) {
   return {
     operationId: operation.operationId,
     operationVersion: operation.operationVersion,
@@ -11260,7 +11303,7 @@ function authorityRequiredResult(operation, context, input, request, missing, no
     missing,
     request,
     approval: approvalAction(request, node),
-    retry: retryDescriptor(operation, input, requiresCallerInput)
+    retry: operationRetryDescriptor(operation, input, requiresCallerInput)
   };
 }
 function approvalAction(request, node) {