@tinycloud/operations 0.7.0-beta.34 → 0.7.0-beta.36

package/dist/{contract-zRklonbR.d.cts → contract-DrtFhVsg.d.cts}

@@ -125,4 +125,4 @@ interface InvocationTarget {
     readonly privateKey?: string;
 }
 
-export { type InvocationTarget as I, type OperationOperatorType as O, type StoredGrantSkipReason as S, type TinyCloudPosture as T, type OperationResult as a, type OperationWarning as b, STORED_GRANT_SKIP_REASONS as c, type OperationContextSummary as d };
+export { type InvocationTarget as I, type OperationOperatorType as O, type RetryDescriptor as R, type StoredGrantSkipReason as S, type TinyCloudPosture as T, type OperationResult as a, type OperationContextSummary as b, type OperationWarning as c, STORED_GRANT_SKIP_REASONS as d, type OperationRef as e };

package/dist/{contract-zRklonbR.d.ts → contract-DrtFhVsg.d.ts}

@@ -125,4 +125,4 @@ interface InvocationTarget {
     readonly privateKey?: string;
 }
 
-export { type InvocationTarget as I, type OperationOperatorType as O, type StoredGrantSkipReason as S, type TinyCloudPosture as T, type OperationResult as a, type OperationWarning as b, STORED_GRANT_SKIP_REASONS as c, type OperationContextSummary as d };
+export { type InvocationTarget as I, type OperationOperatorType as O, type RetryDescriptor as R, type StoredGrantSkipReason as S, type TinyCloudPosture as T, type OperationResult as a, type OperationContextSummary as b, type OperationWarning as c, STORED_GRANT_SKIP_REASONS as d, type OperationRef as e };

package/dist/delegation-binding.d.cts

@@ -1,7 +1,7 @@
 import { PermissionEntry, ValidatedRuntimeDelegation, RuntimeDelegationActivator, PortableDelegation } from '@tinycloud/node-sdk';
 import { O as OperationSpaceResolver } from './authority-ofwbEqmj.cjs';
-import { S as StoredGrantSkipReason, b as OperationWarning } from './contract-zRklonbR.cjs';
-export { c as STORED_GRANT_SKIP_REASONS } from './contract-zRklonbR.cjs';
+import { S as StoredGrantSkipReason, c as OperationWarning } from './contract-DrtFhVsg.cjs';
+export { d as STORED_GRANT_SKIP_REASONS } from './contract-DrtFhVsg.cjs';
 import '@tinycloud/sdk-core';
 
 /** Creates the one owner-aware resolver shared by operation matching paths. */

package/dist/delegation-binding.d.ts

@@ -1,7 +1,7 @@
 import { PermissionEntry, ValidatedRuntimeDelegation, RuntimeDelegationActivator, PortableDelegation } from '@tinycloud/node-sdk';
 import { O as OperationSpaceResolver } from './authority-ofwbEqmj.js';
-import { S as StoredGrantSkipReason, b as OperationWarning } from './contract-zRklonbR.js';
-export { c as STORED_GRANT_SKIP_REASONS } from './contract-zRklonbR.js';
+import { S as StoredGrantSkipReason, c as OperationWarning } from './contract-DrtFhVsg.js';
+export { d as STORED_GRANT_SKIP_REASONS } from './contract-DrtFhVsg.js';
 import '@tinycloud/sdk-core';
 
 /** Creates the one owner-aware resolver shared by operation matching paths. */

package/dist/index-CVP0YT2f.d.cts

@@ -0,0 +1,12 @@
+import { I as InvocationTarget, a as OperationResult, e as OperationRef, R as RetryDescriptor } from './contract-DrtFhVsg.cjs';
+
+/** Value-free counters; the caller owns this optional diagnostic sink. */
+interface OperationMetrics {
+    replayedGrants: number;
+}
+/** The sole projection-facing execution API. */
+declare function invokeOperation(operationId: string, operationVersion: number, invocationTarget: InvocationTarget, unknownInput: unknown, metrics?: OperationMetrics): Promise<OperationResult<unknown>>;
+/** Build the same canonical retry identity used by operation authority results. */
+declare function operationRetryDescriptor(operation: OperationRef, input: unknown, requiresCallerInput?: boolean): RetryDescriptor;
+
+export { invokeOperation as i, operationRetryDescriptor as o };

package/dist/index-D-72hsQ_.d.ts

@@ -0,0 +1,12 @@
+import { I as InvocationTarget, a as OperationResult, e as OperationRef, R as RetryDescriptor } from './contract-DrtFhVsg.js';
+
+/** Value-free counters; the caller owns this optional diagnostic sink. */
+interface OperationMetrics {
+    replayedGrants: number;
+}
+/** The sole projection-facing execution API. */
+declare function invokeOperation(operationId: string, operationVersion: number, invocationTarget: InvocationTarget, unknownInput: unknown, metrics?: OperationMetrics): Promise<OperationResult<unknown>>;
+/** Build the same canonical retry identity used by operation authority results. */
+declare function operationRetryDescriptor(operation: OperationRef, input: unknown, requiresCallerInput?: boolean): RetryDescriptor;
+
+export { invokeOperation as i, operationRetryDescriptor as o };

package/dist/index.cjs

@@ -5655,6 +5655,34 @@ var init_artifacts = __esm({
   }
 });
 
+// src/contract.ts
+var STORED_GRANT_SKIP_REASONS, DELEGATION_CID_PATTERN;
+var init_contract = __esm({
+  "src/contract.ts"() {
+    "use strict";
+    STORED_GRANT_SKIP_REASONS = [
+      "malformed",
+      "unbound",
+      "outside_request",
+      "host_mismatch",
+      "expired",
+      "cid_mismatch",
+      "authority_invalid",
+      "proof_missing",
+      "proof_invalid",
+      "owner_mismatch",
+      "audience_mismatch",
+      "resources_mismatch",
+      "unsupported",
+      "activation_rejected",
+      "activation_unavailable",
+      "activation_unauthenticated",
+      "invalid"
+    ];
+    DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
+  }
+});
+
 // src/recovery.ts
 function signInRecovery(profile, posture) {
   if (!SAFE_PROFILE_TOKEN.test(profile)) return { action: "sign_in" };
@@ -5875,6 +5903,26 @@ var init_revoked_grant = __esm({
 });
 
 // src/kv-failure.ts
+function nodeRevocationOf(error) {
+  if (typeof error !== "object" || error === null || !("service" in error) || error.service !== "kv" || !("code" in error) || error.code !== "AUTH_UNAUTHORIZED" && error.code !== "AUTH_DELEGATION_REVOKED" && error.code !== "AUTH_DELEGATION_ANCESTOR_REVOKED" || !("message" in error) || typeof error.message !== "string" || !("meta" in error) || typeof error.meta !== "object" || error.meta === null || !("status" in error.meta) || error.meta.status !== 401 || (0, import_sdk_services3.authorizationVerdictOf)(error) !== "unauthenticated") return void 0;
+  const { code, message } = error;
+  const separator = ": 401 - ";
+  const start = message.indexOf(separator);
+  if (start < 0) return void 0;
+  const body = message.slice(start + separator.length);
+  const match = NODE_REVOCATION_BODY.exec(body);
+  if (match === null || match[0] !== body) return void 0;
+  if (match[1] !== void 0 && code !== "AUTH_DELEGATION_ANCESTOR_REVOKED") {
+    const revokedCid = match[2];
+    return DELEGATION_CID2.test(revokedCid) ? { reason: "delegation_revoked", revokedCid } : void 0;
+  }
+  if (match[3] !== void 0 && code !== "AUTH_DELEGATION_REVOKED") {
+    const ancestorCid = match[4];
+    const revokedCid = match[5];
+    return DELEGATION_CID2.test(ancestorCid) && DELEGATION_CID2.test(revokedCid) ? { reason: "delegation_ancestor_revoked", revokedCid, ancestorCid } : void 0;
+  }
+  return void 0;
+}
 function kvRefusal(error) {
   const verdict = (0, import_sdk_services3.authorizationVerdictOf)(error);
   if (verdict === "unauthenticated") {
@@ -5884,24 +5932,31 @@ function kvRefusal(error) {
 }
 function authorizationFailure(error, action) {
   switch (kvRefusal(error)) {
-    case "auth_required":
-      if (isRevokedGrantRefusal(error)) {
-        return { status: "error", error: operationError("AUTH_REQUIRED", REVOKED_GRANT_MESSAGE) };
-      }
-      return { status: "error", error: operationError("AUTH_REQUIRED", `Authentication is required to ${action}.`) };
+    case "auth_required": {
+      const revocation = nodeRevocationOf(error);
+      return {
+        status: "error",
+        error: operationError("AUTH_REQUIRED", isRevokedGrantRefusal(error) ? REVOKED_GRANT_MESSAGE : `Authentication is required to ${action}.`, {
+          ...revocation === void 0 ? {} : { details: revocation }
+        })
+      };
+    }
     case "permission_denied":
       return { status: "error", error: operationError("PERMISSION_DENIED", `Permission is denied to ${action}.`) };
     case void 0:
       return void 0;
   }
 }
-var import_sdk_services3;
+var import_sdk_services3, DELEGATION_CID2, NODE_REVOCATION_BODY;
 var init_kv_failure = __esm({
   "src/kv-failure.ts"() {
     "use strict";
     import_sdk_services3 = require("@tinycloud/sdk-services");
+    init_contract();
     init_errors2();
     init_revoked_grant();
+    DELEGATION_CID2 = new RegExp(DELEGATION_CID_PATTERN);
+    NODE_REVOCATION_BODY = /^(?:Invalid invocation: )?delegation-(?:(revoked): ([A-Za-z0-9]+)|(ancestor-revoked): ancestor=([A-Za-z0-9]+) invoked=([A-Za-z0-9]+))$/;
   }
 });
 
@@ -9489,34 +9544,6 @@ var init_secrets_status = __esm({
   }
 });
 
-// src/contract.ts
-var STORED_GRANT_SKIP_REASONS, DELEGATION_CID_PATTERN;
-var init_contract = __esm({
-  "src/contract.ts"() {
-    "use strict";
-    STORED_GRANT_SKIP_REASONS = [
-      "malformed",
-      "unbound",
-      "outside_request",
-      "host_mismatch",
-      "expired",
-      "cid_mismatch",
-      "authority_invalid",
-      "proof_missing",
-      "proof_invalid",
-      "owner_mismatch",
-      "audience_mismatch",
-      "resources_mismatch",
-      "unsupported",
-      "activation_rejected",
-      "activation_unavailable",
-      "activation_unauthenticated",
-      "invalid"
-    ];
-    DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
-  }
-});
-
 // src/delegation-binding.ts
 function bindingMigrationPath(profile) {
   return (0, import_node_path4.join)(profilePath(profile), "delegation-binding-migration.json");
@@ -9667,7 +9694,7 @@ function verifiedStoredCid(node, entry) {
   const cid = delegation?.cid;
   if (typeof cid !== "string" || typeof header?.Authorization !== "string" || typeof node.computeDelegationCid !== "function") return void 0;
   try {
-    return node.computeDelegationCid(header.Authorization) === cid && DELEGATION_CID.test(cid) ? cid : void 0;
+    return node.computeDelegationCid(header.Authorization) === cid && DELEGATION_CID3.test(cid) ? cid : void 0;
   } catch {
     return void 0;
   }
@@ -9774,7 +9801,7 @@ function recordKey(entry) {
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var import_node_path4, nodeSdk5, REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS, NOT_REPLAYED, DELEGATION_CID;
+var import_node_path4, nodeSdk5, REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS, NOT_REPLAYED, DELEGATION_CID3;
 var init_delegation_binding = __esm({
   "src/delegation-binding.ts"() {
     "use strict";
@@ -9799,7 +9826,7 @@ var init_delegation_binding = __esm({
     };
     MIGRATION_LOCK_TIMEOUT_MS = 250;
     NOT_REPLAYED = { status: "not-replayed" };
-    DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);
+    DELEGATION_CID3 = new RegExp(DELEGATION_CID_PATTERN);
   }
 });
 
@@ -10485,6 +10512,7 @@ init_artifacts();
 
 // src/redaction.ts
 var import_node_sdk = require("@tinycloud/node-sdk");
+init_contract();
 init_recovery();
 
 // src/safe-values.ts
@@ -10550,6 +10578,7 @@ function decodeBase58(value) {
 }
 
 // src/redaction.ts
+var DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);
 function redactOperationError(_definition, error) {
   const details = error.details === void 0 ? void 0 : redactSafeErrorDetails(error.code, error.details);
   return {
@@ -10622,6 +10651,19 @@ function redactSafeErrorDetails(code, details) {
     const value = sanitize(details[key]);
     if (value !== void 0) safeDetails[key] = value;
   }
+  if (code === "AUTH_REQUIRED") {
+    const { reason, revokedCid, ancestorCid } = details;
+    if (typeof revokedCid === "string" && DELEGATION_CID.exec(revokedCid)?.[0] === revokedCid) {
+      if (reason === "delegation_revoked") {
+        safeDetails.reason = reason;
+        safeDetails.revokedCid = revokedCid;
+      } else if (reason === "delegation_ancestor_revoked" && typeof ancestorCid === "string" && DELEGATION_CID.exec(ancestorCid)?.[0] === ancestorCid) {
+        safeDetails.reason = reason;
+        safeDetails.revokedCid = revokedCid;
+        safeDetails.ancestorCid = ancestorCid;
+      }
+    }
+  }
   return Object.keys(safeDetails).length === 0 ? void 0 : safeDetails;
 }
 function safeIssueCodes(value) {
@@ -11021,7 +11063,7 @@ async function executePreparedInvocation(prepared, options = {}) {
           operation,
           context: runtimeResolution.context.summary,
           setup: outcome.setup,
-          retry: retryDescriptor(
+          retry: operationRetryDescriptor(
             operation,
             parsedInput.data,
             outcome.requiresCallerInput ?? false
@@ -11096,7 +11138,7 @@ function unresolvedContextSummary(target = {}) {
 function errorResult(operation, context, error) {
   return { status: "error", operation, context, error };
 }
-function retryDescriptor(operation, input, requiresCallerInput) {
+function operationRetryDescriptor(operation, input, requiresCallerInput = false) {
   return {
     operationId: operation.operationId,
     operationVersion: operation.operationVersion,
@@ -11166,7 +11208,7 @@ function authorityRequiredResult(operation, context, input, request, missing, no
     missing,
     request,
     approval: approvalAction(request, node),
-    retry: retryDescriptor(operation, input, requiresCallerInput)
+    retry: operationRetryDescriptor(operation, input, requiresCallerInput)
   };
 }
 function approvalAction(request, node) {