@tinycloud/sdk-core 3.0.1-beta.0 → 3.1.0-beta.10

package/dist/delegations/index.cjs

@@ -1507,8 +1507,17 @@ function canonicalizeRecapCaveats(caveats) {
   }
   return `[${branches.join(",")}]`;
 }
+var EXPLICIT_ONLY_ACTIONS = {
+  "tinycloud.kv/sync": true,
+  "tinycloud.kv/retain": true
+};
+function isExplicitOnlyAction(action) {
+  return Object.prototype.hasOwnProperty.call(EXPLICIT_ONLY_ACTIONS, action);
+}
 function actionContains(grantedAction, requestedAction) {
-  if (grantedAction === "*" || grantedAction === requestedAction) return true;
+  if (grantedAction === requestedAction) return true;
+  if (isExplicitOnlyAction(requestedAction)) return false;
+  if (grantedAction === "*") return true;
   if (!grantedAction.endsWith("/*")) return false;
   const service = grantedAction.slice(0, -2);
   return requestedAction === service || requestedAction.startsWith(`${service}/`);
@@ -2681,7 +2690,7 @@ var hashes = { ...sha2_browser_exports, ...identity_exports2 };
 var import_ed255194 = require("@noble/curves/ed25519");
 
 // src/delegations/ShareRecipientClient.ts
-var import_sdk_services2 = require("@tinycloud/sdk-services");
+var import_sdk_services3 = require("@tinycloud/sdk-services");
 var import_ed255193 = require("@noble/curves/ed25519");
 var import_sha2564 = require("@noble/hashes/sha256");
 
@@ -3959,6 +3968,21 @@ function assertUnicodeScalarString(value, path) {
   }
 }
 
+// src/http-error.ts
+var import_sdk_services2 = require("@tinycloud/sdk-services");
+async function httpResponseError(response, context) {
+  let body;
+  try {
+    body = await response.text();
+  } catch {
+    body = response.statusText;
+  }
+  body = body.trim().slice(0, 512);
+  return Object.assign(new Error(`${context}: HTTP ${response.status}${body ? ` - ${body}` : ""}`), {
+    status: response.status
+  });
+}
+
 // src/policy/unified.ts
 var POLICY_SESSION_UCAN_V1_PROFILE = "policy-session-ucan/v1";
 var POLICY_SESSION_FACT_KEYS = [
@@ -4223,7 +4247,7 @@ async function importPortableDelegation(fetchFn, host, delegation) {
     headers: { Authorization: parsed.delegationHeader.Authorization }
   });
   if (!response.ok)
-    throw new Error(`node rejected delegation import (${response.status})`);
+    throw await httpResponseError(response, "node rejected delegation import");
   const body = await response.json().catch(() => ({}));
   if (body === null || typeof body !== "object" || Array.isArray(body))
     return {};
@@ -4292,7 +4316,7 @@ function redactedCode(error) {
   if (error instanceof ShareConflict) return error.code;
   const code3 = error && typeof error === "object" && "code" in error ? error.code : void 0;
   if (typeof code3 !== "string") return "SHARE_INVALID";
-  if (code3 === import_sdk_services2.ErrorCodes.KV_PRECONDITION_FAILED || code3 === import_sdk_services2.ErrorCodes.KV_CONFLICT || code3 === "412") return "SHARE_CONFLICT";
+  if (code3 === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || code3 === import_sdk_services3.ErrorCodes.KV_CONFLICT || code3 === "412") return "SHARE_CONFLICT";
   if (code3 === "KV_NOT_FOUND" || code3 === "NOT_FOUND" || code3 === "404") return "SHARE_NOT_FOUND";
   if (code3.includes("EXPIRED") || code3 === "expired") return "SHARE_EXPIRED";
   if (code3.includes("REVOK")) return "SHARE_REVOKED";
@@ -4531,7 +4555,7 @@ var ShareRecipientClient = class {
           if (portableDelegation !== void 0 && kv !== void 0) {
             const result2 = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
             if (!result2.ok) {
-              if (result2.error.code === import_sdk_services2.ErrorCodes.KV_PRECONDITION_FAILED || result2.error.code === import_sdk_services2.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
+              if (result2.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || result2.error.code === import_sdk_services3.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
               throw result2.error;
             }
             return { etag: result2.data.headers.etag };
@@ -4539,7 +4563,7 @@ var ShareRecipientClient = class {
           if (policySession !== void 0) return this.nativeSave(envelope, policySession, resolvedPath, bytes2, input);
           const result = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
           if (!result.ok) {
-            if (result.error.code === import_sdk_services2.ErrorCodes.KV_PRECONDITION_FAILED || result.error.code === import_sdk_services2.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
+            if (result.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || result.error.code === import_sdk_services3.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
             throw result.error;
           }
           return { etag: result.data.headers.etag };
@@ -4623,8 +4647,8 @@ var ShareRecipientClient = class {
     if (this.options.createKVService !== void 0) {
       return this.options.createKVService({ hosts: [origin], session, invoke, fetch: this.fetchFn });
     }
-    const context = new import_sdk_services2.ServiceContext({ hosts: [origin], session, invoke, fetch: this.fetchFn });
-    const service = new import_sdk_services2.KVService({ prefix: "" });
+    const context = new import_sdk_services3.ServiceContext({ hosts: [origin], session, invoke, fetch: this.fetchFn });
+    const service = new import_sdk_services3.KVService({ prefix: "" });
     context.registerService("kv", service);
     service.initialize(context);
     return service;
@@ -5725,7 +5749,9 @@ var SharingService = class {
         if (delegation.allowSubDelegation === false) continue;
         if (!this.pathMatches(delegation.path || "", path)) continue;
         const delegationActions = delegation.actions || [];
-        if (!actions.every((action) => delegationActions.includes(action) || delegationActions.includes("*"))) {
+        if (!actions.every(
+          (action) => delegationActions.some((granted) => actionContains(granted, action))
+        )) {
           continue;
         }
         if ((delegation.caveats?.length ?? 0) > 0) {