@tinycloud/sdk-core 3.1.0-beta.1 → 3.1.0-beta.11

package/dist/policy/index.js

@@ -3191,6 +3191,23 @@ import { sha256 as sha2564 } from "@noble/hashes/sha256";
 import { blake3 } from "@noble/hashes/blake3";
 import { ed25519 as ed255192 } from "@noble/curves/ed25519";
 import { z } from "zod";
+
+// src/http-error.ts
+import { ErrorCodes, serviceError } from "@tinycloud/sdk-services";
+async function httpResponseError(response, context) {
+  let body;
+  try {
+    body = await response.text();
+  } catch {
+    body = response.statusText;
+  }
+  body = body.trim().slice(0, 512);
+  return Object.assign(new Error(`${context}: HTTP ${response.status}${body ? ` - ${body}` : ""}`), {
+    status: response.status
+  });
+}
+
+// src/policy/unified.ts
 var POLICY_V1_SCHEMA = "xyz.tinycloud.policy/policy/v1";
 var POLICY_CAPABILITY_V1_SCHEMA = "xyz.tinycloud.policy/capability/v1";
 var POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA = "xyz.tinycloud.policy/enforcement-delegation/v2";
@@ -3218,7 +3235,7 @@ async function requestPolicyChallengeV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ policyCid: input.policyCid, recipientDid: input.recipientDid, requestedCapabilities: input.requestedCapabilities.map(normalizeUnifiedPolicyCapability) })
   });
-  if (!response.ok) throw new Error(`policy challenge rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy challenge rejected");
   const value = object(await response.json(), "policy challenge");
   if (typeof value.challengeId !== "string" || typeof value.nonce !== "string" || value.policyCid !== input.policyCid || value.recipientDid !== input.recipientDid)
     throw new Error("policy challenge binding is invalid");
@@ -3243,7 +3260,7 @@ async function mintPolicySessionV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ policyCid: input.policyCid, challengeId: challenge.challengeId, nonce: challenge.nonce, claim: input.claim, presentation: input.presentation })
   });
-  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy delegation rejected");
   const value = object(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string")
     throw new Error("policy delegation response is invalid");
@@ -3303,7 +3320,7 @@ async function getPolicyRootStatusV3(input) {
     redirect: "error",
     headers: { accept: "application/json" }
   });
-  if (!response.ok) throw new Error(`policy root status rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root status rejected");
   const value = object(await response.json(), "policy root status");
   const checkpoint = object(value.checkpoint, "policy root checkpoint");
   if (value.rootCid !== input.rootCid || value.state !== "active" && value.state !== "revoked" || value.state !== checkpoint.state || !verifyPolicyRootStatusCheckpointV3({ rootCid: input.rootCid, checkpoint, expectedNodeAudience: input.expectedNodeAudience, now: input.now }))
@@ -3363,9 +3380,12 @@ async function renewPolicyRootStatusV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ rootCid: input.rootCid, renewal: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.ownerDid, value: encodeBase64Url(signature) } } })
   });
-  if (!response.ok) throw new Error(`policy root renewal rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root renewal rejected");
   return object(await response.json(), "policy root renewal");
 }
+function rfc3339Seconds(value) {
+  return new Date(Math.floor(value.getTime() / 1e3) * 1e3).toISOString().replace(/\.000Z$/, "Z");
+}
 async function revokePolicyRootV3(input) {
   if (input.reason.length === 0) throw new Error("policy root revocation reason is required");
   const unsigned = {
@@ -3374,7 +3394,7 @@ async function revokePolicyRootV3(input) {
     targetRole: input.targetRole,
     ownerDid: input.ownerDid,
     nodeAudience: input.nodeAudience,
-    revokedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    revokedAt: rfc3339Seconds(input.now ?? /* @__PURE__ */ new Date()),
     reason: input.reason,
     issuerDid: input.issuerDid
   };
@@ -3387,7 +3407,7 @@ async function revokePolicyRootV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ revocation: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.issuerDid, value: encodeBase64Url(signature) } } })
   });
-  if (!response.ok) throw new Error(`policy root revocation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root revocation rejected");
   return object(await response.json(), "policy root revocation");
 }
 var POLICY_SESSION_FACT_KEYS = [
@@ -3656,7 +3676,7 @@ async function registerPolicyV3(input) {
     }
   );
   if (!bindingResponse.ok) {
-    throw new Error(`policy enforcer binding rejected (${bindingResponse.status})`);
+    throw await httpResponseError(bindingResponse, "policy enforcer binding rejected");
   }
   const binding = exactObject(
     await bindingResponse.json(),
@@ -3722,7 +3742,7 @@ async function registerPolicyV3(input) {
     }
   );
   if (!response.ok) {
-    throw new Error(`policy registration rejected (${response.status})`);
+    throw await httpResponseError(response, "policy registration rejected");
   }
   const receipt = exactObject(
     await response.json(),
@@ -4196,7 +4216,7 @@ function date(value, label) {
   if (!Number.isFinite(Date.parse(text))) throw new Error(`${label} is invalid`);
   return text;
 }
-function rfc3339Seconds(value) {
+function rfc3339Seconds2(value) {
   return new Date(Math.floor(value.getTime() / 1e3) * 1e3).toISOString().replace(/\.000Z$/, "Z");
 }
 function validateUnifiedPolicyV2(value, expectedPolicyCid) {
@@ -4361,8 +4381,8 @@ async function buildPolicyCredentialPresentationV4(input) {
     requirementDigest,
     descriptorDigest: input.credential.descriptorDigest,
     requestedCapabilities: Object.freeze(requestedCapabilities),
-    issuedAt: rfc3339Seconds(now),
-    expiresAt: rfc3339Seconds(new Date(expiresAtMs))
+    issuedAt: rfc3339Seconds2(now),
+    expiresAt: rfc3339Seconds2(new Date(expiresAtMs))
   }), input.sign);
 }
 async function buildPolicyCredentialPresentationV3(input) {
@@ -4416,8 +4436,8 @@ async function buildPolicyCredentialPresentationV3(input) {
     requirementDigest,
     descriptorDigest: input.credential.descriptorDigest,
     requestedCapabilities: Object.freeze(requestedCapabilities),
-    issuedAt: rfc3339Seconds(now),
-    expiresAt: rfc3339Seconds(new Date(expiresAtMs))
+    issuedAt: rfc3339Seconds2(now),
+    expiresAt: rfc3339Seconds2(new Date(expiresAtMs))
   });
   const digest2 = sha2565(
     new TextEncoder().encode(
@@ -4479,7 +4499,7 @@ async function admitPolicyCredentialV3(input) {
     requestedSessionExpiry(input.requestedExpiresAt, policy),
     input.signal
   );
-  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy delegation rejected");
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") {
     throw new Error("policy delegation response is invalid");
@@ -4532,7 +4552,7 @@ async function admitPolicyCredentialV4(input) {
     requestedSessionExpiry(input.requestedExpiresAt, policy),
     input.signal
   );
-  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy delegation rejected");
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") throw new Error("policy delegation response is invalid");
   const session = parsePolicySessionUcan(value.authorization, [
@@ -4551,7 +4571,7 @@ async function admitPolicyCredentialV4(input) {
     signal: input.signal,
     headers: { Authorization: session.authorization }
   });
-  if (!importResponse.ok) throw new Error(`delegation import rejected (${importResponse.status})`);
+  if (!importResponse.ok) throw await httpResponseError(importResponse, "delegation import rejected");
   input.signal?.throwIfAborted();
   return Object.freeze({ challenge, presentation, session, delegationImported: true });
 }