@tinycloud/sdk-services 2.11.0-beta.8 → 3.0.0-beta.8

package/dist/index.cjs

@@ -115,6 +115,7 @@ __export(src_exports, {
   parseNetworkId: () => parseNetworkId,
   parsePermissionHint: () => parsePermissionHint,
   parsePermissionHintFromErrorText: () => parsePermissionHintFromErrorText,
+  parseSecretCatalogKey: () => parseSecretCatalogKey,
   permissionDeniedError: () => permissionDeniedError,
   resolveSecretListPrefix: () => resolveSecretListPrefix,
   resolveSecretPath: () => resolveSecretPath,
@@ -5752,7 +5753,9 @@ function canonicalizeSecretScope(scope) {
   }
   const trimmed = scope.trim();
   if (trimmed === "") {
-    throw new Error("Secret scope must be non-empty; omit scope for global secrets.");
+    throw new Error(
+      "Secret scope must be non-empty; omit scope for global secrets."
+    );
   }
   const canonical = trimmed.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
   if (canonical === "") {
@@ -5787,6 +5790,28 @@ function resolveSecretListPrefix(options = {}) {
   const scope = canonicalizeSecretScope(options.scope);
   return scope === void 0 ? "vault/secrets/" : `vault/secrets/scoped/${scope}/`;
 }
+function parseSecretCatalogKey(key) {
+  if (SECRET_NAME_RE.test(key)) {
+    return { name: key };
+  }
+  const parts = key.split("/");
+  if (parts.length !== 3 || parts[0] !== "scoped") {
+    return void 0;
+  }
+  const [, rawScope, name] = parts;
+  if (!name || !SECRET_NAME_RE.test(name)) {
+    return void 0;
+  }
+  try {
+    const scope = canonicalizeSecretScope(rawScope);
+    if (scope === void 0 || scope !== rawScope) {
+      return void 0;
+    }
+    return { name, scope };
+  } catch {
+    return void 0;
+  }
+}
 
 // src/secrets/SecretsService.ts
 function invalidSecretInput(message) {
@@ -5800,7 +5825,9 @@ function resolveSecretPathResult(name, options) {
   try {
     return resolveSecretPath(name, options);
   } catch (error) {
-    return invalidSecretInput(error instanceof Error ? error.message : String(error));
+    return invalidSecretInput(
+      error instanceof Error ? error.message : String(error)
+    );
   }
 }
 var SecretsService = class {
@@ -5849,7 +5876,9 @@ var SecretsService = class {
       const scope = canonicalizeSecretScope(options?.scope);
       prefix = scope === void 0 ? "secrets/" : `secrets/scoped/${scope}/`;
     } catch (error) {
-      return invalidSecretInput(error instanceof Error ? error.message : String(error));
+      return invalidSecretInput(
+        error instanceof Error ? error.message : String(error)
+      );
     }
     const result = await this.vault.list({
       prefix,
@@ -5863,6 +5892,38 @@ var SecretsService = class {
       data: result.data.filter((name) => SECRET_NAME_RE.test(name))
     };
   }
+  async listAll() {
+    const entries = /* @__PURE__ */ new Map();
+    let cursor;
+    do {
+      const result = await this.vault.listPage({
+        prefix: "secrets/",
+        removePrefix: true,
+        limit: 1e3,
+        ...cursor === void 0 ? {} : { cursor }
+      });
+      if (!result.ok) {
+        return result;
+      }
+      for (const key of result.data.keys) {
+        const entry = parseSecretCatalogKey(key);
+        if (!entry) continue;
+        entries.set(`${entry.scope ?? ""}\0${entry.name}`, entry);
+      }
+      cursor = result.data.truncated ? result.data.nextCursor : void 0;
+      if (result.data.truncated && cursor === void 0) {
+        return invalidSecretInput(
+          "Secret catalog listing was truncated without a continuation cursor."
+        );
+      }
+    } while (cursor !== void 0);
+    return {
+      ok: true,
+      data: [...entries.values()].sort(
+        (a, b) => (a.scope ?? "").localeCompare(b.scope ?? "") || a.name.localeCompare(b.name)
+      )
+    };
+  }
 };
 
 // src/encryption/canonical.ts
@@ -6752,7 +6813,10 @@ var EncryptionService = class extends BaseService {
       const descriptor = usable.data;
       const networkPublicKey = base64Decode2(descriptor.publicEncryptionKey);
       const result = encryptToNetwork(this.crypto, {
-        networkId,
+        // Discovery returns the node's canonical network identifier. Persist
+        // that spelling in the envelope so a later response can be compared
+        // byte-for-byte (notably for checksummed did:pkh principals).
+        networkId: descriptor.networkId,
         networkPublicKey,
         plaintext,
         ...options?.aad !== void 0 ? { aad: options.aad } : {},
@@ -7011,6 +7075,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   parseNetworkId,
   parsePermissionHint,
   parsePermissionHintFromErrorText,
+  parseSecretCatalogKey,
   permissionDeniedError,
   resolveSecretListPrefix,
   resolveSecretPath,