@tinycloud/sdk-services 2.11.0 → 3.0.0-beta.14

package/dist/index.cjs

@@ -115,6 +115,7 @@ __export(src_exports, {
   parseNetworkId: () => parseNetworkId,
   parsePermissionHint: () => parsePermissionHint,
   parsePermissionHintFromErrorText: () => parsePermissionHintFromErrorText,
+  parseSecretCatalogKey: () => parseSecretCatalogKey,
   permissionDeniedError: () => permissionDeniedError,
   resolveSecretListPrefix: () => resolveSecretListPrefix,
   resolveSecretPath: () => resolveSecretPath,
@@ -1619,7 +1620,7 @@ var KVService = class extends BaseService {
    */
   getFullPath(key, prefixOverride) {
     const prefix = prefixOverride ?? this._config.prefix ?? "";
-    return prefix ? `${prefix}/${key}` : key;
+    return prefix ? key === "" ? prefix : `${prefix}/${key}` : key;
   }
   /**
    * Get the host URL.
@@ -2103,16 +2104,17 @@ var KVService = class extends BaseService {
             ...options?.ifNoneMatch === void 0 ? {} : { "if-none-match": options.ifNoneMatch }
           }
         );
+        if (response.status === 401 || response.status === 403) {
+          const errorText = await response.text();
+          const message = errorText.trim().length > 0 ? errorText : `Failed to put key "${key}": ${response.status} - ${response.statusText || "authorization failed"}`;
+          const { resource, action: requiredAction } = parseAuthError(errorText);
+          return err(authUnauthorizedError("kv", message, {
+            status: response.status,
+            ...requiredAction && { requiredAction },
+            ...resource && { resource }
+          }));
+        }
         if (!response.ok) {
-          if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
-          }
           const errorText = await response.text();
           if (response.status === 412) {
             return err(serviceError(
@@ -5752,7 +5754,9 @@ function canonicalizeSecretScope(scope) {
   }
   const trimmed = scope.trim();
   if (trimmed === "") {
-    throw new Error("Secret scope must be non-empty; omit scope for global secrets.");
+    throw new Error(
+      "Secret scope must be non-empty; omit scope for global secrets."
+    );
   }
   const canonical = trimmed.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
   if (canonical === "") {
@@ -5787,6 +5791,28 @@ function resolveSecretListPrefix(options = {}) {
   const scope = canonicalizeSecretScope(options.scope);
   return scope === void 0 ? "vault/secrets/" : `vault/secrets/scoped/${scope}/`;
 }
+function parseSecretCatalogKey(key) {
+  if (SECRET_NAME_RE.test(key)) {
+    return { name: key };
+  }
+  const parts = key.split("/");
+  if (parts.length !== 3 || parts[0] !== "scoped") {
+    return void 0;
+  }
+  const [, rawScope, name] = parts;
+  if (!name || !SECRET_NAME_RE.test(name)) {
+    return void 0;
+  }
+  try {
+    const scope = canonicalizeSecretScope(rawScope);
+    if (scope === void 0 || scope !== rawScope) {
+      return void 0;
+    }
+    return { name, scope };
+  } catch {
+    return void 0;
+  }
+}
 
 // src/secrets/SecretsService.ts
 function invalidSecretInput(message) {
@@ -5800,7 +5826,9 @@ function resolveSecretPathResult(name, options) {
   try {
     return resolveSecretPath(name, options);
   } catch (error) {
-    return invalidSecretInput(error instanceof Error ? error.message : String(error));
+    return invalidSecretInput(
+      error instanceof Error ? error.message : String(error)
+    );
   }
 }
 var SecretsService = class {
@@ -5849,7 +5877,9 @@ var SecretsService = class {
       const scope = canonicalizeSecretScope(options?.scope);
       prefix = scope === void 0 ? "secrets/" : `secrets/scoped/${scope}/`;
     } catch (error) {
-      return invalidSecretInput(error instanceof Error ? error.message : String(error));
+      return invalidSecretInput(
+        error instanceof Error ? error.message : String(error)
+      );
     }
     const result = await this.vault.list({
       prefix,
@@ -5863,6 +5893,38 @@ var SecretsService = class {
       data: result.data.filter((name) => SECRET_NAME_RE.test(name))
     };
   }
+  async listAll() {
+    const entries = /* @__PURE__ */ new Map();
+    let cursor;
+    do {
+      const result = await this.vault.listPage({
+        prefix: "secrets/",
+        removePrefix: true,
+        limit: 1e3,
+        ...cursor === void 0 ? {} : { cursor }
+      });
+      if (!result.ok) {
+        return result;
+      }
+      for (const key of result.data.keys) {
+        const entry = parseSecretCatalogKey(key);
+        if (!entry) continue;
+        entries.set(`${entry.scope ?? ""}\0${entry.name}`, entry);
+      }
+      cursor = result.data.truncated ? result.data.nextCursor : void 0;
+      if (result.data.truncated && cursor === void 0) {
+        return invalidSecretInput(
+          "Secret catalog listing was truncated without a continuation cursor."
+        );
+      }
+    } while (cursor !== void 0);
+    return {
+      ok: true,
+      data: [...entries.values()].sort(
+        (a, b) => (a.scope ?? "").localeCompare(b.scope ?? "") || a.name.localeCompare(b.name)
+      )
+    };
+  }
 };
 
 // src/encryption/canonical.ts
@@ -6752,7 +6814,10 @@ var EncryptionService = class extends BaseService {
       const descriptor = usable.data;
       const networkPublicKey = base64Decode2(descriptor.publicEncryptionKey);
       const result = encryptToNetwork(this.crypto, {
-        networkId,
+        // Discovery returns the node's canonical network identifier. Persist
+        // that spelling in the envelope so a later response can be compared
+        // byte-for-byte (notably for checksummed did:pkh principals).
+        networkId: descriptor.networkId,
         networkPublicKey,
         plaintext,
         ...options?.aad !== void 0 ? { aad: options.aad } : {},
@@ -7011,6 +7076,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   parseNetworkId,
   parsePermissionHint,
   parsePermissionHintFromErrorText,
+  parseSecretCatalogKey,
   permissionDeniedError,
   resolveSecretListPrefix,
   resolveSecretPath,