@tinycloud/sdk-services 2.11.0 → 3.0.0-beta.14

package/dist/index.d.cts

@@ -2196,15 +2196,27 @@ interface ResolvedSecretPath {
         vault: string;
     };
 }
+interface ParsedSecretCatalogKey {
+    name: string;
+    scope?: string;
+}
 declare function canonicalizeSecretScope(scope: string | undefined): string | undefined;
 declare function resolveSecretPath(name: string, options?: SecretScopeOptions): ResolvedSecretPath;
 declare function resolveSecretListPrefix(options?: SecretScopeOptions): string;
+/** Parse a key relative to `secrets/` into its canonical catalog identity. */
+declare function parseSecretCatalogKey(key: string): ParsedSecretCatalogKey | undefined;
 
 interface SecretPayload {
     value: string;
     createdAt: string;
     updatedAt: string;
 }
+/** One discoverable secret location. Secret values are never included. */
+interface SecretCatalogEntry {
+    name: string;
+    /** Omitted for the global secret namespace. */
+    scope?: string;
+}
 type SecretsError = VaultError | ServiceError;
 interface ISecretsService {
     readonly vault: IDataVaultService;
@@ -2215,6 +2227,8 @@ interface ISecretsService {
     put(name: string, value: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     delete(name: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
+    /** List global and scoped secrets without decrypting their values. */
+    listAll(): Promise<Result<SecretCatalogEntry[], SecretsError>>;
 }
 
 declare class SecretsService implements ISecretsService {
@@ -2228,6 +2242,7 @@ declare class SecretsService implements ISecretsService {
     put(name: string, value: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     delete(name: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
+    listAll(): Promise<Result<SecretCatalogEntry[], SecretsError>>;
 }
 
-export { BaseService, type BaseServiceOptions, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, type SchemaInfo, type SecretPayload, type SecretScopeOptions, type SecretsError, SecretsService, type ServiceConstructor, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, type ServiceRegistration, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, authExpiredError, authRequiredError, authUnauthorizedError, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, networkError, notFoundError, parseAuthError, parsePermissionHint, parsePermissionHintFromErrorText, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, wrapError };
+export { BaseService, type BaseServiceOptions, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretScopeOptions, type SecretsError, SecretsService, type ServiceConstructor, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, type ServiceRegistration, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, authExpiredError, authRequiredError, authUnauthorizedError, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, networkError, notFoundError, parseAuthError, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, wrapError };

package/dist/index.d.ts

@@ -2196,15 +2196,27 @@ interface ResolvedSecretPath {
         vault: string;
     };
 }
+interface ParsedSecretCatalogKey {
+    name: string;
+    scope?: string;
+}
 declare function canonicalizeSecretScope(scope: string | undefined): string | undefined;
 declare function resolveSecretPath(name: string, options?: SecretScopeOptions): ResolvedSecretPath;
 declare function resolveSecretListPrefix(options?: SecretScopeOptions): string;
+/** Parse a key relative to `secrets/` into its canonical catalog identity. */
+declare function parseSecretCatalogKey(key: string): ParsedSecretCatalogKey | undefined;
 
 interface SecretPayload {
     value: string;
     createdAt: string;
     updatedAt: string;
 }
+/** One discoverable secret location. Secret values are never included. */
+interface SecretCatalogEntry {
+    name: string;
+    /** Omitted for the global secret namespace. */
+    scope?: string;
+}
 type SecretsError = VaultError | ServiceError;
 interface ISecretsService {
     readonly vault: IDataVaultService;
@@ -2215,6 +2227,8 @@ interface ISecretsService {
     put(name: string, value: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     delete(name: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
+    /** List global and scoped secrets without decrypting their values. */
+    listAll(): Promise<Result<SecretCatalogEntry[], SecretsError>>;
 }
 
 declare class SecretsService implements ISecretsService {
@@ -2228,6 +2242,7 @@ declare class SecretsService implements ISecretsService {
     put(name: string, value: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     delete(name: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
+    listAll(): Promise<Result<SecretCatalogEntry[], SecretsError>>;
 }
 
-export { BaseService, type BaseServiceOptions, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, type SchemaInfo, type SecretPayload, type SecretScopeOptions, type SecretsError, SecretsService, type ServiceConstructor, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, type ServiceRegistration, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, authExpiredError, authRequiredError, authUnauthorizedError, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, networkError, notFoundError, parseAuthError, parsePermissionHint, parsePermissionHintFromErrorText, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, wrapError };
+export { BaseService, type BaseServiceOptions, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretScopeOptions, type SecretsError, SecretsService, type ServiceConstructor, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, type ServiceRegistration, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, authExpiredError, authRequiredError, authUnauthorizedError, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, networkError, notFoundError, parseAuthError, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, wrapError };

package/dist/index.js

@@ -1478,7 +1478,7 @@ var KVService = class extends BaseService {
    */
   getFullPath(key, prefixOverride) {
     const prefix = prefixOverride ?? this._config.prefix ?? "";
-    return prefix ? `${prefix}/${key}` : key;
+    return prefix ? key === "" ? prefix : `${prefix}/${key}` : key;
   }
   /**
    * Get the host URL.
@@ -1962,16 +1962,17 @@ var KVService = class extends BaseService {
             ...options?.ifNoneMatch === void 0 ? {} : { "if-none-match": options.ifNoneMatch }
           }
         );
+        if (response.status === 401 || response.status === 403) {
+          const errorText = await response.text();
+          const message = errorText.trim().length > 0 ? errorText : `Failed to put key "${key}": ${response.status} - ${response.statusText || "authorization failed"}`;
+          const { resource, action: requiredAction } = parseAuthError(errorText);
+          return err(authUnauthorizedError("kv", message, {
+            status: response.status,
+            ...requiredAction && { requiredAction },
+            ...resource && { resource }
+          }));
+        }
         if (!response.ok) {
-          if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
-          }
           const errorText = await response.text();
           if (response.status === 412) {
             return err(serviceError(
@@ -5611,7 +5612,9 @@ function canonicalizeSecretScope(scope) {
   }
   const trimmed = scope.trim();
   if (trimmed === "") {
-    throw new Error("Secret scope must be non-empty; omit scope for global secrets.");
+    throw new Error(
+      "Secret scope must be non-empty; omit scope for global secrets."
+    );
   }
   const canonical = trimmed.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
   if (canonical === "") {
@@ -5646,6 +5649,28 @@ function resolveSecretListPrefix(options = {}) {
   const scope = canonicalizeSecretScope(options.scope);
   return scope === void 0 ? "vault/secrets/" : `vault/secrets/scoped/${scope}/`;
 }
+function parseSecretCatalogKey(key) {
+  if (SECRET_NAME_RE.test(key)) {
+    return { name: key };
+  }
+  const parts = key.split("/");
+  if (parts.length !== 3 || parts[0] !== "scoped") {
+    return void 0;
+  }
+  const [, rawScope, name] = parts;
+  if (!name || !SECRET_NAME_RE.test(name)) {
+    return void 0;
+  }
+  try {
+    const scope = canonicalizeSecretScope(rawScope);
+    if (scope === void 0 || scope !== rawScope) {
+      return void 0;
+    }
+    return { name, scope };
+  } catch {
+    return void 0;
+  }
+}
 
 // src/secrets/SecretsService.ts
 function invalidSecretInput(message) {
@@ -5659,7 +5684,9 @@ function resolveSecretPathResult(name, options) {
   try {
     return resolveSecretPath(name, options);
   } catch (error) {
-    return invalidSecretInput(error instanceof Error ? error.message : String(error));
+    return invalidSecretInput(
+      error instanceof Error ? error.message : String(error)
+    );
   }
 }
 var SecretsService = class {
@@ -5708,7 +5735,9 @@ var SecretsService = class {
       const scope = canonicalizeSecretScope(options?.scope);
       prefix = scope === void 0 ? "secrets/" : `secrets/scoped/${scope}/`;
     } catch (error) {
-      return invalidSecretInput(error instanceof Error ? error.message : String(error));
+      return invalidSecretInput(
+        error instanceof Error ? error.message : String(error)
+      );
     }
     const result = await this.vault.list({
       prefix,
@@ -5722,6 +5751,38 @@ var SecretsService = class {
       data: result.data.filter((name) => SECRET_NAME_RE.test(name))
     };
   }
+  async listAll() {
+    const entries = /* @__PURE__ */ new Map();
+    let cursor;
+    do {
+      const result = await this.vault.listPage({
+        prefix: "secrets/",
+        removePrefix: true,
+        limit: 1e3,
+        ...cursor === void 0 ? {} : { cursor }
+      });
+      if (!result.ok) {
+        return result;
+      }
+      for (const key of result.data.keys) {
+        const entry = parseSecretCatalogKey(key);
+        if (!entry) continue;
+        entries.set(`${entry.scope ?? ""}\0${entry.name}`, entry);
+      }
+      cursor = result.data.truncated ? result.data.nextCursor : void 0;
+      if (result.data.truncated && cursor === void 0) {
+        return invalidSecretInput(
+          "Secret catalog listing was truncated without a continuation cursor."
+        );
+      }
+    } while (cursor !== void 0);
+    return {
+      ok: true,
+      data: [...entries.values()].sort(
+        (a, b) => (a.scope ?? "").localeCompare(b.scope ?? "") || a.name.localeCompare(b.name)
+      )
+    };
+  }
 };
 
 // src/encryption/canonical.ts
@@ -6611,7 +6672,10 @@ var EncryptionService = class extends BaseService {
       const descriptor = usable.data;
       const networkPublicKey = base64Decode2(descriptor.publicEncryptionKey);
       const result = encryptToNetwork(this.crypto, {
-        networkId,
+        // Discovery returns the node's canonical network identifier. Persist
+        // that spelling in the envelope so a later response can be compared
+        // byte-for-byte (notably for checksummed did:pkh principals).
+        networkId: descriptor.networkId,
         networkPublicKey,
         plaintext,
         ...options?.aad !== void 0 ? { aad: options.aad } : {},
@@ -6869,6 +6933,7 @@ export {
   parseNetworkId,
   parsePermissionHint,
   parsePermissionHintFromErrorText,
+  parseSecretCatalogKey,
   permissionDeniedError,
   resolveSecretListPrefix,
   resolveSecretPath,