@tinycloud/sdk-services 2.4.0-beta.1 → 2.4.0-beta.10

package/dist/index.d.cts

@@ -3,7 +3,7 @@ export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchRespo
 import { z } from 'zod';
 import { IKVService } from './kv/index.cjs';
 export { DEFAULT_SIGNED_READ_URL_EXPIRY_MS, IPrefixedKVService, KVAction, KVActionType, KVBatchPutItem, KVBatchPutOptions, KVBatchPutResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, PrefixedKVService } from './kv/index.cjs';
-export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SqlStatement, SqlValue } from './sql/index.cjs';
+export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLMigrations, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLMigrations, SQLService, SQLServiceConfig, SqlMigration, SqlMigrationApplyOptions, SqlMigrationApplyResponse, SqlStatement, SqlValue } from './sql/index.cjs';
 import { IEncryptionService, DecryptCapabilityProof } from './encryption/index.cjs';
 export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, InlineEncryptedEnvelope, Json, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, base64Decode, base64Encode, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalize as canonicalizeEncryptionJson, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, encryptionError, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, hexDecode, hexEncode, isNetworkId, networkDiscoveryKey, openWrappedKey, parseNetworkId, utf8Decode, utf8Encode, validateEnvelope, verifyDecryptResponse } from './encryption/index.cjs';
 

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchRespo
 import { z } from 'zod';
 import { IKVService } from './kv/index.js';
 export { DEFAULT_SIGNED_READ_URL_EXPIRY_MS, IPrefixedKVService, KVAction, KVActionType, KVBatchPutItem, KVBatchPutOptions, KVBatchPutResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, PrefixedKVService } from './kv/index.js';
-export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SqlStatement, SqlValue } from './sql/index.js';
+export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLMigrations, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLMigrations, SQLService, SQLServiceConfig, SqlMigration, SqlMigrationApplyOptions, SqlMigrationApplyResponse, SqlStatement, SqlValue } from './sql/index.js';
 import { IEncryptionService, DecryptCapabilityProof } from './encryption/index.js';
 export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, InlineEncryptedEnvelope, Json, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, base64Decode, base64Encode, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalize as canonicalizeEncryptionJson, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, encryptionError, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, hexDecode, hexEncode, isNetworkId, networkDiscoveryKey, openWrappedKey, parseNetworkId, utf8Decode, utf8Encode, validateEnvelope, verifyDecryptResponse } from './encryption/index.js';
 

package/dist/index.js

@@ -983,6 +983,31 @@ var KVService = class extends BaseService {
     }
     return void 0;
   }
+  /**
+   * Classify a KV 404 by reading the response body once.
+   *
+   * The server returns 404 both for a genuinely missing key AND for an
+   * un-hosted space (body "Space not found"). Previously get/head/delete
+   * collapsed every 404 to KV_NOT_FOUND before reading the body, so an
+   * un-hosted-space read was indistinguishable from a missing key. We now
+   * preserve status + the "Space not found" body for the un-hosted case (so the
+   * CLI/SDK can normalize it to SPACE_NOT_HOSTED, matching put/list/sql), and
+   * fall through to KV_NOT_FOUND for a real missing key.
+   */
+  async classifyNotFound(response, key) {
+    const errorText = await response.text();
+    if (/space not found/i.test(errorText)) {
+      return err(
+        serviceError(
+          ErrorCodes.KV_NOT_FOUND,
+          `KV ${response.status} - ${errorText}`,
+          "kv",
+          { meta: { status: response.status, statusText: response.statusText } }
+        )
+      );
+    }
+    return err(serviceError(ErrorCodes.KV_NOT_FOUND, `Key not found: ${key}`, "kv"));
+  }
   /**
    * Get the full path with optional prefix.
    *
@@ -1229,13 +1254,7 @@ var KVService = class extends BaseService {
             }));
           }
           if (response.status === 404) {
-            return err(
-              serviceError(
-                ErrorCodes.KV_NOT_FOUND,
-                `Key not found: ${key}`,
-                "kv"
-              )
-            );
+            return this.classifyNotFound(response, key);
           }
           const errorText = await response.text();
           return err(
@@ -1496,13 +1515,7 @@ var KVService = class extends BaseService {
             }));
           }
           if (response.status === 404) {
-            return err(
-              serviceError(
-                ErrorCodes.KV_NOT_FOUND,
-                `Key not found: ${key}`,
-                "kv"
-              )
-            );
+            return this.classifyNotFound(response, key);
           }
           const errorText = await response.text();
           return err(
@@ -1547,13 +1560,7 @@ var KVService = class extends BaseService {
             }));
           }
           if (response.status === 404) {
-            return err(
-              serviceError(
-                ErrorCodes.KV_NOT_FOUND,
-                `Key not found: ${key}`,
-                "kv"
-              )
-            );
+            return this.classifyNotFound(response, key);
           }
           const errorText = await response.text();
           return err(
@@ -1680,11 +1687,59 @@ var KVService = class extends BaseService {
  */
 KVService.serviceName = "kv";
 
+// src/responseErrors.ts
+function parseServiceErrorBody(errorText) {
+  try {
+    return JSON.parse(errorText);
+  } catch {
+    return {};
+  }
+}
+function formatServiceResponseError(serviceLabel, operation, status, errorText, parsed) {
+  if (parsed.message) {
+    return compactMessage(parsed.message);
+  }
+  if (looksLikeHtml(errorText)) {
+    if (status === 524 || /524\s*[:-]/i.test(errorText) || /a timeout occurred/i.test(errorText)) {
+      return `${serviceLabel} ${operation} failed: upstream request timed out. Please retry.`;
+    }
+    return `${serviceLabel} ${operation} failed: upstream service returned an HTML error page (${status}).`;
+  }
+  return `${serviceLabel} ${operation} failed: ${status} - ${compactMessage(errorText)}`;
+}
+function responseErrorMeta(status, statusText, errorText) {
+  const meta = { status, statusText };
+  const snippet = compactMessage(errorText);
+  if (snippet) {
+    meta.responseSnippet = snippet.slice(0, 300);
+  }
+  return meta;
+}
+function looksLikeHtml(text) {
+  return /<!doctype html/i.test(text) || /<html[\s>]/i.test(text);
+}
+function compactMessage(message) {
+  const compact = message.replace(/\s+/g, " ").trim();
+  return compact.length > 500 ? `${compact.slice(0, 500)}...` : compact;
+}
+
+// src/sql/SQLMigrations.ts
+var SQLMigrations = class {
+  constructor(service, dbName) {
+    this.service = service;
+    this.dbName = dbName;
+  }
+  apply(options) {
+    return this.service.applyMigrationsOnDb(this.dbName, options);
+  }
+};
+
 // src/sql/DatabaseHandle.ts
 var DatabaseHandle = class {
   constructor(service, name) {
     this.service = service;
     this.name = name;
+    this.migrations = new SQLMigrations(service, name);
   }
   async query(sql, params, options) {
     return this.service.queryOnDb(this.name, sql, params, options);
@@ -1707,6 +1762,7 @@ var DatabaseHandle = class {
 var SQLAction = {
   READ: "tinycloud.sql/read",
   WRITE: "tinycloud.sql/write",
+  DDL: "tinycloud.sql/ddl",
   ADMIN: "tinycloud.sql/admin",
   SELECT: "tinycloud.sql/select",
   INSERT: "tinycloud.sql/insert",
@@ -1718,9 +1774,21 @@ var SQLAction = {
 };
 
 // src/sql/SQLService.ts
+var DDL_TOKENS = /* @__PURE__ */ new Set(["alter", "create", "drop"]);
+var MIGRATIONS_TABLE = "__tinycloud_sql_migrations";
+var MIGRATIONS_SCHEMA = `CREATE TABLE IF NOT EXISTS ${MIGRATIONS_TABLE} (
+  key TEXT PRIMARY KEY,
+  namespace TEXT NOT NULL,
+  id TEXT NOT NULL,
+  applied_at TEXT NOT NULL,
+  statement_count INTEGER NOT NULL
+)`;
+var MIGRATIONS_META_NAMESPACE = "tinycloud.sql.migrations";
+var MIGRATIONS_META_ID = "000_metadata";
 var SQLService = class extends BaseService {
   constructor(config = {}) {
     super();
+    this.migrationLocks = /* @__PURE__ */ new Map();
     this._config = config;
   }
   get config() {
@@ -1756,6 +1824,24 @@ var SQLService = class extends BaseService {
   async batch(statements, options) {
     return this.batchOnDb(this.defaultDbName, statements, options);
   }
+  async applyMigrationsOnDb(dbName, options) {
+    const validationError = validateMigrationOptions(options);
+    if (validationError) {
+      return err(serviceError(ErrorCodes.INVALID_INPUT, validationError, "sql"));
+    }
+    const lockKey = `${dbName}\0${options.namespace}`;
+    const existing = this.migrationLocks.get(lockKey);
+    if (existing) {
+      return existing;
+    }
+    const promise = this.applyMigrationsOnDbUnlocked(dbName, options);
+    this.migrationLocks.set(lockKey, promise);
+    try {
+      return await promise;
+    } finally {
+      this.migrationLocks.delete(lockKey);
+    }
+  }
   // === Internal methods called by DatabaseHandle ===
   async queryOnDb(dbName, sql, params, options) {
     return this.withTelemetry("query", dbName, async () => {
@@ -1793,9 +1879,15 @@ var SQLService = class extends BaseService {
         if (options?.schema) {
           body.schema = options.schema;
         }
+        const actions = [
+          this.actionForSql(sql, SQLAction.WRITE),
+          ...(options?.schema ?? []).map(
+            (statement) => this.actionForSql(statement, SQLAction.DDL)
+          )
+        ];
         const response = await this.invokeSQL(
           dbName,
-          this.actionForSql(sql, SQLAction.WRITE),
+          this.dedupeActions(actions),
           body,
           options?.signal
         );
@@ -1817,7 +1909,7 @@ var SQLService = class extends BaseService {
       try {
         const response = await this.invokeSQL(
           dbName,
-          this.actionForSqlBatch(statements),
+          this.actionsForSqlBatch(statements),
           { action: "batch", statements },
           options?.signal
         );
@@ -1880,10 +1972,83 @@ var SQLService = class extends BaseService {
       }
     });
   }
+  async applyMigrationsOnDbUnlocked(dbName, options) {
+    return this.withTelemetry("migrations.apply", dbName, async () => {
+      const created = await this.ensureMigrationsTable(dbName, options.signal);
+      if (!created.ok) return created;
+      const listed = await this.queryOnDb(
+        dbName,
+        `SELECT id FROM ${MIGRATIONS_TABLE} WHERE namespace = ? ORDER BY applied_at, id`,
+        [options.namespace],
+        { signal: options.signal }
+      );
+      if (!listed.ok) return listed;
+      const appliedIds = new Set(
+        listed.data.rows.map((row) => rowValue(row, 0)).filter((id) => typeof id === "string")
+      );
+      const skipped = options.migrations.filter((migration) => appliedIds.has(migration.id)).map((migration) => migration.id);
+      const pending = options.migrations.filter((migration) => !appliedIds.has(migration.id));
+      const applied = [];
+      for (const migration of pending) {
+        const result = await this.applyOneMigration(dbName, options.namespace, migration, options.signal);
+        if (!result.ok) return result;
+        applied.push(migration.id);
+      }
+      return ok({
+        database: dbName,
+        namespace: options.namespace,
+        status: applied.length > 0 ? "applied" : "already_current",
+        applied,
+        skipped
+      });
+    });
+  }
+  async applyOneMigration(dbName, namespace, migration, signal) {
+    const statements = [
+      ...migration.sql.map(
+        (statement) => typeof statement === "string" ? { sql: statement } : statement
+      ),
+      {
+        sql: `INSERT OR REPLACE INTO ${MIGRATIONS_TABLE} (key, namespace, id, applied_at, statement_count) VALUES (?, ?, ?, ?, ?)`,
+        params: [
+          migrationKey(namespace, migration.id),
+          namespace,
+          migration.id,
+          (/* @__PURE__ */ new Date()).toISOString(),
+          migration.sql.length
+        ]
+      }
+    ];
+    const result = await this.batchOnDb(dbName, statements, { signal });
+    if (!result.ok) return result;
+    return ok(void 0);
+  }
+  async ensureMigrationsTable(dbName, signal) {
+    const result = await this.batchOnDb(
+      dbName,
+      [
+        { sql: MIGRATIONS_SCHEMA },
+        {
+          sql: `INSERT OR REPLACE INTO ${MIGRATIONS_TABLE} (key, namespace, id, applied_at, statement_count) VALUES (?, ?, ?, ?, ?)`,
+          params: [
+            migrationKey(MIGRATIONS_META_NAMESPACE, MIGRATIONS_META_ID),
+            MIGRATIONS_META_NAMESPACE,
+            MIGRATIONS_META_ID,
+            (/* @__PURE__ */ new Date()).toISOString(),
+            1
+          ]
+        }
+      ],
+      { signal }
+    );
+    if (!result.ok) return result;
+    return ok(void 0);
+  }
   // === Private helpers ===
-  async invokeSQL(dbName, action, body, signal) {
+  async invokeSQL(dbName, actions, body, signal) {
     const session = this.context.session;
-    const headers = this.context.invoke(session, "sql", dbName, action);
+    const actionList = Array.isArray(actions) ? actions : [actions];
+    const headers = actionList.length === 1 ? this.context.invoke(session, "sql", dbName, actionList[0]) : this.invokeSQLAny(session, dbName, actionList);
     return this.context.fetch(`${this.host}/invoke`, {
       method: "POST",
       headers: {
@@ -1895,26 +2060,50 @@ var SQLService = class extends BaseService {
     });
   }
   actionForSql(sql, fallback) {
-    return firstSqlToken(sql) === "pragma" ? SQLAction.ADMIN : fallback;
+    const token = firstSqlToken(sql);
+    if (token === "pragma") return SQLAction.ADMIN;
+    if (token !== void 0 && DDL_TOKENS.has(token)) return SQLAction.DDL;
+    return fallback;
+  }
+  actionsForSqlBatch(statements) {
+    return this.dedupeActions(
+      statements.map((statement) => this.actionForSql(statement.sql, SQLAction.WRITE))
+    );
+  }
+  dedupeActions(actions) {
+    return [...new Set(actions)];
   }
-  actionForSqlBatch(statements) {
-    return statements.some(
-      (statement) => this.actionForSql(statement.sql, SQLAction.WRITE) === SQLAction.ADMIN
-    ) ? SQLAction.ADMIN : SQLAction.WRITE;
+  invokeSQLAny(session, dbName, actions) {
+    if (!this.context.invokeAny) {
+      throw new Error(
+        `SQL operation requires multiple permissions (${actions.join(", ")}) but this SDK runtime does not support multi-resource invocations`
+      );
+    }
+    return this.context.invokeAny(
+      session,
+      actions.map((action) => ({
+        spaceId: session.spaceId,
+        service: "sql",
+        path: dbName,
+        action
+      }))
+    );
   }
   async handleErrorResponse(response, operation) {
     const errorText = await response.text();
-    let errorBody = {};
-    try {
-      errorBody = JSON.parse(errorText);
-    } catch {
-    }
+    const errorBody = parseServiceErrorBody(errorText);
     const errorCode = this.mapHttpStatusToErrorCode(
       response.status,
       errorBody.error
     );
-    const message = errorBody.message || `SQL ${operation} failed: ${response.status} - ${errorText}`;
-    const meta = { status: response.status, statusText: response.statusText };
+    const message = formatServiceResponseError(
+      "SQL",
+      operation,
+      response.status,
+      errorText,
+      errorBody
+    );
+    const meta = responseErrorMeta(response.status, response.statusText, errorText);
     if (response.status === 401) {
       const { resource, action } = parseAuthError(errorText);
       if (action) meta.requiredAction = action;
@@ -1974,6 +2163,53 @@ function firstSqlToken(sql) {
   const match = /^[A-Za-z_]+/.exec(sql.slice(index));
   return match?.[0].toLowerCase();
 }
+function validateMigrationOptions(options) {
+  if (!options || typeof options !== "object") {
+    return "SQL migrations require options";
+  }
+  if (!options.namespace || typeof options.namespace !== "string") {
+    return "SQL migrations require a non-empty namespace";
+  }
+  if (!Array.isArray(options.migrations)) {
+    return "SQL migrations require an ordered migrations array";
+  }
+  const ids = /* @__PURE__ */ new Set();
+  for (const migration of options.migrations) {
+    if (!migration.id || typeof migration.id !== "string") {
+      return "SQL migrations require every migration to have a non-empty id";
+    }
+    if (ids.has(migration.id)) {
+      return `Duplicate SQL migration id: ${migration.id}`;
+    }
+    ids.add(migration.id);
+    if (!Array.isArray(migration.sql)) {
+      return `SQL migration ${migration.id} requires a sql array`;
+    }
+    for (const statement of migration.sql) {
+      if (typeof statement === "string") {
+        if (statement.trim() === "") {
+          return `SQL migration ${migration.id} contains an empty statement`;
+        }
+        continue;
+      }
+      if (!statement || typeof statement.sql !== "string" || statement.sql.trim() === "") {
+        return `SQL migration ${migration.id} contains an invalid statement`;
+      }
+    }
+  }
+  return null;
+}
+function migrationKey(namespace, id) {
+  return `${encodeURIComponent(namespace)}:${encodeURIComponent(id)}`;
+}
+function rowValue(row, index) {
+  if (Array.isArray(row)) return row[index];
+  if (row && typeof row === "object") {
+    const values = Object.values(row);
+    return values[index];
+  }
+  return void 0;
+}
 
 // src/duckdb/DuckDbDatabaseHandle.ts
 var DuckDbDatabaseHandle = class {
@@ -2283,17 +2519,19 @@ var DuckDbService = class extends BaseService {
   }
   async handleErrorResponse(response, operation) {
     const errorText = await response.text();
-    let errorBody = {};
-    try {
-      errorBody = JSON.parse(errorText);
-    } catch {
-    }
+    const errorBody = parseServiceErrorBody(errorText);
     const errorCode = this.mapHttpStatusToErrorCode(
       response.status,
       errorBody.error
     );
-    const message = errorBody.message || `DuckDB ${operation} failed: ${response.status} - ${errorText}`;
-    const meta = { status: response.status, statusText: response.statusText };
+    const message = formatServiceResponseError(
+      "DuckDB",
+      operation,
+      response.status,
+      errorText,
+      errorBody
+    );
+    const meta = responseErrorMeta(response.status, response.statusText, errorText);
     if (response.status === 401) {
       const { resource, action } = parseAuthError(errorText);
       if (action) meta.requiredAction = action;
@@ -5641,6 +5879,7 @@ export {
   RetryPolicySchema,
   SECRET_NAME_RE,
   SQLAction,
+  SQLMigrations,
   SQLService,
   SecretsService,
   ServiceContext,