@tinycloud/sdk-services 2.6.3 → 2.7.0-beta.4

package/dist/internal/decrypt-transport-response-error.cjs

@@ -0,0 +1,38 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/encryption/DecryptTransportResponseError.ts
+var DecryptTransportResponseError_exports = {};
+__export(DecryptTransportResponseError_exports, {
+  DecryptTransportResponseError: () => DecryptTransportResponseError
+});
+module.exports = __toCommonJS(DecryptTransportResponseError_exports);
+var DecryptTransportResponseError = class extends Error {
+  constructor(status, permissionHint) {
+    super("Node decrypt request failed");
+    this.status = status;
+    this.permissionHint = permissionHint;
+    this.name = "DecryptTransportResponseError";
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DecryptTransportResponseError
+});
+//# sourceMappingURL=decrypt-transport-response-error.cjs.map

package/dist/internal/decrypt-transport-response-error.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/encryption/DecryptTransportResponseError.ts"],"sourcesContent":["import type { PermissionHint } from \"../types\";\n\n/** A reachable node returned an HTTP failure for a decrypt request. */\nexport class DecryptTransportResponseError extends Error {\n  constructor(readonly status: number, readonly permissionHint?: PermissionHint) {\n    super(\"Node decrypt request failed\");\n    this.name = \"DecryptTransportResponseError\";\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAGO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAqB,QAAyB,gBAAiC;AAC7E,UAAM,6BAA6B;AADhB;AAAyB;AAE5C,SAAK,OAAO;AAAA,EACd;AACF;","names":[]}

package/dist/internal/decrypt-transport-response-error.d.cts

@@ -0,0 +1,10 @@
+import { P as PermissionHint } from '../types-DAY1O1kW.cjs';
+
+/** A reachable node returned an HTTP failure for a decrypt request. */
+declare class DecryptTransportResponseError extends Error {
+    readonly status: number;
+    readonly permissionHint?: PermissionHint | undefined;
+    constructor(status: number, permissionHint?: PermissionHint | undefined);
+}
+
+export { DecryptTransportResponseError };

package/dist/internal/decrypt-transport-response-error.d.ts

@@ -0,0 +1,10 @@
+import { P as PermissionHint } from '../types-DAY1O1kW.js';
+
+/** A reachable node returned an HTTP failure for a decrypt request. */
+declare class DecryptTransportResponseError extends Error {
+    readonly status: number;
+    readonly permissionHint?: PermissionHint | undefined;
+    constructor(status: number, permissionHint?: PermissionHint | undefined);
+}
+
+export { DecryptTransportResponseError };

package/dist/internal/decrypt-transport-response-error.js

@@ -0,0 +1,13 @@
+// src/encryption/DecryptTransportResponseError.ts
+var DecryptTransportResponseError = class extends Error {
+  constructor(status, permissionHint) {
+    super("Node decrypt request failed");
+    this.status = status;
+    this.permissionHint = permissionHint;
+    this.name = "DecryptTransportResponseError";
+  }
+};
+export {
+  DecryptTransportResponseError
+};
+//# sourceMappingURL=decrypt-transport-response-error.js.map

package/dist/internal/decrypt-transport-response-error.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/encryption/DecryptTransportResponseError.ts"],"sourcesContent":["import type { PermissionHint } from \"../types\";\n\n/** A reachable node returned an HTTP failure for a decrypt request. */\nexport class DecryptTransportResponseError extends Error {\n  constructor(readonly status: number, readonly permissionHint?: PermissionHint) {\n    super(\"Node decrypt request failed\");\n    this.name = \"DecryptTransportResponseError\";\n  }\n}\n"],"mappings":";AAGO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAqB,QAAyB,gBAAiC;AAC7E,UAAM,6BAA6B;AADhB;AAAyB;AAE5C,SAAK,OAAO;AAAA,EACd;AACF;","names":[]}

package/dist/kv/index.cjs

@@ -97,6 +97,42 @@ function serviceError(code, message, service, options) {
 }
 
 // src/errors.ts
+function parsePermissionHint(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+  const candidate = value;
+  const keys = Object.keys(candidate).sort();
+  if (keys.some((key) => !["actions", "path", "service", "space"].includes(key))) return void 0;
+  if (candidate.service !== "tinycloud.kv" && candidate.service !== "tinycloud.encryption") return void 0;
+  if (typeof candidate.path !== "string" || candidate.path.length === 0 || candidate.path.includes("*")) return void 0;
+  if (candidate.service === "tinycloud.kv" && (typeof candidate.space !== "string" || candidate.space.length === 0 || !candidate.path.startsWith("vault/") || candidate.path.endsWith("/"))) {
+    return void 0;
+  }
+  if (candidate.service === "tinycloud.encryption" && (candidate.space !== void 0 || !candidate.path.startsWith("urn:tinycloud:encryption:") || candidate.path.endsWith(":"))) {
+    return void 0;
+  }
+  if (!Array.isArray(candidate.actions) || candidate.actions.length !== 1 || typeof candidate.actions[0] !== "string" || candidate.actions[0].includes("*")) return void 0;
+  const expectedAction = candidate.service === "tinycloud.kv" ? "tinycloud.kv/get" : "tinycloud.encryption/decrypt";
+  if (candidate.actions[0] !== expectedAction) return void 0;
+  const space = typeof candidate.space === "string" ? candidate.space : void 0;
+  return {
+    service: candidate.service,
+    ...space === void 0 ? {} : { space },
+    path: candidate.path,
+    actions: [candidate.actions[0]]
+  };
+}
+function parsePermissionHintFromErrorText(text) {
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed !== "object" || parsed === null) return void 0;
+    const root = parsed;
+    const nested = root.error;
+    const nestedRecord = typeof nested === "object" && nested !== null ? nested : void 0;
+    return parsePermissionHint(root.permissionHint) ?? parsePermissionHint(nestedRecord?.permissionHint);
+  } catch {
+    return void 0;
+  }
+}
 function authRequiredError(service) {
   return {
     code: ErrorCodes.AUTH_REQUIRED,
@@ -215,7 +251,7 @@ var BaseService = class {
    * Combines the service-level abort with context-level abort.
    */
   get abortSignal() {
-    return this.abortController.signal;
+    return this.combineSignals();
   }
   /**
    * Check if the service is authenticated.
@@ -331,7 +367,11 @@ var BaseService = class {
    */
   combineSignals(...signals) {
     const controller = new AbortController();
-    const allSignals = [this.abortSignal, ...signals.filter(Boolean)];
+    const allSignals = [
+      this.abortController.signal,
+      this.context?.abortSignal,
+      ...signals.filter(Boolean)
+    ].filter(Boolean);
     for (const signal of allSignals) {
       if (signal.aborted) {
         controller.abort(signal.reason);
@@ -804,13 +844,15 @@ var KVService = class extends BaseService {
           options?.signal
         );
         if (!response.ok) {
-          if (response.status === 401) {
+          if (response.status === 401 || response.status === 403) {
             const errorText2 = await response.text();
             const { resource, action } = parseAuthError(errorText2);
+            const permissionHint = parsePermissionHintFromErrorText(errorText2);
             return err(authUnauthorizedError("kv", errorText2, {
               status: response.status,
               ...action && { requiredAction: action },
-              ...resource && { resource }
+              ...resource && { resource },
+              ...permissionHint === void 0 ? {} : { permissionHint }
             }));
           }
           if (response.status === 404) {