@tinycloud/sdk-services 2.6.3 → 2.7.0-beta.4

package/dist/encryption/index.d.cts

@@ -1,4 +1,6 @@
-import { c as IService, e as Result, B as BaseService } from '../BaseService-BdRvNm2s.cjs';
+import { B as BaseService } from '../BaseService-BwBU5CQ4.cjs';
+import { P as PermissionHint, I as IService, R as Result } from '../types-DAY1O1kW.cjs';
+export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
 
 /**
  * Canonical JSON serialization and content hashing for TinyCloud
@@ -298,6 +300,7 @@ type EncryptionErrorInput = {
 } | {
     code: "DECRYPT_DENIED";
     message: string;
+    permissionHint?: PermissionHint;
 } | {
     code: "INVALID_RESPONSE";
     message: string;
@@ -481,14 +484,18 @@ interface DecryptTransport {
         networkId: string;
         authorization: string;
         canonicalBody: string;
+        signal?: AbortSignal;
     }): Promise<DecryptResponseBody>;
 }
+
 interface EncryptionServiceConfig {
     crypto: EncryptionCrypto;
     signer: DecryptInvocationSigner;
     transport: DecryptTransport;
     node?: NodeDescriptorFetcher;
     wellKnown?: WellKnownDescriptorFetcher;
+    /** Bound by an owning service graph to prevent cross-session authority use. */
+    assertActive?: () => void;
     [key: string]: unknown;
 }
 declare class EncryptionService extends BaseService implements IEncryptionService {
@@ -500,6 +507,7 @@ declare class EncryptionService extends BaseService implements IEncryptionServic
     discoverNetwork(identifier: string, ownerDid?: string): Promise<Result<NetworkDescriptor, EncryptionError>>;
     encryptToNetwork(networkId: string, plaintext: Uint8Array, options?: EncryptToNetworkOptions): Promise<Result<InlineEncryptedEnvelope, EncryptionError>>;
     decryptEnvelope(envelope: InlineEncryptedEnvelope, capabilityProof: DecryptCapabilityProof, options?: DecryptEnvelopeOptions): Promise<Result<Uint8Array, EncryptionError>>;
+    private assertActive;
 }
 
 /**

package/dist/encryption/index.d.ts

@@ -1,4 +1,6 @@
-import { c as IService, e as Result, B as BaseService } from '../BaseService-BdRvNm2s.js';
+import { B as BaseService } from '../BaseService-CnPTKR5G.js';
+import { P as PermissionHint, I as IService, R as Result } from '../types-DAY1O1kW.js';
+export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
 
 /**
  * Canonical JSON serialization and content hashing for TinyCloud
@@ -298,6 +300,7 @@ type EncryptionErrorInput = {
 } | {
     code: "DECRYPT_DENIED";
     message: string;
+    permissionHint?: PermissionHint;
 } | {
     code: "INVALID_RESPONSE";
     message: string;
@@ -481,14 +484,18 @@ interface DecryptTransport {
         networkId: string;
         authorization: string;
         canonicalBody: string;
+        signal?: AbortSignal;
     }): Promise<DecryptResponseBody>;
 }
+
 interface EncryptionServiceConfig {
     crypto: EncryptionCrypto;
     signer: DecryptInvocationSigner;
     transport: DecryptTransport;
     node?: NodeDescriptorFetcher;
     wellKnown?: WellKnownDescriptorFetcher;
+    /** Bound by an owning service graph to prevent cross-session authority use. */
+    assertActive?: () => void;
     [key: string]: unknown;
 }
 declare class EncryptionService extends BaseService implements IEncryptionService {
@@ -500,6 +507,7 @@ declare class EncryptionService extends BaseService implements IEncryptionServic
     discoverNetwork(identifier: string, ownerDid?: string): Promise<Result<NetworkDescriptor, EncryptionError>>;
     encryptToNetwork(networkId: string, plaintext: Uint8Array, options?: EncryptToNetworkOptions): Promise<Result<InlineEncryptedEnvelope, EncryptionError>>;
     decryptEnvelope(envelope: InlineEncryptedEnvelope, capabilityProof: DecryptCapabilityProof, options?: DecryptEnvelopeOptions): Promise<Result<Uint8Array, EncryptionError>>;
+    private assertActive;
 }
 
 /**

package/dist/encryption/index.js

@@ -141,7 +141,7 @@ var BaseService = class {
    * Combines the service-level abort with context-level abort.
    */
   get abortSignal() {
-    return this.abortController.signal;
+    return this.combineSignals();
   }
   /**
    * Check if the service is authenticated.
@@ -257,7 +257,11 @@ var BaseService = class {
    */
   combineSignals(...signals) {
     const controller = new AbortController();
-    const allSignals = [this.abortSignal, ...signals.filter(Boolean)];
+    const allSignals = [
+      this.abortController.signal,
+      this.context?.abortSignal,
+      ...signals.filter(Boolean)
+    ].filter(Boolean);
     for (const signal of allSignals) {
       if (signal.aborted) {
         controller.abort(signal.reason);
@@ -1144,6 +1148,8 @@ function openWrappedKey(crypto, receiverPrivateKey, response) {
 }
 
 // src/encryption/EncryptionService.ts
+import { DecryptTransportResponseError } from "@tinycloud/sdk-services/internal/decrypt-transport-response-error";
+import { DecryptTransportResponseError as DecryptTransportResponseError2 } from "@tinycloud/sdk-services/internal/decrypt-transport-response-error";
 function encOk(data) {
   return { ok: true, data };
 }
@@ -1162,17 +1168,20 @@ var EncryptionService = class extends BaseService {
     return this._config.crypto;
   }
   async discoverNetwork(identifier, ownerDid) {
+    this.assertActive();
     const result = await discoverNetwork({
       identifier,
       ...ownerDid !== void 0 ? { ownerDid } : {},
       ...this._config.node !== void 0 ? { node: this._config.node } : {},
       ...this._config.wellKnown !== void 0 ? { wellKnown: this._config.wellKnown } : {}
     });
+    this.assertActive();
     if (!result.ok) return result;
     return encOk(result.data.descriptor);
   }
   async encryptToNetwork(networkId, plaintext, options) {
     try {
+      this.assertActive();
       const discovered = await this.discoverNetwork(networkId);
       if (!discovered.ok) return discovered;
       const usable = ensureNetworkUsableForDecrypt(discovered.data);
@@ -1200,6 +1209,7 @@ var EncryptionService = class extends BaseService {
   }
   async decryptEnvelope(envelope, capabilityProof, options) {
     try {
+      this.assertActive();
       const validated = validateEnvelope(this.crypto, envelope);
       if (!validated.ok) return validated;
       if (options?.aad !== void 0 && validated.data.aad !== base64Encode(options.aad)) {
@@ -1265,16 +1275,38 @@ var EncryptionService = class extends BaseService {
         facts,
         proof: capabilityProof
       });
-      if (!built.ok) return built;
+      this.assertActive();
+      if (!built.ok) {
+        if (built.error.code !== "TRANSPORT_ERROR") return built;
+        return encErr(
+          encryptionError({
+            code: "INVALID_INPUT",
+            message: "Unable to build decrypt request"
+          })
+        );
+      }
       let response;
       try {
         response = await this._config.transport.postDecrypt({
           targetNode,
           networkId: envelope.networkId,
           authorization: built.data.authorization,
-          canonicalBody: built.data.canonicalBody
+          canonicalBody: built.data.canonicalBody,
+          signal: this.abortSignal
         });
+        this.assertActive();
       } catch (error) {
+        if (error instanceof DecryptTransportResponseError) {
+          return encErr(
+            encryptionError(
+              error.status === 401 || error.status === 403 ? {
+                code: "DECRYPT_DENIED",
+                message: "Node denied decrypt request",
+                ...error.permissionHint === void 0 ? {} : { permissionHint: error.permissionHint }
+              } : { code: "INVALID_RESPONSE", message: "Node decrypt request failed" }
+            )
+          );
+        }
         return encErr(
           encryptionError({
             code: "TRANSPORT_ERROR",
@@ -1305,20 +1337,27 @@ var EncryptionService = class extends BaseService {
     } catch (error) {
       return encErr(
         encryptionError({
-          code: "TRANSPORT_ERROR",
-          cause: toError(error)
+          code: "INVALID_RESPONSE",
+          message: "Local decryption failed"
         })
       );
     }
   }
+  assertActive() {
+    this._config.assertActive?.();
+  }
 };
 EncryptionService.serviceName = "encryption";
+
+// src/encryption/index.ts
+import { DecryptTransportResponseError as DecryptTransportResponseError3 } from "@tinycloud/sdk-services/internal/decrypt-transport-response-error";
 export {
   DECRYPT_ACTION,
   DECRYPT_FACT_TYPE,
   DECRYPT_RESULT_TYPE,
   DEFAULT_ENCRYPTION_ALG,
   DEFAULT_KEY_VERSION,
+  DecryptTransportResponseError3 as DecryptTransportResponseError,
   ENCRYPTION_NETWORK_URN_PREFIX,
   ENCRYPTION_SERVICE,
   ENCRYPTION_SERVICE_SHORT,