@tinycloud/sdk-services 3.0.0-beta.8 → 3.1.0-beta.1

package/dist/index.cjs

@@ -73,6 +73,7 @@ __export(src_exports, {
   authExpiredError: () => authExpiredError,
   authRequiredError: () => authRequiredError,
   authUnauthorizedError: () => authUnauthorizedError,
+  authorizationVerdictOf: () => authorizationVerdictOf,
   base64Decode: () => base64Decode2,
   base64Encode: () => base64Encode2,
   buildCanonicalDecryptRequest: () => buildCanonicalDecryptRequest,
@@ -1135,6 +1136,37 @@ function parseAuthError(responseText) {
 function authUnauthorizedError(service, message, meta) {
   return serviceError(ErrorCodes.AUTH_UNAUTHORIZED, message, service, { meta });
 }
+var MAX_CAUSE_DEPTH = 8;
+function errorStatusOf(node) {
+  const meta = node.meta;
+  const candidates = [
+    node.status,
+    node.statusCode,
+    typeof meta === "object" && meta !== null ? meta.status : void 0
+  ];
+  for (const candidate of candidates) {
+    if (typeof candidate === "number" && Number.isInteger(candidate) && candidate >= 400 && candidate <= 599) {
+      return candidate;
+    }
+  }
+  return void 0;
+}
+function authorizationVerdictOf(error) {
+  const seen = /* @__PURE__ */ new Set();
+  let sawUnauthorizedCode = false;
+  let node = error;
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
+    seen.add(node);
+    const record = node;
+    const status = errorStatusOf(record);
+    if (status === 401) return "unauthenticated";
+    if (status === 403) return "forbidden";
+    if (status !== void 0) return "other";
+    if (record.code === ErrorCodes.AUTH_UNAUTHORIZED) sawUnauthorizedCode = true;
+    node = record.cause;
+  }
+  return sawUnauthorizedCode ? "forbidden" : void 0;
+}
 function storageQuotaExceededError(service, message, meta) {
   return {
     code: ErrorCodes.STORAGE_QUOTA_EXCEEDED,
@@ -1563,7 +1595,7 @@ var KVService = class extends BaseService {
       return err(
         storageQuotaExceededError(
           "kv",
-          `Storage quota exceeded for key "${key}": ${errorText}`,
+          `Storage quota exceeded for key ${JSON.stringify(key)}: ${errorText}`,
           {
             status: response.status,
             ...quotaInfo ? { usedBytes: quotaInfo.usedBytes, limitBytes: quotaInfo.limitBytes } : {}
@@ -1576,7 +1608,7 @@ var KVService = class extends BaseService {
       return err(
         storageLimitReachedError(
           "kv",
-          `Storage limit reached for key "${key}": ${errorText}`,
+          `Storage limit reached for key ${JSON.stringify(key)}: ${errorText}`,
           {
             status: response.status,
             ...quotaInfo ? { usedBytes: quotaInfo.usedBytes, limitBytes: quotaInfo.limitBytes } : {}
@@ -1620,7 +1652,7 @@ var KVService = class extends BaseService {
    */
   getFullPath(key, prefixOverride) {
     const prefix = prefixOverride ?? this._config.prefix ?? "";
-    return prefix ? `${prefix}/${key}` : key;
+    return prefix ? key === "" ? prefix : `${prefix}/${key}` : key;
   }
   /**
    * Get the host URL.
@@ -1862,12 +1894,11 @@ var KVService = class extends BaseService {
       if (!response.ok) {
         const errorText = await response.text();
         if (response.status === 401 || response.status === 403) {
-          const { resource, action: requiredAction } = parseAuthError(errorText);
-          return err(authUnauthorizedError("kv", errorText, {
-            status: response.status,
-            ...requiredAction && { requiredAction },
-            ...resource && { resource }
-          }));
+          return this.authorizationFailure(
+            `Failed to batch read ${keys.length} key(s)`,
+            response,
+            errorText
+          );
         }
         if (response.status === 413) {
           return err(serviceError(
@@ -1966,23 +1997,39 @@ var KVService = class extends BaseService {
     } catch {
     }
     if (response.status === 401 || response.status === 403) {
-      const { resource, action } = parseAuthError(errorText);
-      return err(authUnauthorizedError("kv", errorText, {
-        status: response.status,
-        ...action && { requiredAction: action },
-        ...resource && { resource }
-      }));
+      return this.authorizationFailure(
+        `Failed to create signed read URL for key ${JSON.stringify(key)}`,
+        response,
+        errorText
+      );
     }
     const code = response.status === 400 ? ErrorCodes.INVALID_INPUT : ErrorCodes.NETWORK_ERROR;
     return err(
       serviceError(
         code,
-        `Failed to create signed read URL for key "${key}": ${response.status} - ${errorText}`,
+        `Failed to create signed read URL for key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
         "kv",
         { meta: { status: response.status, statusText: response.statusText } }
       )
     );
   }
+  /**
+   * AUTH_UNAUTHORIZED for a 401/403 response. The message keeps the HTTP
+   * status and the server text (`<context>: <status> - <text>`, the same
+   * shape as every other KV failure) so callers that rethrow only the message
+   * still see the status; `meta.status` carries it for typed callers.
+   * Resource/ability hints are parsed from the raw body, never the message.
+   */
+  authorizationFailure(context, response, errorText, extraMeta = {}) {
+    const { resource, action } = parseAuthError(errorText);
+    const detail = errorText.trim().length > 0 ? errorText : response.statusText || "authorization failed";
+    return err(authUnauthorizedError("kv", `${context}: ${response.status} - ${detail}`, {
+      status: response.status,
+      ...action && { requiredAction: action },
+      ...resource && { resource },
+      ...extraMeta
+    }));
+  }
   normalizeSignedReadUrlResponse(data) {
     if (!data || typeof data !== "object") {
       return void 0;
@@ -2025,14 +2072,13 @@ var KVService = class extends BaseService {
         if (!response.ok) {
           if (response.status === 401 || response.status === 403) {
             const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
             const permissionHint = parsePermissionHintFromErrorText(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource },
-              ...permissionHint === void 0 ? {} : { permissionHint }
-            }));
+            return this.authorizationFailure(
+              `Failed to get key ${JSON.stringify(key)}`,
+              response,
+              errorText2,
+              permissionHint === void 0 ? {} : { permissionHint }
+            );
           }
           if (response.status === 404) {
             return this.classifyNotFound(response, key);
@@ -2041,7 +2087,7 @@ var KVService = class extends BaseService {
           if (response.status === 413) {
             return err(serviceError(
               ErrorCodes.KV_RESPONSE_TOO_LARGE,
-              `KV value at key "${key}" exceeds the requested response limit`,
+              `KV value at key ${JSON.stringify(key)} exceeds the requested response limit`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -2049,7 +2095,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.NETWORK_ERROR,
-              `Failed to get key "${key}": ${response.status} - ${errorText}`,
+              `Failed to get key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -2104,21 +2150,19 @@ var KVService = class extends BaseService {
             ...options?.ifNoneMatch === void 0 ? {} : { "if-none-match": options.ifNoneMatch }
           }
         );
+        if (response.status === 401 || response.status === 403) {
+          return this.authorizationFailure(
+            `Failed to put key ${JSON.stringify(key)}`,
+            response,
+            await response.text()
+          );
+        }
         if (!response.ok) {
-          if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
-          }
           const errorText = await response.text();
           if (response.status === 412) {
             return err(serviceError(
               ErrorCodes.KV_PRECONDITION_FAILED,
-              `KV precondition failed for key "${key}"`,
+              `KV precondition failed for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -2126,7 +2170,7 @@ var KVService = class extends BaseService {
           if (response.status === 503 && (options?.ifMatch !== void 0 || options?.ifNoneMatch !== void 0)) {
             return err(serviceError(
               ErrorCodes.KV_CONFLICT,
-              `Concurrent KV update conflicted for key "${key}"`,
+              `Concurrent KV update conflicted for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -2142,7 +2186,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.KV_WRITE_FAILED,
-              `Failed to put key "${key}": ${response.status} - ${errorText}`,
+              `Failed to put key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -2236,12 +2280,11 @@ var KVService = class extends BaseService {
             );
           }
           if (response.status === 401 || response.status === 403) {
-            const { resource, action } = parseAuthError(errorText);
-            return err(authUnauthorizedError("kv", errorText, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              `Failed to batch put ${items.length} key(s)`,
+              response,
+              errorText
+            );
           }
           const quotaError = this.handleQuotaErrorResponse(
             response,
@@ -2362,13 +2405,11 @@ var KVService = class extends BaseService {
         );
         if (!response.ok) {
           if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              "Failed to list keys",
+              response,
+              await response.text()
+            );
           }
           const errorText = await response.text();
           return err(
@@ -2417,13 +2458,11 @@ var KVService = class extends BaseService {
         );
         if (!response.ok) {
           if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              `Failed to delete key ${JSON.stringify(key)}`,
+              response,
+              await response.text()
+            );
           }
           if (response.status === 404) {
             return this.classifyNotFound(response, key);
@@ -2432,7 +2471,7 @@ var KVService = class extends BaseService {
           if (response.status === 412) {
             return err(serviceError(
               ErrorCodes.KV_PRECONDITION_FAILED,
-              `KV precondition failed for key "${key}"`,
+              `KV precondition failed for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -2440,7 +2479,7 @@ var KVService = class extends BaseService {
           if (response.status === 503 && options?.ifMatch !== void 0) {
             return err(serviceError(
               ErrorCodes.KV_CONFLICT,
-              `Concurrent KV delete conflicted for key "${key}"`,
+              `Concurrent KV delete conflicted for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -2448,7 +2487,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.NETWORK_ERROR,
-              `Failed to delete key "${key}": ${response.status} - ${errorText}`,
+              `Failed to delete key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -2481,13 +2520,11 @@ var KVService = class extends BaseService {
         );
         if (!response.ok) {
           if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              `Failed to get metadata for key ${JSON.stringify(key)}`,
+              response,
+              await response.text()
+            );
           }
           if (response.status === 404) {
             return this.classifyNotFound(response, key);
@@ -2496,7 +2533,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.NETWORK_ERROR,
-              `Failed to get metadata for key "${key}": ${response.status} - ${errorText}`,
+              `Failed to get metadata for key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -3978,10 +4015,14 @@ async function responseError(service, message, response) {
     }
   } catch {
   }
-  return wrapError(
+  const error = wrapError(
     service,
     new Error(`${message}: ${response.status} ${detail}`)
   );
+  return {
+    ...error,
+    meta: { ...error.meta, status: response.status, statusText: response.statusText }
+  };
 }
 function isAbortError(error) {
   return error instanceof DOMException && error.name === "AbortError";
@@ -7033,6 +7074,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   authExpiredError,
   authRequiredError,
   authUnauthorizedError,
+  authorizationVerdictOf,
   base64Decode,
   base64Encode,
   buildCanonicalDecryptRequest,