@tinycloud/sdk-services 3.0.0 → 3.1.0-beta.2

package/dist/index.cjs

@@ -55,6 +55,8 @@ __export(src_exports, {
   SQLAction: () => SQLAction,
   SQLMigrations: () => SQLMigrations,
   SQLService: () => SQLService,
+  STORAGE_FULL_MESSAGE: () => STORAGE_FULL_MESSAGE,
+  STORAGE_WRITE_TOO_LARGE_MESSAGE: () => STORAGE_WRITE_TOO_LARGE_MESSAGE,
   SecretsService: () => SecretsService,
   ServiceContext: () => ServiceContext,
   ServiceErrorEventSchema: () => ServiceErrorEventSchema,
@@ -73,6 +75,7 @@ __export(src_exports, {
   authExpiredError: () => authExpiredError,
   authRequiredError: () => authRequiredError,
   authUnauthorizedError: () => authUnauthorizedError,
+  authorizationVerdictOf: () => authorizationVerdictOf,
   base64Decode: () => base64Decode2,
   base64Encode: () => base64Encode2,
   buildCanonicalDecryptRequest: () => buildCanonicalDecryptRequest,
@@ -106,6 +109,7 @@ __export(src_exports, {
   hexEncode: () => hexEncode2,
   installTinyCloudDebugGlobals: () => installTinyCloudDebugGlobals,
   isNetworkId: () => isNetworkId,
+  isStorageFullError: () => isStorageFullError,
   networkDiscoveryKey: () => networkDiscoveryKey,
   networkError: () => networkError,
   notFoundError: () => notFoundError,
@@ -116,12 +120,14 @@ __export(src_exports, {
   parsePermissionHint: () => parsePermissionHint,
   parsePermissionHintFromErrorText: () => parsePermissionHintFromErrorText,
   parseSecretCatalogKey: () => parseSecretCatalogKey,
+  parseStorageQuotaBytes: () => parseStorageQuotaBytes,
   permissionDeniedError: () => permissionDeniedError,
   resolveSecretListPrefix: () => resolveSecretListPrefix,
   resolveSecretPath: () => resolveSecretPath,
   serviceError: () => serviceError,
   storageLimitReachedError: () => storageLimitReachedError,
   storageQuotaExceededError: () => storageQuotaExceededError,
+  storageRejectionError: () => storageRejectionError,
   timeoutError: () => timeoutError,
   tinyCloudDebugLogger: () => tinyCloudDebugLogger,
   utf8Decode: () => utf8Decode,
@@ -1135,6 +1141,37 @@ function parseAuthError(responseText) {
 function authUnauthorizedError(service, message, meta) {
   return serviceError(ErrorCodes.AUTH_UNAUTHORIZED, message, service, { meta });
 }
+var MAX_CAUSE_DEPTH = 8;
+function errorStatusOf(node) {
+  const meta = node.meta;
+  const candidates = [
+    node.status,
+    node.statusCode,
+    typeof meta === "object" && meta !== null ? meta.status : void 0
+  ];
+  for (const candidate of candidates) {
+    if (typeof candidate === "number" && Number.isInteger(candidate) && candidate >= 400 && candidate <= 599) {
+      return candidate;
+    }
+  }
+  return void 0;
+}
+function authorizationVerdictOf(error) {
+  const seen = /* @__PURE__ */ new Set();
+  let sawUnauthorizedCode = false;
+  let node = error;
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
+    seen.add(node);
+    const record = node;
+    const status = errorStatusOf(record);
+    if (status === 401) return "unauthenticated";
+    if (status === 403) return "forbidden";
+    if (status !== void 0) return "other";
+    if (record.code === ErrorCodes.AUTH_UNAUTHORIZED) sawUnauthorizedCode = true;
+    node = record.cause;
+  }
+  return sawUnauthorizedCode ? "forbidden" : void 0;
+}
 function storageQuotaExceededError(service, message, meta) {
   return {
     code: ErrorCodes.STORAGE_QUOTA_EXCEEDED,
@@ -1151,6 +1188,23 @@ function storageLimitReachedError(service, message, meta) {
     meta
   };
 }
+var STORAGE_FULL_MESSAGE = "TinyCloud storage is full, so this change was not saved. Reading still works. Free up space or upgrade your plan to save again.";
+var STORAGE_WRITE_TOO_LARGE_MESSAGE = "This change is larger than the TinyCloud storage you have left, so it was not saved. Reading still works. Free up space or upgrade your plan to save it.";
+function parseStorageQuotaBytes(responseText) {
+  const match = responseText.match(/Used:\s*(\d+)\s*bytes,\s*Limit:\s*(\d+)\s*bytes/i);
+  if (!match) return void 0;
+  return {
+    usedBytes: parseInt(match[1], 10),
+    limitBytes: parseInt(match[2], 10)
+  };
+}
+function storageRejectionError(service, status, meta, responseText) {
+  const quotaMeta = { ...meta, ...parseStorageQuotaBytes(responseText) };
+  return status === 402 ? storageQuotaExceededError(service, STORAGE_FULL_MESSAGE, quotaMeta) : storageLimitReachedError(service, STORAGE_WRITE_TOO_LARGE_MESSAGE, quotaMeta);
+}
+function isStorageFullError(error) {
+  return error?.code === ErrorCodes.STORAGE_QUOTA_EXCEEDED || error?.code === ErrorCodes.STORAGE_LIMIT_REACHED;
+}
 function wrapError(service, error, defaultCode = ErrorCodes.NETWORK_ERROR) {
   if (error instanceof Error) {
     if (error.name === "AbortError") {
@@ -1544,47 +1598,21 @@ var KVService = class extends BaseService {
   get config() {
     return this._config;
   }
-  // Parses "Used: X bytes, Limit: Y bytes" from tinycloud-node error responses
-  parseQuotaInfo(errorText) {
-    const match = errorText.match(
-      /Used:\s*(\d+)\s*bytes,\s*Limit:\s*(\d+)\s*bytes/i
-    );
-    if (match) {
-      return {
-        usedBytes: parseInt(match[1], 10),
-        limitBytes: parseInt(match[2], 10)
-      };
-    }
-    return void 0;
-  }
   handleQuotaErrorResponse(response, errorText, key) {
-    if (response.status === 402) {
-      const quotaInfo = this.parseQuotaInfo(errorText);
-      return err(
-        storageQuotaExceededError(
-          "kv",
-          `Storage quota exceeded for key "${key}": ${errorText}`,
-          {
-            status: response.status,
-            ...quotaInfo ? { usedBytes: quotaInfo.usedBytes, limitBytes: quotaInfo.limitBytes } : {}
-          }
-        )
-      );
+    if (response.status !== 402 && response.status !== 413) {
+      return void 0;
     }
-    if (response.status === 413) {
-      const quotaInfo = this.parseQuotaInfo(errorText);
-      return err(
-        storageLimitReachedError(
-          "kv",
-          `Storage limit reached for key "${key}": ${errorText}`,
-          {
-            status: response.status,
-            ...quotaInfo ? { usedBytes: quotaInfo.usedBytes, limitBytes: quotaInfo.limitBytes } : {}
-          }
-        )
-      );
+    if (response.status === 413 && !parseStorageQuotaBytes(errorText)) {
+      return void 0;
     }
-    return void 0;
+    return err(
+      storageRejectionError(
+        "kv",
+        response.status,
+        { status: response.status, statusText: response.statusText, key },
+        errorText
+      )
+    );
   }
   /**
    * Classify a KV 404 by reading the response body once.
@@ -1862,12 +1890,11 @@ var KVService = class extends BaseService {
       if (!response.ok) {
         const errorText = await response.text();
         if (response.status === 401 || response.status === 403) {
-          const { resource, action: requiredAction } = parseAuthError(errorText);
-          return err(authUnauthorizedError("kv", errorText, {
-            status: response.status,
-            ...requiredAction && { requiredAction },
-            ...resource && { resource }
-          }));
+          return this.authorizationFailure(
+            `Failed to batch read ${keys.length} key(s)`,
+            response,
+            errorText
+          );
         }
         if (response.status === 413) {
           return err(serviceError(
@@ -1966,23 +1993,39 @@ var KVService = class extends BaseService {
     } catch {
     }
     if (response.status === 401 || response.status === 403) {
-      const { resource, action } = parseAuthError(errorText);
-      return err(authUnauthorizedError("kv", errorText, {
-        status: response.status,
-        ...action && { requiredAction: action },
-        ...resource && { resource }
-      }));
+      return this.authorizationFailure(
+        `Failed to create signed read URL for key ${JSON.stringify(key)}`,
+        response,
+        errorText
+      );
     }
     const code = response.status === 400 ? ErrorCodes.INVALID_INPUT : ErrorCodes.NETWORK_ERROR;
     return err(
       serviceError(
         code,
-        `Failed to create signed read URL for key "${key}": ${response.status} - ${errorText}`,
+        `Failed to create signed read URL for key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
         "kv",
         { meta: { status: response.status, statusText: response.statusText } }
       )
     );
   }
+  /**
+   * AUTH_UNAUTHORIZED for a 401/403 response. The message keeps the HTTP
+   * status and the server text (`<context>: <status> - <text>`, the same
+   * shape as every other KV failure) so callers that rethrow only the message
+   * still see the status; `meta.status` carries it for typed callers.
+   * Resource/ability hints are parsed from the raw body, never the message.
+   */
+  authorizationFailure(context, response, errorText, extraMeta = {}) {
+    const { resource, action } = parseAuthError(errorText);
+    const detail = errorText.trim().length > 0 ? errorText : response.statusText || "authorization failed";
+    return err(authUnauthorizedError("kv", `${context}: ${response.status} - ${detail}`, {
+      status: response.status,
+      ...action && { requiredAction: action },
+      ...resource && { resource },
+      ...extraMeta
+    }));
+  }
   normalizeSignedReadUrlResponse(data) {
     if (!data || typeof data !== "object") {
       return void 0;
@@ -2025,14 +2068,13 @@ var KVService = class extends BaseService {
         if (!response.ok) {
           if (response.status === 401 || response.status === 403) {
             const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
             const permissionHint = parsePermissionHintFromErrorText(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource },
-              ...permissionHint === void 0 ? {} : { permissionHint }
-            }));
+            return this.authorizationFailure(
+              `Failed to get key ${JSON.stringify(key)}`,
+              response,
+              errorText2,
+              permissionHint === void 0 ? {} : { permissionHint }
+            );
           }
           if (response.status === 404) {
             return this.classifyNotFound(response, key);
@@ -2041,7 +2083,7 @@ var KVService = class extends BaseService {
           if (response.status === 413) {
             return err(serviceError(
               ErrorCodes.KV_RESPONSE_TOO_LARGE,
-              `KV value at key "${key}" exceeds the requested response limit`,
+              `KV value at key ${JSON.stringify(key)} exceeds the requested response limit`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -2049,7 +2091,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.NETWORK_ERROR,
-              `Failed to get key "${key}": ${response.status} - ${errorText}`,
+              `Failed to get key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -2105,21 +2147,18 @@ var KVService = class extends BaseService {
           }
         );
         if (response.status === 401 || response.status === 403) {
-          const errorText = await response.text();
-          const message = errorText.trim().length > 0 ? errorText : `Failed to put key "${key}": ${response.status} - ${response.statusText || "authorization failed"}`;
-          const { resource, action: requiredAction } = parseAuthError(errorText);
-          return err(authUnauthorizedError("kv", message, {
-            status: response.status,
-            ...requiredAction && { requiredAction },
-            ...resource && { resource }
-          }));
+          return this.authorizationFailure(
+            `Failed to put key ${JSON.stringify(key)}`,
+            response,
+            await response.text()
+          );
         }
         if (!response.ok) {
           const errorText = await response.text();
           if (response.status === 412) {
             return err(serviceError(
               ErrorCodes.KV_PRECONDITION_FAILED,
-              `KV precondition failed for key "${key}"`,
+              `KV precondition failed for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -2127,7 +2166,7 @@ var KVService = class extends BaseService {
           if (response.status === 503 && (options?.ifMatch !== void 0 || options?.ifNoneMatch !== void 0)) {
             return err(serviceError(
               ErrorCodes.KV_CONFLICT,
-              `Concurrent KV update conflicted for key "${key}"`,
+              `Concurrent KV update conflicted for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -2143,7 +2182,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.KV_WRITE_FAILED,
-              `Failed to put key "${key}": ${response.status} - ${errorText}`,
+              `Failed to put key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -2237,12 +2276,11 @@ var KVService = class extends BaseService {
             );
           }
           if (response.status === 401 || response.status === 403) {
-            const { resource, action } = parseAuthError(errorText);
-            return err(authUnauthorizedError("kv", errorText, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              `Failed to batch put ${items.length} key(s)`,
+              response,
+              errorText
+            );
           }
           const quotaError = this.handleQuotaErrorResponse(
             response,
@@ -2363,13 +2401,11 @@ var KVService = class extends BaseService {
         );
         if (!response.ok) {
           if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              "Failed to list keys",
+              response,
+              await response.text()
+            );
           }
           const errorText = await response.text();
           return err(
@@ -2418,13 +2454,11 @@ var KVService = class extends BaseService {
         );
         if (!response.ok) {
           if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              `Failed to delete key ${JSON.stringify(key)}`,
+              response,
+              await response.text()
+            );
           }
           if (response.status === 404) {
             return this.classifyNotFound(response, key);
@@ -2433,7 +2467,7 @@ var KVService = class extends BaseService {
           if (response.status === 412) {
             return err(serviceError(
               ErrorCodes.KV_PRECONDITION_FAILED,
-              `KV precondition failed for key "${key}"`,
+              `KV precondition failed for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -2441,7 +2475,7 @@ var KVService = class extends BaseService {
           if (response.status === 503 && options?.ifMatch !== void 0) {
             return err(serviceError(
               ErrorCodes.KV_CONFLICT,
-              `Concurrent KV delete conflicted for key "${key}"`,
+              `Concurrent KV delete conflicted for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -2449,7 +2483,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.NETWORK_ERROR,
-              `Failed to delete key "${key}": ${response.status} - ${errorText}`,
+              `Failed to delete key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -2482,13 +2516,11 @@ var KVService = class extends BaseService {
         );
         if (!response.ok) {
           if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              `Failed to get metadata for key ${JSON.stringify(key)}`,
+              response,
+              await response.text()
+            );
           }
           if (response.status === 404) {
             return this.classifyNotFound(response, key);
@@ -2497,7 +2529,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.NETWORK_ERROR,
-              `Failed to get metadata for key "${key}": ${response.status} - ${errorText}`,
+              `Failed to get metadata for key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -2917,21 +2949,24 @@ var SQLService = class extends BaseService {
   }
   async applyMigrationsOnDbUnlocked(dbName, options) {
     return this.withTelemetry("migrations.apply", dbName, async () => {
-      const created = await this.ensureMigrationsTable(dbName, options.signal);
-      if (!created.ok) return created;
       const listed = await this.queryOnDb(
         dbName,
         `SELECT id FROM ${MIGRATIONS_TABLE} WHERE namespace = ? ORDER BY applied_at, id`,
         [options.namespace],
         { signal: options.signal }
       );
-      if (!listed.ok) return listed;
+      const tableMissing = !listed.ok && (listed.error.code === ErrorCodes.SQL_DATABASE_NOT_FOUND || isMissingTableError(listed.error.message));
+      if (!listed.ok && !tableMissing) return listed;
       const appliedIds = new Set(
-        listed.data.rows.map((row) => rowValue(row, 0)).filter((id) => typeof id === "string")
+        (listed.ok ? listed.data.rows : []).map((row) => rowValue(row, 0)).filter((id) => typeof id === "string")
       );
       const skipped = options.migrations.filter((migration) => appliedIds.has(migration.id)).map((migration) => migration.id);
       const pending = options.migrations.filter((migration) => !appliedIds.has(migration.id));
       const applied = [];
+      if (pending.length > 0 && tableMissing) {
+        const created = await this.ensureMigrationsTable(dbName, options.signal);
+        if (!created.ok) return created;
+      }
       for (const migration of pending) {
         const result = await this.applyOneMigration(dbName, options.namespace, migration, options.signal);
         if (!result.ok) return result;
@@ -3034,6 +3069,10 @@ var SQLService = class extends BaseService {
   }
   async handleErrorResponse(response, operation) {
     const errorText = await response.text();
+    const meta = responseErrorMeta(response.status, response.statusText, errorText);
+    if (response.status === 402) {
+      return err(storageRejectionError("sql", 402, meta, errorText));
+    }
     const errorBody = parseServiceErrorBody(errorText);
     const errorCode = this.mapHttpStatusToErrorCode(
       response.status,
@@ -3046,7 +3085,6 @@ var SQLService = class extends BaseService {
       errorText,
       errorBody
     );
-    const meta = responseErrorMeta(response.status, response.statusText, errorText);
     if (response.status === 401) {
       const { resource, action } = parseAuthError(errorText);
       if (action) meta.requiredAction = action;
@@ -3147,6 +3185,9 @@ function serializeSqlValues(values) {
     (value) => value instanceof Uint8Array ? Array.from(value) : value
   );
 }
+function isMissingTableError(message) {
+  return /no such table/i.test(message);
+}
 function migrationKey(namespace, id) {
   return `${encodeURIComponent(namespace)}:${encodeURIComponent(id)}`;
 }
@@ -3468,6 +3509,10 @@ var DuckDbService = class extends BaseService {
   }
   async handleErrorResponse(response, operation) {
     const errorText = await response.text();
+    const meta = responseErrorMeta(response.status, response.statusText, errorText);
+    if (response.status === 402) {
+      return err(storageRejectionError("duckdb", 402, meta, errorText));
+    }
     const errorBody = parseServiceErrorBody(errorText);
     const errorCode = this.mapHttpStatusToErrorCode(
       response.status,
@@ -3480,7 +3525,6 @@ var DuckDbService = class extends BaseService {
       errorText,
       errorBody
     );
-    const meta = responseErrorMeta(response.status, response.statusText, errorText);
     if (response.status === 401) {
       const { resource, action } = parseAuthError(errorText);
       if (action) meta.requiredAction = action;
@@ -3979,10 +4023,14 @@ async function responseError(service, message, response) {
     }
   } catch {
   }
-  return wrapError(
+  const error = wrapError(
     service,
     new Error(`${message}: ${response.status} ${detail}`)
   );
+  return {
+    ...error,
+    meta: { ...error.meta, status: response.status, statusText: response.statusText }
+  };
 }
 function isAbortError(error) {
   return error instanceof DOMException && error.name === "AbortError";
@@ -4448,6 +4496,9 @@ function defaultVaultMessage(input) {
       return input.message ?? `Public key not found for ${input.did}`;
     case "STORAGE_ERROR":
       return input.message ?? input.cause.message;
+    case "STORAGE_QUOTA_EXCEEDED":
+    case "STORAGE_LIMIT_REACHED":
+      return input.message;
   }
 }
 function vaultError(input) {
@@ -4458,6 +4509,15 @@ function vaultError(input) {
   };
   return { ok: false, error };
 }
+function kvWriteError(context, error) {
+  if (error.code === ErrorCodes.STORAGE_QUOTA_EXCEEDED || error.code === ErrorCodes.STORAGE_LIMIT_REACHED) {
+    return vaultError({ code: error.code, message: error.message, meta: error.meta });
+  }
+  return vaultError({
+    code: "STORAGE_ERROR",
+    cause: new Error(`${context}: ${error.message}`)
+  });
+}
 var DataVaultService = class extends BaseService {
   /**
    * Create a new DataVaultService instance.
@@ -4740,12 +4800,7 @@ var DataVaultService = class extends BaseService {
         JSON.stringify(envelopeResult.data)
       );
       if (!valuePutResult.ok) {
-        return vaultError({
-          code: "STORAGE_ERROR",
-          cause: new Error(
-            `Failed to store encrypted value: ${valuePutResult.error.message}`
-          )
-        });
+        return kvWriteError("Failed to store encrypted value", valuePutResult.error);
       }
       return { ok: true, data: void 0 };
     } catch (error) {
@@ -4963,12 +5018,7 @@ var DataVaultService = class extends BaseService {
           keyPayload
         );
         if (!keyPutResult.ok) {
-          return vaultError({
-            code: "STORAGE_ERROR",
-            cause: new Error(
-              `Failed to store key blob: ${keyPutResult.error.message}`
-            )
-          });
+          return kvWriteError("Failed to store key blob", keyPutResult.error);
         }
         const valuePayload = JSON.stringify({
           data: base64Encode(encrypted),
@@ -4979,12 +5029,7 @@ var DataVaultService = class extends BaseService {
           valuePayload
         );
         if (!valuePutResult.ok) {
-          return vaultError({
-            code: "STORAGE_ERROR",
-            cause: new Error(
-              `Failed to store encrypted value: ${valuePutResult.error.message}`
-            )
-          });
+          return kvWriteError("Failed to store encrypted value", valuePutResult.error);
         }
         return ok(void 0);
       } catch (error) {
@@ -5315,12 +5360,7 @@ var DataVaultService = class extends BaseService {
           grantPayload
         );
         if (!grantPutResult.ok) {
-          return vaultError({
-            code: "STORAGE_ERROR",
-            cause: new Error(
-              `Failed to store grant: ${grantPutResult.error.message}`
-            )
-          });
+          return kvWriteError("Failed to store grant", grantPutResult.error);
         }
         return ok(void 0);
       } catch (error) {
@@ -5665,12 +5705,7 @@ var DataVaultService = class extends BaseService {
           keyPayload
         );
         if (!keyPutResult.ok) {
-          return vaultError({
-            code: "STORAGE_ERROR",
-            cause: new Error(
-              `Failed to store rotated key blob: ${keyPutResult.error.message}`
-            )
-          });
+          return kvWriteError("Failed to store rotated key blob", keyPutResult.error);
         }
         const valuePayload = JSON.stringify({
           data: base64Encode(encrypted),
@@ -5681,12 +5716,7 @@ var DataVaultService = class extends BaseService {
           valuePayload
         );
         if (!valuePutResult.ok) {
-          return vaultError({
-            code: "STORAGE_ERROR",
-            cause: new Error(
-              `Failed to store re-encrypted value: ${valuePutResult.error.message}`
-            )
-          });
+          return kvWriteError("Failed to store re-encrypted value", valuePutResult.error);
         }
         for (const did of remainingGrantees) {
           const grantResult = await this.reencrypt(key, did);
@@ -7016,6 +7046,8 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   SQLAction,
   SQLMigrations,
   SQLService,
+  STORAGE_FULL_MESSAGE,
+  STORAGE_WRITE_TOO_LARGE_MESSAGE,
   SecretsService,
   ServiceContext,
   ServiceErrorEventSchema,
@@ -7034,6 +7066,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   authExpiredError,
   authRequiredError,
   authUnauthorizedError,
+  authorizationVerdictOf,
   base64Decode,
   base64Encode,
   buildCanonicalDecryptRequest,
@@ -7067,6 +7100,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   hexEncode,
   installTinyCloudDebugGlobals,
   isNetworkId,
+  isStorageFullError,
   networkDiscoveryKey,
   networkError,
   notFoundError,
@@ -7077,12 +7111,14 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   parsePermissionHint,
   parsePermissionHintFromErrorText,
   parseSecretCatalogKey,
+  parseStorageQuotaBytes,
   permissionDeniedError,
   resolveSecretListPrefix,
   resolveSecretPath,
   serviceError,
   storageLimitReachedError,
   storageQuotaExceededError,
+  storageRejectionError,
   timeoutError,
   tinyCloudDebugLogger,
   utf8Decode,