@tinycloud/sdk-services 3.1.0-beta.2 → 3.1.0-beta.7

package/dist/index.cjs

@@ -116,6 +116,7 @@ __export(src_exports, {
   ok: () => ok,
   openWrappedKey: () => openWrappedKey,
   parseAuthError: () => parseAuthError,
+  parseCapabilityResource: () => parseCapabilityResource,
   parseNetworkId: () => parseNetworkId,
   parsePermissionHint: () => parsePermissionHint,
   parsePermissionHintFromErrorText: () => parsePermissionHintFromErrorText,
@@ -141,6 +142,7 @@ __export(src_exports, {
   validateServiceResponseEvent: () => validateServiceResponseEvent,
   validateServiceSession: () => validateServiceSession,
   validateTelemetrySpanEvent: () => validateTelemetrySpanEvent,
+  validatedCapabilityOf: () => validatedCapabilityOf,
   verifyDecryptResponse: () => verifyDecryptResponse,
   wrapError: () => wrapError
 });
@@ -1044,6 +1046,106 @@ var ServiceContext = class {
   }
 };
 
+// src/errors.ts
+var import_bootstrap = require("@tinycloud/bootstrap");
+
+// src/encryption/networkId.ts
+var URN_PREFIX = "urn:tinycloud:encryption:";
+var NETWORK_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+var PKH_EIP155_DID_RE = /^did:pkh:eip155:(\d+):(0x[a-fA-F0-9]{40})$/;
+var NetworkIdError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "NetworkIdError";
+  }
+};
+function parseNetworkId(networkId) {
+  if (typeof networkId !== "string" || networkId.length === 0) {
+    throw new NetworkIdError("networkId must be a non-empty string");
+  }
+  if (!networkId.startsWith(URN_PREFIX)) {
+    throw new NetworkIdError(
+      `networkId must start with ${URN_PREFIX} (got ${JSON.stringify(networkId)})`
+    );
+  }
+  const body = networkId.slice(URN_PREFIX.length);
+  const lastColon = body.lastIndexOf(":");
+  if (lastColon <= 0 || lastColon === body.length - 1) {
+    throw new NetworkIdError(
+      `networkId missing ownerDid or name segment (got ${JSON.stringify(networkId)})`
+    );
+  }
+  const ownerDid = body.slice(0, lastColon);
+  const name = body.slice(lastColon + 1);
+  if (!ownerDid.startsWith("did:")) {
+    throw new NetworkIdError(
+      `networkId ownerDid must be a DID (got ${JSON.stringify(ownerDid)})`
+    );
+  }
+  const didParts = ownerDid.split(":");
+  if (didParts.length < 3 || didParts.some((p) => p.length === 0)) {
+    throw new NetworkIdError(
+      `networkId ownerDid is not a well-formed DID (got ${JSON.stringify(ownerDid)})`
+    );
+  }
+  if (!NETWORK_NAME_RE.test(name)) {
+    throw new NetworkIdError(
+      `networkId name ${JSON.stringify(name)} must match ${NETWORK_NAME_RE.source}`
+    );
+  }
+  return { networkId, ownerDid, name };
+}
+function buildNetworkId(ownerDid, name) {
+  if (typeof ownerDid !== "string" || !ownerDid.startsWith("did:")) {
+    throw new NetworkIdError("ownerDid must be a DID");
+  }
+  if (typeof name !== "string" || !NETWORK_NAME_RE.test(name)) {
+    throw new NetworkIdError(
+      `network name ${JSON.stringify(name)} must match ${NETWORK_NAME_RE.source}`
+    );
+  }
+  const networkId = `${URN_PREFIX}${ownerDid}:${name}`;
+  parseNetworkId(networkId);
+  return networkId;
+}
+function isNetworkId(networkId) {
+  if (typeof networkId !== "string") {
+    return false;
+  }
+  try {
+    parseNetworkId(networkId);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function parsePkhOwnerDid(ownerDid) {
+  const match = ownerDid.match(PKH_EIP155_DID_RE);
+  if (!match) return null;
+  return {
+    chainId: match[1],
+    address: match[2].toLowerCase()
+  };
+}
+function ownerDidMatches(a, b) {
+  const aPkh = parsePkhOwnerDid(a);
+  const bPkh = parsePkhOwnerDid(b);
+  if (aPkh && bPkh) {
+    return aPkh.chainId === bPkh.chainId && aPkh.address === bPkh.address;
+  }
+  return a === b;
+}
+function networkDiscoveryKey(name) {
+  if (!NETWORK_NAME_RE.test(name)) {
+    throw new NetworkIdError(
+      `network name ${JSON.stringify(name)} must match ${NETWORK_NAME_RE.source}`
+    );
+  }
+  return `.well-known/encryption/network/${name}`;
+}
+var ENCRYPTION_NETWORK_URN_PREFIX = URN_PREFIX;
+var NETWORK_NAME_PATTERN = NETWORK_NAME_RE;
+
 // src/errors.ts
 function parsePermissionHint(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
@@ -1103,11 +1205,31 @@ function networkError(service, message, cause) {
     cause
   };
 }
-function timeoutError(service) {
+var RequestTimeoutError = class extends Error {
+  constructor(timeoutMs) {
+    super(`Request timed out after ${timeoutMs}ms.`);
+    this.name = "TimeoutError";
+    this.timeoutMs = timeoutMs;
+  }
+};
+function isRequestTimeoutError(error) {
+  return error instanceof RequestTimeoutError || error instanceof Error && error.name === "TimeoutError" && typeof error.timeoutMs === "number";
+}
+function timeoutError(service, timeoutMs, cause) {
+  if (timeoutMs === void 0) {
+    return {
+      code: ErrorCodes.TIMEOUT,
+      message: "Request timed out.",
+      service,
+      ...cause === void 0 ? {} : { cause }
+    };
+  }
   return {
     code: ErrorCodes.TIMEOUT,
-    message: "Request timed out.",
-    service
+    message: `Request timed out after ${timeoutMs}ms.`,
+    service,
+    ...cause === void 0 ? {} : { cause },
+    meta: { timeoutMs }
   };
 }
 function abortedError(service) {
@@ -1141,6 +1263,70 @@ function parseAuthError(responseText) {
 function authUnauthorizedError(service, message, meta) {
   return serviceError(ErrorCodes.AUTH_UNAUTHORIZED, message, service, { meta });
 }
+var grantableActions = new Set(
+  import_bootstrap.CAPABILITY_REGISTRY.map(({ urn }) => urn).filter((urn) => !urn.endsWith("/*"))
+);
+var capabilityServices = new Set(
+  import_bootstrap.CAPABILITY_REGISTRY.map(({ service }) => service.slice("tinycloud.".length))
+);
+function parseCapabilityResource(resource, service) {
+  if (resource.length === 0 || resource.length > 1024 || !capabilityServices.has(service) || /[\s\p{C}*#]/u.test(resource) || resource.includes("://")) return void 0;
+  const segments = resource.split("/");
+  if (!/^tinycloud:[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(segments[0])) return void 0;
+  const serviceIndex = segments.findIndex(
+    (segment, index) => index > 0 && capabilityServices.has(segment)
+  );
+  if (serviceIndex < 1 || segments[serviceIndex] !== service) return void 0;
+  if (segments.slice(1, serviceIndex).some(
+    (segment) => segment.length === 0 || segment === "." || segment === ".."
+  )) return void 0;
+  const pathSegments = segments.slice(serviceIndex + 1);
+  if (pathSegments.some((segment) => segment === "." || segment === "..")) return void 0;
+  if (service !== "kv" && (pathSegments.length === 0 || pathSegments[pathSegments.length - 1] === "")) return void 0;
+  return {
+    space: segments.slice(0, serviceIndex).join("/"),
+    path: pathSegments.join("/")
+  };
+}
+function safeCapabilityResource(value, service, action) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 1024) return false;
+  if (service === "encryption" && value.startsWith("urn:tinycloud:encryption:")) {
+    if (!/^[A-Za-z0-9_][A-Za-z0-9_.:/-]*$/.test(value) || value.includes("//") || value.split("/").some((segment) => segment === "." || segment === "..")) return false;
+    try {
+      parseNetworkId(value);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  const parsed = parseCapabilityResource(value, service);
+  return parsed !== void 0 && (!parsed.path.endsWith("/") || service === "kv" && action === "tinycloud.kv/list") && (parsed.path !== "" || service === "kv" && action === "tinycloud.kv/list");
+}
+function validatedCapabilityOf(error) {
+  const verdict = authorizationVerdictOf(error);
+  if (verdict !== "unauthenticated" && verdict !== "forbidden") return void 0;
+  const seen = /* @__PURE__ */ new Set();
+  let node = error;
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
+    seen.add(node);
+    const record = node;
+    const status = errorStatusOf(record);
+    const meta = record.meta;
+    if ((status === 401 || status === 403 || status === void 0 && record.code === ErrorCodes.AUTH_UNAUTHORIZED) && typeof meta === "object" && meta !== null && !Array.isArray(meta)) {
+      const metadata = meta;
+      const { resource, requiredAction } = metadata;
+      if (typeof requiredAction === "string" && grantableActions.has(requiredAction)) {
+        const actionService = requiredAction.slice("tinycloud.".length, requiredAction.indexOf("/"));
+        const explicitService = record.service === void 0 ? metadata.service : record.service;
+        if (safeCapabilityResource(resource, actionService, requiredAction) && (explicitService === void 0 || explicitService === actionService || explicitService === `tinycloud.${actionService}`)) {
+          return { resource, requiredAction };
+        }
+      }
+    }
+    node = record.cause;
+  }
+  return void 0;
+}
 var MAX_CAUSE_DEPTH = 8;
 function errorStatusOf(node) {
   const meta = node.meta;
@@ -1207,6 +1393,9 @@ function isStorageFullError(error) {
 }
 function wrapError(service, error, defaultCode = ErrorCodes.NETWORK_ERROR) {
   if (error instanceof Error) {
+    if (isRequestTimeoutError(error)) {
+      return timeoutError(service, error.timeoutMs, error);
+    }
     if (error.name === "AbortError") {
       return abortedError(service);
     }
@@ -1231,6 +1420,7 @@ function errorResult(error) {
 }
 
 // src/base/BaseService.ts
+var MAX_TIMER_DELAY_MS = 2147483647;
 var BaseService = class {
   constructor() {
     /**
@@ -1411,6 +1601,64 @@ var BaseService = class {
     }
     return controller.signal;
   }
+  /**
+   * Create the abort signal for one request, bounded by the request timeout.
+   *
+   * The signal aborts when the service signs out, the context aborts, the
+   * caller's `signal` aborts, or the timeout elapses, whichever comes first.
+   * A timeout aborts with a {@link RequestTimeoutError} (`TimeoutError`), which
+   * `wrapError` maps to `ErrorCodes.TIMEOUT`; the other sources keep their own
+   * reason (normally `AbortError`, mapped to `ErrorCodes.ABORTED`).
+   *
+   * The timeout is `timeoutMs` when given, otherwise `config.timeout`. Only a
+   * positive, finite value (at most 2^31-1 ms) applies; `undefined`, `0`, and
+   * `Infinity` mean no timeout, so a per-call `0` opts out of a configured one.
+   *
+   * Callers must call `dispose()` once the response body has been consumed,
+   * which clears the timer and removes the listeners this adds to the
+   * long-lived service and context signals.
+   *
+   * @param signal - The caller's abort signal for this request
+   * @param timeoutMs - Per-request timeout override in milliseconds
+   */
+  createRequestSignal(signal, timeoutMs) {
+    const controller = new AbortController();
+    const detachers = [];
+    let timer;
+    const dispose = () => {
+      if (timer !== void 0) {
+        clearTimeout(timer);
+        timer = void 0;
+      }
+      for (const detach of detachers.splice(0)) {
+        detach();
+      }
+    };
+    const abort = (reason) => {
+      dispose();
+      controller.abort(reason);
+    };
+    const requestSignal = { signal: controller.signal, dispose };
+    const parents = [
+      this.abortController.signal,
+      this.context?.abortSignal,
+      signal
+    ].filter((parent) => parent !== void 0);
+    for (const parent of parents) {
+      if (parent.aborted) {
+        abort(parent.reason);
+        return requestSignal;
+      }
+      const onAbort = () => abort(parent.reason);
+      parent.addEventListener("abort", onAbort, { once: true });
+      detachers.push(() => parent.removeEventListener("abort", onAbort));
+    }
+    const timeout = timeoutMs ?? this._config.timeout;
+    if (typeof timeout === "number" && timeout > 0 && timeout <= MAX_TIMER_DELAY_MS) {
+      timer = setTimeout(() => abort(new RequestTimeoutError(timeout)), timeout);
+    }
+    return requestSignal;
+  }
   /**
    * Wrap an operation with error handling and telemetry.
    *
@@ -1671,7 +1919,7 @@ var KVService = class extends BaseService {
    * @param path - Resource path
    * @param action - KV action
    * @param body - Optional request body
-   * @param signal - Optional abort signal
+   * @param signal - Request signal from createRequestSignal()
    * @returns Fetch response
    */
   async invokeOperation(path, action, body, signal, extraHeaders) {
@@ -1687,7 +1935,7 @@ var KVService = class extends BaseService {
       method: "POST",
       headers: requestHeaders,
       body,
-      signal: this.combineSignals(signal)
+      signal
     });
   }
   /**
@@ -1864,6 +2112,7 @@ var KVService = class extends BaseService {
         "kv"
       ));
     }
+    const request = this.createRequestSignal(options?.signal, options?.timeout);
     try {
       const session = this.context.session;
       const invocationHeaders = this.context.invokeAny(
@@ -1885,15 +2134,17 @@ var KVService = class extends BaseService {
       const response = await this.context.fetch(`${this.host}/invoke`, {
         method: "POST",
         headers,
-        signal: this.combineSignals(options?.signal)
+        signal: request.signal
       });
       if (!response.ok) {
-        const errorText = await response.text();
+        const errorText = response.status === 401 || response.status === 403 ? await this.readAuthorizationText(response) : await response.text();
         if (response.status === 401 || response.status === 403) {
           return this.authorizationFailure(
             `Failed to batch read ${keys.length} key(s)`,
             response,
-            errorText
+            errorText,
+            paths,
+            action
           );
         }
         if (response.status === 413) {
@@ -1948,6 +2199,8 @@ var KVService = class extends BaseService {
       return ok({ results, count: results.length });
     } catch (error) {
       return err(wrapError("kv", error));
+    } finally {
+      request.dispose();
     }
   }
   /**
@@ -1983,7 +2236,7 @@ var KVService = class extends BaseService {
       return text;
     }
   }
-  async createSignedReadUrlError(response, key) {
+  async createSignedReadUrlError(response, key, path) {
     let errorText = response.statusText;
     try {
       const text = await response.text();
@@ -1996,7 +2249,9 @@ var KVService = class extends BaseService {
       return this.authorizationFailure(
         `Failed to create signed read URL for key ${JSON.stringify(key)}`,
         response,
-        errorText
+        errorText,
+        [path],
+        KVAction.GET
       );
     }
     const code = response.status === 400 ? ErrorCodes.INVALID_INPUT : ErrorCodes.NETWORK_ERROR;
@@ -2009,21 +2264,42 @@ var KVService = class extends BaseService {
       )
     );
   }
+  /** A known 401/403 keeps its typed status even if reading its body fails. */
+  async readAuthorizationText(response) {
+    try {
+      return await response.text();
+    } catch {
+      return "";
+    }
+  }
   /**
    * AUTH_UNAUTHORIZED for a 401/403 response. The message keeps the HTTP
    * status and the server text (`<context>: <status> - <text>`, the same
    * shape as every other KV failure) so callers that rethrow only the message
    * still see the status; `meta.status` carries it for typed callers.
-   * Resource/ability hints are parsed from the raw body, never the message.
+   * Server hints must match the requested path/action (whether the node sends
+   * a relative path or full resource); metadata uses only the request-derived
+   * canonical resource under the authenticated session's space.
    */
-  authorizationFailure(context, response, errorText, extraMeta = {}) {
+  authorizationFailure(context, response, errorText, paths, expectedAction, extraMeta = {}) {
     const { resource, action } = parseAuthError(errorText);
+    const requestedPath = paths.find(
+      (path) => resource === path || resource === `${this.context.session.spaceId}/kv/${path}`
+    );
+    const capability = requestedPath !== void 0 && action === expectedAction ? validatedCapabilityOf({
+      service: "kv",
+      code: ErrorCodes.AUTH_UNAUTHORIZED,
+      meta: {
+        status: response.status,
+        resource: `${this.context.session.spaceId}/kv/${requestedPath}`,
+        requiredAction: action
+      }
+    }) : void 0;
     const detail = errorText.trim().length > 0 ? errorText : response.statusText || "authorization failed";
     return err(authUnauthorizedError("kv", `${context}: ${response.status} - ${detail}`, {
       status: response.status,
-      ...action && { requiredAction: action },
-      ...resource && { resource },
-      ...extraMeta
+      ...extraMeta,
+      ...capability
     }));
   }
   normalizeSignedReadUrlResponse(data) {
@@ -2057,23 +2333,35 @@ var KVService = class extends BaseService {
         ));
       }
       const path = this.getFullPath(key, options?.prefix);
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.invokeOperation(
           path,
           KVAction.GET,
           void 0,
-          options?.signal,
+          request.signal,
           options?.maxResponseBytes === void 0 ? void 0 : { "x-tinycloud-max-response-bytes": String(options.maxResponseBytes) }
         );
         if (!response.ok) {
           if (response.status === 401 || response.status === 403) {
-            const errorText2 = await response.text();
+            const errorText2 = await this.readAuthorizationText(response);
             const permissionHint = parsePermissionHintFromErrorText(errorText2);
+            const structuredCapability = permissionHint?.service === "tinycloud.kv" && permissionHint.space === this.context.session.spaceId && permissionHint.path === path ? validatedCapabilityOf({
+              service: "kv",
+              code: ErrorCodes.AUTH_UNAUTHORIZED,
+              meta: {
+                status: response.status,
+                resource: `${this.context.session.spaceId}/kv/${path}`,
+                requiredAction: KVAction.GET
+              }
+            }) : void 0;
             return this.authorizationFailure(
               `Failed to get key ${JSON.stringify(key)}`,
               response,
               errorText2,
-              permissionHint === void 0 ? {} : { permissionHint }
+              [path],
+              KVAction.GET,
+              structuredCapability ? { permissionHint, ...structuredCapability } : {}
             );
           }
           if (response.status === 404) {
@@ -2108,6 +2396,8 @@ var KVService = class extends BaseService {
         });
       } catch (error) {
         return err(wrapError("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -2135,12 +2425,13 @@ var KVService = class extends BaseService {
       }
       const path = this.getFullPath(key, options?.prefix);
       const body = this.serializePutValue(value, options?.contentType);
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.invokeOperation(
           path,
           KVAction.PUT,
           body,
-          options?.signal,
+          request.signal,
           {
             ...options?.ifMatch === void 0 ? {} : { "if-match": options.ifMatch },
             ...options?.ifNoneMatch === void 0 ? {} : { "if-none-match": options.ifNoneMatch }
@@ -2150,7 +2441,9 @@ var KVService = class extends BaseService {
           return this.authorizationFailure(
             `Failed to put key ${JSON.stringify(key)}`,
             response,
-            await response.text()
+            await this.readAuthorizationText(response),
+            [path],
+            KVAction.PUT
           );
         }
         if (!response.ok) {
@@ -2194,6 +2487,8 @@ var KVService = class extends BaseService {
         });
       } catch (error) {
         return err(wrapError("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -2233,6 +2528,7 @@ var KVService = class extends BaseService {
         seen.add(path);
       }
       let requestMayHaveDispatched = false;
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const body = new FormData();
         for (let index = 0; index < items.length; index++) {
@@ -2255,7 +2551,7 @@ var KVService = class extends BaseService {
           method: "POST",
           headers,
           body,
-          signal: this.combineSignals(options?.signal)
+          signal: request.signal
         };
         const fetchFn = this.context.fetch;
         requestMayHaveDispatched = true;
@@ -2279,7 +2575,9 @@ var KVService = class extends BaseService {
             return this.authorizationFailure(
               `Failed to batch put ${items.length} key(s)`,
               response,
-              errorText
+              errorText,
+              paths,
+              KVAction.PUT
             );
           }
           const quotaError = this.handleQuotaErrorResponse(
@@ -2304,14 +2602,16 @@ var KVService = class extends BaseService {
           rawBody = await response.json();
         } catch (jsonError) {
           const cause = jsonError instanceof Error ? jsonError : new Error(String(jsonError));
+          const timedOut = isRequestTimeoutError(cause);
           return err(
             serviceError(
-              ErrorCodes.NETWORK_ERROR,
-              `KV batchPut response was not valid JSON: ${cause.message}`,
+              timedOut ? ErrorCodes.TIMEOUT : ErrorCodes.NETWORK_ERROR,
+              timedOut ? `KV batchPut response body did not arrive in time: ${cause.message}` : `KV batchPut response was not valid JSON: ${cause.message}`,
               "kv",
               {
                 cause,
                 meta: {
+                  ...timedOut ? { timeoutMs: cause.timeoutMs } : {},
                   requestMayHaveDispatched: true,
                   responseReceived: true,
                   status: response.status,
@@ -2366,6 +2666,8 @@ var KVService = class extends BaseService {
           ...wrapped,
           meta: { ...wrapped.meta, requestMayHaveDispatched }
         });
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -2388,23 +2690,26 @@ var KVService = class extends BaseService {
       if (options?.path) {
         listPath = listPath ? `${listPath}/${options.path}` : options.path;
       }
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.invokeOperation(
           listPath,
           KVAction.LIST,
           void 0,
-          options?.signal,
+          request.signal,
           options?.limit === void 0 && options?.cursor === void 0 ? void 0 : {
             ...options?.limit === void 0 ? {} : { "x-tinycloud-limit": String(options.limit) },
             ...options?.cursor === void 0 ? {} : { "x-tinycloud-cursor": options.cursor }
           }
         );
         if (!response.ok) {
-          if (response.status === 401) {
+          if (response.status === 401 || response.status === 403) {
             return this.authorizationFailure(
               "Failed to list keys",
               response,
-              await response.text()
+              await this.readAuthorizationText(response),
+              [listPath],
+              KVAction.LIST
             );
           }
           const errorText = await response.text();
@@ -2432,6 +2737,8 @@ var KVService = class extends BaseService {
         });
       } catch (error) {
         return err(wrapError("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -2444,20 +2751,23 @@ var KVService = class extends BaseService {
         return err(authRequiredError("kv"));
       }
       const path = this.getFullPath(key, options?.prefix);
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.invokeOperation(
           path,
           KVAction.DELETE,
           void 0,
-          options?.signal,
+          request.signal,
           options?.ifMatch === void 0 ? void 0 : { "if-match": options.ifMatch }
         );
         if (!response.ok) {
-          if (response.status === 401) {
+          if (response.status === 401 || response.status === 403) {
             return this.authorizationFailure(
               `Failed to delete key ${JSON.stringify(key)}`,
               response,
-              await response.text()
+              await this.readAuthorizationText(response),
+              [path],
+              KVAction.DELETE
             );
           }
           if (response.status === 404) {
@@ -2495,6 +2805,8 @@ var KVService = class extends BaseService {
         });
       } catch (error) {
         return err(wrapError("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -2507,19 +2819,22 @@ var KVService = class extends BaseService {
         return err(authRequiredError("kv"));
       }
       const path = this.getFullPath(key, options?.prefix);
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.invokeOperation(
           path,
           KVAction.HEAD,
           void 0,
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
-          if (response.status === 401) {
+          if (response.status === 401 || response.status === 403) {
             return this.authorizationFailure(
               `Failed to get metadata for key ${JSON.stringify(key)}`,
               response,
-              await response.text()
+              await this.readAuthorizationText(response),
+              [path],
+              KVAction.HEAD
             );
           }
           if (response.status === 404) {
@@ -2541,6 +2856,8 @@ var KVService = class extends BaseService {
         });
       } catch (error) {
         return err(wrapError("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -2578,15 +2895,16 @@ var KVService = class extends BaseService {
       if (options?.etag !== void 0) {
         body.etag = options.etag;
       }
+      const request = this.createRequestSignal(options?.signal, options?.timeout);
       try {
         const response = await this.context.fetch(`${this.host}/signed/kv`, {
           method: "POST",
           headers: this.withJsonContentType(headers),
           body: JSON.stringify(body),
-          signal: this.combineSignals(options?.signal)
+          signal: request.signal
         });
         if (!response.ok) {
-          return this.createSignedReadUrlError(response, key);
+          return this.createSignedReadUrlError(response, key, path);
         }
         const signedUrl = this.normalizeSignedReadUrlResponse(
           await response.json()
@@ -2603,6 +2921,8 @@ var KVService = class extends BaseService {
         return ok(signedUrl);
       } catch (error) {
         return err(wrapError("kv", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -2729,16 +3049,16 @@ var DatabaseHandle = class {
 };
 
 // src/sql/types.ts
-var import_bootstrap = require("@tinycloud/bootstrap");
+var import_bootstrap2 = require("@tinycloud/bootstrap");
 var SQLAction = {
-  READ: import_bootstrap.SQL.READ,
-  WRITE: import_bootstrap.SQL.WRITE,
-  SCHEMA: import_bootstrap.SQL.SCHEMA,
-  ADMIN: import_bootstrap.SQL.ADMIN,
-  SELECT: import_bootstrap.SQL.SELECT,
-  EXECUTE: import_bootstrap.SQL.EXECUTE,
-  EXPORT: import_bootstrap.SQL.EXPORT,
-  ALL: import_bootstrap.SQL.ALL
+  READ: import_bootstrap2.SQL.READ,
+  WRITE: import_bootstrap2.SQL.WRITE,
+  SCHEMA: import_bootstrap2.SQL.SCHEMA,
+  ADMIN: import_bootstrap2.SQL.ADMIN,
+  SELECT: import_bootstrap2.SQL.SELECT,
+  EXECUTE: import_bootstrap2.SQL.EXECUTE,
+  EXPORT: import_bootstrap2.SQL.EXPORT,
+  ALL: import_bootstrap2.SQL.ALL
 };
 
 // src/sql/SQLService.ts
@@ -2816,6 +3136,7 @@ var SQLService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("sql"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const body = {
           action: "query",
@@ -2824,19 +3145,22 @@ var SQLService = class extends BaseService {
         };
         if (options?.maxRows !== void 0) body.maxRows = options.maxRows;
         if (options?.maxBytes !== void 0) body.maxBytes = options.maxBytes;
+        const action = this.actionForSql(sql, SQLAction.READ);
         const response = await this.invokeSQL(
           dbName,
-          this.actionForSql(sql, SQLAction.READ),
+          action,
           body,
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
-          return this.handleErrorResponse(response, "query");
+          return this.handleErrorResponse(response, "query", dbName, [action]);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
         return err(wrapError("sql", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -2845,6 +3169,7 @@ var SQLService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("sql"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const body = {
           action: "execute",
@@ -2860,19 +3185,22 @@ var SQLService = class extends BaseService {
             (statement) => this.actionForSql(statement, SQLAction.SCHEMA)
           )
         ];
+        const requestedActions = this.dedupeActions(actions);
         const response = await this.invokeSQL(
           dbName,
-          this.dedupeActions(actions),
+          requestedActions,
           body,
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
-          return this.handleErrorResponse(response, "execute");
+          return this.handleErrorResponse(response, "execute", dbName, requestedActions);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
         return err(wrapError("sql", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -2881,20 +3209,24 @@ var SQLService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("sql"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
+        const requestedActions = this.actionsForSqlBatch(statements);
         const response = await this.invokeSQL(
           dbName,
-          this.actionsForSqlBatch(statements),
+          requestedActions,
           { action: "batch", statements },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
-          return this.handleErrorResponse(response, "batch");
+          return this.handleErrorResponse(response, "batch", dbName, requestedActions);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
         return err(wrapError("sql", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -2903,20 +3235,23 @@ var SQLService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("sql"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeSQL(
           dbName,
           SQLAction.WRITE,
           { action: "execute_statement", name, params: params ?? [] },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
-          return this.handleErrorResponse(response, "executeStatement");
+          return this.handleErrorResponse(response, "executeStatement", dbName, [SQLAction.WRITE]);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
         return err(wrapError("sql", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -2925,15 +3260,16 @@ var SQLService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("sql"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeSQL(
           dbName,
           SQLAction.READ,
           { action: "export" },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
-          return this.handleErrorResponse(response, "export");
+          return this.handleErrorResponse(response, "export", dbName, [SQLAction.READ]);
         }
         const resp = response;
         if (typeof resp.blob === "function") {
@@ -2944,6 +3280,8 @@ var SQLService = class extends BaseService {
         return ok(text);
       } catch (error) {
         return err(wrapError("sql", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -3034,7 +3372,7 @@ var SQLService = class extends BaseService {
         "Content-Type": "application/json"
       },
       body: JSON.stringify(body),
-      signal: this.combineSignals(signal)
+      signal
     });
   }
   actionForSql(sql, fallback) {
@@ -3067,7 +3405,7 @@ var SQLService = class extends BaseService {
       }))
     );
   }
-  async handleErrorResponse(response, operation) {
+  async handleErrorResponse(response, operation, dbName, requestedActions) {
     const errorText = await response.text();
     const meta = responseErrorMeta(response.status, response.statusText, errorText);
     if (response.status === 402) {
@@ -3086,9 +3424,11 @@ var SQLService = class extends BaseService {
       errorBody
     );
     if (response.status === 401) {
-      const { resource, action } = parseAuthError(errorText);
-      if (action) meta.requiredAction = action;
-      if (resource) meta.resource = resource;
+      const { action } = parseAuthError(errorText);
+      if (action && requestedActions.includes(action)) {
+        meta.requiredAction = action;
+        meta.resource = `${this.context.session.spaceId}/sql/${dbName}`;
+      }
     }
     return err(
       serviceError(errorCode, message, "sql", { meta })
@@ -3233,16 +3573,16 @@ var DuckDbDatabaseHandle = class {
 };
 
 // src/duckdb/types.ts
-var import_bootstrap2 = require("@tinycloud/bootstrap");
+var import_bootstrap3 = require("@tinycloud/bootstrap");
 var DuckDbAction = {
-  READ: import_bootstrap2.DUCKDB.READ,
-  WRITE: import_bootstrap2.DUCKDB.WRITE,
-  ADMIN: import_bootstrap2.DUCKDB.ADMIN,
-  DESCRIBE: import_bootstrap2.DUCKDB.DESCRIBE,
-  EXPORT: import_bootstrap2.DUCKDB.EXPORT,
-  IMPORT: import_bootstrap2.DUCKDB.IMPORT,
-  EXECUTE: import_bootstrap2.DUCKDB.EXECUTE,
-  ALL: import_bootstrap2.DUCKDB.ALL
+  READ: import_bootstrap3.DUCKDB.READ,
+  WRITE: import_bootstrap3.DUCKDB.WRITE,
+  ADMIN: import_bootstrap3.DUCKDB.ADMIN,
+  DESCRIBE: import_bootstrap3.DUCKDB.DESCRIBE,
+  EXPORT: import_bootstrap3.DUCKDB.EXPORT,
+  IMPORT: import_bootstrap3.DUCKDB.IMPORT,
+  EXECUTE: import_bootstrap3.DUCKDB.EXECUTE,
+  ALL: import_bootstrap3.DUCKDB.ALL
 };
 
 // src/duckdb/DuckDbService.ts
@@ -3296,12 +3636,13 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeDuckDb(
           dbName,
           DuckDbAction.READ,
           { action: "query", sql, params: params ?? [] },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "query");
@@ -3310,6 +3651,8 @@ var DuckDbService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -3318,12 +3661,13 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeDuckDb(
           dbName,
           DuckDbAction.READ,
           { action: "query", sql, params: params ?? [] },
-          options?.signal,
+          request.signal,
           { Accept: "application/vnd.apache.arrow.stream" }
         );
         if (!response.ok) {
@@ -3333,6 +3677,8 @@ var DuckDbService = class extends BaseService {
         return ok(buffer);
       } catch (error) {
         return err(wrapError("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -3341,6 +3687,7 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const body = {
           action: "execute",
@@ -3354,7 +3701,7 @@ var DuckDbService = class extends BaseService {
           dbName,
           DuckDbAction.WRITE,
           body,
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "execute");
@@ -3363,6 +3710,8 @@ var DuckDbService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -3371,6 +3720,7 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const body = {
           action: "batch",
@@ -3383,7 +3733,7 @@ var DuckDbService = class extends BaseService {
           dbName,
           DuckDbAction.WRITE,
           body,
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "batch");
@@ -3392,6 +3742,8 @@ var DuckDbService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -3400,12 +3752,13 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeDuckDb(
           dbName,
           DuckDbAction.WRITE,
           { action: "executeStatement", name, params: params ?? [] },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "executeStatement");
@@ -3414,6 +3767,8 @@ var DuckDbService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -3422,12 +3777,13 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeDuckDb(
           dbName,
           DuckDbAction.READ,
           { action: "describe" },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "describe");
@@ -3436,6 +3792,8 @@ var DuckDbService = class extends BaseService {
         return ok(data);
       } catch (error) {
         return err(wrapError("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -3444,12 +3802,13 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const response = await this.invokeDuckDb(
           dbName,
           DuckDbAction.EXPORT,
           { action: "export" },
-          options?.signal
+          request.signal
         );
         if (!response.ok) {
           return this.handleErrorResponse(response, "export");
@@ -3458,6 +3817,8 @@ var DuckDbService = class extends BaseService {
         return ok(blob);
       } catch (error) {
         return err(wrapError("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -3466,6 +3827,7 @@ var DuckDbService = class extends BaseService {
       if (!this.requireAuth()) {
         return err(authRequiredError("duckdb"));
       }
+      const request = this.createRequestSignal(options?.signal);
       try {
         const session = this.context.session;
         const headers = this.context.invoke(
@@ -3481,7 +3843,7 @@ var DuckDbService = class extends BaseService {
             "Content-Type": "application/x-duckdb"
           },
           body: new Blob([data]),
-          signal: this.combineSignals(options?.signal)
+          signal: request.signal
         });
         if (!response.ok) {
           return this.handleErrorResponse(response, "import");
@@ -3489,6 +3851,8 @@ var DuckDbService = class extends BaseService {
         return ok(void 0);
       } catch (error) {
         return err(wrapError("duckdb", error));
+      } finally {
+        request.dispose();
       }
     });
   }
@@ -3504,7 +3868,7 @@ var DuckDbService = class extends BaseService {
         ...extraHeaders
       },
       body: JSON.stringify(body),
-      signal: this.combineSignals(signal)
+      signal
     });
   }
   async handleErrorResponse(response, operation) {
@@ -6067,103 +6431,6 @@ function canonicalHashHex(sha256, value) {
   return hexEncode2(sha256(utf8Encode(canonical)));
 }
 
-// src/encryption/networkId.ts
-var URN_PREFIX = "urn:tinycloud:encryption:";
-var NETWORK_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
-var PKH_EIP155_DID_RE = /^did:pkh:eip155:(\d+):(0x[a-fA-F0-9]{40})$/;
-var NetworkIdError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "NetworkIdError";
-  }
-};
-function parseNetworkId(networkId) {
-  if (typeof networkId !== "string" || networkId.length === 0) {
-    throw new NetworkIdError("networkId must be a non-empty string");
-  }
-  if (!networkId.startsWith(URN_PREFIX)) {
-    throw new NetworkIdError(
-      `networkId must start with ${URN_PREFIX} (got ${JSON.stringify(networkId)})`
-    );
-  }
-  const body = networkId.slice(URN_PREFIX.length);
-  const lastColon = body.lastIndexOf(":");
-  if (lastColon <= 0 || lastColon === body.length - 1) {
-    throw new NetworkIdError(
-      `networkId missing ownerDid or name segment (got ${JSON.stringify(networkId)})`
-    );
-  }
-  const ownerDid = body.slice(0, lastColon);
-  const name = body.slice(lastColon + 1);
-  if (!ownerDid.startsWith("did:")) {
-    throw new NetworkIdError(
-      `networkId ownerDid must be a DID (got ${JSON.stringify(ownerDid)})`
-    );
-  }
-  const didParts = ownerDid.split(":");
-  if (didParts.length < 3 || didParts.some((p) => p.length === 0)) {
-    throw new NetworkIdError(
-      `networkId ownerDid is not a well-formed DID (got ${JSON.stringify(ownerDid)})`
-    );
-  }
-  if (!NETWORK_NAME_RE.test(name)) {
-    throw new NetworkIdError(
-      `networkId name ${JSON.stringify(name)} must match ${NETWORK_NAME_RE.source}`
-    );
-  }
-  return { networkId, ownerDid, name };
-}
-function buildNetworkId(ownerDid, name) {
-  if (typeof ownerDid !== "string" || !ownerDid.startsWith("did:")) {
-    throw new NetworkIdError("ownerDid must be a DID");
-  }
-  if (typeof name !== "string" || !NETWORK_NAME_RE.test(name)) {
-    throw new NetworkIdError(
-      `network name ${JSON.stringify(name)} must match ${NETWORK_NAME_RE.source}`
-    );
-  }
-  const networkId = `${URN_PREFIX}${ownerDid}:${name}`;
-  parseNetworkId(networkId);
-  return networkId;
-}
-function isNetworkId(networkId) {
-  if (typeof networkId !== "string") {
-    return false;
-  }
-  try {
-    parseNetworkId(networkId);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function parsePkhOwnerDid(ownerDid) {
-  const match = ownerDid.match(PKH_EIP155_DID_RE);
-  if (!match) return null;
-  return {
-    chainId: match[1],
-    address: match[2].toLowerCase()
-  };
-}
-function ownerDidMatches(a, b) {
-  const aPkh = parsePkhOwnerDid(a);
-  const bPkh = parsePkhOwnerDid(b);
-  if (aPkh && bPkh) {
-    return aPkh.chainId === bPkh.chainId && aPkh.address === bPkh.address;
-  }
-  return a === b;
-}
-function networkDiscoveryKey(name) {
-  if (!NETWORK_NAME_RE.test(name)) {
-    throw new NetworkIdError(
-      `network name ${JSON.stringify(name)} must match ${NETWORK_NAME_RE.source}`
-    );
-  }
-  return `.well-known/encryption/network/${name}`;
-}
-var ENCRYPTION_NETWORK_URN_PREFIX = URN_PREFIX;
-var NETWORK_NAME_PATTERN = NETWORK_NAME_RE;
-
 // src/encryption/types.ts
 var DEFAULT_ENCRYPTION_ALG = "x25519-aes256gcm/v1";
 var ENVELOPE_VERSION = 1;
@@ -7107,6 +7374,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   ok,
   openWrappedKey,
   parseAuthError,
+  parseCapabilityResource,
   parseNetworkId,
   parsePermissionHint,
   parsePermissionHintFromErrorText,
@@ -7132,6 +7400,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   validateServiceResponseEvent,
   validateServiceSession,
   validateTelemetrySpanEvent,
+  validatedCapabilityOf,
   verifyDecryptResponse,
   wrapError
 });