@tinycloud/sdk-services 3.1.0 → 3.2.0-beta.2

package/dist/index.cjs

@@ -47,11 +47,13 @@ __export(src_exports, {
   KVListResultSchema: () => KVListResultSchema,
   KVResponseHeadersSchema: () => KVResponseHeadersSchema,
   KVService: () => KVService,
+  MAX_SECRET_SCOPE_LENGTH: () => MAX_SECRET_SCOPE_LENGTH,
   NETWORK_NAME_PATTERN: () => NETWORK_NAME_PATTERN,
   NetworkIdError: () => NetworkIdError,
   PrefixedKVService: () => PrefixedKVService,
   RetryPolicySchema: () => RetryPolicySchema,
   SECRET_NAME_RE: () => SECRET_NAME_RE,
+  SECRET_SCOPE_RE: () => SECRET_SCOPE_RE,
   SQLAction: () => SQLAction,
   SQLMigrations: () => SQLMigrations,
   SQLService: () => SQLService,
@@ -65,6 +67,7 @@ __export(src_exports, {
   ServiceResponseEventSchema: () => ServiceResponseEventSchema,
   ServiceRetryEventSchema: () => ServiceRetryEventSchema,
   ServiceSessionSchema: () => ServiceSessionSchema,
+  TC832_RESERVED_SCOPES: () => TC832_RESERVED_SCOPES,
   TelemetryEvents: () => TelemetryEvents,
   TelemetrySpanEventSchema: () => TelemetrySpanEventSchema,
   TinyCloudDebugLogger: () => TinyCloudDebugLogger,
@@ -72,6 +75,7 @@ __export(src_exports, {
   VaultHeaders: () => VaultHeaders,
   VaultPublicSpaceKVActions: () => VaultPublicSpaceKVActions,
   abortedError: () => abortedError,
+  appSecretScope: () => appSecretScope,
   authExpiredError: () => authExpiredError,
   authRequiredError: () => authRequiredError,
   authUnauthorizedError: () => authUnauthorizedError,
@@ -2449,7 +2453,7 @@ var KVService = class extends BaseService {
             );
           }
           if (response.status === 404) {
-            return this.classifyNotFound(response, key);
+            return await this.classifyNotFound(response, key);
           }
           const errorText = await response.text();
           if (response.status === 413) {
@@ -3018,7 +3022,7 @@ var KVService = class extends BaseService {
             );
           }
           if (response.status === 404) {
-            return this.classifyNotFound(response, key);
+            return await this.classifyNotFound(response, key);
           }
           const errorText = await response.text();
           if (response.status === 412) {
@@ -3085,7 +3089,7 @@ var KVService = class extends BaseService {
             );
           }
           if (response.status === 404) {
-            return this.classifyNotFound(response, key);
+            return await this.classifyNotFound(response, key);
           }
           const errorText = await response.text();
           return err(
@@ -3151,7 +3155,7 @@ var KVService = class extends BaseService {
           signal: request.signal
         });
         if (!response.ok) {
-          return this.createSignedReadUrlError(response, key, path);
+          return await this.createSignedReadUrlError(response, key, path);
         }
         const signedUrl = this.normalizeSignedReadUrlResponse(
           await response.json()
@@ -5442,6 +5446,12 @@ function defaultVaultMessage(input) {
       return input.message ?? `Public key not found for ${input.did}`;
     case "STORAGE_ERROR":
       return input.message ?? input.cause.message;
+    case "ALREADY_EXISTS":
+      return input.message ?? `A value already exists at ${input.key}`;
+    case "AUTH_UNAUTHORIZED":
+      return input.message;
+    case "PERMISSION_DENIED":
+      return input.message;
     case "STORAGE_QUOTA_EXCEEDED":
     case "STORAGE_LIMIT_REACHED":
       return input.message;
@@ -5455,13 +5465,33 @@ function vaultError(input) {
   };
   return { ok: false, error };
 }
+function typedKvCause(error) {
+  return Object.assign(new Error(error.message), {
+    name: "ServiceError",
+    code: error.code,
+    service: error.service,
+    ...error.meta !== void 0 ? { meta: error.meta } : {},
+    ...error.cause !== void 0 ? { cause: error.cause } : {}
+  });
+}
 function kvWriteError(context, error) {
   if (error.code === ErrorCodes.STORAGE_QUOTA_EXCEEDED || error.code === ErrorCodes.STORAGE_LIMIT_REACHED) {
     return vaultError({ code: error.code, message: error.message, meta: error.meta });
   }
+  const message = `${context}: ${error.message}`;
+  if (error.code === ErrorCodes.AUTH_UNAUTHORIZED) {
+    const code = authorizationVerdictOf(error) === "unauthenticated" ? "AUTH_UNAUTHORIZED" : "PERMISSION_DENIED";
+    return vaultError({
+      code,
+      message,
+      ...error.meta !== void 0 ? { meta: error.meta } : {},
+      cause: typedKvCause(error)
+    });
+  }
   return vaultError({
     code: "STORAGE_ERROR",
-    cause: new Error(`${context}: ${error.message}`)
+    cause: new Error(message, { cause: typedKvCause(error) }),
+    ...error.meta !== void 0 ? { meta: error.meta } : {}
   });
 }
 var DataVaultService = class extends BaseService {
@@ -5741,11 +5771,18 @@ var DataVaultService = class extends BaseService {
           cause: new Error(envelopeResult.error.message)
         });
       }
-      const valuePutResult = await this.tc.kv.put(
-        `vault/${key}`,
-        JSON.stringify(envelopeResult.data)
-      );
+      const valuePath = `vault/${key}`;
+      const valueBody = JSON.stringify(envelopeResult.data);
+      const valuePutResult = options?.ifNoneMatch !== void 0 ? await this.tc.kv.put(valuePath, valueBody, { ifNoneMatch: options.ifNoneMatch }) : await this.tc.kv.put(valuePath, valueBody);
       if (!valuePutResult.ok) {
+        if (options?.ifNoneMatch !== void 0 && valuePutResult.error.code === ErrorCodes.KV_PRECONDITION_FAILED) {
+          return vaultError({
+            code: "ALREADY_EXISTS",
+            key,
+            ...valuePutResult.error.meta !== void 0 ? { meta: valuePutResult.error.meta } : {},
+            cause: typedKvCause(valuePutResult.error)
+          });
+        }
         return kvWriteError("Failed to store encrypted value", valuePutResult.error);
       }
       return { ok: true, data: void 0 };
@@ -5913,6 +5950,14 @@ var DataVaultService = class extends BaseService {
       if (this.usesNetworkEncryption) {
         return this.putNetworkEncrypted(key, value, options);
       }
+      if (options?.ifNoneMatch !== void 0) {
+        return vaultError({
+          code: "STORAGE_ERROR",
+          cause: new Error(
+            "ifNoneMatch is only supported by network-encrypted vaults"
+          )
+        });
+      }
       if (!this._isUnlocked || !this.masterKey) {
         return vaultError({
           code: "VAULT_LOCKED",
@@ -6724,6 +6769,35 @@ var SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
 var SECRET_PREFIX = "secrets/";
 var SCOPED_SECRET_PREFIX = "secrets/scoped/";
 var RESERVED_SECRET_SCOPES = /* @__PURE__ */ new Set(["default", "global"]);
+var SECRET_SCOPE_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var MAX_SECRET_SCOPE_LENGTH = 64;
+var TC832_RESERVED_SCOPES = Object.freeze([
+  "default",
+  "global",
+  "scoped"
+]);
+function appSecretScope(appId) {
+  if (appId.trim() === "") {
+    throw new Error("App id must be non-empty to derive a secret scope.");
+  }
+  const scope = appId.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (scope === "") {
+    throw new Error(
+      `App id ${JSON.stringify(appId)} must contain at least one letter or number.`
+    );
+  }
+  if (scope.length > MAX_SECRET_SCOPE_LENGTH) {
+    throw new Error(
+      `App id ${JSON.stringify(appId)} yields a secret scope longer than ${MAX_SECRET_SCOPE_LENGTH} characters.`
+    );
+  }
+  if (TC832_RESERVED_SCOPES.includes(scope)) {
+    throw new Error(
+      `App id ${JSON.stringify(appId)} yields the reserved secret scope ${JSON.stringify(scope)}.`
+    );
+  }
+  return scope;
+}
 function canonicalizeSecretScope(scope) {
   if (scope === void 0) {
     return void 0;
@@ -6836,11 +6910,12 @@ var SecretsService = class {
     const secretPath = resolveSecretPathResult(name, options);
     if ("ok" in secretPath) return secretPath;
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    return this.vault.put(secretPath.vaultKey, {
+    const payload = {
       value,
       createdAt: now,
       updatedAt: now
-    });
+    };
+    return options?.ifAbsent === true ? this.vault.put(secretPath.vaultKey, payload, { ifNoneMatch: "*" }) : this.vault.put(secretPath.vaultKey, payload);
   }
   async delete(name, options) {
     const secretPath = resolveSecretPathResult(name, options);
@@ -7896,11 +7971,13 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   KVListResultSchema,
   KVResponseHeadersSchema,
   KVService,
+  MAX_SECRET_SCOPE_LENGTH,
   NETWORK_NAME_PATTERN,
   NetworkIdError,
   PrefixedKVService,
   RetryPolicySchema,
   SECRET_NAME_RE,
+  SECRET_SCOPE_RE,
   SQLAction,
   SQLMigrations,
   SQLService,
@@ -7914,6 +7991,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   ServiceResponseEventSchema,
   ServiceRetryEventSchema,
   ServiceSessionSchema,
+  TC832_RESERVED_SCOPES,
   TelemetryEvents,
   TelemetrySpanEventSchema,
   TinyCloudDebugLogger,
@@ -7921,6 +7999,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   VaultHeaders,
   VaultPublicSpaceKVActions,
   abortedError,
+  appSecretScope,
   authExpiredError,
   authRequiredError,
   authUnauthorizedError,