@tinycloud/sdk-services 3.1.0 → 3.2.0-beta.2

package/dist/index.d.cts

@@ -1708,6 +1708,11 @@ interface VaultPutOptions {
     contentType?: string;
     /** Custom serializer (default: JSON.stringify for objects) */
     serialize?: (value: unknown) => Uint8Array;
+    /**
+     * `"*"` writes only when no value exists at the key. An existing value
+     * fails with `ALREADY_EXISTS`; it is never overwritten.
+     */
+    ifNoneMatch?: "*";
 }
 /**
  * Options for vault get operations.
@@ -1830,6 +1835,28 @@ type VaultErrorInput = {
     code: "STORAGE_ERROR";
     cause: Error;
     message?: string;
+    meta?: Record<string, unknown>;
+} | {
+    code: "ALREADY_EXISTS";
+    key: string;
+    message?: string;
+    meta?: Record<string, unknown>;
+    /** The typed KV error that refused the write (an `Error` carrying its `code`, `service` and `meta`). */
+    cause: ServiceError & Error;
+} | {
+    /** HTTP 401 only: the session must sign in again. */
+    code: "AUTH_UNAUTHORIZED";
+    message: string;
+    meta?: Record<string, unknown>;
+    /** The typed KV error that refused the write (an `Error` carrying its `code`, `service` and `meta`). */
+    cause: ServiceError & Error;
+} | {
+    /** A 403, or an authorization refusal without a status: signing in again does not help. */
+    code: "PERMISSION_DENIED";
+    message: string;
+    meta?: Record<string, unknown>;
+    /** The typed KV error that refused the write (an `Error` carrying its `code`, `service` and `meta`). */
+    cause: ServiceError & Error;
 } | {
     code: "STORAGE_QUOTA_EXCEEDED" | "STORAGE_LIMIT_REACHED";
     message: string;
@@ -2317,6 +2344,21 @@ interface SecretScopeOptions {
     /** Optional logical scope. Omit for the global secret namespace. */
     scope?: string;
 }
+/** Canonical secret scope grammar shared with the TC-832 `/request` link. */
+declare const SECRET_SCOPE_RE: RegExp;
+/** Longest scope the TC-832 `/request` link accepts. */
+declare const MAX_SECRET_SCOPE_LENGTH = 64;
+/** Scopes the TC-832 `/request` link refuses. */
+declare const TC832_RESERVED_SCOPES: readonly string[];
+interface SecretPutOptions extends SecretScopeOptions {
+    /** Write only when no secret exists under this name; never overwrite. */
+    ifAbsent?: boolean;
+}
+/**
+ * Derive the canonical secret scope for an app id such as
+ * `xyz.tinycloud.feed-workflows` → `xyz-tinycloud-feed-workflows`.
+ */
+declare function appSecretScope(appId: string): string;
 interface ResolvedSecretPath {
     /** Canonical env-style secret name. */
     name: string;
@@ -2357,7 +2399,7 @@ interface ISecretsService {
     lock(): void;
     readonly isUnlocked: boolean;
     get(name: string, options?: SecretScopeOptions): Promise<Result<string, SecretsError>>;
-    put(name: string, value: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
+    put(name: string, value: string, options?: SecretPutOptions): Promise<Result<void, SecretsError>>;
     delete(name: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
     /** List global and scoped secrets without decrypting their values. */
@@ -2372,10 +2414,10 @@ declare class SecretsService implements ISecretsService {
     unlock(signer?: unknown): Promise<Result<void, VaultError>>;
     lock(): void;
     get(name: string, options?: SecretScopeOptions): Promise<Result<string, SecretsError>>;
-    put(name: string, value: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
+    put(name: string, value: string, options?: SecretPutOptions): Promise<Result<void, SecretsError>>;
     delete(name: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
     listAll(): Promise<Result<SecretCatalogEntry[], SecretsError>>;
 }
 
-export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };
+export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, MAX_SECRET_SCOPE_LENGTH, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, SECRET_SCOPE_RE, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretPutOptions, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, TC832_RESERVED_SCOPES, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, appSecretScope, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };

package/dist/index.d.ts

@@ -1708,6 +1708,11 @@ interface VaultPutOptions {
     contentType?: string;
     /** Custom serializer (default: JSON.stringify for objects) */
     serialize?: (value: unknown) => Uint8Array;
+    /**
+     * `"*"` writes only when no value exists at the key. An existing value
+     * fails with `ALREADY_EXISTS`; it is never overwritten.
+     */
+    ifNoneMatch?: "*";
 }
 /**
  * Options for vault get operations.
@@ -1830,6 +1835,28 @@ type VaultErrorInput = {
     code: "STORAGE_ERROR";
     cause: Error;
     message?: string;
+    meta?: Record<string, unknown>;
+} | {
+    code: "ALREADY_EXISTS";
+    key: string;
+    message?: string;
+    meta?: Record<string, unknown>;
+    /** The typed KV error that refused the write (an `Error` carrying its `code`, `service` and `meta`). */
+    cause: ServiceError & Error;
+} | {
+    /** HTTP 401 only: the session must sign in again. */
+    code: "AUTH_UNAUTHORIZED";
+    message: string;
+    meta?: Record<string, unknown>;
+    /** The typed KV error that refused the write (an `Error` carrying its `code`, `service` and `meta`). */
+    cause: ServiceError & Error;
+} | {
+    /** A 403, or an authorization refusal without a status: signing in again does not help. */
+    code: "PERMISSION_DENIED";
+    message: string;
+    meta?: Record<string, unknown>;
+    /** The typed KV error that refused the write (an `Error` carrying its `code`, `service` and `meta`). */
+    cause: ServiceError & Error;
 } | {
     code: "STORAGE_QUOTA_EXCEEDED" | "STORAGE_LIMIT_REACHED";
     message: string;
@@ -2317,6 +2344,21 @@ interface SecretScopeOptions {
     /** Optional logical scope. Omit for the global secret namespace. */
     scope?: string;
 }
+/** Canonical secret scope grammar shared with the TC-832 `/request` link. */
+declare const SECRET_SCOPE_RE: RegExp;
+/** Longest scope the TC-832 `/request` link accepts. */
+declare const MAX_SECRET_SCOPE_LENGTH = 64;
+/** Scopes the TC-832 `/request` link refuses. */
+declare const TC832_RESERVED_SCOPES: readonly string[];
+interface SecretPutOptions extends SecretScopeOptions {
+    /** Write only when no secret exists under this name; never overwrite. */
+    ifAbsent?: boolean;
+}
+/**
+ * Derive the canonical secret scope for an app id such as
+ * `xyz.tinycloud.feed-workflows` → `xyz-tinycloud-feed-workflows`.
+ */
+declare function appSecretScope(appId: string): string;
 interface ResolvedSecretPath {
     /** Canonical env-style secret name. */
     name: string;
@@ -2357,7 +2399,7 @@ interface ISecretsService {
     lock(): void;
     readonly isUnlocked: boolean;
     get(name: string, options?: SecretScopeOptions): Promise<Result<string, SecretsError>>;
-    put(name: string, value: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
+    put(name: string, value: string, options?: SecretPutOptions): Promise<Result<void, SecretsError>>;
     delete(name: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
     /** List global and scoped secrets without decrypting their values. */
@@ -2372,10 +2414,10 @@ declare class SecretsService implements ISecretsService {
     unlock(signer?: unknown): Promise<Result<void, VaultError>>;
     lock(): void;
     get(name: string, options?: SecretScopeOptions): Promise<Result<string, SecretsError>>;
-    put(name: string, value: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
+    put(name: string, value: string, options?: SecretPutOptions): Promise<Result<void, SecretsError>>;
     delete(name: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
     listAll(): Promise<Result<SecretCatalogEntry[], SecretsError>>;
 }
 
-export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };
+export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, MAX_SECRET_SCOPE_LENGTH, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, SECRET_SCOPE_RE, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretPutOptions, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, TC832_RESERVED_SCOPES, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, appSecretScope, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };

package/dist/index.js

@@ -2299,7 +2299,7 @@ var KVService = class extends BaseService {
             );
           }
           if (response.status === 404) {
-            return this.classifyNotFound(response, key);
+            return await this.classifyNotFound(response, key);
           }
           const errorText = await response.text();
           if (response.status === 413) {
@@ -2868,7 +2868,7 @@ var KVService = class extends BaseService {
             );
           }
           if (response.status === 404) {
-            return this.classifyNotFound(response, key);
+            return await this.classifyNotFound(response, key);
           }
           const errorText = await response.text();
           if (response.status === 412) {
@@ -2935,7 +2935,7 @@ var KVService = class extends BaseService {
             );
           }
           if (response.status === 404) {
-            return this.classifyNotFound(response, key);
+            return await this.classifyNotFound(response, key);
           }
           const errorText = await response.text();
           return err(
@@ -3001,7 +3001,7 @@ var KVService = class extends BaseService {
           signal: request.signal
         });
         if (!response.ok) {
-          return this.createSignedReadUrlError(response, key, path);
+          return await this.createSignedReadUrlError(response, key, path);
         }
         const signedUrl = this.normalizeSignedReadUrlResponse(
           await response.json()
@@ -5292,6 +5292,12 @@ function defaultVaultMessage(input) {
       return input.message ?? `Public key not found for ${input.did}`;
     case "STORAGE_ERROR":
       return input.message ?? input.cause.message;
+    case "ALREADY_EXISTS":
+      return input.message ?? `A value already exists at ${input.key}`;
+    case "AUTH_UNAUTHORIZED":
+      return input.message;
+    case "PERMISSION_DENIED":
+      return input.message;
     case "STORAGE_QUOTA_EXCEEDED":
     case "STORAGE_LIMIT_REACHED":
       return input.message;
@@ -5305,13 +5311,33 @@ function vaultError(input) {
   };
   return { ok: false, error };
 }
+function typedKvCause(error) {
+  return Object.assign(new Error(error.message), {
+    name: "ServiceError",
+    code: error.code,
+    service: error.service,
+    ...error.meta !== void 0 ? { meta: error.meta } : {},
+    ...error.cause !== void 0 ? { cause: error.cause } : {}
+  });
+}
 function kvWriteError(context, error) {
   if (error.code === ErrorCodes.STORAGE_QUOTA_EXCEEDED || error.code === ErrorCodes.STORAGE_LIMIT_REACHED) {
     return vaultError({ code: error.code, message: error.message, meta: error.meta });
   }
+  const message = `${context}: ${error.message}`;
+  if (error.code === ErrorCodes.AUTH_UNAUTHORIZED) {
+    const code = authorizationVerdictOf(error) === "unauthenticated" ? "AUTH_UNAUTHORIZED" : "PERMISSION_DENIED";
+    return vaultError({
+      code,
+      message,
+      ...error.meta !== void 0 ? { meta: error.meta } : {},
+      cause: typedKvCause(error)
+    });
+  }
   return vaultError({
     code: "STORAGE_ERROR",
-    cause: new Error(`${context}: ${error.message}`)
+    cause: new Error(message, { cause: typedKvCause(error) }),
+    ...error.meta !== void 0 ? { meta: error.meta } : {}
   });
 }
 var DataVaultService = class extends BaseService {
@@ -5591,11 +5617,18 @@ var DataVaultService = class extends BaseService {
           cause: new Error(envelopeResult.error.message)
         });
       }
-      const valuePutResult = await this.tc.kv.put(
-        `vault/${key}`,
-        JSON.stringify(envelopeResult.data)
-      );
+      const valuePath = `vault/${key}`;
+      const valueBody = JSON.stringify(envelopeResult.data);
+      const valuePutResult = options?.ifNoneMatch !== void 0 ? await this.tc.kv.put(valuePath, valueBody, { ifNoneMatch: options.ifNoneMatch }) : await this.tc.kv.put(valuePath, valueBody);
       if (!valuePutResult.ok) {
+        if (options?.ifNoneMatch !== void 0 && valuePutResult.error.code === ErrorCodes.KV_PRECONDITION_FAILED) {
+          return vaultError({
+            code: "ALREADY_EXISTS",
+            key,
+            ...valuePutResult.error.meta !== void 0 ? { meta: valuePutResult.error.meta } : {},
+            cause: typedKvCause(valuePutResult.error)
+          });
+        }
         return kvWriteError("Failed to store encrypted value", valuePutResult.error);
       }
       return { ok: true, data: void 0 };
@@ -5763,6 +5796,14 @@ var DataVaultService = class extends BaseService {
       if (this.usesNetworkEncryption) {
         return this.putNetworkEncrypted(key, value, options);
       }
+      if (options?.ifNoneMatch !== void 0) {
+        return vaultError({
+          code: "STORAGE_ERROR",
+          cause: new Error(
+            "ifNoneMatch is only supported by network-encrypted vaults"
+          )
+        });
+      }
       if (!this._isUnlocked || !this.masterKey) {
         return vaultError({
           code: "VAULT_LOCKED",
@@ -6574,6 +6615,35 @@ var SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
 var SECRET_PREFIX = "secrets/";
 var SCOPED_SECRET_PREFIX = "secrets/scoped/";
 var RESERVED_SECRET_SCOPES = /* @__PURE__ */ new Set(["default", "global"]);
+var SECRET_SCOPE_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var MAX_SECRET_SCOPE_LENGTH = 64;
+var TC832_RESERVED_SCOPES = Object.freeze([
+  "default",
+  "global",
+  "scoped"
+]);
+function appSecretScope(appId) {
+  if (appId.trim() === "") {
+    throw new Error("App id must be non-empty to derive a secret scope.");
+  }
+  const scope = appId.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (scope === "") {
+    throw new Error(
+      `App id ${JSON.stringify(appId)} must contain at least one letter or number.`
+    );
+  }
+  if (scope.length > MAX_SECRET_SCOPE_LENGTH) {
+    throw new Error(
+      `App id ${JSON.stringify(appId)} yields a secret scope longer than ${MAX_SECRET_SCOPE_LENGTH} characters.`
+    );
+  }
+  if (TC832_RESERVED_SCOPES.includes(scope)) {
+    throw new Error(
+      `App id ${JSON.stringify(appId)} yields the reserved secret scope ${JSON.stringify(scope)}.`
+    );
+  }
+  return scope;
+}
 function canonicalizeSecretScope(scope) {
   if (scope === void 0) {
     return void 0;
@@ -6686,11 +6756,12 @@ var SecretsService = class {
     const secretPath = resolveSecretPathResult(name, options);
     if ("ok" in secretPath) return secretPath;
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    return this.vault.put(secretPath.vaultKey, {
+    const payload = {
       value,
       createdAt: now,
       updatedAt: now
-    });
+    };
+    return options?.ifAbsent === true ? this.vault.put(secretPath.vaultKey, payload, { ifNoneMatch: "*" }) : this.vault.put(secretPath.vaultKey, payload);
   }
   async delete(name, options) {
     const secretPath = resolveSecretPathResult(name, options);
@@ -7745,11 +7816,13 @@ export {
   KVListResultSchema,
   KVResponseHeadersSchema,
   KVService,
+  MAX_SECRET_SCOPE_LENGTH,
   NETWORK_NAME_PATTERN,
   NetworkIdError,
   PrefixedKVService,
   RetryPolicySchema,
   SECRET_NAME_RE,
+  SECRET_SCOPE_RE,
   SQLAction,
   SQLMigrations,
   SQLService,
@@ -7763,6 +7836,7 @@ export {
   ServiceResponseEventSchema,
   ServiceRetryEventSchema,
   ServiceSessionSchema,
+  TC832_RESERVED_SCOPES,
   TelemetryEvents,
   TelemetrySpanEventSchema,
   TinyCloudDebugLogger,
@@ -7770,6 +7844,7 @@ export {
   VaultHeaders,
   VaultPublicSpaceKVActions,
   abortedError,
+  appSecretScope,
   authExpiredError,
   authRequiredError,
   authUnauthorizedError,