@tinycloud/sdk-services 3.11.0 → 3.12.0-beta.4

package/dist/encryption/index.d.cts

@@ -1,25 +1,9 @@
-import { B as BaseService } from '../BaseService-O0iyuFLk.cjs';
-import { c as IService, f as Result } from '../types-CSd0RYir.cjs';
-import { N as NetworkDescriptor, n as EncryptionError, I as InlineEncryptedEnvelope, D as DecryptCapabilityProof, j as DecryptResponseBody, E as EncryptionCrypto, h as DecryptInvocationSigner, p as ReceiverKeySigner, R as ReceiverKeyPair, i as DecryptRequestBody, g as DecryptInvocationFact, B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation } from '../types-D4XbIfFJ.cjs';
-export { C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, o as EncryptionErrorInput, J as Json, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalize, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from '../types-D4XbIfFJ.cjs';
+import { B as BaseService } from '../BaseService-CdBkfPGE.cjs';
+import { c as IService, f as Result } from '../types-DjAP8dve.cjs';
+import { N as NetworkDescriptor, n as EncryptionError, I as InlineEncryptedEnvelope, D as DecryptCapabilityProof, j as DecryptResponseBody, E as EncryptionCrypto, h as DecryptInvocationSigner, s as ReceiverKeySigner, r as ReceiverKeyPair, i as DecryptRequestBody, g as DecryptInvocationFact, B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation } from '../types-cWtQmCCw.cjs';
+export { C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, o as EncryptionErrorInput, J as Json, x as base64Decode, y as base64Encode, z as canonicalHashHex, A as canonicalize, G as encryptionError, H as hexDecode, K as hexEncode, M as utf8Decode, O as utf8Encode } from '../types-cWtQmCCw.cjs';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
 
-/**
- * Network-descriptor discovery.
- *
- * Resolution order (per architecture):
- *
- * 1. The node's authoritative endpoint
- *    `GET /encryption/networks/<networkId>` returns the current
- *    descriptor (`state`, `publicEncryptionKey`, `keyVersion`, ...).
- * 2. If the node is unreachable, fall back to the cached discovery
- *    record at `.well-known/encryption/network/<name>` inside the
- *    owner's public space.
- *
- * The node DB is authoritative on conflict; cached records are
- * advisory only.
- */
-
 type DiscoverySource = "node" | "well-known";
 interface DiscoveredNetwork {
     descriptor: NetworkDescriptor;
@@ -45,8 +29,8 @@ interface DiscoverNetworkInput {
     wellKnown?: WellKnownDescriptorFetcher;
 }
 /**
- * Resolve a network descriptor. The node fetcher is preferred; the
- * well-known fallback is used only on transport failure.
+ * Resolve a network descriptor. The node fetcher is preferred. An optional
+ * well-known cache cannot override a typed registry, identity, or transport failure.
  *
  * The returned descriptor is sanity-checked: `networkId`, `ownerDid`,
  * and `name` must agree with the URN, and the public key field must
@@ -131,6 +115,10 @@ interface IEncryptionService extends IService {
      *
      * The capability proof must root at the network owner DID embedded
      * in the envelope's networkId.
+     *
+     * Unresponsive decrypt transports use DECRYPTION_DEPENDENCY_UNAVAILABLE.
+     * HTTP failure, identity, registry and caller-cancellation classifications
+     * remain distinct; a failed request never returns partial plaintext.
      */
     decryptEnvelope(envelope: InlineEncryptedEnvelope, capabilityProof: DecryptCapabilityProof, options?: DecryptEnvelopeOptions): Promise<Result<Uint8Array, EncryptionError>>;
 }
@@ -173,6 +161,8 @@ interface EncryptionServiceConfig {
     transport: DecryptTransport;
     node?: NodeDescriptorFetcher;
     wellKnown?: WellKnownDescriptorFetcher;
+    /** Verified registry destination; overrides descriptor order and caller hints. */
+    resolveTargetNode?: (networkId: string) => Promise<string>;
     /** Bound by an owning service graph to prevent cross-session authority use. */
     assertActive?: () => void;
     [key: string]: unknown;

package/dist/encryption/index.d.ts

@@ -1,25 +1,9 @@
-import { B as BaseService } from '../BaseService-Ma2MwJAd.js';
-import { c as IService, f as Result } from '../types-CSd0RYir.js';
-import { N as NetworkDescriptor, n as EncryptionError, I as InlineEncryptedEnvelope, D as DecryptCapabilityProof, j as DecryptResponseBody, E as EncryptionCrypto, h as DecryptInvocationSigner, p as ReceiverKeySigner, R as ReceiverKeyPair, i as DecryptRequestBody, g as DecryptInvocationFact, B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation } from '../types-Bf91gup6.js';
-export { C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, o as EncryptionErrorInput, J as Json, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalize, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from '../types-Bf91gup6.js';
+import { B as BaseService } from '../BaseService-BRDG69KR.js';
+import { c as IService, f as Result } from '../types-DjAP8dve.js';
+import { N as NetworkDescriptor, n as EncryptionError, I as InlineEncryptedEnvelope, D as DecryptCapabilityProof, j as DecryptResponseBody, E as EncryptionCrypto, h as DecryptInvocationSigner, s as ReceiverKeySigner, r as ReceiverKeyPair, i as DecryptRequestBody, g as DecryptInvocationFact, B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation } from '../types-XE4tyBLH.js';
+export { C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, o as EncryptionErrorInput, J as Json, x as base64Decode, y as base64Encode, z as canonicalHashHex, A as canonicalize, G as encryptionError, H as hexDecode, K as hexEncode, M as utf8Decode, O as utf8Encode } from '../types-XE4tyBLH.js';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
 
-/**
- * Network-descriptor discovery.
- *
- * Resolution order (per architecture):
- *
- * 1. The node's authoritative endpoint
- *    `GET /encryption/networks/<networkId>` returns the current
- *    descriptor (`state`, `publicEncryptionKey`, `keyVersion`, ...).
- * 2. If the node is unreachable, fall back to the cached discovery
- *    record at `.well-known/encryption/network/<name>` inside the
- *    owner's public space.
- *
- * The node DB is authoritative on conflict; cached records are
- * advisory only.
- */
-
 type DiscoverySource = "node" | "well-known";
 interface DiscoveredNetwork {
     descriptor: NetworkDescriptor;
@@ -45,8 +29,8 @@ interface DiscoverNetworkInput {
     wellKnown?: WellKnownDescriptorFetcher;
 }
 /**
- * Resolve a network descriptor. The node fetcher is preferred; the
- * well-known fallback is used only on transport failure.
+ * Resolve a network descriptor. The node fetcher is preferred. An optional
+ * well-known cache cannot override a typed registry, identity, or transport failure.
  *
  * The returned descriptor is sanity-checked: `networkId`, `ownerDid`,
  * and `name` must agree with the URN, and the public key field must
@@ -131,6 +115,10 @@ interface IEncryptionService extends IService {
      *
      * The capability proof must root at the network owner DID embedded
      * in the envelope's networkId.
+     *
+     * Unresponsive decrypt transports use DECRYPTION_DEPENDENCY_UNAVAILABLE.
+     * HTTP failure, identity, registry and caller-cancellation classifications
+     * remain distinct; a failed request never returns partial plaintext.
      */
     decryptEnvelope(envelope: InlineEncryptedEnvelope, capabilityProof: DecryptCapabilityProof, options?: DecryptEnvelopeOptions): Promise<Result<Uint8Array, EncryptionError>>;
 }
@@ -173,6 +161,8 @@ interface EncryptionServiceConfig {
     transport: DecryptTransport;
     node?: NodeDescriptorFetcher;
     wellKnown?: WellKnownDescriptorFetcher;
+    /** Verified registry destination; overrides descriptor order and caller hints. */
+    resolveTargetNode?: (networkId: string) => Promise<string>;
     /** Bound by an owning service graph to prevent cross-session authority use. */
     assertActive?: () => void;
     [key: string]: unknown;

package/dist/encryption/index.js

@@ -10,6 +10,10 @@ var ErrorCodes = {
   /** HTTP 401: a delegation the cited one rests on was revoked. */
   AUTH_DELEGATION_ANCESTOR_REVOKED: "AUTH_DELEGATION_ANCESTOR_REVOKED",
   NETWORK_ERROR: "NETWORK_ERROR",
+  NODE_NOT_RESPONDING: "NODE_NOT_RESPONDING",
+  NODE_IDENTITY_MISMATCH: "NODE_IDENTITY_MISMATCH",
+  PARTIAL_NODE_WRITE: "PARTIAL_NODE_WRITE",
+  RESOURCE_NOT_ROUTED: "RESOURCE_NOT_ROUTED",
   TIMEOUT: "TIMEOUT",
   ABORTED: "ABORTED",
   INVALID_INPUT: "INVALID_INPUT",
@@ -206,6 +210,34 @@ function networkDiscoveryKey(name) {
 var ENCRYPTION_NETWORK_URN_PREFIX = URN_PREFIX;
 var NETWORK_NAME_PATTERN = NETWORK_NAME_RE;
 
+// src/resourceRouting.ts
+var ROUTING_FAILURE_CODES = {
+  NODE_NOT_RESPONDING: true,
+  PARTIAL_NODE_WRITE: true,
+  NODE_IDENTITY_MISMATCH: true,
+  RESOURCE_NOT_ROUTED: true,
+  DECRYPTION_DEPENDENCY_UNAVAILABLE: true,
+  registry_unavailable: true,
+  node_not_found: true,
+  node_registry_entry_exists: true
+};
+function isRoutingFailureCode(code) {
+  return Object.prototype.hasOwnProperty.call(ROUTING_FAILURE_CODES, code);
+}
+function routingFailure(error) {
+  if (typeof error === "object" && error !== null && "code" in error && "message" in error && typeof error.code === "string" && typeof error.message === "string" && isRoutingFailureCode(error.code)) {
+    const candidate = "meta" in error ? error.meta : void 0;
+    let meta = typeof candidate === "object" && candidate !== null && !Array.isArray(candidate) ? candidate : void 0;
+    if (error.code === "NODE_NOT_RESPONDING" && "hosts" in error && Array.isArray(error.hosts)) {
+      meta = { ...meta, hosts: error.hosts };
+    } else if (error.code === "PARTIAL_NODE_WRITE" && "succeeded" in error && Array.isArray(error.succeeded) && "failed" in error && Array.isArray(error.failed)) {
+      meta = { ...meta, succeeded: error.succeeded, failed: error.failed };
+    }
+    return { code: error.code, message: error.message, ...error instanceof Error ? { cause: error } : {}, ...meta ? { meta } : {} };
+  }
+  return void 0;
+}
+
 // src/errors.ts
 var RequestTimeoutError = class extends Error {
   constructor(timeoutMs) {
@@ -248,6 +280,8 @@ var capabilityServices = new Set(
   CAPABILITY_REGISTRY.map(({ service }) => service.slice("tinycloud.".length))
 );
 function wrapError(service, error, defaultCode = ErrorCodes.NETWORK_ERROR) {
+  const routing = routingFailure(error);
+  if (routing) return { ...routing, service };
   if (error instanceof Error) {
     if (isRequestTimeoutError(error)) {
       return timeoutError(service, error.timeoutMs, error);
@@ -695,6 +729,8 @@ function defaultEncryptionMessage(input) {
       return input.message ?? input.cause.message;
     case "INVALID_INPUT":
       return input.message;
+    default:
+      return input.message ?? input.code;
   }
 }
 function encryptionError(input) {
@@ -759,6 +795,8 @@ async function discoverNetwork(input) {
         return { ok: true, data: { descriptor: validated.data, source: "node" } };
       }
     } catch (err2) {
+      const routing = routingFailure(err2);
+      if (routing) return { ok: false, error: encryptionError(routing) };
     }
   }
   if (input.wellKnown !== void 0) {
@@ -776,6 +814,8 @@ async function discoverNetwork(input) {
         };
       }
     } catch (err2) {
+      const routing = routingFailure(err2);
+      if (routing) return { ok: false, error: encryptionError(routing) };
     }
   }
   return {
@@ -1360,6 +1400,14 @@ function encOk(data) {
 function encErr(error) {
   return { ok: false, error };
 }
+function decryptionError(input) {
+  const unavailable = input.code === "NODE_NOT_RESPONDING" || input.code === "TRANSPORT_ERROR" && input.cause.name !== "AbortError";
+  return encryptionError(unavailable ? {
+    ...input,
+    code: "DECRYPTION_DEPENDENCY_UNAVAILABLE",
+    message: "The decryption service isn't responding right now. Please try again."
+  } : input);
+}
 var EncryptionService = class extends BaseService {
   constructor(config) {
     super();
@@ -1407,6 +1455,8 @@ var EncryptionService = class extends BaseService {
       });
       return encOk(result.envelope);
     } catch (error) {
+      const routing = routingFailure(error);
+      if (routing) return encErr(encryptionError(routing));
       return encErr(
         encryptionError({
           code: "TRANSPORT_ERROR",
@@ -1433,12 +1483,12 @@ var EncryptionService = class extends BaseService {
         descriptor = options.descriptor;
       } else {
         const discovered = await this.discoverNetwork(envelope.networkId);
-        if (!discovered.ok) return discovered;
+        if (!discovered.ok) return encErr(decryptionError(discovered.error));
         descriptor = discovered.data;
       }
       const usable = ensureNetworkUsableForDecrypt(descriptor);
       if (!usable.ok) return usable;
-      const targetNode = options?.targetNode ?? descriptor.members[0]?.nodeId;
+      const targetNode = this._config.resolveTargetNode ? await this._config.resolveTargetNode(envelope.networkId) : options?.targetNode ?? descriptor.members[0]?.nodeId;
       if (targetNode === void 0) {
         return encErr(
           encryptionError({
@@ -1447,6 +1497,9 @@ var EncryptionService = class extends BaseService {
           })
         );
       }
+      if (this._config.resolveTargetNode && (options?.targetNode !== void 0 && options.targetNode !== targetNode || !descriptor.members.some((member) => member.nodeId === targetNode))) {
+        return encErr(encryptionError({ code: "INVALID_INPUT", message: "Encryption destination does not match the registry" }));
+      }
       const receiverKey = generateRandomReceiverKey({ crypto: this.crypto });
       const receiverPublicKey = base64Encode(receiverKey.publicKey);
       const receiverPublicKeyHash = canonicalHashHex(
@@ -1505,6 +1558,8 @@ var EncryptionService = class extends BaseService {
         });
         this.assertActive();
       } catch (error) {
+        const routing = routingFailure(error);
+        if (routing) return encErr(decryptionError(routing));
         if (error instanceof DecryptTransportResponseError) {
           return encErr(
             encryptionError(
@@ -1521,7 +1576,7 @@ var EncryptionService = class extends BaseService {
           );
         }
         return encErr(
-          encryptionError({
+          decryptionError({
             code: "TRANSPORT_ERROR",
             cause: toError(error)
           })
@@ -1548,6 +1603,8 @@ var EncryptionService = class extends BaseService {
       );
       return encOk(plaintext);
     } catch (error) {
+      const routing = routingFailure(error);
+      if (routing) return encErr(decryptionError(routing));
       return encErr(
         encryptionError({
           code: "INVALID_RESPONSE",