@tinycloud/sdk-services 3.12.0-beta.7 → 3.12.0-beta.8

package/dist/encryption/named-keys.d.cts

@@ -1,4 +1,4 @@
-import { E as EncryptionCrypto, I as InlineEncryptedEnvelope, J as Json } from '../types-cWtQmCCw.cjs';
+import { E as EncryptionCrypto, I as InlineEncryptedEnvelope, J as Json } from '../types-CoZ0vXo8.cjs';
 import { ParsedKeyResource } from './resource.cjs';
 import '../types-DjAP8dve.cjs';
 

package/dist/encryption/named-keys.d.ts

@@ -1,4 +1,4 @@
-import { E as EncryptionCrypto, I as InlineEncryptedEnvelope, J as Json } from '../types-XE4tyBLH.js';
+import { E as EncryptionCrypto, I as InlineEncryptedEnvelope, J as Json } from '../types-Ceti5xVp.js';
 import { ParsedKeyResource } from './resource.js';
 import '../types-DjAP8dve.js';
 

package/dist/index.cjs

@@ -104,6 +104,7 @@ __export(src_exports, {
   clearTinyCloudDebugLogs: () => clearTinyCloudDebugLogs,
   createKVResponseSchema: () => createKVResponseSchema,
   createResourceRoutingFetch: () => createResourceRoutingFetch,
+  createResourceTransportInvocationFetch: () => createResourceTransportInvocationFetch,
   createResultSchema: () => createResultSchema,
   createVaultCrypto: () => createVaultCrypto,
   decryptEnvelopeWithKey: () => decryptEnvelopeWithKey,
@@ -146,7 +147,9 @@ __export(src_exports, {
   requiresSecretsOptIn: () => requiresSecretsOptIn,
   resolveSecretListPrefix: () => resolveSecretListPrefix,
   resolveSecretPath: () => resolveSecretPath,
+  routeResourceRequest: () => routeResourceRequest,
   routingFailure: () => routingFailure,
+  routingResourceOf: () => routingResourceOf,
   serviceError: () => serviceError,
   storageLimitReachedError: () => storageLimitReachedError,
   storageQuotaExceededError: () => storageQuotaExceededError,
@@ -989,6 +992,7 @@ async function verifyResourceDestination(target, fetchFn) {
   if (infoDid !== target.nodeDid || keysDid !== target.nodeDid) {
     throw new NodeIdentityMismatchError(target.url, target.nodeDid, infoDid !== target.nodeDid ? infoDid : keysDid);
   }
+  return info;
 }
 var NodeNotRespondingError = class extends Error {
   constructor(hosts, cause) {
@@ -1056,6 +1060,17 @@ function authorizationOf(headers) {
   if (headers === void 0) return void 0;
   return (Array.isArray(headers) ? headers : Object.entries(headers)).find(([name]) => name.toLowerCase() === "authorization")?.[1];
 }
+function routingResourceOf(uri) {
+  if (uri.startsWith("tinycloud://")) {
+    const resource = uri.slice("tinycloud://".length).split("/", 1)[0];
+    if (resource) return resource;
+  } else if (uri.startsWith("urn:tinycloud:encryption:")) {
+    return uri;
+  } else if (uri.startsWith("tinycloud:")) {
+    return uri.split("/", 1)[0];
+  }
+  throw new ResourceNotRoutedError(uri);
+}
 function invocationResources(authorization) {
   const encoded = authorization.split(".")[1];
   if (!encoded) throw new ResourceNotRoutedError("invalid invocation");
@@ -1067,8 +1082,7 @@ function invocationResources(authorization) {
   for (const [uri, abilities] of Object.entries(payload.att)) {
     if (typeof abilities !== "object" || abilities === null || Array.isArray(abilities)) throw new ResourceNotRoutedError(uri);
     for (const action of Object.keys(abilities)) {
-      const resource = uri.startsWith("tinycloud:") ? uri.split("/")[0] : uri;
-      if (!resource.startsWith("tinycloud:") && !resource.startsWith("urn:tinycloud:encryption:")) throw new ResourceNotRoutedError(uri);
+      const resource = routingResourceOf(uri);
       const read2 = /^(tinycloud\.(kv\/(get|list|metadata|head|sync)|sql\/(read|export)|duckdb\/(read|describe|export)|capabilities\/read|space\/(list|info)|hooks\/list))$/.test(action);
       const access = resource.startsWith("urn:tinycloud:encryption:") ? "encryption" : action === "tinycloud.space/host" ? "host" : read2 ? "read" : "write";
       if (!resources.some((entry) => entry.resource === resource && entry.access === access)) resources.push({ resource, access });
@@ -1077,6 +1091,83 @@ function invocationResources(authorization) {
   if (resources.length === 0) throw new ResourceNotRoutedError("empty invocation");
   return resources;
 }
+async function routeResourceRequest(resources, routing, send, options) {
+  if (resources.length === 0) throw new ResourceNotRoutedError("empty request");
+  const routes = await Promise.all(resources.map(({ resource, access }) => routing.resolveResource(resource, access)));
+  if (routes.some((route) => route.length === 0)) throw new ResourceNotRoutedError(resources[routes.findIndex((route) => route.length === 0)].resource);
+  const write = options?.independentResources === true || resources.some(({ access }) => access === "write" || access === "host");
+  let targets;
+  if (options?.independentResources) {
+    targets = routes.flat();
+    const identities = /* @__PURE__ */ new Map();
+    for (const target of targets) {
+      if (identities.has(target.url) && identities.get(target.url) !== target.nodeDid) throw new ResourceNotRoutedError(target.url);
+      identities.set(target.url, target.nodeDid);
+    }
+  } else {
+    targets = routes[0].filter((target) => routes.every((route) => route.some((other) => other.url === target.url && other.nodeDid === target.nodeDid)));
+    if (targets.length === 0 || write && routes.some((route) => route.length !== targets.length)) throw new ResourceNotRoutedError(resources.map(({ resource }) => resource).join(", "));
+  }
+  targets = targets.filter((target, index) => targets.findIndex((other) => other.url === target.url) === index);
+  if (options?.nodeDid) targets = targets.filter((target) => target.nodeDid === options.nodeDid || target.nodeDid === void 0);
+  if (targets.length === 0 || options?.nodeLocal && targets.length !== 1) throw new ResourceNotRoutedError(resources.map(({ resource }) => resource).join(", "));
+  if (!write) {
+    let response2;
+    let failure;
+    for (const target of targets) {
+      try {
+        response2 = await send(target);
+        if (response2.ok || response2.status !== 404) return response2;
+      } catch (error) {
+        if (!(error instanceof NodeNotRespondingError)) throw error;
+        failure = error;
+      }
+    }
+    if (failure) throw new NodeNotRespondingError(targets.map(({ url }) => url), failure);
+    if (response2) return response2;
+    throw new NodeNotRespondingError(targets.map(({ url }) => url), failure);
+  }
+  const succeeded = [];
+  const failed = [];
+  let response;
+  let failureResponse;
+  for (const target of targets) {
+    try {
+      const result = await send(target);
+      if (result.ok) {
+        succeeded.push(target.url);
+        response ?? (response = result);
+      } else {
+        failed.push({ url: target.url, status: result.status });
+        failureResponse ?? (failureResponse = result);
+      }
+    } catch (error) {
+      if (!routingFailure(error) && succeeded.length === 0) throw error;
+      failed.push({ url: target.url, cause: error });
+    }
+  }
+  if (failed.length > 0) {
+    if (succeeded.length > 0 || targets.length > 1) throw new PartialNodeWriteError(succeeded, failed);
+    if (failureResponse) return failureResponse;
+    if (failed[0]?.cause && !(failed[0].cause instanceof NodeNotRespondingError)) throw failed[0].cause;
+    throw new NodeNotRespondingError(targets.map(({ url }) => url), failed[0]?.cause);
+  }
+  return response;
+}
+function createResourceTransportInvocationFetch(transport, session) {
+  return async (url, init) => {
+    const parsed = new URL(url);
+    if (parsed.pathname !== "/invoke") throw new ResourceNotRoutedError(parsed.pathname);
+    const authorization = authorizationOf(init?.headers);
+    if (!authorization) throw new ResourceNotRoutedError("unsigned invocation");
+    return transport(invocationResources(authorization), async (target) => {
+      const signed = await target.bindAudience(authorization);
+      const headers = (Array.isArray(init?.headers) ? init.headers : Object.entries(init?.headers ?? {})).filter(([name]) => name.toLowerCase() !== "authorization");
+      headers.push(["Authorization", signed]);
+      return target.fetch(`${target.url}${parsed.pathname}${parsed.search}`, { ...init, headers });
+    }, { invocationSession: session });
+  };
+}
 function createResourceRoutingFetch(fetchFn, routing) {
   return async (url, init) => {
     const parsed = new URL(url);
@@ -1084,12 +1175,6 @@ function createResourceRoutingFetch(fetchFn, routing) {
     const authorization = authorizationOf(init?.headers);
     if (!authorization) throw new ResourceNotRoutedError("unsigned invocation");
     const resources = invocationResources(authorization);
-    const routes = await Promise.all(resources.map(({ resource, access }) => routing.resolveResource(resource, access)));
-    if (routes.some((route) => route.length === 0)) throw new ResourceNotRoutedError(resources[routes.findIndex((route) => route.length === 0)].resource);
-    const write = resources.some(({ access }) => access === "write" || access === "host");
-    let targets = routes[0].filter((target) => routes.every((route) => route.some((other) => other.url === target.url && other.nodeDid === target.nodeDid)));
-    if (targets.length === 0 || write && routes.some((route) => route.length !== targets.length)) throw new ResourceNotRoutedError(resources.map(({ resource }) => resource).join(", "));
-    targets = targets.filter((target, index) => targets.findIndex((other) => other.url === target.url) === index);
     const send = async (target) => {
       init?.signal?.throwIfAborted();
       if (routing.verifyDestination) await routing.verifyDestination(target);
@@ -1107,48 +1192,7 @@ function createResourceRoutingFetch(fetchFn, routing) {
         throw new NodeNotRespondingError([target.url], error);
       }
     };
-    if (!write) {
-      let response2;
-      let failure;
-      for (const target of targets) {
-        try {
-          response2 = await send(target);
-          if (response2.ok || response2.status !== 404) return response2;
-        } catch (error) {
-          if (!(error instanceof NodeNotRespondingError)) throw error;
-          failure = error;
-        }
-      }
-      if (failure) throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failure);
-      if (response2) return response2;
-      throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failure);
-    }
-    const succeeded = [];
-    const failed = [];
-    let response;
-    let failureResponse;
-    for (const target of targets) {
-      try {
-        const result = await send(target);
-        if (result.ok) {
-          succeeded.push(target.url);
-          response ?? (response = result);
-        } else {
-          failed.push({ url: target.url, status: result.status });
-          failureResponse ?? (failureResponse = result);
-        }
-      } catch (error) {
-        if (!routingFailure(error) && succeeded.length === 0) throw error;
-        failed.push({ url: target.url, cause: error });
-      }
-    }
-    if (failed.length > 0) {
-      if (succeeded.length > 0 || targets.length > 1) throw new PartialNodeWriteError(succeeded, failed);
-      if (failureResponse) return failureResponse;
-      if (failed[0]?.cause && !(failed[0].cause instanceof NodeNotRespondingError)) throw failed[0].cause;
-      throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failed[0]?.cause);
-    }
-    return response;
+    return routeResourceRequest(resources, routing, send);
   };
 }
 
@@ -9080,6 +9124,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   clearTinyCloudDebugLogs,
   createKVResponseSchema,
   createResourceRoutingFetch,
+  createResourceTransportInvocationFetch,
   createResultSchema,
   createVaultCrypto,
   decryptEnvelopeWithKey,
@@ -9122,7 +9167,9 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   requiresSecretsOptIn,
   resolveSecretListPrefix,
   resolveSecretPath,
+  routeResourceRequest,
   routingFailure,
+  routingResourceOf,
   serviceError,
   storageLimitReachedError,
   storageQuotaExceededError,