@tinycloud/sdk-services 3.12.0-beta.7 → 3.12.0-beta.8

package/dist/index.d.cts

@@ -2,8 +2,8 @@ import { g as ServiceError, f as Result, P as PermissionHint, c as IService, S a
 export { k as ErrorCode, l as ErrorCodes, E as EventHandler, F as FetchFunction, d as FetchRequestInit, e as FetchResponse, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, b as InvokeAnyFunction, a as InvokeFunction, R as RetryPolicy, i as RetryStats, p as ServiceErrorEvent, h as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, T as TelemetryConfig, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-DjAP8dve.cjs';
 import { z } from 'zod';
 export { ServiceContext, ServiceContextConfig } from './context.cjs';
-import { D as DecryptCapabilityProof, R as RoutingFailure } from './types-cWtQmCCw.cjs';
-export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, p as NodeIdentityMismatchError, q as NodeNotRespondingError, P as PartialNodeWriteError, r as ReceiverKeyPair, s as ReceiverKeySigner, t as ResourceAccess, u as ResourceDestination, v as ResourceNotRoutedError, w as ResourceRoutingConfig, x as base64Decode, y as base64Encode, z as canonicalHashHex, A as canonicalizeEncryptionJson, F as createResourceRoutingFetch, G as encryptionError, H as hexDecode, K as hexEncode, L as routingFailure, M as utf8Decode, O as utf8Encode, Q as verifyResourceDestination } from './types-cWtQmCCw.cjs';
+import { D as DecryptCapabilityProof, R as RoutingFailure } from './types-CoZ0vXo8.cjs';
+export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, p as NodeIdentityMismatchError, q as NodeNotRespondingError, P as PartialNodeWriteError, r as ReceiverKeyPair, s as ReceiverKeySigner, t as ResourceAccess, u as ResourceDestination, v as ResourceNodeInfo, w as ResourceNotRoutedError, x as ResourceRoutingConfig, y as ResourceTransport, z as ResourceTransportOptions, A as ResourceTransportTarget, F as base64Decode, G as base64Encode, H as canonicalHashHex, K as canonicalizeEncryptionJson, L as createResourceRoutingFetch, M as createResourceTransportInvocationFetch, O as encryptionError, Q as hexDecode, S as hexEncode, T as routeResourceRequest, U as routingFailure, V as routingResourceOf, W as utf8Decode, X as utf8Encode, Y as verifyResourceDestination } from './types-CoZ0vXo8.cjs';
 export { RequestEvent, RequestLog, RequestLogReader, RequestService, RequestSink } from './telemetry/requestLog.cjs';
 import { B as BaseService } from './BaseService-CdBkfPGE.cjs';
 export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-CdBkfPGE.cjs';

package/dist/index.d.ts

@@ -2,8 +2,8 @@ import { g as ServiceError, f as Result, P as PermissionHint, c as IService, S a
 export { k as ErrorCode, l as ErrorCodes, E as EventHandler, F as FetchFunction, d as FetchRequestInit, e as FetchResponse, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, b as InvokeAnyFunction, a as InvokeFunction, R as RetryPolicy, i as RetryStats, p as ServiceErrorEvent, h as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, T as TelemetryConfig, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-DjAP8dve.js';
 import { z } from 'zod';
 export { ServiceContext, ServiceContextConfig } from './context.js';
-import { D as DecryptCapabilityProof, R as RoutingFailure } from './types-XE4tyBLH.js';
-export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, p as NodeIdentityMismatchError, q as NodeNotRespondingError, P as PartialNodeWriteError, r as ReceiverKeyPair, s as ReceiverKeySigner, t as ResourceAccess, u as ResourceDestination, v as ResourceNotRoutedError, w as ResourceRoutingConfig, x as base64Decode, y as base64Encode, z as canonicalHashHex, A as canonicalizeEncryptionJson, F as createResourceRoutingFetch, G as encryptionError, H as hexDecode, K as hexEncode, L as routingFailure, M as utf8Decode, O as utf8Encode, Q as verifyResourceDestination } from './types-XE4tyBLH.js';
+import { D as DecryptCapabilityProof, R as RoutingFailure } from './types-Ceti5xVp.js';
+export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, p as NodeIdentityMismatchError, q as NodeNotRespondingError, P as PartialNodeWriteError, r as ReceiverKeyPair, s as ReceiverKeySigner, t as ResourceAccess, u as ResourceDestination, v as ResourceNodeInfo, w as ResourceNotRoutedError, x as ResourceRoutingConfig, y as ResourceTransport, z as ResourceTransportOptions, A as ResourceTransportTarget, F as base64Decode, G as base64Encode, H as canonicalHashHex, K as canonicalizeEncryptionJson, L as createResourceRoutingFetch, M as createResourceTransportInvocationFetch, O as encryptionError, Q as hexDecode, S as hexEncode, T as routeResourceRequest, U as routingFailure, V as routingResourceOf, W as utf8Decode, X as utf8Encode, Y as verifyResourceDestination } from './types-Ceti5xVp.js';
 export { RequestEvent, RequestLog, RequestLogReader, RequestService, RequestSink } from './telemetry/requestLog.js';
 import { B as BaseService } from './BaseService-BRDG69KR.js';
 export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-BRDG69KR.js';

package/dist/index.js

@@ -815,6 +815,7 @@ async function verifyResourceDestination(target, fetchFn) {
   if (infoDid !== target.nodeDid || keysDid !== target.nodeDid) {
     throw new NodeIdentityMismatchError(target.url, target.nodeDid, infoDid !== target.nodeDid ? infoDid : keysDid);
   }
+  return info;
 }
 var NodeNotRespondingError = class extends Error {
   constructor(hosts, cause) {
@@ -882,6 +883,17 @@ function authorizationOf(headers) {
   if (headers === void 0) return void 0;
   return (Array.isArray(headers) ? headers : Object.entries(headers)).find(([name]) => name.toLowerCase() === "authorization")?.[1];
 }
+function routingResourceOf(uri) {
+  if (uri.startsWith("tinycloud://")) {
+    const resource = uri.slice("tinycloud://".length).split("/", 1)[0];
+    if (resource) return resource;
+  } else if (uri.startsWith("urn:tinycloud:encryption:")) {
+    return uri;
+  } else if (uri.startsWith("tinycloud:")) {
+    return uri.split("/", 1)[0];
+  }
+  throw new ResourceNotRoutedError(uri);
+}
 function invocationResources(authorization) {
   const encoded = authorization.split(".")[1];
   if (!encoded) throw new ResourceNotRoutedError("invalid invocation");
@@ -893,8 +905,7 @@ function invocationResources(authorization) {
   for (const [uri, abilities] of Object.entries(payload.att)) {
     if (typeof abilities !== "object" || abilities === null || Array.isArray(abilities)) throw new ResourceNotRoutedError(uri);
     for (const action of Object.keys(abilities)) {
-      const resource = uri.startsWith("tinycloud:") ? uri.split("/")[0] : uri;
-      if (!resource.startsWith("tinycloud:") && !resource.startsWith("urn:tinycloud:encryption:")) throw new ResourceNotRoutedError(uri);
+      const resource = routingResourceOf(uri);
       const read2 = /^(tinycloud\.(kv\/(get|list|metadata|head|sync)|sql\/(read|export)|duckdb\/(read|describe|export)|capabilities\/read|space\/(list|info)|hooks\/list))$/.test(action);
       const access = resource.startsWith("urn:tinycloud:encryption:") ? "encryption" : action === "tinycloud.space/host" ? "host" : read2 ? "read" : "write";
       if (!resources.some((entry) => entry.resource === resource && entry.access === access)) resources.push({ resource, access });
@@ -903,6 +914,83 @@ function invocationResources(authorization) {
   if (resources.length === 0) throw new ResourceNotRoutedError("empty invocation");
   return resources;
 }
+async function routeResourceRequest(resources, routing, send, options) {
+  if (resources.length === 0) throw new ResourceNotRoutedError("empty request");
+  const routes = await Promise.all(resources.map(({ resource, access }) => routing.resolveResource(resource, access)));
+  if (routes.some((route) => route.length === 0)) throw new ResourceNotRoutedError(resources[routes.findIndex((route) => route.length === 0)].resource);
+  const write = options?.independentResources === true || resources.some(({ access }) => access === "write" || access === "host");
+  let targets;
+  if (options?.independentResources) {
+    targets = routes.flat();
+    const identities = /* @__PURE__ */ new Map();
+    for (const target of targets) {
+      if (identities.has(target.url) && identities.get(target.url) !== target.nodeDid) throw new ResourceNotRoutedError(target.url);
+      identities.set(target.url, target.nodeDid);
+    }
+  } else {
+    targets = routes[0].filter((target) => routes.every((route) => route.some((other) => other.url === target.url && other.nodeDid === target.nodeDid)));
+    if (targets.length === 0 || write && routes.some((route) => route.length !== targets.length)) throw new ResourceNotRoutedError(resources.map(({ resource }) => resource).join(", "));
+  }
+  targets = targets.filter((target, index) => targets.findIndex((other) => other.url === target.url) === index);
+  if (options?.nodeDid) targets = targets.filter((target) => target.nodeDid === options.nodeDid || target.nodeDid === void 0);
+  if (targets.length === 0 || options?.nodeLocal && targets.length !== 1) throw new ResourceNotRoutedError(resources.map(({ resource }) => resource).join(", "));
+  if (!write) {
+    let response2;
+    let failure;
+    for (const target of targets) {
+      try {
+        response2 = await send(target);
+        if (response2.ok || response2.status !== 404) return response2;
+      } catch (error) {
+        if (!(error instanceof NodeNotRespondingError)) throw error;
+        failure = error;
+      }
+    }
+    if (failure) throw new NodeNotRespondingError(targets.map(({ url }) => url), failure);
+    if (response2) return response2;
+    throw new NodeNotRespondingError(targets.map(({ url }) => url), failure);
+  }
+  const succeeded = [];
+  const failed = [];
+  let response;
+  let failureResponse;
+  for (const target of targets) {
+    try {
+      const result = await send(target);
+      if (result.ok) {
+        succeeded.push(target.url);
+        response ?? (response = result);
+      } else {
+        failed.push({ url: target.url, status: result.status });
+        failureResponse ?? (failureResponse = result);
+      }
+    } catch (error) {
+      if (!routingFailure(error) && succeeded.length === 0) throw error;
+      failed.push({ url: target.url, cause: error });
+    }
+  }
+  if (failed.length > 0) {
+    if (succeeded.length > 0 || targets.length > 1) throw new PartialNodeWriteError(succeeded, failed);
+    if (failureResponse) return failureResponse;
+    if (failed[0]?.cause && !(failed[0].cause instanceof NodeNotRespondingError)) throw failed[0].cause;
+    throw new NodeNotRespondingError(targets.map(({ url }) => url), failed[0]?.cause);
+  }
+  return response;
+}
+function createResourceTransportInvocationFetch(transport, session) {
+  return async (url, init) => {
+    const parsed = new URL(url);
+    if (parsed.pathname !== "/invoke") throw new ResourceNotRoutedError(parsed.pathname);
+    const authorization = authorizationOf(init?.headers);
+    if (!authorization) throw new ResourceNotRoutedError("unsigned invocation");
+    return transport(invocationResources(authorization), async (target) => {
+      const signed = await target.bindAudience(authorization);
+      const headers = (Array.isArray(init?.headers) ? init.headers : Object.entries(init?.headers ?? {})).filter(([name]) => name.toLowerCase() !== "authorization");
+      headers.push(["Authorization", signed]);
+      return target.fetch(`${target.url}${parsed.pathname}${parsed.search}`, { ...init, headers });
+    }, { invocationSession: session });
+  };
+}
 function createResourceRoutingFetch(fetchFn, routing) {
   return async (url, init) => {
     const parsed = new URL(url);
@@ -910,12 +998,6 @@ function createResourceRoutingFetch(fetchFn, routing) {
     const authorization = authorizationOf(init?.headers);
     if (!authorization) throw new ResourceNotRoutedError("unsigned invocation");
     const resources = invocationResources(authorization);
-    const routes = await Promise.all(resources.map(({ resource, access }) => routing.resolveResource(resource, access)));
-    if (routes.some((route) => route.length === 0)) throw new ResourceNotRoutedError(resources[routes.findIndex((route) => route.length === 0)].resource);
-    const write = resources.some(({ access }) => access === "write" || access === "host");
-    let targets = routes[0].filter((target) => routes.every((route) => route.some((other) => other.url === target.url && other.nodeDid === target.nodeDid)));
-    if (targets.length === 0 || write && routes.some((route) => route.length !== targets.length)) throw new ResourceNotRoutedError(resources.map(({ resource }) => resource).join(", "));
-    targets = targets.filter((target, index) => targets.findIndex((other) => other.url === target.url) === index);
     const send = async (target) => {
       init?.signal?.throwIfAborted();
       if (routing.verifyDestination) await routing.verifyDestination(target);
@@ -933,48 +1015,7 @@ function createResourceRoutingFetch(fetchFn, routing) {
         throw new NodeNotRespondingError([target.url], error);
       }
     };
-    if (!write) {
-      let response2;
-      let failure;
-      for (const target of targets) {
-        try {
-          response2 = await send(target);
-          if (response2.ok || response2.status !== 404) return response2;
-        } catch (error) {
-          if (!(error instanceof NodeNotRespondingError)) throw error;
-          failure = error;
-        }
-      }
-      if (failure) throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failure);
-      if (response2) return response2;
-      throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failure);
-    }
-    const succeeded = [];
-    const failed = [];
-    let response;
-    let failureResponse;
-    for (const target of targets) {
-      try {
-        const result = await send(target);
-        if (result.ok) {
-          succeeded.push(target.url);
-          response ?? (response = result);
-        } else {
-          failed.push({ url: target.url, status: result.status });
-          failureResponse ?? (failureResponse = result);
-        }
-      } catch (error) {
-        if (!routingFailure(error) && succeeded.length === 0) throw error;
-        failed.push({ url: target.url, cause: error });
-      }
-    }
-    if (failed.length > 0) {
-      if (succeeded.length > 0 || targets.length > 1) throw new PartialNodeWriteError(succeeded, failed);
-      if (failureResponse) return failureResponse;
-      if (failed[0]?.cause && !(failed[0].cause instanceof NodeNotRespondingError)) throw failed[0].cause;
-      throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failed[0]?.cause);
-    }
-    return response;
+    return routeResourceRequest(resources, routing, send);
   };
 }
 
@@ -8905,6 +8946,7 @@ export {
   clearTinyCloudDebugLogs,
   createKVResponseSchema,
   createResourceRoutingFetch,
+  createResourceTransportInvocationFetch,
   createResultSchema,
   createVaultCrypto,
   decryptEnvelopeWithKey,
@@ -8947,7 +8989,9 @@ export {
   requiresSecretsOptIn,
   resolveSecretListPrefix,
   resolveSecretPath,
+  routeResourceRequest,
   routingFailure,
+  routingResourceOf,
   serviceError,
   storageLimitReachedError,
   storageQuotaExceededError,