@tinycloud/sdk-services 3.8.0-beta.9 → 3.8.0

package/dist/index.js

@@ -713,6 +713,26 @@ function parseNetworkId(networkId) {
   }
   return { networkId, ownerDid, name };
 }
+function parseEncryptionResource(resource) {
+  const networkSeparator = resource.lastIndexOf(":");
+  const nameAndPath = resource.slice(networkSeparator + 1);
+  const pathSeparator = nameAndPath.indexOf("/");
+  const name = pathSeparator === -1 ? nameAndPath : nameAndPath.slice(0, pathSeparator);
+  const networkId = pathSeparator === -1 ? resource : `${resource.slice(0, networkSeparator + 1)}${name}`;
+  const parsed = parseNetworkId(networkId);
+  if (pathSeparator === -1) return parsed;
+  const keyPath = nameAndPath.slice(pathSeparator + 1);
+  const segments = keyPath.split("/");
+  const prefix = keyPath.endsWith("/");
+  if (keyPath.length === 0 || /[\u0000-\u001f\u007f\\]/.test(keyPath) || segments.some(
+    (segment, index) => segment === "." || segment === ".." || segment.length === 0 && !(prefix && index === segments.length - 1)
+  )) {
+    throw new NetworkIdError(
+      `encryption resource has an invalid keyPath (got ${JSON.stringify(resource)})`
+    );
+  }
+  return { ...parsed, keyPath };
+}
 function buildNetworkId(ownerDid, name) {
   if (typeof ownerDid !== "string" || !ownerDid.startsWith("did:")) {
     throw new NetworkIdError("ownerDid must be a DID");
@@ -3611,12 +3631,13 @@ var SQLService = class extends BaseService {
           request.signal
         );
         if (!response.ok) {
-          return await this.handleErrorResponse(response, "query", dbName, [action]);
+          const failure = await this.handleErrorResponse(response, "query", dbName, [action]);
+          return this.redactFailure(failure, options?.redactErrors, response.status);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
-        return err(wrapError("sql", error));
+        return this.redactFailure(err(wrapError("sql", error)), options?.redactErrors);
       } finally {
         request.dispose();
       }
@@ -3651,12 +3672,13 @@ var SQLService = class extends BaseService {
           request.signal
         );
         if (!response.ok) {
-          return await this.handleErrorResponse(response, "execute", dbName, requestedActions);
+          const failure = await this.handleErrorResponse(response, "execute", dbName, requestedActions);
+          return this.redactFailure(failure, options?.redactErrors, response.status);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
-        return err(wrapError("sql", error));
+        return this.redactFailure(err(wrapError("sql", error)), options?.redactErrors);
       } finally {
         request.dispose();
       }
@@ -3677,12 +3699,13 @@ var SQLService = class extends BaseService {
           request.signal
         );
         if (!response.ok) {
-          return await this.handleErrorResponse(response, "batch", dbName, requestedActions);
+          const failure = await this.handleErrorResponse(response, "batch", dbName, requestedActions);
+          return this.redactFailure(failure, options?.redactErrors, response.status);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
-        return err(wrapError("sql", error));
+        return this.redactFailure(err(wrapError("sql", error)), options?.redactErrors);
       } finally {
         request.dispose();
       }
@@ -3878,6 +3901,18 @@ var SQLService = class extends BaseService {
       }))
     );
   }
+  redactFailure(result, redactErrors, status) {
+    if (!redactErrors || result.ok) return result;
+    const candidate = result.error.code;
+    const code = typeof candidate === "string" && Object.prototype.hasOwnProperty.call(ErrorCodes, candidate) ? candidate : ErrorCodes.SQL_ERROR;
+    const safeStatus = typeof status === "number" && Number.isInteger(status) && status >= 400 && status <= 599 ? status : void 0;
+    return err(serviceError(
+      code,
+      "SQL operation failed",
+      "sql",
+      safeStatus === void 0 ? void 0 : { meta: { status: safeStatus } }
+    ));
+  }
   async handleErrorResponse(response, operation, dbName, requestedActions) {
     const errorText = await response.text();
     const meta = responseErrorMeta(response.status, response.statusText, errorText);
@@ -4475,6 +4510,7 @@ var HooksService = class extends BaseService {
     this._supervising = false;
     /** Bumped on every session change; part of the plan key. */
     this._sessionGeneration = 0;
+    this._streamGeneration = 0;
     this._config = config;
   }
   get config() {
@@ -4495,6 +4531,7 @@ var HooksService = class extends BaseService {
       requested,
       signatures: requested.map(subscriptionSignature),
       ttlSeconds: options.ttlSeconds,
+      onReady: options.onReady,
       queue: new AsyncQueue()
     };
     const leave = () => {
@@ -4509,6 +4546,7 @@ var HooksService = class extends BaseService {
     signal?.addEventListener("abort", leave, { once: true });
     this._subscribers.add(subscriber);
     this.wake();
+    if (this._readyStream) this.notifyReady(subscriber, this._readyStream);
     try {
       for await (const event of subscriber.queue) {
         yield event;
@@ -4741,6 +4779,7 @@ var HooksService = class extends BaseService {
   async attempt(plan, signal, health) {
     let phase = "mint";
     let request;
+    const generation = ++this._streamGeneration;
     const owns = () => !signal.aborted && !request?.signal.aborted && this.plan()?.key === plan.key;
     try {
       const context = this.context;
@@ -4805,6 +4844,14 @@ var HooksService = class extends BaseService {
           if (next.done) break;
           const message = next.value;
           if (!message.data) continue;
+          if (message.event === "ready") {
+            const marker = JSON.parse(message.data);
+            if (marker !== null && typeof marker === "object" && "type" in marker && marker.type === "ready") {
+              this._readyStream = { key: plan.key, generation };
+              for (const subscriber of this._subscribers) this.notifyReady(subscriber, this._readyStream);
+            }
+            continue;
+          }
           const event = parseHookEvent(message);
           if (!owns()) return { kind: "stopped" };
           this.dispatch(event);
@@ -4817,6 +4864,8 @@ var HooksService = class extends BaseService {
       return owns() ? { kind: "ended" } : { kind: "stopped" };
     } catch (thrown) {
       return request?.signal.aborted || thrown === SUPERSEDED ? { kind: "stopped" } : { kind: "failed", error: hookStreamFailure(phase, thrown) };
+    } finally {
+      if (this._readyStream?.generation === generation) this._readyStream = void 0;
     }
   }
   /**
@@ -4872,6 +4921,15 @@ var HooksService = class extends BaseService {
       ttlSeconds
     };
   }
+  notifyReady(subscriber, ready) {
+    if (!this._subscribers.has(subscriber) || subscriber.readyGeneration === ready.generation || this.plan()?.key !== ready.key || this._phase?.interrupt.signal.aborted) return;
+    subscriber.readyGeneration = ready.generation;
+    try {
+      subscriber.onReady?.();
+    } catch {
+      this.report(serviceError(ErrorCodes.INVALID_INPUT, "Hook readiness callback failed", "hooks"));
+    }
+  }
   dispatch(event) {
     for (const subscriber of this._subscribers) {
       if (matchesAnySubscription(event, subscriber.requested)) {
@@ -5106,7 +5164,7 @@ function abortPromise(signal) {
 function normalizeSubscription(subscription) {
   return {
     ...subscription,
-    pathPrefix: normalizePathPrefix(subscription.pathPrefix),
+    pathPrefix: subscription.service === "kv" ? normalizePathPrefix(subscription.pathPrefix) : subscription.pathPrefix?.replace(/^\/+/, "") || void 0,
     abilities: subscription.abilities ? [...subscription.abilities] : []
   };
 }
@@ -5130,7 +5188,11 @@ function matchesSubscription(event, subscription) {
   if (event.service !== subscription.service) {
     return false;
   }
-  if (subscription.pathPrefix) {
+  if (event.service === "sql" || event.service === "duckdb") {
+    const scope = subscription.pathPrefix;
+    const database = event.databasePath ?? event.path;
+    if (scope && scope !== "/" && (!database || (scope.endsWith("/") ? !database.startsWith(scope) : database !== scope))) return false;
+  } else if (subscription.pathPrefix) {
     const prefix = subscription.pathPrefix.endsWith("/") ? subscription.pathPrefix : `${subscription.pathPrefix}/`;
     if (event.path && event.path !== subscription.pathPrefix && !event.path.startsWith(prefix)) {
       return false;
@@ -5290,6 +5352,7 @@ function parseHookEvent(message) {
     service: parsed.service ?? "",
     ability: parsed.ability ?? "",
     path: parsed.path,
+    databasePath: typeof parsed.databasePath === "string" ? parsed.databasePath : void 0,
     actor: parsed.actor ?? "",
     epoch: parsed.epoch ?? "",
     eventIndex: parsed.eventIndex ?? 0,
@@ -7810,7 +7873,12 @@ function ensureNetworkUsableForDecrypt(descriptor) {
 
 // src/encryption/envelope.ts
 function encryptToNetwork(crypto2, input) {
-  parseNetworkId(input.networkId);
+  const parsedResource = parseEncryptionResource(
+    input.keyPath === void 0 ? input.networkId : `${input.networkId}/${input.keyPath}`
+  );
+  if (parsedResource.keyPath !== input.keyPath || input.keyPath?.endsWith("/")) {
+    throw new NetworkIdError("keyPath must name an exact encryption key");
+  }
   const alg = input.alg ?? DEFAULT_ENCRYPTION_ALG;
   const keyVersion = input.keyVersion ?? DEFAULT_KEY_VERSION;
   const symmetricKey = crypto2.randomBytes(32);
@@ -7824,6 +7892,7 @@ function encryptToNetwork(crypto2, input) {
   const envelope = {
     v: ENVELOPE_VERSION,
     networkId: input.networkId,
+    ...input.keyPath !== void 0 ? { keyPath: input.keyPath } : {},
     alg,
     keyVersion,
     encryptedSymmetricKey,
@@ -7855,13 +7924,24 @@ function validateEnvelope(crypto2, envelope) {
     };
   }
   try {
-    parseNetworkId(e.networkId);
+    if (parseEncryptionResource(e.networkId).keyPath !== void 0) {
+      throw new Error("networkId must identify the network root");
+    }
+    if (e.keyPath !== void 0) {
+      if (typeof e.keyPath !== "string") {
+        throw new Error("keyPath must be a string");
+      }
+      const parsed = parseEncryptionResource(`${e.networkId}/${e.keyPath}`);
+      if (parsed.keyPath !== e.keyPath || e.keyPath.endsWith("/")) {
+        throw new Error("keyPath must name an exact encryption key");
+      }
+    }
   } catch (err3) {
     return {
       ok: false,
       error: encryptionError({
         code: "INVALID_ENVELOPE",
-        message: `envelope.networkId is malformed: ${err3 instanceof Error ? err3.message : String(err3)}`
+        message: `envelope encryption resource is malformed: ${err3 instanceof Error ? err3.message : String(err3)}`
       })
     };
   }
@@ -7934,6 +8014,7 @@ function buildDecryptFacts(input) {
     type: DECRYPT_FACT_TYPE,
     targetNode: input.body.targetNode,
     networkId: input.body.networkId,
+    ...input.body.keyPath !== void 0 ? { keyPath: input.body.keyPath } : {},
     bodyHash,
     encryptedSymmetricKeyHash: input.encryptedSymmetricKeyHash,
     receiverPublicKeyHash,
@@ -7941,10 +8022,14 @@ function buildDecryptFacts(input) {
     keyVersion: input.body.keyVersion
   };
 }
-function buildDecryptAttenuation(networkId) {
-  parseNetworkId(networkId);
+function buildDecryptAttenuation(networkId, keyPath) {
+  const resource = keyPath === void 0 ? networkId : `${networkId}/${keyPath}`;
+  const parsed = parseEncryptionResource(resource);
+  if (parsed.networkId !== networkId || parsed.keyPath !== keyPath || keyPath?.endsWith("/")) {
+    throw new NetworkIdError("keyPath must name an exact encryption key");
+  }
   return {
-    [networkId]: {
+    [resource]: {
       [DECRYPT_ACTION]: {}
     }
   };
@@ -8004,6 +8089,15 @@ function checkDecryptInvocationInput(crypto2, input) {
       })
     };
   }
+  if (input.facts.keyPath !== input.body.keyPath) {
+    return {
+      ok: false,
+      error: encryptionError({
+        code: "INVALID_INPUT",
+        message: "facts.keyPath must equal body.keyPath"
+      })
+    };
+  }
   if (input.facts.alg !== input.body.alg) {
     return {
       ok: false,
@@ -8041,7 +8135,9 @@ function checkDecryptInvocationInput(crypto2, input) {
     };
   }
   try {
-    parseNetworkId(input.networkId);
+    if (parseEncryptionResource(input.networkId).keyPath !== void 0) {
+      throw new NetworkIdError("networkId must identify the network root");
+    }
   } catch (err3) {
     return {
       ok: false,
@@ -8051,6 +8147,22 @@ function checkDecryptInvocationInput(crypto2, input) {
       })
     };
   }
+  try {
+    const resource = parseEncryptionResource(
+      input.body.keyPath === void 0 ? input.body.networkId : `${input.body.networkId}/${input.body.keyPath}`
+    );
+    if (resource.keyPath !== input.body.keyPath || input.body.keyPath?.endsWith("/")) {
+      throw new NetworkIdError("keyPath must name an exact encryption key");
+    }
+  } catch (err3) {
+    return {
+      ok: false,
+      error: encryptionError({
+        code: "INVALID_INPUT",
+        message: err3 instanceof Error ? err3.message : String(err3)
+      })
+    };
+  }
   const canonicalBody = canonicalize(
     input.body
   );
@@ -8291,6 +8403,7 @@ var EncryptionService = class extends BaseService {
         // that spelling in the envelope so a later response can be compared
         // byte-for-byte (notably for checksummed did:pkh principals).
         networkId: descriptor.networkId,
+        ...options?.keyPath !== void 0 ? { keyPath: options.keyPath } : {},
         networkPublicKey,
         plaintext,
         ...options?.aad !== void 0 ? { aad: options.aad } : {},
@@ -8350,6 +8463,7 @@ var EncryptionService = class extends BaseService {
         type: DECRYPT_FACT_TYPE,
         targetNode,
         networkId: envelope.networkId,
+        ...envelope.keyPath !== void 0 ? { keyPath: envelope.keyPath } : {},
         alg: envelope.alg,
         keyVersion: envelope.keyVersion,
         encryptedSymmetricKey: envelope.encryptedSymmetricKey,
@@ -8565,6 +8679,7 @@ export {
   openWrappedKey,
   parseAuthError,
   parseCapabilityResource,
+  parseEncryptionResource,
   parseNetworkId,
   parsePermissionHint,
   parsePermissionHintFromErrorText,