@tinycloud/share-sdk 1.1.0-beta.1 → 1.1.0

package/dist/index.js

@@ -7909,7 +7909,6 @@ async function notifyShare(input) {
     };
   }
   let attempts = 0;
-  let lastError;
   while (attempts < attemptsLimit) {
     if (input.signal?.aborted) throw new ShareNotifyError("share delivery was cancelled");
     attempts += 1;
@@ -7936,10 +7935,19 @@ async function notifyShare(input) {
           reason: "delivery-window-expired"
         };
       }
-      lastError = error;
+      if (error !== null && typeof error === "object" && "status" in error && (error.status === 401 || error.status === 403)) {
+        return {
+          protocol: "tinycloud-share",
+          version: 1,
+          shareId: input.shareId,
+          state: "partial-failure",
+          idempotencyKey,
+          attempts,
+          retryable: false
+        };
+      }
     }
   }
-  void lastError;
   return { protocol: "tinycloud-share", version: 1, shareId: input.shareId, state: "partial-failure", idempotencyKey, attempts, retryable: true };
 }
 async function defaultIdempotencyKey(shareId, recipient) {
@@ -8365,6 +8373,10 @@ function parseV3InlineEncryptedEnvelope(bytes3, expected) {
   }
   return record;
 }
+async function recipientHttpError(response, context) {
+  const body = (await response.text().catch(() => "")).trim().slice(0, 512);
+  return Object.assign(new Error(`${context} (${response.status})${body ? `: ${body}` : ""}`), { status: response.status });
+}
 var ShareRecipientClient = class {
   constructor(options) {
     this.options = options;
@@ -8438,7 +8450,7 @@ var ShareRecipientClient = class {
       body: JSON.stringify({ policyCid: envelope.policyCid, recipientDid: this.options.holderDid, requestedCapabilities: envelope.policy.capabilityCeiling }),
       ...this.options.signal === void 0 ? {} : { signal: this.options.signal }
     });
-    if (!challengeResponse.ok) throw new Error(`v3 policy challenge rejected (${challengeResponse.status})`);
+    if (!challengeResponse.ok) throw await recipientHttpError(challengeResponse, "v3 policy challenge rejected");
     const challenge = object3(await challengeResponse.json(), "v3 policy challenge");
     if (typeof challenge.challengeId !== "string" || typeof challenge.nonce !== "string" || challenge.policyCid !== envelope.policyCid || challenge.recipientDid !== this.options.holderDid || challenge.nodeAudience !== attestedEnforcer.nodeAudience || challenge.enforcerDid !== void 0 && challenge.enforcerDid !== attestedEnforcer.enforcerDid || typeof challenge.expiresAt !== "string" || !Number.isFinite(Date.parse(challenge.expiresAt)) || Date.parse(challenge.expiresAt) <= Date.now()) throw new Error("v3 policy challenge binding mismatch");
     const material = await this.options.buildPresentation({
@@ -8463,14 +8475,14 @@ var ShareRecipientClient = class {
     const requestedExpiresAt = requestedSessionExpiry(envelope.expiry);
     let delegationResponse = await mint(requestedExpiresAt === void 0 ? mintBody : { ...mintBody, requestedExpiresAt });
     if (requestedExpiresAt !== void 0 && delegationResponse.status === 422) delegationResponse = await mint(mintBody);
-    if (!delegationResponse.ok) throw new Error(`v3 policy delegation rejected (${delegationResponse.status})`);
+    if (!delegationResponse.ok) throw await recipientHttpError(delegationResponse, "v3 policy delegation rejected");
     const delegation = object3(await delegationResponse.json(), "v3 policy delegation");
     if (delegation.admitted !== true || typeof delegation.sessionCid !== "string" || typeof delegation.authorization !== "string") throw new Error("v3 policy delegation response is not admitted");
     const compact = verifyV3PolicyAuthorization({ authorization: delegation.authorization, cid: delegation.sessionCid, envelope, holderDid: this.options.holderDid });
     const fact = compact.payload.fct[0];
     this.options.onStage?.("delegation-import");
     const imported = await this.fetchFn(new URL("/delegate", this.options.nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: delegation.authorization }, ...this.options.signal === void 0 ? {} : { signal: this.options.signal } });
-    if (!imported.ok) throw new Error(`ordinary delegation import rejected (${imported.status})`);
+    if (!imported.ok) throw await recipientHttpError(imported, "ordinary delegation import rejected");
     this.signer = material.sign;
     this.v3Authorization = delegation.authorization;
     this.v3NodeAudience = fact.nodeAudience;
@@ -8505,7 +8517,7 @@ var ShareRecipientClient = class {
     try {
       this.options.onStage?.("decryption");
       const response = await this.fetchFn(new URL("/invoke", this.options.nodeOrigin), { method: "POST", redirect: "error", headers: { accept: "application/json", "content-type": "application/json", Authorization: invocation.authorization }, body: JSON.stringify(body), ...this.options.signal === void 0 ? {} : { signal: this.options.signal } });
-      if (!response.ok) throw new Error(`v3 decrypt invocation rejected (${response.status})`);
+      if (!response.ok) throw await recipientHttpError(response, "v3 decrypt invocation rejected");
       const value = object3(await response.json(), "v3 decrypt response");
       const allowed = ["type", "targetNode", "networkId", "invocationCid", "encryptedSymmetricKeyHash", "receiverPublicKeyHash", "wrappedKey", "alg", "keyVersion", "requestHash", "nodeId", "nodeSignature"];
       if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key)) || value.type !== "tinycloud.encryption.decrypt-result/v1" || value.targetNode !== body.targetNode || value.nodeId !== body.targetNode || value.networkId !== body.networkId || value.invocationCid !== invocation.cid || value.encryptedSymmetricKeyHash !== body.encryptedSymmetricKeyHash || value.receiverPublicKeyHash !== receiverPublicKeyHash || value.alg !== body.alg || value.keyVersion !== body.keyVersion || value.requestHash !== hex3(sha2566(new TextEncoder().encode(`${invocation.cid}${bodyHash}`))) || typeof value.wrappedKey !== "string" || typeof value.nodeSignature !== "string") throw new Error("v3 decrypt response binding is invalid");