@tinycloud/operations 0.7.7-beta.12 → 0.7.7-beta.14

package/dist/cli-runtime.cjs

@@ -1048,12 +1048,13 @@ function expandActionShortNames(service, actions) {
     return `${service}/${a}`;
   });
 }
-var import_ms, import_sdk_services, DEFAULT_MANIFEST_SPACE, SERVICE_SHORT_TO_LONG, SERVICE_LONG_TO_SHORT, KEY_SEGMENT, KEY_APP_ID, KEY_PATH;
+var import_ms, import_sdk_services, import_resource, DEFAULT_MANIFEST_SPACE, SERVICE_SHORT_TO_LONG, SERVICE_LONG_TO_SHORT, KEY_SEGMENT, KEY_APP_ID, KEY_PATH;
 var init_manifest = __esm({
   "../sdk-core/src/manifest.ts"() {
     "use strict";
     import_ms = __toESM(require_ms(), 1);
     import_sdk_services = require("@tinycloud/sdk-services");
+    import_resource = require("@tinycloud/sdk-services/encryption/resource");
     DEFAULT_MANIFEST_SPACE = "applications";
     SERVICE_SHORT_TO_LONG = Object.freeze({
       kv: "tinycloud.kv",
@@ -1100,10 +1101,9 @@ function isCapabilitySubset(requested, granted) {
     const grantedActions = matchingScope.flatMap(
       (entry) => expandActionShortNames(entry.service, entry.actions)
     );
+    const namedKeyRequest = req.service === "tinycloud.encryption" && req.path.startsWith("urn:tinycloud:encryption:") && req.path.includes("/");
     const covered = requestedActions.every(
-      (requestedAction) => grantedActions.some(
-        (grantedAction) => actionContains(grantedAction, requestedAction)
-      )
+      (requestedAction) => grantedActions.some((grantedAction) => namedKeyRequest ? grantedAction === requestedAction : actionContains(grantedAction, requestedAction))
     );
     if (!covered) {
       missing.push(cloneEntry(req));
@@ -1118,7 +1118,9 @@ function canonicalizeEntryScopeMatches(requested, granted) {
   if (normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !== normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)) {
     return false;
   }
-  if (!pathContains(granted.path, requested.path)) {
+  const namedKeyRequest = requested.service === "tinycloud.encryption" && requested.path.startsWith("urn:tinycloud:encryption:") && requested.path.includes("/");
+  const coveredPath = namedKeyRequest ? (0, import_resource2.encryptionResourceContains)(granted.path, requested.path) : pathContains(granted.path, requested.path);
+  if (!coveredPath) {
     return false;
   }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
@@ -1188,11 +1190,12 @@ function cloneEntry(entry) {
     ...entry.expiry !== void 0 ? { expiry: entry.expiry } : {}
   };
 }
-var EXPLICIT_ONLY_ACTIONS;
+var import_resource2, EXPLICIT_ONLY_ACTIONS;
 var init_capabilities = __esm({
   "../sdk-core/src/capabilities.ts"() {
     "use strict";
     init_manifest();
+    import_resource2 = require("@tinycloud/sdk-services/encryption/resource");
     EXPLICIT_ONLY_ACTIONS = {
       "tinycloud.kv/sync": true,
       "tinycloud.kv/retain": true