@tinycloud/operations 0.7.7-beta.13 → 0.7.7-beta.15

package/coverage.json

@@ -3,6 +3,7 @@
   "source": "packages/cli/src/command-registry.ts",
   "commands": [
     { "command": "init", "status": "legacy" },
+    { "command": "onboard", "status": "excluded", "reason": "Local composition of the existing OpenKey scoped login and grant flows (key-only profile, then one approval per space); adds no storage operation." },
     { "command": "context", "status": "excluded", "reason": "Read-only local CLI context diagnostics; performs no storage operation." },
     { "command": "enable", "status": "legacy" },
     { "command": "enable share", "status": "legacy" },

package/dist/artifacts.cjs

@@ -173,6 +173,7 @@ var import_zod = require("zod");
 // ../sdk-core/src/manifest.ts
 var import_ms = __toESM(require_ms(), 1);
 var import_sdk_services = require("@tinycloud/sdk-services");
+var import_resource = require("@tinycloud/sdk-services/encryption/resource");
 var DEFAULT_MANIFEST_SPACE = "applications";
 var SERVICE_SHORT_TO_LONG = Object.freeze({
   kv: "tinycloud.kv",
@@ -202,6 +203,7 @@ var KEY_APP_ID = new RegExp(`^${KEY_SEGMENT}$`);
 var KEY_PATH = new RegExp(`^${KEY_SEGMENT}(?:/${KEY_SEGMENT}){2,7}$`);
 
 // ../sdk-core/src/capabilities.ts
+var import_resource2 = require("@tinycloud/sdk-services/encryption/resource");
 function normalizeSpace(space) {
   if (!space.startsWith("tinycloud:")) {
     return space;
@@ -225,10 +227,9 @@ function isCapabilitySubset(requested, granted) {
     const grantedActions = matchingScope.flatMap(
       (entry) => expandActionShortNames(entry.service, entry.actions)
     );
+    const namedKeyRequest = req.service === "tinycloud.encryption" && req.path.startsWith("urn:tinycloud:encryption:") && req.path.includes("/");
     const covered = requestedActions.every(
-      (requestedAction) => grantedActions.some(
-        (grantedAction) => actionContains(grantedAction, requestedAction)
-      )
+      (requestedAction) => grantedActions.some((grantedAction) => namedKeyRequest ? grantedAction === requestedAction : actionContains(grantedAction, requestedAction))
     );
     if (!covered) {
       missing.push(cloneEntry(req));
@@ -243,7 +244,9 @@ function canonicalizeEntryScopeMatches(requested, granted) {
   if (normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !== normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)) {
     return false;
   }
-  if (!pathContains(granted.path, requested.path)) {
+  const namedKeyRequest = requested.service === "tinycloud.encryption" && requested.path.startsWith("urn:tinycloud:encryption:") && requested.path.includes("/");
+  const coveredPath = namedKeyRequest ? (0, import_resource2.encryptionResourceContains)(granted.path, requested.path) : pathContains(granted.path, requested.path);
+  if (!coveredPath) {
     return false;
   }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {