@tinycloud/operations 0.7.7-beta.13 → 0.7.7-beta.15

package/dist/index.cjs

@@ -1048,12 +1048,13 @@ function expandActionShortNames(service, actions) {
     return `${service}/${a}`;
   });
 }
-var import_ms, import_sdk_services, DEFAULT_MANIFEST_SPACE, SERVICE_SHORT_TO_LONG, SERVICE_LONG_TO_SHORT, KEY_SEGMENT, KEY_APP_ID, KEY_PATH;
+var import_ms, import_sdk_services, import_resource, DEFAULT_MANIFEST_SPACE, SERVICE_SHORT_TO_LONG, SERVICE_LONG_TO_SHORT, KEY_SEGMENT, KEY_APP_ID, KEY_PATH;
 var init_manifest = __esm({
   "../sdk-core/src/manifest.ts"() {
     "use strict";
     import_ms = __toESM(require_ms(), 1);
     import_sdk_services = require("@tinycloud/sdk-services");
+    import_resource = require("@tinycloud/sdk-services/encryption/resource");
     DEFAULT_MANIFEST_SPACE = "applications";
     SERVICE_SHORT_TO_LONG = Object.freeze({
       kv: "tinycloud.kv",
@@ -1100,10 +1101,9 @@ function isCapabilitySubset(requested, granted) {
     const grantedActions = matchingScope.flatMap(
       (entry) => expandActionShortNames(entry.service, entry.actions)
     );
+    const namedKeyRequest = req.service === "tinycloud.encryption" && req.path.startsWith("urn:tinycloud:encryption:") && req.path.includes("/");
     const covered = requestedActions.every(
-      (requestedAction) => grantedActions.some(
-        (grantedAction) => actionContains(grantedAction, requestedAction)
-      )
+      (requestedAction) => grantedActions.some((grantedAction) => namedKeyRequest ? grantedAction === requestedAction : actionContains(grantedAction, requestedAction))
     );
     if (!covered) {
       missing.push(cloneEntry(req));
@@ -1118,7 +1118,9 @@ function canonicalizeEntryScopeMatches(requested, granted) {
   if (normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !== normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)) {
     return false;
   }
-  if (!pathContains(granted.path, requested.path)) {
+  const namedKeyRequest = requested.service === "tinycloud.encryption" && requested.path.startsWith("urn:tinycloud:encryption:") && requested.path.includes("/");
+  const coveredPath = namedKeyRequest ? (0, import_resource2.encryptionResourceContains)(granted.path, requested.path) : pathContains(granted.path, requested.path);
+  if (!coveredPath) {
     return false;
   }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
@@ -1188,11 +1190,12 @@ function cloneEntry(entry) {
     ...entry.expiry !== void 0 ? { expiry: entry.expiry } : {}
   };
 }
-var EXPLICIT_ONLY_ACTIONS;
+var import_resource2, EXPLICIT_ONLY_ACTIONS;
 var init_capabilities = __esm({
   "../sdk-core/src/capabilities.ts"() {
     "use strict";
     init_manifest();
+    import_resource2 = require("@tinycloud/sdk-services/encryption/resource");
     EXPLICIT_ONLY_ACTIONS = {
       "tinycloud.kv/sync": true,
       "tinycloud.kv/retain": true
@@ -4071,7 +4074,7 @@ function decodeBase64Url(value) {
 function equalBytes2(left, right) {
   return left.length === right.length && left.every((byte, index) => byte === right[index]);
 }
-var import_zod, CompactHeaderSchema, CompactPayloadSchema, MAX_POLICY_ROOT_SECONDS, SignedCompactAttenuationSchema;
+var import_zod, import_sdk_services2, CompactHeaderSchema, CompactPayloadSchema, MAX_POLICY_ROOT_SECONDS, SignedCompactAttenuationSchema;
 var init_unified = __esm({
   "../sdk-core/src/policy/unified.ts"() {
     "use strict";
@@ -4081,6 +4084,7 @@ var init_unified = __esm({
     init_base58();
     init_digest();
     import_zod = require("zod");
+    import_sdk_services2 = require("@tinycloud/sdk-services");
     CompactHeaderSchema = import_zod.z.object({
       alg: import_zod.z.literal("EdDSA"),
       jwk: import_zod.z.object({ alg: import_zod.z.literal("EdDSA"), crv: import_zod.z.literal("Ed25519"), kty: import_zod.z.literal("OKP"), x: import_zod.z.string().min(1) }).strict(),
@@ -5880,7 +5884,7 @@ var init_rules_generated = __esm({
 
 // src/revoked-grant.ts
 function isRevokedGrantRefusal(error) {
-  if ((0, import_sdk_services2.authorizationVerdictOf)(error) !== "unauthenticated") return false;
+  if ((0, import_sdk_services3.authorizationVerdictOf)(error) !== "unauthenticated") return false;
   const seen = /* @__PURE__ */ new Set();
   let node = error;
   for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
@@ -5892,11 +5896,11 @@ function isRevokedGrantRefusal(error) {
   }
   return false;
 }
-var import_sdk_services2, MAX_CAUSE_DEPTH, REVOKED_GRANT_BODY, REVOKED_GRANT_CODES, REVOKED_GRANT_MESSAGE;
+var import_sdk_services3, MAX_CAUSE_DEPTH, REVOKED_GRANT_BODY, REVOKED_GRANT_CODES, REVOKED_GRANT_MESSAGE;
 var init_revoked_grant = __esm({
   "src/revoked-grant.ts"() {
     "use strict";
-    import_sdk_services2 = require("@tinycloud/sdk-services");
+    import_sdk_services3 = require("@tinycloud/sdk-services");
     init_cli_name();
     MAX_CAUSE_DEPTH = 8;
     REVOKED_GRANT_BODY = /\b401 - (?:Invalid invocation: )?delegation-(?:revoked: [A-Za-z0-9]+|ancestor-revoked: ancestor=[A-Za-z0-9]+ invoked=[A-Za-z0-9]+)\s*$/;
@@ -5907,7 +5911,7 @@ var init_revoked_grant = __esm({
 
 // src/kv-failure.ts
 function nodeRevocationOf(error) {
-  if (typeof error !== "object" || error === null || !("service" in error) || error.service !== "kv" || !("code" in error) || error.code !== "AUTH_UNAUTHORIZED" && error.code !== "AUTH_DELEGATION_REVOKED" && error.code !== "AUTH_DELEGATION_ANCESTOR_REVOKED" || !("message" in error) || typeof error.message !== "string" || !("meta" in error) || typeof error.meta !== "object" || error.meta === null || !("status" in error.meta) || error.meta.status !== 401 || (0, import_sdk_services3.authorizationVerdictOf)(error) !== "unauthenticated") return void 0;
+  if (typeof error !== "object" || error === null || !("service" in error) || error.service !== "kv" || !("code" in error) || error.code !== "AUTH_UNAUTHORIZED" && error.code !== "AUTH_DELEGATION_REVOKED" && error.code !== "AUTH_DELEGATION_ANCESTOR_REVOKED" || !("message" in error) || typeof error.message !== "string" || !("meta" in error) || typeof error.meta !== "object" || error.meta === null || !("status" in error.meta) || error.meta.status !== 401 || (0, import_sdk_services4.authorizationVerdictOf)(error) !== "unauthenticated") return void 0;
   const { code, message } = error;
   const separator = ": 401 - ";
   const start = message.indexOf(separator);
@@ -5927,9 +5931,9 @@ function nodeRevocationOf(error) {
   return void 0;
 }
 function kvRefusal(error) {
-  const verdict = (0, import_sdk_services3.authorizationVerdictOf)(error);
+  const verdict = (0, import_sdk_services4.authorizationVerdictOf)(error);
   if (verdict === "unauthenticated") {
-    return (0, import_sdk_services3.validatedCapabilityOf)(error) === void 0 ? "auth_required" : "permission_denied";
+    return (0, import_sdk_services4.validatedCapabilityOf)(error) === void 0 ? "auth_required" : "permission_denied";
   }
   return verdict === "forbidden" ? "permission_denied" : void 0;
 }
@@ -5950,11 +5954,11 @@ function authorizationFailure(error, action) {
       return void 0;
   }
 }
-var import_sdk_services3, DELEGATION_CID2, NODE_REVOCATION_BODY;
+var import_sdk_services4, DELEGATION_CID2, NODE_REVOCATION_BODY;
 var init_kv_failure = __esm({
   "src/kv-failure.ts"() {
     "use strict";
-    import_sdk_services3 = require("@tinycloud/sdk-services");
+    import_sdk_services4 = require("@tinycloud/sdk-services");
     init_contract();
     init_errors2();
     init_revoked_grant();