@tinycloud/operations 0.7.7-beta.2 → 0.7.7-beta.20

package/coverage.json

@@ -3,6 +3,7 @@
   "source": "packages/cli/src/command-registry.ts",
   "commands": [
     { "command": "init", "status": "legacy" },
+    { "command": "onboard", "status": "excluded", "reason": "Local composition of the existing OpenKey scoped login and grant flows (key-only profile, then one approval per space); adds no storage operation." },
     { "command": "context", "status": "excluded", "reason": "Read-only local CLI context diagnostics; performs no storage operation." },
     { "command": "enable", "status": "legacy" },
     { "command": "enable share", "status": "legacy" },
@@ -107,6 +108,7 @@
       "operationId": "tinycloud.secrets.get",
       "operationVersion": 1
     },
+    { "command": "secrets run [names]", "status": "legacy" },
     { "command": "secrets put <name> [value]", "status": "legacy" },
     { "command": "secrets delete <name>", "status": "legacy" },
     { "command": "secrets network grant <recipientDid> [name]", "status": "legacy" },
@@ -130,6 +132,17 @@
     { "command": "sql execute <sql>", "status": "legacy" },
     { "command": "sql export", "status": "legacy" },
     { "command": "sql copy", "status": "legacy" },
+    { "command": "feed", "status": "legacy" },
+    { "command": "feed connect", "status": "legacy" },
+    { "command": "feed publish", "status": "legacy" },
+    { "command": "feed respond", "status": "legacy" },
+    { "command": "feed message", "status": "legacy" },
+    { "command": "feed handling", "status": "legacy" },
+    { "command": "feed list", "status": "legacy" },
+    { "command": "feed show <reference>", "status": "legacy" },
+    { "command": "feed responses", "status": "legacy" },
+    { "command": "feed payload", "status": "legacy" },
+    { "command": "feed watch", "status": "legacy" },
     { "command": "duckdb", "status": "legacy" },
     { "command": "duckdb query <sql>", "status": "legacy" },
     { "command": "duckdb execute <sql>", "status": "legacy" },

package/dist/artifacts.cjs

@@ -173,6 +173,7 @@ var import_zod = require("zod");
 // ../sdk-core/src/manifest.ts
 var import_ms = __toESM(require_ms(), 1);
 var import_sdk_services = require("@tinycloud/sdk-services");
+var import_resource = require("@tinycloud/sdk-services/encryption/resource");
 var DEFAULT_MANIFEST_SPACE = "applications";
 var SERVICE_SHORT_TO_LONG = Object.freeze({
   kv: "tinycloud.kv",
@@ -197,8 +198,12 @@ function expandActionShortNames(service, actions) {
     return `${service}/${a}`;
   });
 }
+var KEY_SEGMENT = "[a-z0-9][a-z0-9._-]{0,63}";
+var KEY_APP_ID = new RegExp(`^${KEY_SEGMENT}$`);
+var KEY_PATH = new RegExp(`^${KEY_SEGMENT}(?:/${KEY_SEGMENT}){2,7}$`);
 
 // ../sdk-core/src/capabilities.ts
+var import_resource2 = require("@tinycloud/sdk-services/encryption/resource");
 function normalizeSpace(space) {
   if (!space.startsWith("tinycloud:")) {
     return space;
@@ -222,10 +227,9 @@ function isCapabilitySubset(requested, granted) {
     const grantedActions = matchingScope.flatMap(
       (entry) => expandActionShortNames(entry.service, entry.actions)
     );
+    const namedKeyRequest = req.service === "tinycloud.encryption" && req.path.startsWith("urn:tinycloud:encryption:") && req.path.includes("/");
     const covered = requestedActions.every(
-      (requestedAction) => grantedActions.some(
-        (grantedAction) => actionContains(grantedAction, requestedAction)
-      )
+      (requestedAction) => grantedActions.some((grantedAction) => namedKeyRequest ? grantedAction === requestedAction : actionContains(grantedAction, requestedAction))
     );
     if (!covered) {
       missing.push(cloneEntry(req));
@@ -240,7 +244,9 @@ function canonicalizeEntryScopeMatches(requested, granted) {
   if (normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !== normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)) {
     return false;
   }
-  if (!pathContains(granted.path, requested.path)) {
+  const namedKeyRequest = requested.service === "tinycloud.encryption" && requested.path.startsWith("urn:tinycloud:encryption:") && requested.path.includes("/");
+  const coveredPath = namedKeyRequest ? (0, import_resource2.encryptionResourceContains)(granted.path, requested.path) : pathContains(granted.path, requested.path);
+  if (!coveredPath) {
     return false;
   }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {