@tinycloud/operations 0.7.7-beta.9 → 0.7.8-beta.0

package/dist/delegation-binding.js

@@ -714,6 +714,7 @@ import { join as join2 } from "path";
 // ../sdk-core/src/manifest.ts
 var import_ms = __toESM(require_ms(), 1);
 import { resolveSecretPath, SECRET_NAME_RE, parseNetworkId } from "@tinycloud/sdk-services";
+import { parseEncryptionResource } from "@tinycloud/sdk-services/encryption/resource";
 var DEFAULT_MANIFEST_SPACE = "applications";
 var SERVICE_SHORT_TO_LONG = Object.freeze({
   kv: "tinycloud.kv",
@@ -743,6 +744,7 @@ var KEY_APP_ID = new RegExp(`^${KEY_SEGMENT}$`);
 var KEY_PATH = new RegExp(`^${KEY_SEGMENT}(?:/${KEY_SEGMENT}){2,7}$`);
 
 // ../sdk-core/src/capabilities.ts
+import { encryptionResourceContains } from "@tinycloud/sdk-services/encryption/resource";
 function normalizeSpace(space) {
   if (!space.startsWith("tinycloud:")) {
     return space;
@@ -766,10 +768,9 @@ function isCapabilitySubset(requested, granted) {
     const grantedActions = matchingScope.flatMap(
       (entry) => expandActionShortNames(entry.service, entry.actions)
     );
+    const namedKeyRequest = req.service === "tinycloud.encryption" && req.path.startsWith("urn:tinycloud:encryption:") && req.path.includes("/");
     const covered = requestedActions.every(
-      (requestedAction) => grantedActions.some(
-        (grantedAction) => actionContains(grantedAction, requestedAction)
-      )
+      (requestedAction) => grantedActions.some((grantedAction) => namedKeyRequest ? grantedAction === requestedAction : actionContains(grantedAction, requestedAction))
     );
     if (!covered) {
       missing.push(cloneEntry(req));
@@ -784,7 +785,9 @@ function canonicalizeEntryScopeMatches(requested, granted) {
   if (normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !== normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)) {
     return false;
   }
-  if (!pathContains(granted.path, requested.path)) {
+  const namedKeyRequest = requested.service === "tinycloud.encryption" && requested.path.startsWith("urn:tinycloud:encryption:") && requested.path.includes("/");
+  const coveredPath = namedKeyRequest ? encryptionResourceContains(granted.path, requested.path) : pathContains(granted.path, requested.path);
+  if (!coveredPath) {
     return false;
   }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
@@ -3553,6 +3556,7 @@ var cidSymbol = /* @__PURE__ */ Symbol.for("@ipld/js-cid/CID");
 
 // ../sdk-core/src/policy/unified.ts
 import { z } from "zod";
+import { parseEncryptionResource as parseNamedEncryptionResource } from "@tinycloud/sdk-services";
 var CompactHeaderSchema = z.object({
   alg: z.literal("EdDSA"),
   jwk: z.object({ alg: z.literal("EdDSA"), crv: z.literal("Ed25519"), kty: z.literal("OKP"), x: z.string().min(1) }).strict(),