@tinycloud/sdk-core 3.1.0-beta.7 → 3.1.0-beta.9

package/dist/index.cjs

@@ -359,6 +359,7 @@ __export(index_exports, {
   isCapabilitySubset: () => isCapabilitySubset,
   isDigest: () => isDigest,
   isEvmAddress: () => isEvmAddress,
+  isExplicitOnlyAction: () => isExplicitOnlyAction,
   isNetworkId: () => import_sdk_services9.isNetworkId,
   isPlausibleOpenKeyActionId: () => isPlausibleOpenKeyActionId,
   isStorageFullError: () => import_sdk_services9.isStorageFullError,
@@ -8661,8 +8662,17 @@ function canonicalizeRecapCaveats(caveats) {
   }
   return `[${branches.join(",")}]`;
 }
+var EXPLICIT_ONLY_ACTIONS = {
+  "tinycloud.kv/sync": true,
+  "tinycloud.kv/retain": true
+};
+function isExplicitOnlyAction(action) {
+  return Object.prototype.hasOwnProperty.call(EXPLICIT_ONLY_ACTIONS, action);
+}
 function actionContains(grantedAction, requestedAction) {
-  if (grantedAction === "*" || grantedAction === requestedAction) return true;
+  if (grantedAction === requestedAction) return true;
+  if (isExplicitOnlyAction(requestedAction)) return false;
+  if (grantedAction === "*") return true;
   if (!grantedAction.endsWith("/*")) return false;
   const service = grantedAction.slice(0, -2);
   return requestedAction === service || requestedAction.startsWith(`${service}/`);
@@ -11345,7 +11355,9 @@ var SharingService = class {
         if (delegation.allowSubDelegation === false) continue;
         if (!this.pathMatches(delegation.path || "", path)) continue;
         const delegationActions = delegation.actions || [];
-        if (!actions.every((action) => delegationActions.includes(action) || delegationActions.includes("*"))) {
+        if (!actions.every(
+          (action) => delegationActions.some((granted) => actionContains(granted, action))
+        )) {
           continue;
         }
         if ((delegation.caveats?.length ?? 0) > 0) {