@tinycloud/sdk-core 3.8.0-beta.20 → 3.8.0-beta.21

package/dist/index.cjs

@@ -364,6 +364,7 @@ __export(index_exports, {
   expandDelegationPermissionEntries: () => expandDelegationPermissionEntries,
   expandPermissionEntries: () => expandPermissionEntries,
   expandPermissionEntry: () => expandPermissionEntry,
+  expandRuntimePermissionEntries: () => expandRuntimePermissionEntries,
   extractImmutableSiweFields: () => extractImmutableSiweFields,
   extractRecapAttenuations: () => extractRecapAttenuations,
   fetchLocationRecord: () => fetchLocationRecord,
@@ -7950,6 +7951,32 @@ function expandEncryptionPermissionEntry(entry) {
 function expandPermissionEntries(entries) {
   return entries.flatMap(expandPermissionEntry);
 }
+function expandRuntimePermissionEntries(entries, ownerDid) {
+  return entries.flatMap((entry) => {
+    if (entry.service !== ENCRYPTION_PERMISSION_SERVICE || typeof entry.path !== "string" || !entry.path.includes("/") || entry.path.endsWith("/share/")) {
+      return expandPermissionEntry(entry);
+    }
+    let resource;
+    let ownerNetwork;
+    try {
+      resource = (0, import_resource.parseEncryptionResource)(entry.path);
+      if (typeof ownerDid !== "string" || ownerDid.length === 0) throw new Error("missing owner");
+      ownerNetwork = (0, import_resource.parseEncryptionResource)(`urn:tinycloud:encryption:${ownerDid}:default`);
+    } catch {
+      throw new ManifestValidationError("runtime Share key creation requires a canonical current-owner key resource");
+    }
+    if (resource.kind !== "key" || resource.networkId !== ownerNetwork.networkId || !/^share\/[^/]+$/.test(resource.path) || entry.space !== void 0 && entry.space !== ENCRYPTION_MANIFEST_SPACE || !Array.isArray(entry.actions) || entry.actions.length === 0 || entry.actions.some((action) => action !== "key.create" && action !== "tinycloud.encryption/key.create")) {
+      throw new ManifestValidationError("runtime Share key creation requires the current owner's exact default/share/<id> key and key.create only");
+    }
+    return [{
+      ...entry,
+      space: ENCRYPTION_MANIFEST_SPACE,
+      path: `${resource.networkId}/${resource.path}`,
+      actions: ["tinycloud.encryption/key.create"],
+      skipPrefix: true
+    }];
+  });
+}
 function expandDelegationPermissionEntries(entries) {
   return entries.flatMap((entry) => {
     if (entry.service !== ENCRYPTION_PERMISSION_SERVICE || typeof entry.path !== "string" || !entry.path.includes("/")) {