@tinycloud/sdk-core 3.9.0-beta.8 → 3.9.1-beta.0

package/dist/index.cjs

@@ -7925,6 +7925,10 @@ function expandEncryptionPermissionEntry(entry) {
       normalizedActions.push("tinycloud.encryption/network.revoke");
       continue;
     }
+    if (sharePrefix && (action === "key.create" || action === "tinycloud.encryption/key.create")) {
+      normalizedActions.push("tinycloud.encryption/key.create");
+      continue;
+    }
     if (action.includes("/")) {
       throw new ManifestValidationError(
         `unknown encryption action ${JSON.stringify(action)}; expected decrypt, network.create, or network.revoke`
@@ -7942,8 +7946,20 @@ function expandEncryptionPermissionEntry(entry) {
       seen.add(a);
     }
   }
-  if (sharePrefix && dedupedActions.some((action) => action !== "tinycloud.encryption/decrypt")) {
-    throw new ManifestValidationError("share prefix only supports decrypt");
+  if (sharePrefix && dedupedActions.some((action) => action !== "tinycloud.encryption/decrypt" && action !== "tinycloud.encryption/key.create")) {
+    throw new ManifestValidationError("share prefix only supports decrypt and key.create");
+  }
+  if (dedupedActions.includes("tinycloud.encryption/key.create")) {
+    let canonical = false;
+    try {
+      const parsed = (0, import_resource.parseEncryptionResource)(entry.path);
+      canonical = parsed.kind === "prefix" && parsed.network === "default" && parsed.prefix === "share";
+    } catch {
+      canonical = false;
+    }
+    if (!canonical) {
+      throw new ManifestValidationError("share prefix key.create requires the canonical owner address (EIP-55 checksummed) on the default network");
+    }
   }
   return [
     {
@@ -7962,6 +7978,9 @@ function expandPermissionEntries(entries) {
 }
 function expandRuntimePermissionEntries(entries, ownerDid) {
   return entries.flatMap((entry) => {
+    if (entry.service === ENCRYPTION_PERMISSION_SERVICE && typeof entry.path === "string" && entry.path.endsWith("/share/") && Array.isArray(entry.actions) && entry.actions.some((action) => action === "key.create" || action === "tinycloud.encryption/key.create")) {
+      throw new ManifestValidationError("runtime Share key creation requires the current owner's exact default/share/<id> key and key.create only");
+    }
     if (entry.service !== ENCRYPTION_PERMISSION_SERVICE || typeof entry.path !== "string" || !entry.path.includes("/") || entry.path.endsWith("/share/")) {
       return expandPermissionEntry(entry);
     }