@b00dea/cockpit 0.0.0-stage → 0.1.0

package/dist/registry-resolve/render-shell.d.ts

@@ -0,0 +1,18 @@
+export interface ResolvedRegistryShellModel {
+    formatVersion: string;
+    cockpitSourceRevision: string;
+    registrySha256: string;
+    dialect: 'lane' | 'tier';
+    siblingsRoot: string;
+    rows: readonly string[];
+    paths: readonly string[];
+    variables: readonly {
+        name: string;
+        defaultPath: string;
+    }[];
+    adoption: readonly {
+        layer: string;
+        state: string;
+    }[];
+}
+export declare function renderResolvedRegistryShell(model: ResolvedRegistryShellModel): string;

package/dist/registry-resolve/render-shell.js

@@ -0,0 +1,36 @@
+function quote(value) {
+    if (/\0|\r|\n|\$\(|\$\{|`/.test(value)) {
+        throw new Error('REGISTRY_ARTIFACT_UNSAFE: value contains executable or multiline shell syntax');
+    }
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function array(name, values) {
+    return [`${name}=(`, ...values.map((value) => `  ${quote(value)}`), ')'];
+}
+export function renderResolvedRegistryShell(model) {
+    if (model.siblingsRoot.includes('|') ||
+        model.variables.some(({ defaultPath }) => defaultPath.includes('|')) ||
+        model.paths.some((path) => path.split('|').length !== 3) ||
+        model.rows.some((row) => row.split('|').length !== (model.dialect === 'lane' ? 6 : 7)) ||
+        model.adoption.some(({ layer, state }) => layer.includes('|') || state.includes('|'))) {
+        throw new Error('REGISTRY_ARTIFACT_UNSAFE: a field contains the shell record delimiter');
+    }
+    for (const variable of model.variables) {
+        if (!/^[A-Z][A-Z0-9_]*_DIR$/.test(variable.name)) {
+            throw new Error('REGISTRY_VARIABLE_INVALID: expected a namespaced sibling directory variable');
+        }
+    }
+    return [
+        `COCKPIT_REGISTRY_FORMAT=${quote(model.formatVersion)}`,
+        `COCKPIT_SOURCE_REVISION=${quote(model.cockpitSourceRevision)}`,
+        `COCKPIT_REGISTRY_SHA256=${quote(model.registrySha256)}`,
+        `COCKPIT_REGISTRY_DIALECT=${quote(model.dialect)}`,
+        `COCKPIT_SIBLINGS_ROOT=${quote(model.siblingsRoot)}`,
+        ...array('COCKPIT_REGISTRY_ROWS', model.rows),
+        ...array('COCKPIT_SIBLING_PATHS', model.paths),
+        ...array('COCKPIT_SIBLING_VARIABLES', model.variables.map((variable) => `${variable.name}|${variable.defaultPath}`)),
+        ...array('COCKPIT_ADOPTION_STATES', model.adoption.map(({ layer, state }) => `${layer}|${state}`)),
+        ...model.variables.map(({ name, defaultPath }) => `export ${name}=${quote(defaultPath)}`),
+        '',
+    ].join('\n');
+}

package/dist/repair.d.ts

@@ -0,0 +1,29 @@
+import { type ExecutableFix, type FixContext } from './fix-catalogue.js';
+import type { Diagnostic } from './diagnostics.js';
+interface RepairInput {
+    readonly changes: readonly Readonly<{
+        operation: 'write' | 'remove';
+        path: string;
+    }>[];
+    readonly repairAuthority?: Readonly<{
+        kind: 'generated-environment-repair';
+    }>;
+    readonly outcome: Readonly<{
+        diagnostics: readonly Diagnostic[];
+    }>;
+    readonly fixContext: FixContext;
+    readonly repairRefusal?: Readonly<{
+        kind: 'refusal';
+        artifact: null;
+        destination: null;
+        diagnostics: readonly Diagnostic[];
+        result: null;
+        status: 2;
+    }>;
+}
+export declare function proposeGeneratedEnvironmentRepair(currentness: RepairInput): Readonly<{
+    changes: RepairInput['changes'];
+    fixes: readonly ExecutableFix[];
+    refusal: RepairInput['repairRefusal'] | null;
+}>;
+export {};

package/dist/repair.js

@@ -0,0 +1,8 @@
+import { admitDiagnosticFix } from './fix-catalogue.js';
+export function proposeGeneratedEnvironmentRepair(currentness) {
+    const fixes = currentness.repairAuthority ? currentness.outcome.diagnostics.flatMap(diagnostic => {
+        const admitted = admitDiagnosticFix(diagnostic, currentness.fixContext);
+        return admitted ? [admitted] : [];
+    }) : [];
+    return { changes: currentness.changes, fixes, refusal: currentness.repairRefusal ?? null };
+}

package/dist/schema-json.d.ts

@@ -0,0 +1 @@
+export declare function renderCockpitSchema(): string;

package/dist/schema-json.js

@@ -0,0 +1,177 @@
+import { z } from 'zod';
+import { CockpitConfig, OPERATOR_GATE_RISK_PATTERN, STRUCTURED_INPUT_ENTRY_LIMIT } from './schema.js';
+export function renderCockpitSchema() {
+    const schema = z.toJSONSchema(CockpitConfig, {
+        io: 'input',
+        target: 'draft-04',
+        // Draft 4 has no propertyNames, and Zod drops a record's key schema there, so an editor
+        // accepted any key the loader refuses. Every key must match one pattern property instead.
+        override: ({ zodSchema, jsonSchema }) => {
+            const def = zodSchema._zod.def;
+            if (def.type !== 'record')
+                return;
+            const { type, pattern, maxLength, ...rest } = z.toJSONSchema(def.keyType, { io: 'input', target: 'draft-7' });
+            delete rest.$schema;
+            const value = jsonSchema.additionalProperties;
+            if (type !== 'string' || typeof pattern !== 'string' || Object.keys(rest).length > 0 || maxLength !== undefined && typeof maxLength !== 'number'
+                || value === undefined || typeof value === 'boolean') {
+                throw new Error(`record key schema ${JSON.stringify({ type, pattern, maxLength, ...rest })} has no draft-04 rendering`);
+            }
+            const key = maxLength === undefined ? pattern : `^(?=[\\s\\S]{0,${maxLength}}$)(?:${pattern})`;
+            jsonSchema.patternProperties = { [key]: value };
+            jsonSchema.additionalProperties = false;
+        },
+    });
+    const properties = schema.properties;
+    const sibling = properties.sibling.items;
+    const environment = properties.environment;
+    const environmentProperties = environment.properties;
+    const browser = properties.browser;
+    const browserProperties = browser.properties;
+    const testing = properties.testing;
+    const postureRequirement = environmentProperties.posture_requirements.items;
+    postureRequirement.anyOf = [{ required: ['addressing'] }, { required: ['authentication'] }];
+    for (const field of ['resettable_volumes', 'generated_host_paths', 'compose_files']) {
+        environmentProperties[field].uniqueItems = true;
+    }
+    ;
+    browserProperties.harnesses.uniqueItems = true;
+    const browserProxy = browserProperties.proxy;
+    const browserProxyProperties = browserProxy.properties;
+    browserProxyProperties.allowed_hosts.uniqueItems = true;
+    browser.anyOf = [
+        { properties: { request_preapproval: { enum: [false] } } },
+        { properties: { data: { required: ['mode', 'isolated', 'reaches_production'], properties: {
+                        mode: { enum: ['empty', 'seeded'] }, isolated: { enum: [true] }, reaches_production: { enum: [false] },
+                    } } } },
+    ];
+    testing.oneOf = [
+        { properties: { native_hooks: { properties: { install: { enum: ['inspect'] } } } }, not: { required: ['native_hook_policy'] } },
+        { properties: { native_hooks: { properties: { install: { enum: ['explicit-native'] } }, required: ['install'] } }, required: ['native_hooks', 'native_hook_policy'] },
+    ];
+    sibling.allOf = [
+        {
+            oneOf: [
+                {
+                    properties: { acquire: { enum: ['none'] } },
+                    not: { required: ['remote'] },
+                },
+                {
+                    properties: { acquire: { enum: ['auto', 'manual'] } },
+                    required: ['remote'],
+                },
+            ],
+        },
+        {
+            anyOf: [
+                {
+                    properties: { mount: { enum: ['host'] } },
+                    required: ['host_reason'],
+                },
+                {
+                    properties: { mount: { not: { enum: ['host'] } } },
+                },
+            ],
+        },
+        {
+            anyOf: [
+                {
+                    properties: { gate: { enum: ['operator'] } },
+                    required: ['gate'],
+                },
+                {
+                    not: {
+                        anyOf: [
+                            { properties: { mount: { enum: ['host'] } } },
+                            { properties: { purpose: { pattern: OPERATOR_GATE_RISK_PATTERN } } },
+                        ],
+                    },
+                },
+            ],
+        },
+    ];
+    schema['x-cockpit-runtime-checks'] = [
+        { path: 'sibling[].slug', rule: 'unique' },
+        { path: 'sibling[].dir', rule: 'unique' },
+        { path: 'sibling[].var', rule: 'unique' },
+        { path: 'sibling[].environment_files[].instance', rule: 'unique' },
+        { path: 'environment.resettable_volumes[]', rule: 'unique' },
+        { path: 'environment.resettable_volumes[]', rule: 'declared_compose_volume_key' },
+        { path: 'environment.generated_host_paths[]', rule: 'unique' },
+        { path: 'environment.compose_files[]', rule: 'unique' },
+        { path: 'environment.entrypoint_derivatives[].name', rule: 'unique' },
+        { path: 'environment.install_policies[].toolchain+lockfile', rule: 'unique' },
+        { path: 'environment.posture_requirements[].requirement', rule: 'unique' },
+        { path: 'environment.entrypoint_derivatives[].port', rule: 'declared_in_ports.bases' },
+        { path: 'browser.artifacts', rule: 'exact_environment.generated_host_paths_coverage' },
+        { path: 'browser', rule: 'matches_environment_addressing_authentication_and_client_cap' },
+        { path: 'browser.images', rule: 'mcp_driver_shares_major_minor_with_project_driver' },
+        { path: 'testing.gates[].stages[]', rule: 'references_declared_testing_stage' },
+        { path: 'sibling[].environment_files[]', rule: 'template_and_instance_differ' },
+        { path: 'sibling[].derives.mcp_sources[].path', rule: 'unique_within_sibling' },
+        { path: 'environment.seed', rule: 'requires_resettable_volumes' },
+        {
+            path: 'ports',
+            rule: 'count_times_base_count_within_shared_input_budget',
+            limit: STRUCTURED_INPUT_ENTRY_LIMIT,
+        },
+        { path: 'surfaces.overlays[].name', rule: 'unique' },
+        { path: 'surfaces.overlays[].sources[].path', rule: 'unique' },
+        { path: 'surfaces.overlays[].sources', rule: 'feature_namespace_and_complete_skill_definitions' },
+        { path: 'surfaces.overlays[].sources[].bytes', rule: 'utf8_byte_length_at_most_65536' },
+        { path: 'surfaces.overlays[].replaces.name', rule: 'matches_declaration_name' },
+        { path: 'surfaces.harnesses[].name', rule: 'unique' },
+        { path: 'surfaces.harnesses[].capabilities', rule: 'one_row_per_surface_feature' },
+        { path: 'surfaces.harnesses[].capabilities[].spelling', rule: 'unique_when_emitted' },
+        { path: 'surfaces.adopted[].path', rule: 'unique' },
+        { path: 'surfaces.adopted[].source', rule: 'equals_cockpit/adopted/<path>' },
+        { path: 'surfaces.adopted[].provenance.kind', rule: 'declared' },
+    ];
+    schema['x-cockpit-editor-limitations'] = [
+        { path: 'sibling[].environment_files[].instance', rule: 'unique' },
+        { path: 'sibling[].environment_files[]', rule: 'template_and_instance_differ' },
+        { path: 'sibling[].derives.mcp_sources[].path', rule: 'unique_within_sibling' },
+        { path: 'environment.seed', rule: 'requires_resettable_volumes' },
+        { path: 'environment.entrypoint_derivatives[].name', rule: 'unique' },
+        { path: 'environment.entrypoint_derivatives[].port', rule: 'declared_in_ports.bases' },
+        { path: 'environment.install_policies[].toolchain+lockfile', rule: 'unique' },
+        { path: 'environment.posture_requirements[].requirement', rule: 'unique' },
+        { path: 'browser.artifacts', rule: 'exact_environment.generated_host_paths_coverage' },
+        { path: 'browser', rule: 'matches_environment_addressing_authentication_and_client_cap' },
+        { path: 'browser.images', rule: 'mcp_driver_shares_major_minor_with_project_driver' },
+        { path: 'testing.gates[].stages[]', rule: 'references_declared_testing_stage' },
+        { path: 'surfaces.overlays[].name', rule: 'unique' },
+        { path: 'surfaces.overlays[].sources[].path', rule: 'unique' },
+        { path: 'surfaces.overlays[].sources', rule: 'feature_namespace_and_complete_skill_definitions' },
+        { path: 'surfaces.overlays[].sources[].bytes', rule: 'utf8_byte_length_at_most_65536' },
+        { path: 'surfaces.overlays[].replaces.name', rule: 'matches_declaration_name' },
+        { path: 'surfaces.harnesses[].name', rule: 'unique' },
+        { path: 'surfaces.harnesses[].capabilities', rule: 'one_row_per_surface_feature' },
+        { path: 'surfaces.harnesses[].capabilities[].spelling', rule: 'unique_when_emitted' },
+        { path: 'surfaces.adopted[].path', rule: 'unique' },
+        { path: 'surfaces.adopted[].source', rule: 'equals_cockpit/adopted/<path>' },
+        { path: 'surfaces.adopted[].provenance.kind', rule: 'declared' },
+    ];
+    // Found by shape, so every table that embeds a provenance carries the rule, wherever it sits.
+    const requireProvenanceEvidence = (node) => {
+        const fields = node.properties;
+        if (fields?.observed_on && fields.kind && fields.source) {
+            node.anyOf = [
+                { properties: { kind: { enum: ['declared'] } } },
+                { properties: { kind: { enum: ['measured'] } }, required: ['observed_on'] },
+                { properties: { kind: { enum: ['inferred'] }, confirmed: { enum: [true] } }, required: ['confirmed', 'observed_on'] },
+            ];
+        }
+        for (const value of Object.values(node)) {
+            if (Array.isArray(value))
+                for (const entry of value) {
+                    if (entry !== null && typeof entry === 'object')
+                        requireProvenanceEvidence(entry);
+                }
+            else if (value !== null && typeof value === 'object')
+                requireProvenanceEvidence(value);
+        }
+    };
+    requireProvenanceEvidence(schema);
+    return `${JSON.stringify(schema, null, 2)}\n`;
+}