@closerepo/sentinel-contracts 1.2.0 → 1.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +1 -1
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
import{z as e}from"zod";const t=1,n=32*1024,r=64,i=64,a=t=>e.string().trim().min(1).max(t),o=e.string().regex(/^[a-z][a-z0-9_-]{0,63}$/),s=e.string().regex(/^[a-z][A-Za-z0-9_]{0,63}$/),c=e.uuid(),l=c,ee=e.url().refine(e=>e.startsWith(`https://`),`must use HTTPS`),u=e.object({label:e.enum([`Observed value`,`Warning threshold`,`Critical threshold`]),value:e.number().finite().nonnegative()}).strict(),d=e.object({label:a(80),url:ee}).strict(),f=e.object({type:e.literal(`none`)}).strict(),p=e.object({type:e.literal(`live_command`),command:a(500).regex(/^abuse apply\b/).refine(e=>e.endsWith(` --apply`),`must end with --apply`)}).strict(),m=e.object({type:e.literal(`test_preview`),summary:a(300).refine(e=>!e.includes(`--apply`),`must not contain --apply`)}).strict(),h=e.discriminatedUnion(`type`,[f,p,m]),g=e.object({contractVersion:e.literal(1),projectId:o,environment:o,incidentId:l,eventId:l,kind:e.enum([`firing`,`reminder`,`resolved`]),severity:e.enum([`warning`,`critical`]),signalClass:e.enum([`attack`,`service`]),signal:o,title:a(120),occurredAt:e.iso.datetime(),evidence:e.array(u).max(8),runbook:d,statusCommand:a(300).regex(/^sentinel status\b/),receiverKeys:e.array(o).min(1).max(16),action:h}).strict(),_=g.extend({mode:e.literal(`live`)}).superRefine((e,t)=>{e.signalClass===`service`&&e.action.type!==`none`&&t.addIssue({code:`custom`,message:`service events cannot contain an operational action`,path:[`action`]}),e.action.type===`test_preview`&&t.addIssue({code:`custom`,message:`live events cannot contain a test preview`,path:[`action`]})}),v=g.extend({mode:e.literal(`test`),action:e.discriminatedUnion(`type`,[f,m])}).strict(),y=e.union([_,v]);function b(e){let t=y.parse(e);return JSON.stringify(t)}const x=e.enum([`delivery_interrupted`,`provider_rejected`,`provider_timeout`,`provider_unavailable`,`receiver_missing`,`synthetic_retry`]),S=e.object({receiverKey:o,state:e.enum([`pending`,`delivering`,`delivered`,`failed`]),attempts:e.number().int().min(0).max(4),failureCode:x.nullable(),leaseExpiresAt:e.iso.datetime().nullable(),lastAttemptAt:e.iso.datetime().nullable()}).strict().superRefine((e,t)=>{e.state===`failed`&&e.failureCode===null&&t.addIssue({code:`custom`,message:`failed receivers require failureCode`,path:[`failureCode`]}),e.state!==`failed`&&e.failureCode!==null&&t.addIssue({code:`custom`,message:`only failed receivers can carry failureCode`,path:[`failureCode`]})}),C=e.object({contractVersion:e.literal(1),projectId:o,environment:o,eventId:l,state:e.enum([`pending`,`retrying`,`partial`,`delivered`,`failed`,`unavailable`]),reason:e.enum([`in_progress`,`partial_delivery`,`complete`,`retry_exhausted`,`receipt_unavailable`]),receivers:e.array(S).max(16),updatedAt:e.iso.datetime()}).strict(),w=e.object({code:o,state:e.enum([`degraded`,`failed`,`unknown`,`warning`]),summary:a(300),suggestedCommand:a(500).optional()}).strict(),T=e.object({contractVersion:e.literal(1),projectId:o,environment:o,registration:e.object({enabled:e.boolean(),mode:e.enum([`disabled`,`shadow`,`live`]),policyDigest:e.string().regex(/^[a-f0-9]{64}$/),projectionDigest:e.string().regex(/^[a-f0-9]{64}$/),projectedAt:e.iso.datetime(),sourceRevision:a(160)}).strict(),rules:e.array(e.object({id:o,semanticDigest:e.string().regex(/^[a-f0-9]{64}$/),enabled:e.boolean(),state:e.enum([`closed`,`firing`,`idle`,`unknown`]),severity:e.enum([`warning`,`critical`]).nullable(),incidentId:l.nullable(),lastEvaluatedAt:e.iso.datetime().nullable(),lastEventId:l.nullable()}).strict()).max(64),deliveries:e.array(C).max(64),heartbeat:e.object({state:e.enum([`healthy`,`stale`,`unavailable`]),lastCompletedAt:e.iso.datetime().nullable()}).strict(),diagnostics:e.array(w).max(32)}).strict(),te=e.object({state:e.enum([`available`,`unavailable`]),backlogCount:e.number().int().nonnegative().nullable(),backlogBytes:e.number().int().nonnegative().nullable(),oldestMessageAt:e.iso.datetime().nullable(),retentionSeconds:e.number().int().positive().nullable()}).strict(),E=e.string().regex(/^[A-Z][A-Z0-9_]{2,127}$/),ne=e.string().max(240).regex(/^(?![A-Za-z]:|\/|.*(?:^|\/)\.\.(?:\/|$)).+\.json$/),D=e.object({mode:e.enum([`disabled`,`shadow`,`live`]),statusUrlEnv:E,statusHmacSecretEnv:E,healthReportHmacSecretEnv:E.optional(),opsAccountIdEnv:E,provisionApiTokenEnv:E,statusApiTokenEnv:E,analyticsAccountIdEnv:E,analyticsApiTokenEnv:E,analyticsDataset:o,workerName:o,queueName:o,dlqName:o,registrationQueueName:o,registrationDlqName:o,notificationWorkerName:o,healthchecksProvisionApiKeyEnv:E.optional(),healthchecksPingUrlEnv:E.optional(),healthchecksStatusApiKeyEnv:E.optional()}).strict().superRefine((e,t)=>{let n=[e.healthchecksProvisionApiKeyEnv,e.healthchecksPingUrlEnv,e.healthchecksStatusApiKeyEnv].filter(Boolean);n.length>0&&n.length!==3&&t.addIssue({code:`custom`,message:`Healthchecks provision, status and ping URL references must be configured together`,path:[`healthchecksProvisionApiKeyEnv`]})}),O=e.object({contractVersion:e.literal(1),projectId:o,policy:ne,environments:e.record(o,D)}).strict().superRefine((e,t)=>{Object.keys(e.environments).length===0&&t.addIssue({code:`custom`,message:`at least one environment is required`,path:[`environments`]})}),k=e.object({type:e.literal(`abuse`),project:e.string().regex(/^[a-zA-Z0-9._/-]{1,120}$/),target:o,action:o,layer:o,ttl:e.string().regex(/^[1-9][0-9]{0,4}[smhd]$/).optional()}).strict(),A=e.discriminatedUnion(`type`,[f,k]),j=e.object({id:o,enabled:e.boolean(),signalClass:e.enum([`attack`,`service`]),signal:e.object({type:e.enum([`operation_count`,`worker_error_ratio`,`edge_security_spike`,`provider_health`]),operation:s.optional(),operations:e.array(s).min(1).max(16).optional(),outcomes:e.array(e.enum([`committed`,`accepted_noop`,`rejected`,`failed`])).max(4).optional(),minimumSample:e.number().int().positive().optional()}).strict(),windowMinutes:e.number().int().min(5).max(1440),thresholds:e.object({warning:e.number().nonnegative(),critical:e.number().positive()}).strict().refine(e=>e.critical>e.warning,`critical must exceed warning`),recovery:e.object({healthyEvaluations:e.number().int().min(1).max(24)}).strict(),reminders:e.object({warningMinutes:e.number().int().min(5).max(10080),criticalMinutes:e.number().int().min(5).max(10080)}).strict(),runbook:d,receiverKeys:e.array(o).min(1).max(16),actions:e.object({warning:A,critical:A}).strict()}).strict().superRefine((e,t)=>{e.signal.operation&&e.signal.operations&&t.addIssue({code:`custom`,message:`signal cannot define both operation and operations`,path:[`signal`]}),e.signal.type===`operation_count`&&!e.signal.operation&&!e.signal.operations&&t.addIssue({code:`custom`,message:`operation_count requires operation or operations`,path:[`signal`]}),e.signal.type===`provider_health`&&e.thresholds.warning>1&&t.addIssue({code:`custom`,message:`provider_health warning threshold must be at most 1`,path:[`thresholds`,`warning`]}),e.signalClass===`service`&&(e.actions.warning.type!==`none`||e.actions.critical.type!==`none`)&&t.addIssue({code:`custom`,message:`service rules cannot configure abuse actions`,path:[`actions`]})}),M=e.object({contractVersion:e.literal(1),evaluationMinutes:e.number().int().min(5).max(60),rules:e.array(j).min(1).max(64)}).strict().superRefine((e,t)=>{let n=new Set;for(let[r,i]of e.rules.entries())n.has(i.id)&&t.addIssue({code:`custom`,message:`duplicate rule id ${i.id}`,path:[`rules`,r,`id`]}),n.add(i.id)}),N=e.object({analytics:e.object({accountIdBinding:E,dataset:o,index:a(160),tokenBinding:E}).strict(),enabled:e.boolean(),environment:o,mode:e.enum([`disabled`,`shadow`,`live`]),policy:M,policyDigest:e.string().regex(/^[a-f0-9]{64}$/),projectionDigest:e.string().regex(/^[a-f0-9]{64}$/),projectId:o,projectedAt:e.iso.datetime(),sourceRevision:a(160),healthReportHmacSecretBinding:E.optional()}).strict().refine(e=>e.enabled===(e.mode!==`disabled`),{message:`enabled must match registration mode`,path:[`enabled`]}).superRefine((e,t)=>{e.mode===`live`&&!e.policy.rules.some(e=>e.enabled&&e.signal.type===`provider_health`)&&t.addIssue({code:`custom`,message:`Live registration requires an enabled provider_health rule`,path:[`policy`,`rules`]})}),P=e.object({commandId:l,contractVersion:e.literal(1),expectedPreviousDigest:e.string().regex(/^[a-f0-9]{64}$/).nullable(),kind:e.literal(`registration_upsert`),registration:N}).strict(),F=e.string().trim().min(1).max(160),I=e.object({key:o,value:e.number().finite().nonnegative(),unit:e.enum([`bytes`,`count`,`milliseconds`,`percent`,`ratio`]).optional()}).strict(),L=e.object({episodeId:c,attempt:e.number().int().min(1).max(1e3),terminal:e.boolean(),operation:s,stage:o,code:o,summary:a(300),correlationId:F.optional(),upstreamStatus:e.number().int().min(100).max(599).optional(),upstreamCode:o.optional()}).strict(),R=e.object({componentKey:o,componentClass:o,state:e.enum([`healthy`,`degraded`,`failed`,`unavailable`,`unknown`]),lastSuccessAt:e.iso.datetime().nullable(),facts:e.array(I).max(16),failure:L.nullable()}).strict().superRefine((e,t)=>{e.state===`healthy`&&e.failure!==null&&t.addIssue({code:`custom`,message:`healthy components cannot carry a current failure`,path:[`failure`]}),(e.state===`failed`||e.state===`unavailable`)&&e.failure===null&&t.addIssue({code:`custom`,message:`failed and unavailable components require a current failure`,path:[`failure`]})}),z=e.object({contractVersion:e.literal(1),projectId:o,environment:o,runtimeInstanceId:o,reportId:c,sequence:e.number().int().min(1).max(2**53-1),observedAt:e.iso.datetime(),components:e.array(R).min(1).max(64)}).strict().superRefine((e,t)=>{let n=new Set;for(let[r,i]of e.components.entries())n.has(i.componentKey)&&t.addIssue({code:`custom`,message:`duplicate component key ${i.componentKey}`,path:[`components`,r,`componentKey`]}),n.add(i.componentKey)}),B=e.object({capabilityKey:o,state:e.enum([`enabled`,`disabled`])}).strict(),V=e.object({contractVersion:e.literal(2),projectId:o,environment:o,runtimeInstanceId:o,reportId:c,sequence:e.number().int().min(1).max(2**53-1),observedAt:e.iso.datetime(),components:e.array(R).min(1).max(64),capabilities:e.array(B).max(64)}).strict().superRefine((e,t)=>{let n=new Set;for(let[r,i]of e.components.entries())n.has(i.componentKey)&&t.addIssue({code:`custom`,message:`duplicate component key ${i.componentKey}`,path:[`components`,r,`componentKey`]}),n.add(i.componentKey);let r=new Set;for(let[n,i]of e.capabilities.entries())r.has(i.capabilityKey)&&t.addIssue({code:`custom`,message:`duplicate capability key ${i.capabilityKey}`,path:[`capabilities`,n,`capabilityKey`]}),r.add(i.capabilityKey)}),H=e.union([z,V]),U=e.object({capabilityKey:o,expected:e.enum([`enabled`,`disabled`]),kind:e.enum([`mismatch`,`missing`]),observed:e.enum([`enabled`,`disabled`]).nullable()}).strict(),W=e.object({componentKey:o,failure:L,incidentId:l}).strict(),G=e.object({runtimeInstanceId:o,state:e.enum([`degraded`,`healthy`,`stale`,`unavailable`]),latestReport:e.object({receivedAt:e.iso.datetime(),report:H}).strict().nullable(),componentIncidents:e.array(W).max(64),runtimeExpectationIncident:e.object({differences:e.array(U).max(64),expectationRevision:o,incidentId:l,observationState:e.enum([`available`,`unavailable`])}).strict().nullable(),staleIncident:e.object({incidentId:l,openedAt:e.iso.datetime()}).strict().nullable()}).strict().superRefine((e,t)=>{let n=e.latestReport===null?`unavailable`:e.staleIncident===null?e.componentIncidents.length>0||e.runtimeExpectationIncident!==null?`degraded`:`healthy`:`stale`;e.state!==n&&t.addIssue({code:`custom`,message:`runtime state must be ${n}`,path:[`state`]}),e.latestReport===null&&(e.componentIncidents.length>0||e.runtimeExpectationIncident!==null||e.staleIncident!==null)&&t.addIssue({code:`custom`,message:`an unavailable runtime without a report cannot carry incidents`,path:[`latestReport`]})}),K=e.object({contractVersion:e.literal(1),statusType:e.literal(`health`),projectId:o,environment:o,runtimes:e.array(G).max(64)}).strict().superRefine((e,t)=>{let n=new Set;for(let[r,i]of e.runtimes.entries()){n.has(i.runtimeInstanceId)&&t.addIssue({code:`custom`,message:`duplicate runtime identity ${i.runtimeInstanceId}`,path:[`runtimes`,r,`runtimeInstanceId`]}),n.add(i.runtimeInstanceId);let a=i.latestReport?.report;a&&(a.projectId!==e.projectId||a.environment!==e.environment||a.runtimeInstanceId!==i.runtimeInstanceId)&&t.addIssue({code:`custom`,message:`latest report identity must match the status runtime identity`,path:[`runtimes`,r,`latestReport`,`report`]})}}),q=e.union([T,K]),J=e.object({timestamp:e.iso.datetime(),nonce:c,signature:e.string().regex(/^[a-f0-9]{64}$/)}).strict(),Y=e.object({contractVersion:e.literal(1),report:z,authentication:J}).strict(),X=e.object({contractVersion:e.literal(2),report:V,authentication:J}).strict(),re=e.union([Y,X]);function Z(e){let t=Y.omit({authentication:!0}).extend({authentication:J.omit({signature:!0})}).parse(e);return JSON.stringify(t)}function Q(e){let t=X.omit({authentication:!0}).extend({authentication:J.omit({signature:!0})}).parse(e);return JSON.stringify(t)}function ie(e){return e.contractVersion===1?Z(e):Q(e)}const $=e.enum([`authentication_failed`,`identity_not_registered`,`nonce_replayed`,`report_invalid`,`runtime_identity_mismatch`,`sequence_invalid`,`size_exceeded`,`timestamp_out_of_range`,`unexpected_failure`]),ae=e.discriminatedUnion(`outcome`,[e.object({outcome:e.literal(`accepted`),acceptedSequence:e.number().int().min(1).max(2**53-1),receivedAt:e.iso.datetime()}).strict(),e.object({outcome:e.literal(`duplicate`),acceptedSequence:e.number().int().min(1).max(2**53-1),receivedAt:e.iso.datetime()}).strict(),e.object({outcome:e.literal(`out_of_order`),acceptedSequence:e.number().int().min(1).max(2**53-1),receivedAt:e.iso.datetime()}).strict(),e.object({outcome:e.literal(`rejected`),rejectionCode:$,summary:a(300)}).strict()]);export{h as sentinelActionSchema,M as sentinelAlertPolicySchema,t as sentinelContractVersion,C as sentinelDeliveryReceiptSchema,w as sentinelDiagnosticSchema,D as sentinelEnvironmentBindingSchema,c as sentinelEventIdSchema,u as sentinelEvidenceSchema,R as sentinelHealthComponentSchema,L as sentinelHealthFailureSchema,I as sentinelHealthMetricFactSchema,H as sentinelHealthReportAnySchema,ie as sentinelHealthReportAnySignatureInput,J as sentinelHealthReportAuthenticationSchema,ae as sentinelHealthReportIngestResultSchema,n as sentinelHealthReportMaximumBytes,i as sentinelHealthReportMaximumCapabilities,r as sentinelHealthReportMaximumComponents,$ as sentinelHealthReportRejectionCodeSchema,z as sentinelHealthReportSchema,Z as sentinelHealthReportSignatureInput,re as sentinelHealthReportSubmissionAnySchema,Y as sentinelHealthReportSubmissionSchema,X as sentinelHealthReportSubmissionV2Schema,V as sentinelHealthReportV2Schema,Q as sentinelHealthReportV2SignatureInput,K as sentinelHealthRuntimeStatusSchema,_ as sentinelIncidentEventSchema,A as sentinelPolicyActionSchema,O as sentinelProjectManifestSchema,b as sentinelQueueEventIdentityInput,y as sentinelQueueEventSchema,te as sentinelQueueMetricsSchema,x as sentinelReceiverFailureCodeSchema,S as sentinelReceiverStateSchema,P as sentinelRegistrationCommandSchema,N as sentinelRegistrationSchema,j as sentinelRuleSchema,d as sentinelRunbookSchema,B as sentinelRuntimeCapabilityObservationSchema,T as sentinelRuntimeStatusSchema,q as sentinelStatusResponseSchema,v as sentinelTestEventSchema};
|
|
1
|
+
import{z as e}from"zod";const t=1,n=32*1024,r=64,i=64,a=t=>e.string().trim().min(1).max(t),o=e.string().regex(/^[a-z][a-z0-9_-]{0,63}$/),s=e.string().regex(/^[a-z][A-Za-z0-9_]{0,63}$/),c=e.uuid(),l=c,ee=e.url().refine(e=>e.startsWith(`https://`),`must use HTTPS`),u=e.object({label:e.enum([`Observed value`,`Warning threshold`,`Critical threshold`]),value:e.number().finite().nonnegative()}).strict(),d=e.object({label:a(80),url:ee}).strict(),f=e.object({type:e.literal(`none`)}).strict(),p=e.object({type:e.literal(`live_command`),command:a(500).regex(/^abuse apply\b/).refine(e=>e.endsWith(` --apply`),`must end with --apply`)}).strict(),m=e.object({type:e.literal(`test_preview`),summary:a(300).refine(e=>!e.includes(`--apply`),`must not contain --apply`)}).strict(),h=e.discriminatedUnion(`type`,[f,p,m]),g=e.object({contractVersion:e.literal(1),projectId:o,environment:o,incidentId:l,eventId:l,kind:e.enum([`firing`,`reminder`,`resolved`]),severity:e.enum([`warning`,`critical`]),signalClass:e.enum([`attack`,`service`]),signal:o,title:a(120),occurredAt:e.iso.datetime(),evidence:e.array(u).max(8),runbook:d,statusCommand:a(300).regex(/^sentinel status\b/),receiverKeys:e.array(o).min(1).max(16),action:h}).strict(),_=g.extend({mode:e.literal(`live`)}).superRefine((e,t)=>{e.signalClass===`service`&&e.action.type!==`none`&&t.addIssue({code:`custom`,message:`service events cannot contain an operational action`,path:[`action`]}),e.action.type===`test_preview`&&t.addIssue({code:`custom`,message:`live events cannot contain a test preview`,path:[`action`]})}),v=g.extend({mode:e.literal(`test`),action:e.discriminatedUnion(`type`,[f,m])}).strict(),y=e.union([_,v]);function b(e){let t=y.parse(e);return JSON.stringify(t)}const x=e.enum([`delivery_interrupted`,`provider_rejected`,`provider_timeout`,`provider_unavailable`,`receiver_missing`,`synthetic_retry`]),S=e.object({receiverKey:o,state:e.enum([`pending`,`delivering`,`delivered`,`failed`]),attempts:e.number().int().min(0).max(4),failureCode:x.nullable(),leaseExpiresAt:e.iso.datetime().nullable(),lastAttemptAt:e.iso.datetime().nullable()}).strict().superRefine((e,t)=>{e.state===`failed`&&e.failureCode===null&&t.addIssue({code:`custom`,message:`failed receivers require failureCode`,path:[`failureCode`]}),e.state!==`failed`&&e.failureCode!==null&&t.addIssue({code:`custom`,message:`only failed receivers can carry failureCode`,path:[`failureCode`]})}),C=e.object({contractVersion:e.literal(1),projectId:o,environment:o,eventId:l,state:e.enum([`pending`,`retrying`,`partial`,`delivered`,`failed`,`unavailable`]),reason:e.enum([`in_progress`,`partial_delivery`,`complete`,`retry_exhausted`,`receipt_unavailable`]),receivers:e.array(S).max(16),updatedAt:e.iso.datetime()}).strict(),w=e.object({code:o,state:e.enum([`degraded`,`failed`,`unknown`,`warning`]),summary:a(300),suggestedCommand:a(500).optional()}).strict(),T=e.object({contractVersion:e.literal(1),projectId:o,environment:o,registration:e.object({enabled:e.boolean(),mode:e.enum([`disabled`,`shadow`,`live`]),policyDigest:e.string().regex(/^[a-f0-9]{64}$/),projectionDigest:e.string().regex(/^[a-f0-9]{64}$/),projectedAt:e.iso.datetime(),sourceRevision:a(160)}).strict(),rules:e.array(e.object({id:o,semanticDigest:e.string().regex(/^[a-f0-9]{64}$/),enabled:e.boolean(),state:e.enum([`closed`,`firing`,`idle`,`unknown`]),severity:e.enum([`warning`,`critical`]).nullable(),incidentId:l.nullable(),lastEvaluatedAt:e.iso.datetime().nullable(),lastEventId:l.nullable()}).strict()).max(64),deliveries:e.array(C).max(64),heartbeat:e.object({state:e.enum([`healthy`,`stale`,`unavailable`]),lastCompletedAt:e.iso.datetime().nullable()}).strict(),diagnostics:e.array(w).max(32)}).strict(),te=e.object({state:e.enum([`available`,`unavailable`]),backlogCount:e.number().int().nonnegative().nullable(),backlogBytes:e.number().int().nonnegative().nullable(),oldestMessageAt:e.iso.datetime().nullable(),retentionSeconds:e.number().int().positive().nullable()}).strict(),E=e.string().regex(/^[A-Z][A-Z0-9_]{2,127}$/),ne=e.string().max(240).regex(/^(?![A-Za-z]:|\/|.*(?:^|\/)\.\.(?:\/|$)).+\.json$/),D=e.object({mode:e.enum([`disabled`,`shadow`,`live`]),statusUrlEnv:E,statusHmacSecretEnv:E,healthReportHmacSecretEnv:E.optional(),opsAccountIdEnv:E,provisionApiTokenEnv:E,statusApiTokenEnv:E,analyticsAccountIdEnv:E,analyticsApiTokenEnv:E,analyticsDataset:o,workerName:o,queueName:o,dlqName:o,registrationQueueName:o,registrationDlqName:o,notificationWorkerName:o,healthchecksProvisionApiKeyEnv:E.optional(),healthchecksPingUrlEnv:E.optional(),healthchecksStatusApiKeyEnv:E.optional()}).strict().superRefine((e,t)=>{let n=[e.healthchecksProvisionApiKeyEnv,e.healthchecksPingUrlEnv,e.healthchecksStatusApiKeyEnv].filter(Boolean);n.length>0&&n.length!==3&&t.addIssue({code:`custom`,message:`Healthchecks provision, status and ping URL references must be configured together`,path:[`healthchecksProvisionApiKeyEnv`]})}),O=e.object({contractVersion:e.literal(1),projectId:o,policy:ne,environments:e.record(o,D)}).strict().superRefine((e,t)=>{Object.keys(e.environments).length===0&&t.addIssue({code:`custom`,message:`at least one environment is required`,path:[`environments`]})}),k=e.object({type:e.literal(`abuse`),project:e.string().regex(/^[a-zA-Z0-9._/-]{1,120}$/),target:o,action:o,layer:o,ttl:e.string().regex(/^[1-9][0-9]{0,4}[smhd]$/).optional()}).strict(),A=e.discriminatedUnion(`type`,[f,k]),j=e.object({id:o,enabled:e.boolean(),signalClass:e.enum([`attack`,`service`]),signal:e.object({type:e.enum([`operation_count`,`worker_error_ratio`,`edge_security_spike`,`provider_health`]),operation:s.optional(),operations:e.array(s).min(1).max(16).optional(),outcomes:e.array(e.enum([`committed`,`accepted_noop`,`rejected`,`failed`])).max(4).optional(),minimumSample:e.number().int().positive().optional()}).strict(),windowMinutes:e.number().int().min(5).max(1440),thresholds:e.object({warning:e.number().nonnegative(),critical:e.number().positive()}).strict().refine(e=>e.critical>e.warning,`critical must exceed warning`),recovery:e.object({healthyEvaluations:e.number().int().min(1).max(24)}).strict(),reminders:e.object({warningMinutes:e.number().int().min(5).max(10080),criticalMinutes:e.number().int().min(5).max(10080)}).strict(),runbook:d,receiverKeys:e.array(o).min(1).max(16),actions:e.object({warning:A,critical:A}).strict()}).strict().superRefine((e,t)=>{e.signal.operation&&e.signal.operations&&t.addIssue({code:`custom`,message:`signal cannot define both operation and operations`,path:[`signal`]}),e.signal.type===`operation_count`&&!e.signal.operation&&!e.signal.operations&&t.addIssue({code:`custom`,message:`operation_count requires operation or operations`,path:[`signal`]}),e.signal.type===`provider_health`&&e.thresholds.warning>1&&t.addIssue({code:`custom`,message:`provider_health warning threshold must be at most 1`,path:[`thresholds`,`warning`]}),e.signalClass===`service`&&(e.actions.warning.type!==`none`||e.actions.critical.type!==`none`)&&t.addIssue({code:`custom`,message:`service rules cannot configure abuse actions`,path:[`actions`]})}),M=e.object({contractVersion:e.literal(1),evaluationMinutes:e.number().int().min(5).max(60),rules:e.array(j).min(1).max(64)}).strict().superRefine((e,t)=>{let n=new Set;for(let[r,i]of e.rules.entries())n.has(i.id)&&t.addIssue({code:`custom`,message:`duplicate rule id ${i.id}`,path:[`rules`,r,`id`]}),n.add(i.id)}),N=e.object({analytics:e.object({accountIdBinding:E,dataset:o,index:a(160),tokenBinding:E}).strict(),enabled:e.boolean(),environment:o,mode:e.enum([`disabled`,`shadow`,`live`]),policy:M,policyDigest:e.string().regex(/^[a-f0-9]{64}$/),projectionDigest:e.string().regex(/^[a-f0-9]{64}$/),projectId:o,projectedAt:e.iso.datetime(),sourceRevision:a(160),healthReportHmacSecretBinding:E.optional()}).strict().refine(e=>e.enabled===(e.mode!==`disabled`),{message:`enabled must match registration mode`,path:[`enabled`]}).superRefine((e,t)=>{e.mode===`live`&&!e.policy.rules.some(e=>e.enabled&&e.signal.type===`provider_health`)&&t.addIssue({code:`custom`,message:`Live registration requires an enabled provider_health rule`,path:[`policy`,`rules`]})}),P=e.object({commandId:l,contractVersion:e.literal(1),expectedPreviousDigest:e.string().regex(/^[a-f0-9]{64}$/).nullable(),kind:e.literal(`registration_upsert`),registration:N}).strict(),F=e.string().trim().min(1).max(160),I=e.object({key:o,value:e.number().finite().nonnegative(),unit:e.enum([`bytes`,`count`,`milliseconds`,`percent`,`ratio`]).optional()}).strict(),L=e.object({episodeId:c,attempt:e.number().int().min(1).max(1e3),terminal:e.boolean(),operation:s,stage:o,code:o,summary:a(300),correlationId:F.optional(),upstreamStatus:e.number().int().min(100).max(599).optional(),upstreamCode:o.optional()}).strict(),R=e.object({componentKey:o,componentClass:o,state:e.enum([`healthy`,`degraded`,`failed`,`unavailable`,`unknown`]),lastSuccessAt:e.iso.datetime().nullable(),facts:e.array(I).max(16),failure:L.nullable()}).strict().superRefine((e,t)=>{e.state===`healthy`&&e.failure!==null&&t.addIssue({code:`custom`,message:`healthy components cannot carry a current failure`,path:[`failure`]}),(e.state===`failed`||e.state===`unavailable`)&&e.failure===null&&t.addIssue({code:`custom`,message:`failed and unavailable components require a current failure`,path:[`failure`]})}),z=e.object({contractVersion:e.literal(1),projectId:o,environment:o,runtimeInstanceId:o,reportId:c,sequence:e.number().int().min(1).max(2**53-1),observedAt:e.iso.datetime(),components:e.array(R).min(1).max(64)}).strict().superRefine((e,t)=>{let n=new Set;for(let[r,i]of e.components.entries())n.has(i.componentKey)&&t.addIssue({code:`custom`,message:`duplicate component key ${i.componentKey}`,path:[`components`,r,`componentKey`]}),n.add(i.componentKey)}),B=e.object({capabilityKey:o,state:e.enum([`enabled`,`disabled`])}).strict(),V=e.object({contractVersion:e.literal(2),projectId:o,environment:o,runtimeInstanceId:o,reportId:c,sequence:e.number().int().min(1).max(2**53-1),observedAt:e.iso.datetime(),components:e.array(R).min(1).max(64),capabilities:e.array(B).max(64)}).strict().superRefine((e,t)=>{let n=new Set;for(let[r,i]of e.components.entries())n.has(i.componentKey)&&t.addIssue({code:`custom`,message:`duplicate component key ${i.componentKey}`,path:[`components`,r,`componentKey`]}),n.add(i.componentKey);let r=new Set;for(let[n,i]of e.capabilities.entries())r.has(i.capabilityKey)&&t.addIssue({code:`custom`,message:`duplicate capability key ${i.capabilityKey}`,path:[`capabilities`,n,`capabilityKey`]}),r.add(i.capabilityKey)}),H=e.union([z,V]),U=e.object({capabilityKey:o,expected:e.enum([`enabled`,`disabled`]),kind:e.enum([`mismatch`,`missing`]),observed:e.enum([`enabled`,`disabled`]).nullable()}).strict(),W=e.object({componentKey:o,failure:L,incidentId:l}).strict(),G=e.object({runtimeInstanceId:o,state:e.enum([`degraded`,`healthy`,`stale`,`unavailable`]),latestReport:e.object({receivedAt:e.iso.datetime(),report:H}).strict().nullable(),componentIncidents:e.array(W).max(64),runtimeExpectationIncident:e.object({differences:e.array(U).max(64),expectationRevision:o,incidentId:l,observationState:e.enum([`available`,`unavailable`])}).strict().nullable(),staleIncident:e.object({incidentId:l,openedAt:e.iso.datetime()}).strict().nullable()}).strict().superRefine((e,t)=>{let n=e.latestReport===null?`unavailable`:e.staleIncident===null?e.latestReport.report.components.some(e=>e.state!==`healthy`)||e.componentIncidents.length>0||e.runtimeExpectationIncident!==null?`degraded`:`healthy`:`stale`;e.state!==n&&t.addIssue({code:`custom`,message:`runtime state must be ${n}`,path:[`state`]}),e.latestReport===null&&(e.componentIncidents.length>0||e.runtimeExpectationIncident!==null||e.staleIncident!==null)&&t.addIssue({code:`custom`,message:`an unavailable runtime without a report cannot carry incidents`,path:[`latestReport`]})}),K=e.object({contractVersion:e.literal(1),statusType:e.literal(`health`),projectId:o,environment:o,runtimes:e.array(G).max(64)}).strict().superRefine((e,t)=>{let n=new Set;for(let[r,i]of e.runtimes.entries()){n.has(i.runtimeInstanceId)&&t.addIssue({code:`custom`,message:`duplicate runtime identity ${i.runtimeInstanceId}`,path:[`runtimes`,r,`runtimeInstanceId`]}),n.add(i.runtimeInstanceId);let a=i.latestReport?.report;a&&(a.projectId!==e.projectId||a.environment!==e.environment||a.runtimeInstanceId!==i.runtimeInstanceId)&&t.addIssue({code:`custom`,message:`latest report identity must match the status runtime identity`,path:[`runtimes`,r,`latestReport`,`report`]})}}),q=e.union([T,K]),J=e.object({timestamp:e.iso.datetime(),nonce:c,signature:e.string().regex(/^[a-f0-9]{64}$/)}).strict(),Y=e.object({contractVersion:e.literal(1),report:z,authentication:J}).strict(),X=e.object({contractVersion:e.literal(2),report:V,authentication:J}).strict(),re=e.union([Y,X]);function Z(e){let t=Y.omit({authentication:!0}).extend({authentication:J.omit({signature:!0})}).parse(e);return JSON.stringify(t)}function Q(e){let t=X.omit({authentication:!0}).extend({authentication:J.omit({signature:!0})}).parse(e);return JSON.stringify(t)}function ie(e){return e.contractVersion===1?Z(e):Q(e)}const $=e.enum([`authentication_failed`,`identity_not_registered`,`nonce_replayed`,`report_invalid`,`runtime_identity_mismatch`,`sequence_invalid`,`size_exceeded`,`timestamp_out_of_range`,`unexpected_failure`]),ae=e.discriminatedUnion(`outcome`,[e.object({outcome:e.literal(`accepted`),acceptedSequence:e.number().int().min(1).max(2**53-1),receivedAt:e.iso.datetime()}).strict(),e.object({outcome:e.literal(`duplicate`),acceptedSequence:e.number().int().min(1).max(2**53-1),receivedAt:e.iso.datetime()}).strict(),e.object({outcome:e.literal(`out_of_order`),acceptedSequence:e.number().int().min(1).max(2**53-1),receivedAt:e.iso.datetime()}).strict(),e.object({outcome:e.literal(`rejected`),rejectionCode:$,summary:a(300)}).strict()]);export{h as sentinelActionSchema,M as sentinelAlertPolicySchema,t as sentinelContractVersion,C as sentinelDeliveryReceiptSchema,w as sentinelDiagnosticSchema,D as sentinelEnvironmentBindingSchema,c as sentinelEventIdSchema,u as sentinelEvidenceSchema,R as sentinelHealthComponentSchema,L as sentinelHealthFailureSchema,I as sentinelHealthMetricFactSchema,H as sentinelHealthReportAnySchema,ie as sentinelHealthReportAnySignatureInput,J as sentinelHealthReportAuthenticationSchema,ae as sentinelHealthReportIngestResultSchema,n as sentinelHealthReportMaximumBytes,i as sentinelHealthReportMaximumCapabilities,r as sentinelHealthReportMaximumComponents,$ as sentinelHealthReportRejectionCodeSchema,z as sentinelHealthReportSchema,Z as sentinelHealthReportSignatureInput,re as sentinelHealthReportSubmissionAnySchema,Y as sentinelHealthReportSubmissionSchema,X as sentinelHealthReportSubmissionV2Schema,V as sentinelHealthReportV2Schema,Q as sentinelHealthReportV2SignatureInput,K as sentinelHealthRuntimeStatusSchema,_ as sentinelIncidentEventSchema,A as sentinelPolicyActionSchema,O as sentinelProjectManifestSchema,b as sentinelQueueEventIdentityInput,y as sentinelQueueEventSchema,te as sentinelQueueMetricsSchema,x as sentinelReceiverFailureCodeSchema,S as sentinelReceiverStateSchema,P as sentinelRegistrationCommandSchema,N as sentinelRegistrationSchema,j as sentinelRuleSchema,d as sentinelRunbookSchema,B as sentinelRuntimeCapabilityObservationSchema,T as sentinelRuntimeStatusSchema,q as sentinelStatusResponseSchema,v as sentinelTestEventSchema};
|