@dynamicalsystems/idl 0.11.0 → 0.13.0

package/src/extension/release.v1.ts

@@ -0,0 +1,217 @@
+// dsg.extension.release/1
+// Semantic, immutable Extension Release manifests. Publication signatures and
+// observations are separate envelopes; this body never self-references its
+// digest and never carries transport or verification outcomes.
+import { type Static, Type } from "@sinclair/typebox";
+import {
+  closed,
+  Hex64,
+  NonEmptyString,
+  Orn,
+  Reference,
+  SafeInt,
+  UtcSecond,
+  type ProfileEntry,
+} from "../primitives.js";
+
+export const EXTENSION_RELEASE_PROFILE = "dsg.extension.release/1" as const;
+export const EXTENSION_RELEASE_CANONICALIZATION = "RFC8785-JCS-UTF8" as const;
+
+const IdentifierSchema = Type.String({ pattern: "^[a-z][a-z0-9-]*(?:[.-][a-z0-9]+)*$" });
+const IdentifierSet = () => Type.Array(IdentifierSchema, { uniqueItems: true });
+const RequiredStrings = () => Type.Array(NonEmptyString, { minItems: 1, uniqueItems: true });
+
+export const ExtensionReleaseReferenceSchema = Reference;
+export type ExtensionReleaseReference = Static<typeof ExtensionReleaseReferenceSchema>;
+
+export const ExtensionComponentKindSchema = Type.Union([
+  Type.Literal("workflow"),
+  Type.Literal("example"),
+  Type.Literal("contract"),
+  Type.Literal("job-class"),
+  Type.Literal("workload-artifact"),
+  Type.Literal("event-catalog"),
+  Type.Literal("connector"),
+  Type.Literal("module"),
+  Type.Literal("check"),
+  Type.Literal("vocabulary"),
+  Type.Literal("assurance"),
+  Type.Literal("documentation"),
+]);
+export type ExtensionComponentKind = Static<typeof ExtensionComponentKindSchema>;
+
+export const ExtensionComponentReferenceSchema = Reference;
+export type ExtensionComponentReference = Static<typeof ExtensionComponentReferenceSchema>;
+
+const ComponentProperties = {
+  id: IdentifierSchema,
+  reference: ExtensionComponentReferenceSchema,
+  mediaType: NonEmptyString,
+  required: Type.Boolean(),
+  dependsOn: IdentifierSet(),
+};
+
+export const ExtensionComponentSchema = closed({
+  ...ComponentProperties,
+  kind: ExtensionComponentKindSchema,
+});
+export type ExtensionComponent = Static<typeof ExtensionComponentSchema>;
+
+const ComputeComponentKindSchema = Type.Union([
+  Type.Literal("workflow"),
+  Type.Literal("example"),
+  Type.Literal("contract"),
+  Type.Literal("job-class"),
+  Type.Literal("workload-artifact"),
+  Type.Literal("event-catalog"),
+  Type.Literal("connector"),
+  Type.Literal("module"),
+  Type.Literal("check"),
+  Type.Literal("vocabulary"),
+  Type.Literal("assurance"),
+  Type.Literal("documentation"),
+]);
+const ComputeComponentSchema = closed({
+  ...ComponentProperties,
+  kind: ComputeComponentKindSchema,
+});
+const NonComputeComponentKindSchema = Type.Union([
+  Type.Literal("workflow"),
+  Type.Literal("example"),
+  Type.Literal("contract"),
+  Type.Literal("event-catalog"),
+  Type.Literal("connector"),
+  Type.Literal("module"),
+  Type.Literal("check"),
+  Type.Literal("vocabulary"),
+  Type.Literal("assurance"),
+  Type.Literal("documentation"),
+]);
+const NonComputeComponentSchema = closed({
+  ...ComponentProperties,
+  kind: NonComputeComponentKindSchema,
+});
+
+export const ExtensionDependencyKindSchema = Type.Union([
+  Type.Literal("extension-release"),
+  Type.Literal("idl-package"),
+  Type.Literal("module-release"),
+  Type.Literal("law-release"),
+  Type.Literal("event-catalog"),
+  Type.Literal("example-release"),
+  Type.Literal("target-release"),
+]);
+export type ExtensionDependencyKind = Static<typeof ExtensionDependencyKindSchema>;
+
+export const ExtensionDependencySchema = closed({
+  id: IdentifierSchema,
+  kind: ExtensionDependencyKindSchema,
+  reference: Reference,
+  required: Type.Boolean(),
+});
+export type ExtensionDependency = Static<typeof ExtensionDependencySchema>;
+
+/** Shared requirements contain no compute-only workload obligations. */
+export const ExtensionRequirementsSchema = closed({
+  idlProfiles: Type.Array(NonEmptyString, { uniqueItems: true }),
+  roles: Type.Array(NonEmptyString, { uniqueItems: true }),
+  qualification: Type.Optional(Reference),
+  handling: Type.Union([
+    Type.Literal("public"),
+    Type.Literal("restricted"),
+    Type.Literal("confidential"),
+  ]),
+});
+export type ExtensionRequirements = Static<typeof ExtensionRequirementsSchema>;
+
+export const ExtensionComputeRequirementsSchema = closed({
+  idlProfiles: Type.Array(NonEmptyString, { uniqueItems: true }),
+  roles: Type.Array(NonEmptyString, { uniqueItems: true }),
+  qualification: Type.Optional(Reference),
+  handling: Type.Union([
+    Type.Literal("public"),
+    Type.Literal("restricted"),
+    Type.Literal("confidential"),
+  ]),
+  supportedPlatforms: RequiredStrings(),
+  targets: Type.Array(Reference, { uniqueItems: true }),
+  isolation: Type.Union([Type.Literal("ephemeral"), Type.Literal("dedicated")]),
+  retention: Type.Union([
+    Type.Literal("ephemeral"),
+    Type.Literal("bounded"),
+    Type.Literal("durable"),
+  ]),
+  completion: Reference,
+  teardown: Reference,
+  evidence: Reference,
+  replay: Reference,
+});
+export type ExtensionComputeRequirements = Static<typeof ExtensionComputeRequirementsSchema>;
+
+export const ExtensionBoundsSchema = closed({
+  maxDurationSeconds: SafeInt,
+  maxParallelism: SafeInt,
+  maxUsdMicroUnits: SafeInt,
+});
+export type ExtensionBounds = Static<typeof ExtensionBoundsSchema>;
+
+const ReleaseIdentity = {
+  profile: Type.Literal(EXTENSION_RELEASE_PROFILE),
+  schemaVersion: Type.Literal(1),
+  kind: Type.Literal("extension-release"),
+  publisher: Orn,
+  name: IdentifierSchema,
+  version: Type.String({ pattern: "^(?:0|[1-9][0-9]*)\\.[0-9]+\\.[0-9]+$" }),
+  /** Derived from publisher, namespace, name, and version; never from this
+   * body's digest, so canonical hashing has no self-reference. */
+  releaseOrn: Orn,
+  namespace: NonEmptyString,
+  source: closed({
+    repository: NonEmptyString,
+    revision: Type.String({ pattern: "^(?:[0-9a-f]{40}|[0-9a-f]{64})$" }),
+  }),
+  build: closed({ provenance: Reference, sourceDigest: Hex64 }),
+  canonicalization: Type.Literal(EXTENSION_RELEASE_CANONICALIZATION),
+  dependencies: Type.Array(ExtensionDependencySchema, { uniqueItems: true }),
+};
+
+const ComputeReleaseSchema = closed({
+  ...ReleaseIdentity,
+  compute: Type.Literal(true),
+  components: Type.Array(ComputeComponentSchema, { minItems: 1, uniqueItems: true }),
+  requirements: ExtensionComputeRequirementsSchema,
+  bounds: ExtensionBoundsSchema,
+});
+const NonComputeReleaseSchema = closed({
+  ...ReleaseIdentity,
+  compute: Type.Literal(false),
+  components: Type.Array(NonComputeComponentSchema, { minItems: 1, uniqueItems: true }),
+  requirements: ExtensionRequirementsSchema,
+});
+export const ExtensionReleaseSchema = Type.Union([ComputeReleaseSchema, NonComputeReleaseSchema]);
+export type ExtensionRelease = Static<typeof ExtensionReleaseSchema>;
+
+/** Detached publisher envelope. `release.sha256` and `bodySha256` both pin
+ * the RFC 8785 JCS UTF-8 bytes of the semantic release body. */
+export const ExtensionReleaseSignatureSchema = closed({
+  profile: Type.Literal(EXTENSION_RELEASE_PROFILE),
+  schemaVersion: Type.Literal(1),
+  kind: Type.Literal("extension-release-signature"),
+  release: ExtensionReleaseReferenceSchema,
+  publisher: Orn,
+  publicKey: Hex64,
+  bodySha256: Hex64,
+  canonicalization: Type.Literal(EXTENSION_RELEASE_CANONICALIZATION),
+  signature: Type.String({ pattern: "^[0-9a-f]{128}$" }),
+  signedAt: UtcSecond,
+});
+export type ExtensionReleaseSignature = Static<typeof ExtensionReleaseSignatureSchema>;
+
+export const extensionReleaseV1: ProfileEntry = {
+  literal: EXTENSION_RELEASE_PROFILE,
+  rootDocument: "release",
+  documents: {
+    release: ExtensionReleaseSchema,
+    signature: ExtensionReleaseSignatureSchema,
+  },
+};

package/src/index.ts

@@ -153,6 +153,162 @@ export {
 export type { RefusalCodeV3, RefusalStageV3, RefusalV3 } from "./core/refusal.v3.js";
 export { IDENTITY_BINDING_PROFILE, IdentityBindingSchema } from "./core/identity-binding.v1.js";
 export type { IdentityBinding } from "./core/identity-binding.v1.js";
+export {
+  ORGANIZATION_SOURCE_PROFILE,
+  CapabilityOriginSchema,
+  CapabilitySelectionSchema,
+  OrganizationDocumentPathSchema,
+  OrganizationInstructionSchema,
+  OrganizationRootSchema,
+  OrganizationRootV1Schema,
+  OrganizationSourceLocationSchema,
+  OrganizationSpaceSchema,
+  ProjectMembershipSchema,
+  ProjectSourceSchema,
+  ReleaseDeclarationSchema,
+  ReleaseMemberKindSchema,
+  WorkspaceProfileSchema,
+} from "./organization/source.v2.js";
+export type {
+  CapabilityOrigin,
+  CapabilitySelection,
+  OrganizationInstruction,
+  OrganizationRoot,
+  OrganizationRootV1,
+  OrganizationSourceLocation,
+  OrganizationSourceLocationV1,
+  ProjectMembership,
+  ProjectSource,
+  ReleaseDeclaration,
+  ReleaseMemberKind,
+  WorkspaceProfile,
+} from "./organization/source.v2.js";
+export {
+  EXTENSION_RELEASE_PROFILE,
+  EXTENSION_RELEASE_CANONICALIZATION,
+  ExtensionReleaseReferenceSchema,
+  ExtensionComponentReferenceSchema,
+  ExtensionComponentKindSchema,
+  ExtensionComponentSchema,
+  ExtensionDependencyKindSchema,
+  ExtensionDependencySchema,
+  ExtensionRequirementsSchema,
+  ExtensionComputeRequirementsSchema,
+  ExtensionBoundsSchema,
+  ExtensionReleaseSchema,
+  ExtensionReleaseSignatureSchema,
+} from "./extension/release.v1.js";
+export type {
+  ExtensionReleaseReference,
+  ExtensionComponentReference,
+  ExtensionComponentKind,
+  ExtensionComponent,
+  ExtensionDependencyKind,
+  ExtensionDependency,
+  ExtensionRequirements,
+  ExtensionComputeRequirements,
+  ExtensionBounds,
+  ExtensionRelease,
+  ExtensionReleaseSignature,
+} from "./extension/release.v1.js";
+export {
+  ORGANIZATION_SOURCE_V3_PROFILE,
+  OrganizationRootV3Schema,
+  WorkspaceProfileV3Schema,
+  OrganizationSourceProjectSchema,
+  CapabilitySelectionV3Schema,
+  OrganizationSelectionDispositionSchema,
+  AuthoredOverlaySchema,
+  OrganizationDependencyLockSchema,
+  OrganizationSourceReleaseMemberSchema,
+  OrganizationReleaseDeclarationSchema,
+} from "./organization/source.v3.js";
+export type {
+  OrganizationRootV3,
+  WorkspaceProfileV3,
+  OrganizationSourceProject,
+  CapabilitySelectionV3,
+  OrganizationSelectionDisposition,
+  AuthoredOverlay,
+  OrganizationDependencyLock,
+  OrganizationSourceReleaseMember,
+  OrganizationReleaseDeclaration,
+} from "./organization/source.v3.js";
+export {
+  ORGANIZATION_RELEASE_PROFILE,
+  ORGANIZATION_RELEASE_CANONICALIZATION,
+  CompilerContractSchema,
+  DependencyKindSchema,
+  DependencyLockEntrySchema,
+  DependencyLockSchema,
+  OrganizationBuildSchema,
+  BuildSelectionSchema,
+  BuildComponentSchema,
+  OrganizationReleaseMemberKindSchema,
+  OrganizationReleaseMemberSchema,
+  OrganizationReleaseSchema,
+  ComponentBindingSchema,
+  ImportDispositionSchema,
+  ReleaseStatusSchema,
+  ReleaseStatusObservationSchema,
+  ReleaseEligibilitySchema,
+  ApprovedUseSchema,
+  AdmissionRecordSchema,
+  AdmissionStatusObservationSchema,
+  MemberObservationSchema,
+  ActiveMemberSchema,
+  ActiveSetSchema,
+  CatalogEntrySchema,
+  CatalogSchema,
+  BoundAttestationSchema,
+} from "./organization/release.v1.js";
+export type {
+  CompilerContract,
+  DependencyKind,
+  DependencyLockEntry,
+  DependencyLock,
+  OrganizationBuild,
+  BuildSelection,
+  BuildComponent,
+  OrganizationReleaseMemberKind,
+  OrganizationReleaseMember,
+  OrganizationRelease,
+  ComponentBinding,
+  ImportDisposition,
+  ReleaseStatus,
+  ReleaseStatusObservation,
+  ReleaseEligibility,
+  ApprovedUse,
+  AdmissionRecord,
+  AdmissionStatusObservation,
+  MemberObservation,
+  ActiveMember,
+  ActiveSet,
+  CatalogEntry,
+  Catalog,
+  BoundAttestation,
+} from "./organization/release.v1.js";
+export { JOB_CLASS_PROFILE, JobClassBoundsSchema, JobClassSchema } from "./run/job-class.v1.js";
+export type { JobClassBounds, JobClass } from "./run/job-class.v1.js";
+export {
+  WORKLOAD_ARTIFACT_PROFILE,
+  WorkloadArtifactSchema,
+  WorkloadArtifactProvenanceSchema,
+  WorkloadSourceSchema,
+  OciPlatformSchema,
+} from "./run/workload-artifact.v1.js";
+export type {
+  WorkloadArtifact,
+  WorkloadArtifactProvenance,
+  WorkloadSource,
+  OciPlatform,
+} from "./run/workload-artifact.v1.js";
+export {
+  EXECUTION_BINDING_PROFILE,
+  ExecutionBindingSchema,
+  ExecutionRequestEnvelopeSchema,
+} from "./run/execution-binding.v1.js";
+export type { ExecutionBinding, ExecutionRequestEnvelope } from "./run/execution-binding.v1.js";
 
 import type { ProfileEntry } from "./primitives.js";
 import { dispatchConsumeV1 } from "./kernel/dispatch-consume.v1.js";
@@ -173,6 +329,13 @@ import { revocationsV1 } from "./registry/revocations.v1.js";
 import { bootstrapV1 } from "./kernel/bootstrap.v1.js";
 import { ordinaryAuthorityV1 } from "./kernel/ordinary-authority.v1.js";
 import { standingOrderActivationV1 } from "./kernel/standing-order-activation.v1.js";
+import { organizationSourceV2 } from "./organization/source.v2.js";
+import { extensionReleaseV1 } from "./extension/release.v1.js";
+import { organizationSourceV3 } from "./organization/source.v3.js";
+import { organizationReleaseV1 } from "./organization/release.v1.js";
+import { jobClassV1 } from "./run/job-class.v1.js";
+import { workloadArtifactV1 } from "./run/workload-artifact.v1.js";
+import { executionBindingV1 } from "./run/execution-binding.v1.js";
 /** Every profile this version of the package defines, keyed by literal.
  * Profile modules are added here as they are extracted; the rules test
  * and the schema emitter walk this registry, so a module that is not
@@ -196,4 +359,11 @@ export const PROFILES = {
   [bootstrapV1.literal]: bootstrapV1,
   [ordinaryAuthorityV1.literal]: ordinaryAuthorityV1,
   [standingOrderActivationV1.literal]: standingOrderActivationV1,
+  [organizationSourceV2.literal]: organizationSourceV2,
+  [extensionReleaseV1.literal]: extensionReleaseV1,
+  [organizationSourceV3.literal]: organizationSourceV3,
+  [organizationReleaseV1.literal]: organizationReleaseV1,
+  [jobClassV1.literal]: jobClassV1,
+  [workloadArtifactV1.literal]: workloadArtifactV1,
+  [executionBindingV1.literal]: executionBindingV1,
 } satisfies Readonly<Record<string, ProfileEntry>>;