@fabricorg/platform-host 7.1.1 → 7.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/README.md +9 -0
- package/dist/index.cjs +433 -229
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +63 -1
- package/dist/index.d.ts +63 -1
- package/dist/index.js +432 -230
- package/dist/index.js.map +1 -1
- package/package.json +3 -3
package/dist/index.d.cts
CHANGED
|
@@ -1167,4 +1167,66 @@ interface CreateDurableSagaParentLifecycleOptions<TDb> {
|
|
|
1167
1167
|
*/
|
|
1168
1168
|
declare function createDurableSagaParentLifecycle<TDb>(options: CreateDurableSagaParentLifecycleOptions<TDb>): HostSagaParentLifecycle;
|
|
1169
1169
|
|
|
1170
|
-
|
|
1170
|
+
interface TenantIsolationScope {
|
|
1171
|
+
tenantId: string;
|
|
1172
|
+
spaceId: string;
|
|
1173
|
+
actorId: string;
|
|
1174
|
+
actorType: ActorType;
|
|
1175
|
+
}
|
|
1176
|
+
interface TenantIsolationSubject<TDb = unknown> {
|
|
1177
|
+
host: GovernedActionHost;
|
|
1178
|
+
store: RecoverablePlatformHostStore<TDb>;
|
|
1179
|
+
/** A governed action registered on the host, and parameters it accepts. */
|
|
1180
|
+
actionId: ActionId;
|
|
1181
|
+
parameters?: Record<string, unknown>;
|
|
1182
|
+
/** Two scopes in different tenants. */
|
|
1183
|
+
ours: TenantIsolationScope;
|
|
1184
|
+
theirs: TenantIsolationScope;
|
|
1185
|
+
/**
|
|
1186
|
+
* Optional: a governed read the subject exposes, scoped as the projection
|
|
1187
|
+
* host scopes it. Returns what a viewer in `scope` sees for the view. Every
|
|
1188
|
+
* row must carry the `tenantId` it belongs to, so the check can tell a row
|
|
1189
|
+
* of ours from a row of theirs that merely looks the same; two tenants may
|
|
1190
|
+
* legitimately hold equal-looking rows.
|
|
1191
|
+
*/
|
|
1192
|
+
read?(scope: TenantIsolationScope): Promise<{
|
|
1193
|
+
allowed: boolean;
|
|
1194
|
+
rows: readonly {
|
|
1195
|
+
tenantId: string;
|
|
1196
|
+
}[];
|
|
1197
|
+
}>;
|
|
1198
|
+
/**
|
|
1199
|
+
* Optional: put the host and store back to a known state before a check.
|
|
1200
|
+
* The checks tolerate accumulated state, and each cleans up any row it
|
|
1201
|
+
* creates directly, so this exists for subjects whose store is shared.
|
|
1202
|
+
*/
|
|
1203
|
+
reset?(): Promise<void> | void;
|
|
1204
|
+
}
|
|
1205
|
+
interface TenantIsolationCheck {
|
|
1206
|
+
id: "fabric.tenancy.invocation-scoped-read.v1" | "fabric.tenancy.idempotency-key-scoped.v1" | "fabric.tenancy.events-scoped.v1" | "fabric.tenancy.worker-claim-scoped.v1" | "fabric.tenancy.completion-scoped.v1" | "fabric.tenancy.projection-scoped.v1";
|
|
1207
|
+
run(subject: TenantIsolationSubject): Promise<string[]>;
|
|
1208
|
+
}
|
|
1209
|
+
interface TenantIsolationResult {
|
|
1210
|
+
passed: boolean;
|
|
1211
|
+
checks: Array<{
|
|
1212
|
+
id: TenantIsolationCheck["id"];
|
|
1213
|
+
status: "passed" | "failed" | "skipped";
|
|
1214
|
+
evidence: string[];
|
|
1215
|
+
error?: string;
|
|
1216
|
+
}>;
|
|
1217
|
+
}
|
|
1218
|
+
/**
|
|
1219
|
+
* The suite any deployment of the host must pass before it claims isolation.
|
|
1220
|
+
*
|
|
1221
|
+
* Six checks: an invocation cannot be read, executed, or completed under
|
|
1222
|
+
* another tenant's scope; an idempotency key is a tenant's own, so the same
|
|
1223
|
+
* key in two tenants is two invocations; a tenant's event stream carries no
|
|
1224
|
+
* other tenant's events; a worker scoped to one tenant never claims another's
|
|
1225
|
+
* work; and, when the subject lends a read, a viewer in the other tenant sees
|
|
1226
|
+
* nothing of ours.
|
|
1227
|
+
*/
|
|
1228
|
+
declare function tenantIsolationChecks(): readonly TenantIsolationCheck[];
|
|
1229
|
+
/** Run every check, returning each result rather than throwing on the first. */
|
|
1230
|
+
declare function runTenantIsolationChecks(subject: TenantIsolationSubject): Promise<TenantIsolationResult>;
|
|
1231
|
+
|
|
1232
|
+
export { type ActionApprovalDecision, type ActionAuthorizationInput, type ActionExecutionAuthorizationInput, type ActionExecutionReason, type ActionInvocationPatch, type ActionInvocationRecord, type AdapterInvocationRecord, type AdapterInvocationStatus, type AdapterReconciliationOutcome, type ApprovalDecisionTransitionResult, type ApprovalPlatformHostStore, type AtomicMutationPlatformHostStore, type AuthorizationBinding, type AuthorizationGoverningMoment, type AuthorizationReconciliationOutcome, type BeginApprovalDecisionInput, type ClaimActionInvocationsInput, type ClaimOutboxInput, type CreateActionInvocationInput, type CreateDurableSagaParentLifecycleOptions, type DispatchActionInput, type DispatchActionResult, type EnterpriseEventEnvelope, type EnterpriseEventPublisher, type EventPayloadClassification, type ExecuteActionResult, type ExecuteInvocationOptions, type ExecutionAttestationRecord, type ExternalCompletion, ExternalCompletionError, type ExternalCompletionRefusal, type ExternalReconciliationRecord, type GovernancePlatformHostStore, type GovernedActionHost, type HitlDecisionEvidence, type HostCompensationRecord, type HostSagaParentApprovalInput, type HostSagaParentCancellationInput, type HostSagaParentCompletionInput, type HostSagaParentFailureInput, type HostSagaParentLifecycle, type HostSagaParentProgressInput, type HostSagaParentProgressRecord, type IdempotencyConflict, IdempotencyConflictError, type InvocationProvenance, type InvocationSource, type KnownActionExecutionReason, type ListActionInvocationsInput, MemoryPlatformHostStore, type MemoryPlatformHostTransactionProvider, type NamespacedAttributes, type OutboxEventMetadata, type OutboxPlatformHostStore, type OutboxRecord, type OutboxRelayOptions, type OutboxRelayResult, type OutboxStatus, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, type PendingAssetEvent, type PendingExternalCompletion, type PersistedActionApprovalDecision, type PlatformActionDispatcher, type PlatformActionWorkerCycleResult, type PlatformActionWorkerOptions, type PlatformHostAuthorization, type PlatformHostHealthCounts, type PlatformHostHealthOptions, type PlatformHostHealthQuery, type PlatformHostHealthSnapshot, type PlatformHostHealthStatus, type PlatformHostHealthStore, type PlatformHostLifecycleTelemetry, type PlatformHostMetricName, type PlatformHostMetricTelemetry, type PlatformHostMetricType, type PlatformHostMutationTransaction, type PlatformHostOptions, type PlatformHostReadinessReason, type PlatformHostSqlClient, type PlatformHostSqlResult, type PlatformHostStore, type PlatformHostTelemetry, type PlatformHostTelemetryAttribute, type PlatformHostTelemetryEventName, type PlatformHostTelemetryHook, type PlatformHostTelemetryInput, type PlatformHostTelemetryRecord, type PlatformHostWorkerHealthInput, type PolicyEvaluationRecord, type PolicyObligationRecord, type PostgresMigration, PostgresPlatformHostStore, type PostgresPlatformHostTransactionContext, type PostgresPlatformHostTransactionProvider, type ReconcileOverdueCompletionsInput, type RecordedExternalCompletion, type RecoverablePlatformHostStore, type RenewActionInvocationLeaseInput, type SubmitActionInput, type SubmitActionResult, type TenantIsolationCheck, type TenantIsolationResult, type TenantIsolationScope, type TenantIsolationSubject, type UpdateLeasedActionInvocationInput, applyPostgresMigrations, canonicalJson, cloneOutboxRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, getPlatformHostHealthSnapshot, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, runTenantIsolationChecks, tenantIsolationChecks, toEnterpriseEventEnvelope };
|
package/dist/index.d.ts
CHANGED
|
@@ -1167,4 +1167,66 @@ interface CreateDurableSagaParentLifecycleOptions<TDb> {
|
|
|
1167
1167
|
*/
|
|
1168
1168
|
declare function createDurableSagaParentLifecycle<TDb>(options: CreateDurableSagaParentLifecycleOptions<TDb>): HostSagaParentLifecycle;
|
|
1169
1169
|
|
|
1170
|
-
|
|
1170
|
+
interface TenantIsolationScope {
|
|
1171
|
+
tenantId: string;
|
|
1172
|
+
spaceId: string;
|
|
1173
|
+
actorId: string;
|
|
1174
|
+
actorType: ActorType;
|
|
1175
|
+
}
|
|
1176
|
+
interface TenantIsolationSubject<TDb = unknown> {
|
|
1177
|
+
host: GovernedActionHost;
|
|
1178
|
+
store: RecoverablePlatformHostStore<TDb>;
|
|
1179
|
+
/** A governed action registered on the host, and parameters it accepts. */
|
|
1180
|
+
actionId: ActionId;
|
|
1181
|
+
parameters?: Record<string, unknown>;
|
|
1182
|
+
/** Two scopes in different tenants. */
|
|
1183
|
+
ours: TenantIsolationScope;
|
|
1184
|
+
theirs: TenantIsolationScope;
|
|
1185
|
+
/**
|
|
1186
|
+
* Optional: a governed read the subject exposes, scoped as the projection
|
|
1187
|
+
* host scopes it. Returns what a viewer in `scope` sees for the view. Every
|
|
1188
|
+
* row must carry the `tenantId` it belongs to, so the check can tell a row
|
|
1189
|
+
* of ours from a row of theirs that merely looks the same; two tenants may
|
|
1190
|
+
* legitimately hold equal-looking rows.
|
|
1191
|
+
*/
|
|
1192
|
+
read?(scope: TenantIsolationScope): Promise<{
|
|
1193
|
+
allowed: boolean;
|
|
1194
|
+
rows: readonly {
|
|
1195
|
+
tenantId: string;
|
|
1196
|
+
}[];
|
|
1197
|
+
}>;
|
|
1198
|
+
/**
|
|
1199
|
+
* Optional: put the host and store back to a known state before a check.
|
|
1200
|
+
* The checks tolerate accumulated state, and each cleans up any row it
|
|
1201
|
+
* creates directly, so this exists for subjects whose store is shared.
|
|
1202
|
+
*/
|
|
1203
|
+
reset?(): Promise<void> | void;
|
|
1204
|
+
}
|
|
1205
|
+
interface TenantIsolationCheck {
|
|
1206
|
+
id: "fabric.tenancy.invocation-scoped-read.v1" | "fabric.tenancy.idempotency-key-scoped.v1" | "fabric.tenancy.events-scoped.v1" | "fabric.tenancy.worker-claim-scoped.v1" | "fabric.tenancy.completion-scoped.v1" | "fabric.tenancy.projection-scoped.v1";
|
|
1207
|
+
run(subject: TenantIsolationSubject): Promise<string[]>;
|
|
1208
|
+
}
|
|
1209
|
+
interface TenantIsolationResult {
|
|
1210
|
+
passed: boolean;
|
|
1211
|
+
checks: Array<{
|
|
1212
|
+
id: TenantIsolationCheck["id"];
|
|
1213
|
+
status: "passed" | "failed" | "skipped";
|
|
1214
|
+
evidence: string[];
|
|
1215
|
+
error?: string;
|
|
1216
|
+
}>;
|
|
1217
|
+
}
|
|
1218
|
+
/**
|
|
1219
|
+
* The suite any deployment of the host must pass before it claims isolation.
|
|
1220
|
+
*
|
|
1221
|
+
* Six checks: an invocation cannot be read, executed, or completed under
|
|
1222
|
+
* another tenant's scope; an idempotency key is a tenant's own, so the same
|
|
1223
|
+
* key in two tenants is two invocations; a tenant's event stream carries no
|
|
1224
|
+
* other tenant's events; a worker scoped to one tenant never claims another's
|
|
1225
|
+
* work; and, when the subject lends a read, a viewer in the other tenant sees
|
|
1226
|
+
* nothing of ours.
|
|
1227
|
+
*/
|
|
1228
|
+
declare function tenantIsolationChecks(): readonly TenantIsolationCheck[];
|
|
1229
|
+
/** Run every check, returning each result rather than throwing on the first. */
|
|
1230
|
+
declare function runTenantIsolationChecks(subject: TenantIsolationSubject): Promise<TenantIsolationResult>;
|
|
1231
|
+
|
|
1232
|
+
export { type ActionApprovalDecision, type ActionAuthorizationInput, type ActionExecutionAuthorizationInput, type ActionExecutionReason, type ActionInvocationPatch, type ActionInvocationRecord, type AdapterInvocationRecord, type AdapterInvocationStatus, type AdapterReconciliationOutcome, type ApprovalDecisionTransitionResult, type ApprovalPlatformHostStore, type AtomicMutationPlatformHostStore, type AuthorizationBinding, type AuthorizationGoverningMoment, type AuthorizationReconciliationOutcome, type BeginApprovalDecisionInput, type ClaimActionInvocationsInput, type ClaimOutboxInput, type CreateActionInvocationInput, type CreateDurableSagaParentLifecycleOptions, type DispatchActionInput, type DispatchActionResult, type EnterpriseEventEnvelope, type EnterpriseEventPublisher, type EventPayloadClassification, type ExecuteActionResult, type ExecuteInvocationOptions, type ExecutionAttestationRecord, type ExternalCompletion, ExternalCompletionError, type ExternalCompletionRefusal, type ExternalReconciliationRecord, type GovernancePlatformHostStore, type GovernedActionHost, type HitlDecisionEvidence, type HostCompensationRecord, type HostSagaParentApprovalInput, type HostSagaParentCancellationInput, type HostSagaParentCompletionInput, type HostSagaParentFailureInput, type HostSagaParentLifecycle, type HostSagaParentProgressInput, type HostSagaParentProgressRecord, type IdempotencyConflict, IdempotencyConflictError, type InvocationProvenance, type InvocationSource, type KnownActionExecutionReason, type ListActionInvocationsInput, MemoryPlatformHostStore, type MemoryPlatformHostTransactionProvider, type NamespacedAttributes, type OutboxEventMetadata, type OutboxPlatformHostStore, type OutboxRecord, type OutboxRelayOptions, type OutboxRelayResult, type OutboxStatus, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, type PendingAssetEvent, type PendingExternalCompletion, type PersistedActionApprovalDecision, type PlatformActionDispatcher, type PlatformActionWorkerCycleResult, type PlatformActionWorkerOptions, type PlatformHostAuthorization, type PlatformHostHealthCounts, type PlatformHostHealthOptions, type PlatformHostHealthQuery, type PlatformHostHealthSnapshot, type PlatformHostHealthStatus, type PlatformHostHealthStore, type PlatformHostLifecycleTelemetry, type PlatformHostMetricName, type PlatformHostMetricTelemetry, type PlatformHostMetricType, type PlatformHostMutationTransaction, type PlatformHostOptions, type PlatformHostReadinessReason, type PlatformHostSqlClient, type PlatformHostSqlResult, type PlatformHostStore, type PlatformHostTelemetry, type PlatformHostTelemetryAttribute, type PlatformHostTelemetryEventName, type PlatformHostTelemetryHook, type PlatformHostTelemetryInput, type PlatformHostTelemetryRecord, type PlatformHostWorkerHealthInput, type PolicyEvaluationRecord, type PolicyObligationRecord, type PostgresMigration, PostgresPlatformHostStore, type PostgresPlatformHostTransactionContext, type PostgresPlatformHostTransactionProvider, type ReconcileOverdueCompletionsInput, type RecordedExternalCompletion, type RecoverablePlatformHostStore, type RenewActionInvocationLeaseInput, type SubmitActionInput, type SubmitActionResult, type TenantIsolationCheck, type TenantIsolationResult, type TenantIsolationScope, type TenantIsolationSubject, type UpdateLeasedActionInvocationInput, applyPostgresMigrations, canonicalJson, cloneOutboxRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, getPlatformHostHealthSnapshot, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, runTenantIsolationChecks, tenantIsolationChecks, toEnterpriseEventEnvelope };
|