@inf-monkeys-tech/monkeys 1.1.6 → 1.1.8

package/lib/esm/runtime/index.mjs

@@ -15485,11 +15485,6 @@ var DeclarativeAuthoringActionSchema = z14.enum([
   "publish",
   "rollback"
 ]);
-var DeclarativeLegacyMigrationKindSchema = z14.enum([
-  "page",
-  "page-data-assets",
-  "workbench"
-]);
 var DeclarativeErrorEnvelopeSchema = z14.object({
   code: z14.string().trim().min(1),
   message: z14.string().trim().min(1),
@@ -16971,73 +16966,6 @@ var DeclarativePublicationResultSchema = z14.union([
   DeclarativeDirectPublicationResultSchema,
   DeclarativeAtomicPublicationPlanResultSchema
 ]);
-var DeclarativeMigrationDiffEntrySchema = z14.object({
-  path: z14.string().trim().startsWith("/").max(1024),
-  status: z14.enum(["added", "changed", "removed", "unchanged"]),
-  legacyValueHash: Sha256Schema.optional(),
-  declarativeValueHash: Sha256Schema.optional()
-}).strict();
-var DeclarativeMigrationBlockerSchema = z14.object({
-  code: ContractIdentifierSchema,
-  path: z14.string().trim().max(1024).optional(),
-  message: z14.string().trim().min(1).max(4096)
-}).strict();
-var DeclarativeLegacyMigrationInspectionSchema = z14.object({
-  contract: z14.literal("DeclarativeLegacyMigrationInspection"),
-  schemaVersion: z14.literal(1),
-  migrationKind: DeclarativeLegacyMigrationKindSchema,
-  legacyResourceId: ContractIdentifierSchema,
-  sourceRevisionRef: RevisionRefSchema,
-  sourceContentHash: Sha256Schema,
-  legacyAdapterRevisionRef: RevisionRefSchema,
-  targetResourceRef: StableRefSchema,
-  environmentRevisionRef: RevisionRefSchema,
-  routeSpaceRevisionRef: RevisionRefSchema,
-  normalizedPath: z14.string().trim().startsWith("/").max(2048),
-  takeoverAuthorization: LegacyRouteTakeoverAuthorizationSchema,
-  diff: z14.array(DeclarativeMigrationDiffEntrySchema).max(256),
-  blockers: z14.array(DeclarativeMigrationBlockerSchema).max(128),
-  canCreateDraft: z14.boolean(),
-  inspectionFingerprint: Sha256Schema
-}).strict().superRefine((value, context) => {
-  const expectedKind = value.migrationKind === "workbench" ? "workbench" : "page";
-  if (value.targetResourceRef.kind !== expectedKind) {
-    context.addIssue({
-      code: "custom",
-      path: ["targetResourceRef", "kind"],
-      message: `A ${value.migrationKind} migration must target ${expectedKind}.`
-    });
-  }
-  if (value.takeoverAuthorization.inspectedSourceContentHash !== value.sourceContentHash || value.takeoverAuthorization.normalizedPath !== value.normalizedPath || value.takeoverAuthorization.targetResourceRef.kind !== value.targetResourceRef.kind || value.takeoverAuthorization.targetResourceRef.id !== value.targetResourceRef.id || value.takeoverAuthorization.targetResourceRef.ownerRepo !== value.targetResourceRef.ownerRepo) {
-    context.addIssue({
-      code: "custom",
-      path: ["takeoverAuthorization"],
-      message: "The takeover authority must bind the exact inspected source, path and target."
-    });
-  }
-  if (value.canCreateDraft !== (value.blockers.length === 0)) {
-    context.addIssue({
-      code: "custom",
-      path: ["canCreateDraft"],
-      message: "Draft creation is allowed exactly when inspection has no blockers."
-    });
-  }
-});
-var DeclarativeLegacyMigrationCreateDraftIntentSchema = z14.object({
-  inspectionFingerprint: Sha256Schema,
-  expectedSourceRevisionRef: RevisionRefSchema,
-  expectedSourceContentHash: Sha256Schema,
-  idempotencyKey: z14.string().trim().min(1).max(256)
-}).strict();
-var DeclarativeLegacyMigrationCreateDraftResultSchema = z14.object({
-  migrationKind: DeclarativeLegacyMigrationKindSchema,
-  legacyResourceId: ContractIdentifierSchema,
-  inspectionFingerprint: Sha256Schema,
-  sourceRevisionRef: RevisionRefSchema,
-  sourceContentHash: Sha256Schema,
-  takeoverAuthorization: LegacyRouteTakeoverAuthorizationSchema,
-  draft: DeclarativeDraftResultSchema
-}).strict();
 var DeclarativeRetireResultSchema = z14.object({
   action: z14.literal("retire"),
   resourceKind: DeclarativeResourceKindSchema,
@@ -20003,6 +19931,27 @@ var compileNavigationRuntimeBundle = (input) => {
     input.compilerRevisionRef
   );
   const scope = TenantScopeSchema.parse(navigation.tenantScope);
+  const verifiedKernelPageReferences = [...input.verifiedKernelPageReferences ?? []].map((reference, index) => {
+    const parsed = RevisionRefSchema.parse(reference);
+    if (release.target.surface !== "kernel" || parsed.visibility !== "tenant" || !parsed.tenantScope?.teamRef?.id.startsWith("kernel-page.") || parsed.ownerRepo !== "monkeys-server" || !["page", "page-release"].includes(parsed.kind)) {
+      throw new DeclarativeControlCompilationError(
+        "CROSS_TENANT_REFERENCE",
+        `verifiedKernelPageReferences[${index}]`,
+        "Verified Kernel Page references must be exact tenant-scoped Page and PageRelease revisions from the Kernel page catalog."
+      );
+    }
+    if (scopeKey(parsed.tenantScope) === scopeKey(scope)) {
+      throw new DeclarativeControlCompilationError(
+        "CROSS_TENANT_REFERENCE",
+        `verifiedKernelPageReferences[${index}]`,
+        "Verified Kernel Page references must belong to a different tenant scope."
+      );
+    }
+    return parsed;
+  });
+  const verifiedKernelPageReferenceKeys = new Set(
+    verifiedKernelPageReferences.map(revisionRefKey)
+  );
   assertSameTenantScope(release.tenantScope, scope, "release.tenantScope");
   if (navigation.nodes.length > input.limits.maxNavigationNodes)
     throw new DeclarativeControlCompilationError(
@@ -20243,11 +20192,32 @@ var compileNavigationRuntimeBundle = (input) => {
         "Navigation target is active on another surface."
       );
     }
-    assertTenantCompatible(
-      registration.targetRevisionRef,
-      scope,
-      `nodes[${index}].targetRef`
-    );
+    const targetIsForeignTenant = registration.targetRevisionRef.visibility === "tenant" && scopeKey(registration.targetRevisionRef.tenantScope) !== scopeKey(scope);
+    if (targetIsForeignTenant) {
+      const releaseReference = registration.kind === "route" ? registration.releaseRevisionRef : void 0;
+      if (release.target.surface !== "kernel" || registration.kind !== "route" || registration.targetRevisionRef.kind !== "page" || !releaseReference || !verifiedKernelPageReferenceKeys.has(
+        revisionRefKey(registration.targetRevisionRef)
+      ) || !verifiedKernelPageReferenceKeys.has(revisionRefKey(releaseReference))) {
+        throw new DeclarativeControlCompilationError(
+          "CROSS_TENANT_REFERENCE",
+          `nodes[${index}].targetRef`,
+          "Kernel Navigation may retain only Page references independently verified by the authenticated Kernel page catalog."
+        );
+      }
+      if (scopeKey(releaseReference.tenantScope) !== scopeKey(registration.targetRevisionRef.tenantScope)) {
+        throw new DeclarativeControlCompilationError(
+          "CROSS_TENANT_REFERENCE",
+          `nodes[${index}].targetRef`,
+          "Verified Kernel Page and PageRelease references must belong to the same tenant scope."
+        );
+      }
+    } else {
+      assertTenantCompatible(
+        registration.targetRevisionRef,
+        scope,
+        `nodes[${index}].targetRef`
+      );
+    }
     if (!accessPolicyChainImplies(
       [...ancestors, node.audience],
       registration.accessPolicy