@inf-monkeys-tech/monkeys 1.1.7 → 1.1.9

package/lib/esm/runtime/index.mjs

@@ -17905,13 +17905,17 @@ var requireDependencies = (snapshot, required) => {
     }
   }
 };
-var assertDependencyScopes = (snapshot, scope) => snapshot.forEach(
-  (dependency, index) => assertTenantCompatible(
-    dependency.revisionRef,
+var assertDependencyScopes = (snapshot, scope, allowedForeignReferences = /* @__PURE__ */ new Set()) => snapshot.forEach((dependency, index) => {
+  const reference = dependency.revisionRef;
+  const foreign = reference.visibility === "tenant" && scopeKey(reference.tenantScope) !== scopeKey(scope);
+  if (foreign && allowedForeignReferences.has(revisionRefKey(reference)))
+    return;
+  assertTenantCompatible(
+    reference,
     scope,
     `dependencySnapshot[${index}].revisionRef`
-  )
-);
+  );
+});
 var requireReleaseReady = (release) => {
   if (release.operation === "deactivate") {
     throw new DeclarativeControlCompilationError(
@@ -19931,6 +19935,27 @@ var compileNavigationRuntimeBundle = (input) => {
     input.compilerRevisionRef
   );
   const scope = TenantScopeSchema.parse(navigation.tenantScope);
+  const verifiedKernelPageReferences = [...input.verifiedKernelPageReferences ?? []].map((reference, index) => {
+    const parsed = RevisionRefSchema.parse(reference);
+    if (release.target.surface !== "kernel" || parsed.visibility !== "tenant" || !parsed.tenantScope?.teamRef?.id.startsWith("kernel-page.") || parsed.ownerRepo !== "monkeys-server" || !["page", "page-release"].includes(parsed.kind)) {
+      throw new DeclarativeControlCompilationError(
+        "CROSS_TENANT_REFERENCE",
+        `verifiedKernelPageReferences[${index}]`,
+        "Verified Kernel Page references must be exact tenant-scoped Page and PageRelease revisions from the Kernel page catalog."
+      );
+    }
+    if (scopeKey(parsed.tenantScope) === scopeKey(scope)) {
+      throw new DeclarativeControlCompilationError(
+        "CROSS_TENANT_REFERENCE",
+        `verifiedKernelPageReferences[${index}]`,
+        "Verified Kernel Page references must belong to a different tenant scope."
+      );
+    }
+    return parsed;
+  });
+  const verifiedKernelPageReferenceKeys = new Set(
+    verifiedKernelPageReferences.map(revisionRefKey)
+  );
   assertSameTenantScope(release.tenantScope, scope, "release.tenantScope");
   if (navigation.nodes.length > input.limits.maxNavigationNodes)
     throw new DeclarativeControlCompilationError(
@@ -19985,7 +20010,11 @@ var compileNavigationRuntimeBundle = (input) => {
     release.dependencySnapshot,
     navigationDependencies(navigation, release, compilerRevisionRef)
   );
-  assertDependencyScopes(release.dependencySnapshot, scope);
+  assertDependencyScopes(
+    release.dependencySnapshot,
+    scope,
+    verifiedKernelPageReferenceKeys
+  );
   const targetRegistry = input.targetRegistry.map((registration, index) => {
     const common = {
       stableTargetRef: StableRefSchema.parse(registration.stableTargetRef),
@@ -20171,11 +20200,32 @@ var compileNavigationRuntimeBundle = (input) => {
         "Navigation target is active on another surface."
       );
     }
-    assertTenantCompatible(
-      registration.targetRevisionRef,
-      scope,
-      `nodes[${index}].targetRef`
-    );
+    const targetIsForeignTenant = registration.targetRevisionRef.visibility === "tenant" && scopeKey(registration.targetRevisionRef.tenantScope) !== scopeKey(scope);
+    if (targetIsForeignTenant) {
+      const releaseReference = registration.kind === "route" ? registration.releaseRevisionRef : void 0;
+      if (release.target.surface !== "kernel" || registration.kind !== "route" || registration.targetRevisionRef.kind !== "page" || !releaseReference || !verifiedKernelPageReferenceKeys.has(
+        revisionRefKey(registration.targetRevisionRef)
+      ) || !verifiedKernelPageReferenceKeys.has(revisionRefKey(releaseReference))) {
+        throw new DeclarativeControlCompilationError(
+          "CROSS_TENANT_REFERENCE",
+          `nodes[${index}].targetRef`,
+          "Kernel Navigation may retain only Page references independently verified by the authenticated Kernel page catalog."
+        );
+      }
+      if (scopeKey(releaseReference.tenantScope) !== scopeKey(registration.targetRevisionRef.tenantScope)) {
+        throw new DeclarativeControlCompilationError(
+          "CROSS_TENANT_REFERENCE",
+          `nodes[${index}].targetRef`,
+          "Verified Kernel Page and PageRelease references must belong to the same tenant scope."
+        );
+      }
+    } else {
+      assertTenantCompatible(
+        registration.targetRevisionRef,
+        scope,
+        `nodes[${index}].targetRef`
+      );
+    }
     if (!accessPolicyChainImplies(
       [...ancestors, node.audience],
       registration.accessPolicy