@push.rocks/smartnftables 1.2.1 → 1.4.0

package/ts/managed.types.ts

@@ -0,0 +1,91 @@
+/** The caller owns these workload links and keeps them disabled until apply is confirmed. */
+export interface IManagedNftEndpoint {
+  id: string;
+  interfaceIndex: number;
+  interfaceName: string;
+  /** Routed, unbridged veth or L3 TUN; TAP/bridge/uplink interfaces reject. */
+  interfaceKind: 'veth' | 'tun';
+  sourcePrefixes: string[];
+}
+
+/** Null selects the actual local host (input/output only), never an unbound forwarding side. */
+export interface IManagedNftRule {
+  sourceEndpoint: string | null;
+  destinationEndpoint: string | null;
+  sourcePrefix: string;
+  destinationPrefix: string;
+  protocol: 'any' | 'tcp' | 'udp';
+  sourcePort: number | null;
+  destinationPort: number | null;
+}
+
+export interface IManagedNftPolicy {
+  schemaVersion: 1;
+  revision: number;
+  endpoints: IManagedNftEndpoint[];
+  rules: IManagedNftRule[];
+}
+
+export interface IPreparedManagedNftPolicy {
+  policy: IManagedNftPolicy;
+  digest: string;
+}
+
+export interface IManagedNftIdentity {
+  ownerId: string;
+  instanceId: string;
+  tableName: string;
+  bootId: string;
+  namespaceDevice: string;
+  namespaceInode: string;
+}
+
+export interface IManagedNftReceipt {
+  identity: IManagedNftIdentity;
+  tableHandle: string;
+  revision: number;
+  digest: string;
+}
+
+export interface IAppliedManagedNftPolicy {
+  receipt: IManagedNftReceipt;
+  prepared: IPreparedManagedNftPolicy;
+}
+
+/** Persist this complete command before reconcile, then retain its complete result. */
+export interface IManagedNftTransition {
+  previous: IAppliedManagedNftPolicy | null;
+  target: IPreparedManagedNftPolicy;
+}
+
+export interface IManagedNftStatus {
+  identity: IManagedNftIdentity;
+  state: 'idle' | 'applied' | 'failed-owned' | 'released';
+  enforced: boolean;
+  applied: IAppliedManagedNftPolicy | null;
+  pending: IManagedNftTransition | null;
+  error: string | null;
+}
+
+export interface IManagedNftOptions {
+  ownerId: string;
+  /** Caller-retained unique operation identity, at least 16 identifier characters. */
+  instanceId: string;
+  /** Dedicated name beginning snft_; existing foreign tables always reject. */
+  tableName: string;
+  /** Explicit executable selection for qualified distributions and isolated tests. */
+  binaryPath?: string;
+  /** Linux network namespace descriptor, owned by the caller and valid through start().
+   * The native process enters before readiness or netlink activity. Keep a namespace
+   * owner alive for policy lifetime and recovery; this process option is not durable authority. */
+  networkNamespaceFd?: number;
+}
+
+export type TManagedNftCommands = {
+  preparePolicy: { params: IManagedNftPolicy; result: IPreparedManagedNftPolicy };
+  openOwner: { params: Pick<IManagedNftOptions, 'ownerId' | 'instanceId' | 'tableName'>; result: IManagedNftStatus };
+  reconcilePolicy: { params: IManagedNftTransition; result: IAppliedManagedNftPolicy };
+  inspectPolicy: { params: Record<string, never>; result: IManagedNftStatus };
+  releasePolicy: { params: IAppliedManagedNftPolicy; result: { released: true } };
+  closeOwner: { params: Record<string, never>; result: { released: true } };
+};

package/ts/plugins.ts

@@ -1,16 +1,22 @@
 // node native scope
 import * as childProcess from 'node:child_process';
 import * as util from 'node:util';
+import * as path from 'node:path';
+import * as url from 'node:url';
 
 export {
   childProcess,
   util,
+  path,
+  url,
 };
 
 // @push.rocks scope
 import * as smartlog from '@push.rocks/smartlog';
 import * as smartpromise from '@push.rocks/smartpromise';
+import * as smartrust from '@push.rocks/smartrust';
 export {
   smartlog,
   smartpromise,
+  smartrust,
 };