@push.rocks/smartnftables 1.4.0 → 1.5.0

package/rust/src/wire.links.rs

@@ -0,0 +1,268 @@
+use super::{attrs, one, text, Attr, Socket};
+use crate::{Error, Result};
+use std::collections::BTreeSet;
+use std::net::Ipv4Addr;
+use std::time::{Duration, Instant};
+
+struct Link {
+    hardware: u16,
+    flags: u32,
+    attributes: Vec<Attr>,
+}
+
+/// Current local facts only. Peer namespaces and link-generation lifetimes remain caller-owned.
+#[derive(Clone, Copy)]
+pub struct BoundInterface<'a> {
+    pub index: u32,
+    pub name: &'a str,
+    pub kind: &'a str,
+    pub mac: Option<&'a str>,
+    pub link_index: u32,
+    pub addresses: &'a [String],
+}
+
+fn read_link(socket: &mut Socket, index: u32) -> Result<Link> {
+    let sequence = socket.sequence()?;
+    let mut request = Vec::new();
+    request.extend(32_u32.to_ne_bytes());
+    request.extend(18_u16.to_ne_bytes());
+    request.extend(1_u16.to_ne_bytes());
+    request.extend(sequence.to_ne_bytes());
+    request.extend(socket.port.to_ne_bytes());
+    request.extend([0; 4]);
+    request.extend(index.to_ne_bytes());
+    request.extend([0; 8]);
+    socket.send(&request)?;
+    let until = Instant::now() + Duration::from_secs(3);
+    loop {
+        for message in socket.receive(until)? {
+            if message.sequence != sequence {
+                continue;
+            }
+            if message.kind == 2 {
+                let error = i32::from_ne_bytes(
+                    message
+                        .payload
+                        .get(..4)
+                        .ok_or(Error::Protocol)?
+                        .try_into()
+                        .unwrap(),
+                );
+                if error != 0 {
+                    return Err(Error::kernel(error));
+                }
+            } else if message.kind == 16 && message.payload.len() >= 16 {
+                if u32::from_ne_bytes(message.payload[4..8].try_into().unwrap()) != index {
+                    return Err(Error::Conflict);
+                }
+                return Ok(Link {
+                    hardware: u16::from_ne_bytes(message.payload[2..4].try_into().unwrap()),
+                    flags: u32::from_ne_bytes(message.payload[8..12].try_into().unwrap()),
+                    attributes: attrs(&message.payload[16..])?,
+                });
+            } else {
+                return Err(Error::Protocol);
+            }
+        }
+    }
+}
+fn unbridged(attributes: &[Attr]) -> Result<()> {
+    if attributes.iter().any(|attr| attr.id() == 10)
+        && one(attributes, 10)?.value != 0_u32.to_ne_bytes()
+    {
+        return Err(Error::Conflict);
+    }
+    Ok(())
+}
+fn virtual_kind(attributes: &[Attr], kind: &str) -> Result<()> {
+    let info = attrs(&one(attributes, 18)?.value)?;
+    if text(&info, 1)? != kind {
+        return Err(Error::Conflict);
+    }
+    if kind == "tun" && one(&attrs(&one(&info, 2)?.value)?, 3)?.value != [1] {
+        return Err(Error::Conflict);
+    }
+    Ok(())
+}
+/// Preserve schema-v1's local name/index/kind/master checks exactly.
+pub fn verify_interfaces<'a>(
+    interfaces: impl Iterator<Item = (u32, &'a str, &'a str)>,
+) -> Result<()> {
+    let mut socket = Socket::open_protocol(libc::NETLINK_ROUTE)?;
+    for (index, name, kind) in interfaces {
+        let link = read_link(&mut socket, index)?;
+        if text(&link.attributes, 3)? != name {
+            return Err(Error::Conflict);
+        }
+        unbridged(&link.attributes)?;
+        virtual_kind(&link.attributes, kind)?;
+    }
+    Ok(())
+}
+fn matches(link: &Link, binding: &BoundInterface<'_>) -> Result<()> {
+    if text(&link.attributes, 3)? != binding.name || link.flags & libc::IFF_LOOPBACK as u32 != 0 {
+        return Err(Error::Conflict);
+    }
+    unbridged(&link.attributes)?;
+    match binding.kind {
+        "veth" | "tun" => virtual_kind(&link.attributes, binding.kind)?,
+        "ethernet" => {
+            // Physical/VirtIO Ethernet has no IFLA_LINKINFO; bridge, VLAN, bond,
+            // dummy and other virtual kinds are not an implicit uplink role.
+            if link.attributes.iter().any(|item| item.id() == 18) {
+                return Err(Error::Conflict);
+            }
+        }
+        _ => return Err(Error::Invalid),
+    }
+    if binding.kind == "tun" {
+        if link.hardware != 65534 || binding.mac.is_some() {
+            return Err(Error::Conflict);
+        }
+    } else {
+        let mac = &one(&link.attributes, 1)?.value;
+        if link.hardware != 1
+            || mac.len() != 6
+            || mac[0] & 1 != 0
+            || mac.iter().all(|item| *item == 0)
+        {
+            return Err(Error::Conflict);
+        }
+        let actual = mac
+            .iter()
+            .map(|item| format!("{item:02x}"))
+            .collect::<Vec<_>>()
+            .join(":");
+        if binding.mac != Some(actual.as_str()) {
+            return Err(Error::Conflict);
+        }
+    }
+    let peer = if link.attributes.iter().any(|item| item.id() == 5) {
+        u32::from_ne_bytes(
+            one(&link.attributes, 5)?
+                .value
+                .as_slice()
+                .try_into()
+                .map_err(|_| Error::Protocol)?,
+        )
+    } else {
+        binding.index
+    };
+    if peer != binding.link_index {
+        return Err(Error::Conflict);
+    }
+    Ok(())
+}
+fn read_addresses(socket: &mut Socket, index: u32) -> Result<BTreeSet<String>> {
+    let sequence = socket.sequence()?;
+    let mut request = Vec::new();
+    request.extend(24_u32.to_ne_bytes());
+    request.extend(22_u16.to_ne_bytes());
+    request.extend(0x301_u16.to_ne_bytes());
+    request.extend(sequence.to_ne_bytes());
+    request.extend(socket.port.to_ne_bytes());
+    request.extend([libc::AF_INET as u8, 0, 0, 0]);
+    request.extend(index.to_ne_bytes());
+    socket.send(&request)?;
+    let until = Instant::now() + Duration::from_secs(3);
+    let mut result = BTreeSet::new();
+    let mut total = 0;
+    let mut count = 0;
+    loop {
+        for message in socket.receive(until)? {
+            if message.sequence != sequence {
+                continue;
+            }
+            if message.flags & 0x10 != 0 {
+                return Err(Error::Conflict);
+            }
+            if message.kind == 2 || message.kind == 3 {
+                if message.kind == 2 || !message.payload.is_empty() {
+                    let error = i32::from_ne_bytes(
+                        message
+                            .payload
+                            .get(..4)
+                            .ok_or(Error::Protocol)?
+                            .try_into()
+                            .unwrap(),
+                    );
+                    if error != 0 {
+                        return Err(Error::kernel(error));
+                    }
+                }
+                if message.kind == 3 {
+                    return Ok(result);
+                }
+                continue;
+            }
+            count += 1;
+            total += message.payload.len();
+            if message.kind != 20 || message.payload.len() < 8 || count > 4096 || total > 2_097_152
+            {
+                return Err(Error::Protocol);
+            }
+            if message.payload[0] != libc::AF_INET as u8 {
+                return Err(Error::Protocol);
+            }
+            if u32::from_ne_bytes(message.payload[4..8].try_into().unwrap()) != index {
+                continue;
+            }
+            let data = attrs(&message.payload[8..])?;
+            let local = if data.iter().any(|item| item.id() == 2) {
+                one(&data, 2)?
+            } else {
+                one(&data, 1)?
+            };
+            let bytes: [u8; 4] = local
+                .value
+                .as_slice()
+                .try_into()
+                .map_err(|_| Error::Protocol)?;
+            let flags = if data.iter().any(|item| item.id() == 8) {
+                u32::from_ne_bytes(
+                    one(&data, 8)?
+                        .value
+                        .as_slice()
+                        .try_into()
+                        .map_err(|_| Error::Protocol)?,
+                )
+            } else {
+                u32::from(message.payload[2])
+            };
+            // Tentative, failed or deprecated source addresses do not qualify.
+            if flags & (0x40 | 0x08 | 0x20) != 0 {
+                continue;
+            }
+            if data.iter().any(|item| item.id() == 6) {
+                let cache = &one(&data, 6)?.value;
+                if cache.len() != 16 {
+                    return Err(Error::Protocol);
+                }
+                if u32::from_ne_bytes(cache[..4].try_into().unwrap()) == 0
+                    || u32::from_ne_bytes(cache[4..8].try_into().unwrap()) == 0
+                {
+                    continue;
+                }
+            }
+            result.insert(Ipv4Addr::from(bytes).to_string());
+        }
+    }
+}
+pub fn verify_bound_interfaces<'a>(
+    interfaces: impl Iterator<Item = BoundInterface<'a>>,
+) -> Result<()> {
+    let mut socket = Socket::open_protocol(libc::NETLINK_ROUTE)?;
+    for binding in interfaces {
+        matches(&read_link(&mut socket, binding.index)?, &binding)?;
+        let addresses = read_addresses(&mut socket, binding.index)?;
+        if binding
+            .addresses
+            .iter()
+            .any(|address| !addresses.contains(address))
+        {
+            return Err(Error::Conflict);
+        }
+        matches(&read_link(&mut socket, binding.index)?, &binding)?;
+    }
+    Ok(())
+}

package/rust/src/wire.rs

@@ -123,70 +123,9 @@ pub struct Socket {
     sequence: u32,
 }
 
-/// Read-only, namespace-local RTM_GETLINK qualification. This is not a public
-/// routing or link-creation escape; only the strict native compiler calls it.
-pub fn verify_interfaces<'a>(
-    interfaces: impl Iterator<Item = (u32, &'a str, &'a str)>,
-) -> Result<()> {
-    let mut socket = Socket::open_protocol(libc::NETLINK_ROUTE)?;
-    for (index, name, kind) in interfaces {
-        let sequence = socket.sequence()?;
-        let mut request = Vec::new();
-        request.extend(32_u32.to_ne_bytes());
-        request.extend(18_u16.to_ne_bytes());
-        request.extend(1_u16.to_ne_bytes());
-        request.extend(sequence.to_ne_bytes());
-        request.extend(socket.port.to_ne_bytes());
-        request.extend([0; 4]);
-        request.extend(index.to_ne_bytes());
-        request.extend([0; 8]);
-        socket.send(&request)?;
-        let until = Instant::now() + Duration::from_secs(3);
-        let response = 'read: loop {
-            for message in socket.receive(until)? {
-                if message.sequence != sequence {
-                    continue;
-                }
-                if message.kind == 2 {
-                    let error = i32::from_ne_bytes(
-                        message
-                            .payload
-                            .get(..4)
-                            .ok_or(Error::Protocol)?
-                            .try_into()
-                            .unwrap(),
-                    );
-                    if error != 0 {
-                        return Err(Error::kernel(error));
-                    }
-                } else if message.kind == 16 && message.payload.len() >= 16 {
-                    if u32::from_ne_bytes(message.payload[4..8].try_into().unwrap()) != index {
-                        return Err(Error::Conflict);
-                    }
-                    break 'read attrs(&message.payload[16..])?;
-                } else {
-                    return Err(Error::Protocol);
-                }
-            }
-        };
-        if text(&response, 3)? != name {
-            return Err(Error::Conflict);
-        }
-        if response.iter().any(|attr| attr.id() == 10)
-            && one(&response, 10)?.value != 0_u32.to_ne_bytes()
-        {
-            return Err(Error::Conflict);
-        }
-        let info = attrs(&one(&response, 18)?.value)?;
-        if text(&info, 1)? != kind {
-            return Err(Error::Conflict);
-        }
-        if kind == "tun" && one(&attrs(&one(&info, 2)?.value)?, 3)?.value != [1] {
-            return Err(Error::Conflict);
-        }
-    }
-    Ok(())
-}
+#[path = "wire.links.rs"]
+mod links;
+pub use links::{verify_bound_interfaces, verify_interfaces, BoundInterface};
 impl Socket {
     pub fn open() -> Result<Self> {
         Self::open_protocol(libc::NETLINK_NETFILTER)

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '1.4.0',
+  version: '1.5.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/classes.managednftables.ts

@@ -1,6 +1,6 @@
 import * as plugins from './plugins.js';
 import type { IManagedNftOptions, IManagedNftPolicy, IManagedNftTransition, IAppliedManagedNftPolicy,
-  IPreparedManagedNftPolicy, IManagedNftStatus, TManagedNftCommands } from './managed.types.js';
+  IPreparedManagedNftPolicy, IManagedNftStatus, TManagedNftCommands, TManagedNftPolicy } from './managed.types.js';
 
 export class ManagedNftablesError extends Error {
   constructor(public readonly code: string) { super(`Managed nftables ${code}.`); }
@@ -43,9 +43,9 @@ function snapshot<T>(input: T): T {
 }
 
 /** One private native/netlink owner. Persistence and workload link lifetimes belong to its caller. */
-export class ManagedNftables {
+export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
   readonly #options: Readonly<IManagedNftOptions>;
-  #bridge: plugins.smartrust.RustBridge<TManagedNftCommands> | null = null;
+  #bridge: plugins.smartrust.RustBridge<TManagedNftCommands<TPolicy>> | null = null;
   #state: 'new' | 'starting' | 'ready' | 'closing' | 'failed-owned' | 'stopped' = 'new';
   #work: Promise<unknown> | null = null;
   #close: Promise<void> | null = null;
@@ -67,13 +67,13 @@ export class ManagedNftables {
   public get state(): string { return this.#state; }
 
   /** Starts only the compiler/IPC owner. The returned idle status is not enforcement. */
-  public start(): Promise<IManagedNftStatus> {
+  public start(): Promise<IManagedNftStatus<TPolicy>> {
     if (this.#state !== 'new') return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
     this.#state = 'starting';
     const work = (async () => {
       if (process.platform !== 'linux' || !['x64', 'arm64'].includes(process.arch)) throw new ManagedNftablesError('UNSUPPORTED_PLATFORM');
       const root = plugins.url.fileURLToPath(new URL('../', import.meta.url));
-      this.#bridge = new plugins.smartrust.RustBridge<TManagedNftCommands>({
+      this.#bridge = new plugins.smartrust.RustBridge<TManagedNftCommands<TPolicy>>({
         binaryName: 'smartnftables', binaryPath: this.#options.binaryPath
           ?? plugins.path.join(root, 'dist_rust', `smartnftables_linux_${process.arch === 'x64' ? 'amd64' : 'arm64'}_musl`),
         localPaths: [], searchSystemPath: false,
@@ -94,14 +94,14 @@ export class ManagedNftables {
     return this.#track(work);
   }
 
-  public prepare(policy: IManagedNftPolicy): Promise<IPreparedManagedNftPolicy> {
+  public prepare(policy: TPolicy): Promise<IPreparedManagedNftPolicy<TPolicy>> {
     return this.#invoke('preparePolicy', policy);
   }
-  public reconcile(transition: IManagedNftTransition): Promise<IAppliedManagedNftPolicy> {
+  public reconcile(transition: IManagedNftTransition<TPolicy>): Promise<IAppliedManagedNftPolicy<TPolicy>> {
     return this.#invoke('reconcilePolicy', transition);
   }
-  public inspect(): Promise<IManagedNftStatus> { return this.#invoke('inspectPolicy', {}); }
-  public release(expected: IAppliedManagedNftPolicy): Promise<{ released: true }> {
+  public inspect(): Promise<IManagedNftStatus<TPolicy>> { return this.#invoke('inspectPolicy', {}); }
+  public release(expected: IAppliedManagedNftPolicy<TPolicy>): Promise<{ released: true }> {
     return this.#invoke('releasePolicy', expected);
   }
 
@@ -127,16 +127,16 @@ export class ManagedNftables {
     return this.#close;
   }
 
-  #invoke<K extends keyof TManagedNftCommands>(method: K, params: TManagedNftCommands[K]['params']): Promise<TManagedNftCommands[K]['result']> {
+  #invoke<K extends keyof TManagedNftCommands<TPolicy>>(method: K, params: TManagedNftCommands<TPolicy>[K]['params']): Promise<TManagedNftCommands<TPolicy>[K]['result']> {
     if (!['ready', 'failed-owned'].includes(this.#state) || !this.#bridge || this.#work) return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
-    let captured: TManagedNftCommands[K]['params'];
+    let captured: TManagedNftCommands<TPolicy>[K]['params'];
     try { captured = snapshot(params); } catch { return Promise.reject(new ManagedNftablesError('INVALID')); }
     if (method === 'reconcilePolicy' || method === 'releasePolicy') this.#nativeMayOwn = true;
     return this.#track(this.#bridge.sendCommand(method, captured).then((result) => {
       const capturedResult = snapshot(result);
       if (method === 'releasePolicy') this.#nativeMayOwn = false;
       if (this.#state !== 'closing' && (method === 'reconcilePolicy' || method === 'releasePolicy'
-        || method === 'inspectPolicy' && (capturedResult as IManagedNftStatus).error === null)) this.#state = 'ready';
+        || method === 'inspectPolicy' && (capturedResult as IManagedNftStatus<TPolicy>).error === null)) this.#state = 'ready';
       return capturedResult;
     }));
   }

package/ts/index.ts

@@ -2,6 +2,7 @@
 export { SmartNftables } from './nft.manager.js';
 export { ManagedNftables, ManagedNftablesError } from './classes.managednftables.js';
 export type * from './managed.types.js';
+export type * from './managed.egress.types.js';
 
 // Sub-managers
 export { NatManager } from './nft.manager.nat.js';

package/ts/managed.egress.types.ts

@@ -0,0 +1,85 @@
+import type { IManagedNftEndpoint, IManagedNftRule } from './managed.types.js';
+
+/** Namespace-local facts, checked through rtnetlink. The caller retains actual link-generation ownership. */
+export interface IManagedNftLocalLinkV2 {
+  interfaceIndex: number;
+  interfaceName: string;
+  interfaceKind: 'veth' | 'tun' | 'ethernet';
+  /** Canonical unicast Ethernet address, or null for an L3 TUN. */
+  macAddress: string | null;
+  interfaceLinkIndex: number;
+  requiredIpv4Addresses: string[];
+}
+
+export interface IManagedNftPlatformEndpointV2 {
+  id: string;
+  address: string;
+  protocol: 'tcp' | 'udp';
+  port: number;
+}
+
+/** Caller-authenticated complete protected authority; hashing does not attest completeness. */
+export interface IManagedNftProtectionV2 {
+  authorityDigest: string;
+  prefixes: string[];
+  platformEndpoints: IManagedNftPlatformEndpointV2[];
+}
+
+export interface IManagedNftHandoffPortRangeV2 {
+  protocol: 'tcp' | 'udp';
+  first: number;
+  last: number;
+}
+
+export interface IManagedNftHandoffAllocationV2 {
+  lease: { id: string; generation: number; digest: string };
+  transitSourceAddress: string;
+  sourcePortRanges: IManagedNftHandoffPortRangeV2[];
+}
+
+export interface IManagedNftEgressGrantV2 {
+  /** A workload veth endpoint, or the actual router-local host for DNS/relay sockets. */
+  sourceEndpoint: string | null;
+  sourcePrefix: string;
+  destination: { kind: 'public'; prefix: string } | { kind: 'platform'; endpointId: string };
+  protocol: 'tcp' | 'udp';
+  sourcePort: number | null;
+  destinationPort: number | null;
+  /** One exact range from this generation's lease; selects the SNAT range for this grant. */
+  sourcePortRange: { first: number; last: number };
+}
+
+export interface IManagedNftEgressGenerationV2 extends IManagedNftHandoffAllocationV2 {
+  conntrackZone: number;
+  conntrackLabel: string;
+  grants: IManagedNftEgressGrantV2[];
+}
+
+/** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
+export interface IManagedNftRouterEgressScopeV2 {
+  kind: 'routerEgress';
+  endpoints: IManagedNftEndpoint[];
+  rules: IManagedNftRule[];
+  /** One exact local binding for every private endpoint. */
+  links: IManagedNftLocalLinkV2[];
+  handoff: IManagedNftLocalLinkV2;
+  protection: IManagedNftProtectionV2;
+  /** Empty retains private/local enforcement while denying external egress. */
+  generations: IManagedNftEgressGenerationV2[];
+}
+
+/** Shared-host capture barrier and explicit outer SNAT; Docker forwarding remains a separate owner. */
+export interface IManagedNftHostTransitScopeV2 {
+  kind: 'hostTransit';
+  protection: IManagedNftProtectionV2;
+  handoffs: Array<{ link: IManagedNftLocalLinkV2; allocations: IManagedNftHandoffAllocationV2[] }>;
+  uplink: IManagedNftLocalLinkV2;
+  /** Exact current address present on uplink. No masquerade or default-route inference. */
+  snatAddress: string;
+}
+
+export interface IManagedNftPolicyV2 {
+  schemaVersion: 2;
+  revision: number;
+  scope: IManagedNftRouterEgressScopeV2 | IManagedNftHostTransitScopeV2;
+}

package/ts/managed.types.ts

@@ -1,3 +1,5 @@
+import type { IManagedNftPolicyV2 } from './managed.egress.types.js';
+
 /** The caller owns these workload links and keeps them disabled until apply is confirmed. */
 export interface IManagedNftEndpoint {
   id: string;
@@ -26,8 +28,8 @@ export interface IManagedNftPolicy {
   rules: IManagedNftRule[];
 }
 
-export interface IPreparedManagedNftPolicy {
-  policy: IManagedNftPolicy;
+export interface IPreparedManagedNftPolicy<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
+  policy: TPolicy;
   digest: string;
 }
 
@@ -47,23 +49,23 @@ export interface IManagedNftReceipt {
   digest: string;
 }
 
-export interface IAppliedManagedNftPolicy {
+export interface IAppliedManagedNftPolicy<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
   receipt: IManagedNftReceipt;
-  prepared: IPreparedManagedNftPolicy;
+  prepared: IPreparedManagedNftPolicy<TPolicy>;
 }
 
 /** Persist this complete command before reconcile, then retain its complete result. */
-export interface IManagedNftTransition {
-  previous: IAppliedManagedNftPolicy | null;
-  target: IPreparedManagedNftPolicy;
+export interface IManagedNftTransition<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
+  previous: IAppliedManagedNftPolicy<TPolicy> | null;
+  target: IPreparedManagedNftPolicy<TPolicy>;
 }
 
-export interface IManagedNftStatus {
+export interface IManagedNftStatus<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
   identity: IManagedNftIdentity;
   state: 'idle' | 'applied' | 'failed-owned' | 'released';
   enforced: boolean;
-  applied: IAppliedManagedNftPolicy | null;
-  pending: IManagedNftTransition | null;
+  applied: IAppliedManagedNftPolicy<TPolicy> | null;
+  pending: IManagedNftTransition<TPolicy> | null;
   error: string | null;
 }
 
@@ -81,11 +83,13 @@ export interface IManagedNftOptions {
   networkNamespaceFd?: number;
 }
 
-export type TManagedNftCommands = {
-  preparePolicy: { params: IManagedNftPolicy; result: IPreparedManagedNftPolicy };
-  openOwner: { params: Pick<IManagedNftOptions, 'ownerId' | 'instanceId' | 'tableName'>; result: IManagedNftStatus };
-  reconcilePolicy: { params: IManagedNftTransition; result: IAppliedManagedNftPolicy };
-  inspectPolicy: { params: Record<string, never>; result: IManagedNftStatus };
-  releasePolicy: { params: IAppliedManagedNftPolicy; result: { released: true } };
+export type TManagedNftPolicy = IManagedNftPolicy | IManagedNftPolicyV2;
+
+export type TManagedNftCommands<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> = {
+  preparePolicy: { params: TPolicy; result: IPreparedManagedNftPolicy<TPolicy> };
+  openOwner: { params: Pick<IManagedNftOptions, 'ownerId' | 'instanceId' | 'tableName'>; result: IManagedNftStatus<TPolicy> };
+  reconcilePolicy: { params: IManagedNftTransition<TPolicy>; result: IAppliedManagedNftPolicy<TPolicy> };
+  inspectPolicy: { params: Record<string, never>; result: IManagedNftStatus<TPolicy> };
+  releasePolicy: { params: IAppliedManagedNftPolicy<TPolicy>; result: { released: true } };
   closeOwner: { params: Record<string, never>; result: { released: true } };
 };