@scoutflo/topology-contracts 0.8.0 → 0.8.1

package/dist/test/runtime-provenance.test.js

@@ -0,0 +1,134 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = __importDefault(require("node:test"));
+const src_1 = require("../src");
+(0, node_test_1.default)('accepts only credential-free HTTPS source repositories with a path', () => {
+    strict_1.default.equal(src_1.safeSourceRepositorySchema.safeParse('https://github.com/example/checkout').success, true);
+    for (const repository of [
+        'github.com/example/checkout',
+        'git@github.com:example/checkout.git',
+        'http://github.com/example/checkout',
+        'https://user:token@github.com/example/checkout',
+        'https://github.com/example/checkout?ref=main',
+        'https://github.com/example/checkout#readme',
+        'https://github.com/',
+    ]) {
+        strict_1.default.equal(src_1.safeSourceRepositorySchema.safeParse(repository).success, false, repository);
+    }
+});
+(0, node_test_1.default)('parses immutable observed-vs-claimed provenance for Gateway consumption', () => {
+    const parsed = src_1.runtimeWorkloadProvenanceSchema.parse({
+        version: src_1.RUNTIME_CONTAINER_PROVENANCE_VERSION,
+        containers: [{
+                name: 'checkout',
+                kind: 'regular',
+                scope: { namespace: 'prod', workload_kind: 'Deployment', workload_name: 'checkout' },
+                requested_image: 'registry.example/checkout:v2',
+                observed_image: 'registry.example/checkout@sha256:abc',
+                observed_image_id: 'containerd://sha256:abc',
+                digest: `sha256:${'a'.repeat(64)}`,
+                runtime_identity_status: 'verified',
+                consistency_status: 'consistent',
+                claimed_source: {
+                    repository: 'https://github.com/example/checkout',
+                    commit_sha: '0123456789abcdef0123456789abcdef01234567',
+                    scope: 'pod_metadata',
+                    status: 'unverified',
+                    reason: 'Pod metadata is a claim and is not runtime verification.',
+                },
+            }],
+        truncated: false,
+    });
+    strict_1.default.equal(parsed.containers[0]?.digest, `sha256:${'a'.repeat(64)}`);
+    strict_1.default.equal(parsed.containers[0]?.claimed_source?.status, 'unverified');
+});
+(0, node_test_1.default)('allows duplicate names across kinds but enforces deterministic ordering', () => {
+    strict_1.default.equal(src_1.runtimeWorkloadProvenanceSchema.safeParse({
+        version: src_1.RUNTIME_CONTAINER_PROVENANCE_VERSION,
+        containers: [
+            { name: 'agent', kind: 'regular', runtime_identity_status: 'unavailable', runtime_identity_reason: 'not observed', consistency_status: 'unknown', consistency_reason: 'not compared' },
+            { name: 'agent', kind: 'init', runtime_identity_status: 'unavailable', runtime_identity_reason: 'not observed', consistency_status: 'unknown', consistency_reason: 'not compared' },
+        ],
+        truncated: false,
+    }).success, true);
+    strict_1.default.equal(src_1.runtimeWorkloadProvenanceSchema.safeParse({
+        version: src_1.RUNTIME_CONTAINER_PROVENANCE_VERSION,
+        containers: [
+            { name: 'agent', kind: 'init', runtime_identity_status: 'unavailable', runtime_identity_reason: 'not observed', consistency_status: 'unknown', consistency_reason: 'not compared' },
+            { name: 'agent', kind: 'regular', runtime_identity_status: 'unavailable', runtime_identity_reason: 'not observed', consistency_status: 'unknown', consistency_reason: 'not compared' },
+        ],
+        truncated: false,
+    }).success, false);
+});
+(0, node_test_1.default)('rejects oversized containers and untruthful truncation metadata', () => {
+    const container = {
+        name: 'agent', kind: 'regular',
+        runtime_identity_status: 'unavailable', runtime_identity_reason: 'not observed',
+        consistency_status: 'unknown', consistency_reason: 'not compared',
+    };
+    strict_1.default.equal(src_1.runtimeWorkloadProvenanceSchema.safeParse({
+        version: src_1.RUNTIME_CONTAINER_PROVENANCE_VERSION,
+        containers: Array.from({ length: 129 }, (_, index) => ({ ...container, name: `agent-${index}` })),
+        truncated: true,
+        reason: 'container_limit_exceeded',
+        containers_omitted: 1,
+    }).success, false);
+    strict_1.default.equal(src_1.runtimeWorkloadProvenanceSchema.safeParse({
+        containers: [],
+        truncated: true,
+        reason: 'container_limit_exceeded',
+    }).success, true);
+    const compatibleRawK8sOutput = src_1.runtimeWorkloadProvenanceSchema.parse({
+        containers: [],
+        truncated: true,
+        reason: 'container_limit_exceeded',
+    });
+    strict_1.default.equal(compatibleRawK8sOutput.version, src_1.RUNTIME_CONTAINER_PROVENANCE_VERSION);
+    strict_1.default.equal(src_1.runtimeWorkloadProvenanceSchema.safeParse({
+        version: src_1.RUNTIME_CONTAINER_PROVENANCE_VERSION,
+        containers: [{
+                ...container,
+                claimed_source: {
+                    repository: 'https://github.com/example/checkout',
+                    commit_sha: 'v2.1.0',
+                    scope: 'pod_metadata',
+                    status: 'unverified',
+                },
+            }],
+        truncated: false,
+    }).success, false);
+    strict_1.default.equal(src_1.runtimeWorkloadProvenanceSchema.safeParse({
+        containers: [{
+                ...container,
+                runtime_identity_status: 'verified',
+                digest: 'sha256:not-a-digest',
+            }],
+        truncated: false,
+    }).success, false);
+    strict_1.default.equal(src_1.runtimeWorkloadProvenanceSchema.safeParse({
+        containers: [{
+                ...container,
+                claimed_source: {
+                    repository: 'https://github.com/example/checkout',
+                    scope: 'pod_metadata',
+                    status: 'unavailable',
+                    reason: 'metadata unavailable',
+                },
+            }],
+        truncated: false,
+    }).success, false);
+    strict_1.default.equal(src_1.runtimeWorkloadProvenanceSchema.safeParse({
+        containers: [{
+                ...container,
+                runtime_identity_status: 'verified',
+                runtime_identity_reason: undefined,
+                digest: `sha256:${'A'.repeat(64)}`,
+            }],
+        truncated: false,
+    }).success, false);
+});
+//# sourceMappingURL=runtime-provenance.test.js.map

package/dist/test/runtime-provenance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-provenance.test.js","sourceRoot":"","sources":["../../test/runtime-provenance.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,0DAA6B;AAC7B,gCAIgB;AAEhB,IAAA,mBAAI,EAAC,oEAAoE,EAAE,GAAG,EAAE;IAC9E,gBAAM,CAAC,KAAK,CAAC,gCAA0B,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxG,KAAK,MAAM,UAAU,IAAI;QACvB,6BAA6B;QAC7B,qCAAqC;QACrC,oCAAoC;QACpC,gDAAgD;QAChD,8CAA8C;QAC9C,4CAA4C;QAC5C,qBAAqB;KACtB,EAAE,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,gCAA0B,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,yEAAyE,EAAE,GAAG,EAAE;IACnF,MAAM,MAAM,GAAG,qCAA+B,CAAC,KAAK,CAAC;QACnD,OAAO,EAAE,0CAAoC;QAC7C,UAAU,EAAE,CAAC;gBACX,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE;gBACpF,eAAe,EAAE,8BAA8B;gBAC/C,cAAc,EAAE,sCAAsC;gBACtD,iBAAiB,EAAE,yBAAyB;gBAC5C,MAAM,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;gBAClC,uBAAuB,EAAE,UAAU;gBACnC,kBAAkB,EAAE,YAAY;gBAChC,cAAc,EAAE;oBACd,UAAU,EAAE,qCAAqC;oBACjD,UAAU,EAAE,0CAA0C;oBACtD,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,0DAA0D;iBACnE;aACF,CAAC;QACF,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;IAEH,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,yEAAyE,EAAE,GAAG,EAAE;IACnF,gBAAM,CAAC,KAAK,CAAC,qCAA+B,CAAC,SAAS,CAAC;QACrD,OAAO,EAAE,0CAAoC;QAC7C,UAAU,EAAE;YACV,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,uBAAuB,EAAE,aAAa,EAAE,uBAAuB,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE;YACtL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,aAAa,EAAE,uBAAuB,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE;SACpL;QACD,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClB,gBAAM,CAAC,KAAK,CAAC,qCAA+B,CAAC,SAAS,CAAC;QACrD,OAAO,EAAE,0CAAoC;QAC7C,UAAU,EAAE;YACV,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,aAAa,EAAE,uBAAuB,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE;YACnL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,uBAAuB,EAAE,aAAa,EAAE,uBAAuB,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE;SACvL;QACD,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,SAAS,GAAG;QAChB,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;QAC9B,uBAAuB,EAAE,aAAa,EAAE,uBAAuB,EAAE,cAAc;QAC/E,kBAAkB,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc;KACzD,CAAC;IACX,gBAAM,CAAC,KAAK,CAAC,qCAA+B,CAAC,SAAS,CAAC;QACrD,OAAO,EAAE,0CAAoC;QAC7C,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,SAAS,KAAK,EAAE,EAAE,CAAC,CAAC;QACjG,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,0BAA0B;QAClC,kBAAkB,EAAE,CAAC;KACtB,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnB,gBAAM,CAAC,KAAK,CAAC,qCAA+B,CAAC,SAAS,CAAC;QACrD,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,0BAA0B;KACnC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClB,MAAM,sBAAsB,GAAG,qCAA+B,CAAC,KAAK,CAAC;QACnE,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,0BAA0B;KACnC,CAAC,CAAC;IACH,gBAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,OAAO,EAAE,0CAAoC,CAAC,CAAC;IACnF,gBAAM,CAAC,KAAK,CAAC,qCAA+B,CAAC,SAAS,CAAC;QACrD,OAAO,EAAE,0CAAoC;QAC7C,UAAU,EAAE,CAAC;gBACX,GAAG,SAAS;gBACZ,cAAc,EAAE;oBACd,UAAU,EAAE,qCAAqC;oBACjD,UAAU,EAAE,QAAQ;oBACpB,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,YAAY;iBACrB;aACF,CAAC;QACF,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnB,gBAAM,CAAC,KAAK,CAAC,qCAA+B,CAAC,SAAS,CAAC;QACrD,UAAU,EAAE,CAAC;gBACX,GAAG,SAAS;gBACZ,uBAAuB,EAAE,UAAU;gBACnC,MAAM,EAAE,qBAAqB;aAC9B,CAAC;QACF,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnB,gBAAM,CAAC,KAAK,CAAC,qCAA+B,CAAC,SAAS,CAAC;QACrD,UAAU,EAAE,CAAC;gBACX,GAAG,SAAS;gBACZ,cAAc,EAAE;oBACd,UAAU,EAAE,qCAAqC;oBACjD,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE,sBAAsB;iBAC/B;aACF,CAAC;QACF,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnB,gBAAM,CAAC,KAAK,CAAC,qCAA+B,CAAC,SAAS,CAAC;QACrD,UAAU,EAAE,CAAC;gBACX,GAAG,SAAS;gBACZ,uBAAuB,EAAE,UAAU;gBACnC,uBAAuB,EAAE,SAAS;gBAClC,MAAM,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;aACnC,CAAC;QACF,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scoutflo/topology-contracts",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Pure shared topology vocabulary and Zod schemas for Scoutflo topology workflows.",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
@@ -9,7 +9,8 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "test": "npm run build && node --test dist/test/*.test.js"
+    "test": "npm run build && node --test dist/test/*.test.js && node scripts/verify-packed-exports.cjs",
+    "prepack": "npm run build"
   },
   "keywords": [
     "scoutflo",