@substrat-run/contracts 0.139.0 → 0.141.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/capability.d.ts +4 -0
- package/dist/capability.d.ts.map +1 -1
- package/dist/capability.js +4 -0
- package/dist/capability.js.map +1 -1
- package/dist/connections.d.ts +131 -0
- package/dist/connections.d.ts.map +1 -1
- package/dist/connections.js +90 -1
- package/dist/connections.js.map +1 -1
- package/dist/control-plane.d.ts +251 -10
- package/dist/control-plane.d.ts.map +1 -1
- package/dist/control-plane.js +173 -14
- package/dist/control-plane.js.map +1 -1
- package/dist/deploy.d.ts +71 -3
- package/dist/deploy.d.ts.map +1 -1
- package/dist/deploy.js +109 -3
- package/dist/deploy.js.map +1 -1
- package/dist/email-intent.d.ts +106 -0
- package/dist/email-intent.d.ts.map +1 -0
- package/dist/email-intent.js +111 -0
- package/dist/email-intent.js.map +1 -0
- package/dist/entity-state.d.ts +1 -0
- package/dist/entity-state.d.ts.map +1 -1
- package/dist/entity-state.js +6 -0
- package/dist/entity-state.js.map +1 -1
- package/dist/ids.d.ts +13 -0
- package/dist/ids.d.ts.map +1 -1
- package/dist/ids.js +30 -0
- package/dist/ids.js.map +1 -1
- package/dist/index.d.ts +3 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -0
- package/dist/index.js.map +1 -1
- package/dist/introspection.d.ts +22 -0
- package/dist/introspection.d.ts.map +1 -1
- package/dist/introspection.js +1 -1
- package/dist/introspection.js.map +1 -1
- package/dist/kernel-events.d.ts.map +1 -1
- package/dist/kernel-events.js +7 -1
- package/dist/kernel-events.js.map +1 -1
- package/dist/manifest.d.ts +46 -0
- package/dist/manifest.d.ts.map +1 -1
- package/dist/manifest.js +33 -2
- package/dist/manifest.js.map +1 -1
- package/dist/model.d.ts +68 -1
- package/dist/model.d.ts.map +1 -1
- package/dist/model.js +110 -2
- package/dist/model.js.map +1 -1
- package/dist/operations.d.ts +119 -1
- package/dist/operations.d.ts.map +1 -1
- package/dist/operations.js +364 -1
- package/dist/operations.js.map +1 -1
- package/dist/pagination.d.ts +0 -0
- package/dist/pagination.d.ts.map +1 -1
- package/dist/pagination.js +0 -0
- package/dist/pagination.js.map +1 -1
- package/dist/peer.d.ts +34 -0
- package/dist/peer.d.ts.map +1 -1
- package/dist/peer.js +17 -2
- package/dist/peer.js.map +1 -1
- package/dist/permission.d.ts +50 -0
- package/dist/permission.d.ts.map +1 -1
- package/dist/permission.js +52 -3
- package/dist/permission.js.map +1 -1
- package/dist/registry-diff.d.ts +18 -1
- package/dist/registry-diff.d.ts.map +1 -1
- package/dist/registry-diff.js +24 -7
- package/dist/registry-diff.js.map +1 -1
- package/dist/registry.d.ts +6 -0
- package/dist/registry.d.ts.map +1 -1
- package/dist/registry.js +8 -2
- package/dist/registry.js.map +1 -1
- package/dist/relay-caller.d.ts +28 -0
- package/dist/relay-caller.d.ts.map +1 -0
- package/dist/relay-caller.js +28 -0
- package/dist/relay-caller.js.map +1 -0
- package/dist/subject-erasure.d.ts +109 -0
- package/dist/subject-erasure.d.ts.map +1 -0
- package/dist/subject-erasure.js +93 -0
- package/dist/subject-erasure.js.map +1 -0
- package/dist/vertical-events.d.ts +1 -0
- package/dist/vertical-events.d.ts.map +1 -1
- package/dist/vertical-events.js +6 -0
- package/dist/vertical-events.js.map +1 -1
- package/dist/wire-headers.d.ts +6 -1
- package/dist/wire-headers.d.ts.map +1 -1
- package/dist/wire-headers.js.map +1 -1
- package/package.json +3 -2
package/dist/peer.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
-
import { instant, permissionKey, platformActorId, scopeId, tenantId, verticalSlug } from './ids.js';
|
|
2
|
+
import { auditOperationId, instant, permissionKey, platformActorId, scopeId, tenantId, verticalSlug } from './ids.js';
|
|
3
3
|
/**
|
|
4
4
|
* Peers (#1706): another vertical of the SAME tenant, calling this one's operations through the
|
|
5
5
|
* platform — with no token, no pasted API key, no hostname and no outbound allowlist entry.
|
|
@@ -84,6 +84,19 @@ export const verticalResolution = z.discriminatedUnion('outcome', [
|
|
|
84
84
|
count: z.number().int().min(2),
|
|
85
85
|
}),
|
|
86
86
|
]);
|
|
87
|
+
/** A peer binding is an explicit choice by the tenant for one calling scope and target slug. */
|
|
88
|
+
export const peerBinding = z.object({
|
|
89
|
+
tenantId,
|
|
90
|
+
callerScopeId: scopeId,
|
|
91
|
+
vertical: verticalSlug,
|
|
92
|
+
targetScopeId: scopeId,
|
|
93
|
+
invalidated: z.boolean(),
|
|
94
|
+
});
|
|
95
|
+
/** A stale explicit choice refuses the call, even if another instance is now the only live one. */
|
|
96
|
+
export const peerInstanceResolution = z.discriminatedUnion('outcome', [
|
|
97
|
+
...verticalResolution.options,
|
|
98
|
+
z.object({ outcome: z.literal('bound-unavailable'), tenantId, vertical: verticalSlug, targetScopeId: scopeId }),
|
|
99
|
+
]);
|
|
87
100
|
/**
|
|
88
101
|
* The per-(scope, peer) kill switch (#1706) — a tenant turning one calling vertical off on one
|
|
89
102
|
* scope, and back on, WITHOUT a push. `HostAdmin.revokeFromPeer` / `restoreToPeer`, the mirror of
|
|
@@ -112,12 +125,14 @@ export const peerSwitchOutcome = z.object({
|
|
|
112
125
|
});
|
|
113
126
|
/** What `revokeFromPeer` / `restoreToPeer` answer: the position the switch is now in. */
|
|
114
127
|
export const peerSwitchResult = z.object({
|
|
115
|
-
operationId:
|
|
128
|
+
operationId: auditOperationId,
|
|
116
129
|
vertical: verticalSlug,
|
|
117
130
|
calls: z.enum(['on', 'off']),
|
|
118
131
|
changed: z.boolean(),
|
|
119
132
|
/** The grants this call tombstoned (off) or restored (on), by permission key. */
|
|
120
133
|
permissions: z.array(permissionKey),
|
|
134
|
+
/** #2089: as `SystemSwitchResult.auditWarning`. */
|
|
135
|
+
auditWarning: z.string().optional(),
|
|
121
136
|
});
|
|
122
137
|
/**
|
|
123
138
|
* One key of `ScopeHost.peerCovers`: does `vertical:<slug>` hold it at the scope node RIGHT NOW —
|
package/dist/peer.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"peer.js","sourceRoot":"","sources":["../src/peer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"peer.js","sourceRoot":"","sources":["../src/peer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAEtH;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAGnF,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC,MAAM,YAAY,GAAG,CAAI,KAAmB,EAAW,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;AAE/F;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,GAAG,CAAC,mBAAmB,CAAC;SACxB,MAAM,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IAChF,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,aAAa,CAAC;SACpB,GAAG,CAAC,CAAC,EAAE;QACN,OAAO,EACL,gGAAgG;YAChG,iDAAiD;KACpD,CAAC;SACD,GAAG,CAAC,oBAAoB,CAAC;SACzB,MAAM,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;CAClF,CAAC,CAAC;AAGH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;AAGxF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAChE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACxE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACnF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC/B,QAAQ;QACR,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;CACH,CAAC,CAAC;AAGH,gGAAgG;AAChG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,aAAa,EAAE,OAAO;IACtB,QAAQ,EAAE,YAAY;IACtB,aAAa,EAAE,OAAO;IACtB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACzB,CAAC,CAAC;AAGH,mGAAmG;AACnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACpE,GAAG,kBAAkB,CAAC,OAAO;IAC7B,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;CAChH,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,YAAY;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC1C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IACnC,iGAAiG;IACjG,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACtC,8CAA8C;IAC9C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,yFAAyF;AACzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,WAAW,EAAE,gBAAgB;IAC7B,QAAQ,EAAE,YAAY;IACtB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,iFAAiF;IACjF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IACnC,mDAAmD;IACnD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAGvF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,YAAY;IACtB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;CAC1C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC,MAAM,CAAC;IAC1D,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,EAAE,EAAE,OAAO;KACZ,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC"}
|
package/dist/permission.d.ts
CHANGED
|
@@ -246,6 +246,7 @@ export declare const systemSwitchResult: z.ZodObject<{
|
|
|
246
246
|
}>;
|
|
247
247
|
changed: z.ZodBoolean;
|
|
248
248
|
permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
249
|
+
auditWarning: z.ZodOptional<z.ZodString>;
|
|
249
250
|
}, z.core.$strip>;
|
|
250
251
|
export type SystemSwitchResult = z.infer<typeof systemSwitchResult>;
|
|
251
252
|
/**
|
|
@@ -370,6 +371,55 @@ export declare const entityLinkedPayload: z.ZodObject<{
|
|
|
370
371
|
}, z.core.$strip>;
|
|
371
372
|
}, z.core.$strip>;
|
|
372
373
|
export type EntityLinkedPayload = z.infer<typeof entityLinkedPayload>;
|
|
374
|
+
/**
|
|
375
|
+
* A declared entity-grant SHAPE (`ENTITY_GRANTS`) grew, and a person who already held it on an
|
|
376
|
+
* entity was given the keys it gained (#2071). The kernel writes it at reconcile, one per
|
|
377
|
+
* (person, entity) topped up, so the entity's own history says which keys arrived, for whom,
|
|
378
|
+
* and when. The deploy whose declared shape did it is the outbox row's `version`. Entity: the
|
|
379
|
+
* entity the shape is held on.
|
|
380
|
+
*
|
|
381
|
+
* A top-up never brings back a key that was revoked from the person on that entity: the
|
|
382
|
+
* tombstone (K-21) is the record that someone took it back, and it is left as it is.
|
|
383
|
+
*/
|
|
384
|
+
export declare const ENTITY_GRANTS_TOPPED_UP = "entity.grants-topped-up";
|
|
385
|
+
export declare const entityGrantsToppedUpPayload: z.ZodObject<{
|
|
386
|
+
entity: z.ZodObject<{
|
|
387
|
+
entityType: z.ZodString;
|
|
388
|
+
entityId: z.ZodString;
|
|
389
|
+
}, z.core.$strip>;
|
|
390
|
+
principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
|
|
391
|
+
added: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
392
|
+
}, z.core.$strip>;
|
|
393
|
+
export type EntityGrantsToppedUpPayload = z.infer<typeof entityGrantsToppedUpPayload>;
|
|
394
|
+
/**
|
|
395
|
+
* A key a declared entity-grant SHAPE retired (#2082) was taken back from a person who held the
|
|
396
|
+
* shape on an entity. The kernel writes it at reconcile, one per (person, entity), when the
|
|
397
|
+
* reviewed registry of the version reached declares the key under the shape's `retired`. The
|
|
398
|
+
* key's row is TOMBSTONED (K-21), never deleted, and the deploy that did it is the outbox
|
|
399
|
+
* row's `version`. Entity: the entity the shape is held on.
|
|
400
|
+
*
|
|
401
|
+
* One tuple is one authority: a direct `ctx.grant` of the same key to the same person on the
|
|
402
|
+
* same entity is the same row, so it goes too.
|
|
403
|
+
*/
|
|
404
|
+
export declare const ENTITY_GRANTS_RETIRED = "entity.grants-retired";
|
|
405
|
+
export declare const entityGrantsRetiredPayload: z.ZodObject<{
|
|
406
|
+
entity: z.ZodObject<{
|
|
407
|
+
entityType: z.ZodString;
|
|
408
|
+
entityId: z.ZodString;
|
|
409
|
+
}, z.core.$strip>;
|
|
410
|
+
principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
|
|
411
|
+
removed: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
412
|
+
}, z.core.$strip>;
|
|
413
|
+
export type EntityGrantsRetiredPayload = z.infer<typeof entityGrantsRetiredPayload>;
|
|
414
|
+
/**
|
|
415
|
+
* The marker a declared shape's grant leaves beside its keys (#2071):
|
|
416
|
+
* `(principal:<id>, bootstrap, <entityType>:<id>)`. It says "this person was given the
|
|
417
|
+
* declared shape on this entity", which no set of keys can say — someone ctx.granted one of
|
|
418
|
+
* those keys holds a subset of the shape and is not a holder of it. The checker walks only
|
|
419
|
+
* `granted:` and `role:` relations, so the marker grants nothing by itself. Tombstoning it
|
|
420
|
+
* stops the top-ups for that person on that entity.
|
|
421
|
+
*/
|
|
422
|
+
export declare const ENTITY_SHAPE_MARKER_RELATION = "bootstrap";
|
|
373
423
|
export declare const relationName: z.ZodString;
|
|
374
424
|
export declare const relationTuple: z.ZodObject<{
|
|
375
425
|
subject: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
|
package/dist/permission.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AASxD,eAAO,MAAM,IAAI;;;iBAGf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,eAAO,MAAM,OAAO,aAAwD,CAAC;AAE7E,eAAO,MAAM,cAAc;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;iBAAsC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;mBAuBvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,UAAU,YAAa,YAAY,KAAG,MAAyC,CAAC;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAahC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW;;;;;;;;;iBAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAIvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB;;;;;;;iBAuB9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;mBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;iBAY7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;;;iBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;iBAelC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;iBAU7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAwBpE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzE,eAAO,MAAM,SAAS,qDAAuC,CAAC;AAC9D,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CA0B1E;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAEjD,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;iBAIhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,eAAO,MAAM,mBAAmB;;;;;;;;;iBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,eAAO,MAAM,2BAA2B;;;;;;;iBAKtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D,eAAO,MAAM,0BAA0B;;;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,cAAc,CAAC;AAGxD,eAAO,MAAM,YAAY,aAAqC,CAAC;AAE/D,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAQ1D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;8BAUnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAOhD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,QAAQ;;;;;;8BAGnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,eAAe,YAAa,SAAS,MAAM,EAAE,WAAW,MAAM,OAAO,MAAM,KAAG,MAClB,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,aAAa,EAAE,GAC9B,MAAM,GAAG,SAAS,CAOpB;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
|
package/dist/permission.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
-
import { capabilityId, instant, moduleId, permissionKey, platformActorId, principalId, scopeId, tenantId, verticalSlug, } from './ids.js';
|
|
2
|
+
import { auditOperationId, capabilityId, instant, moduleId, permissionKey, platformActorId, principalId, scopeId, tenantId, verticalSlug, } from './ids.js';
|
|
3
3
|
import { entityRef } from './events.js';
|
|
4
4
|
import { substratError } from './errors.js';
|
|
5
5
|
import { OBJECT_ID, OBJECT_NAMESPACE, isKernelNamespace, objectRefString } from './object-ref.js';
|
|
@@ -233,11 +233,17 @@ export const switchedOffInUnit = z.union([
|
|
|
233
233
|
* so an operator can tie what the route answered to what the log recorded.
|
|
234
234
|
*/
|
|
235
235
|
export const systemSwitchResult = z.object({
|
|
236
|
-
operationId:
|
|
236
|
+
operationId: auditOperationId,
|
|
237
237
|
moduleId,
|
|
238
238
|
schedules: z.enum(['on', 'off']),
|
|
239
239
|
changed: z.boolean(),
|
|
240
240
|
permissions: z.array(permissionKey),
|
|
241
|
+
/**
|
|
242
|
+
* #2089: present only when the switch moved but its outcome row could not be written to the
|
|
243
|
+
* admin log, as an audited change's `AuditedAnswer.auditWarning`. Still a success: the switch
|
|
244
|
+
* is where this answer says, and the scheduled settle closes the intent as `unknown`.
|
|
245
|
+
*/
|
|
246
|
+
auditWarning: z.string().optional(),
|
|
241
247
|
});
|
|
242
248
|
/**
|
|
243
249
|
* One module's schedule-switch position on a scope (#1674) — bare, with no audit join.
|
|
@@ -288,7 +294,7 @@ export const systemSwitchRecord = z.object({
|
|
|
288
294
|
position: z.enum(['on', 'off']),
|
|
289
295
|
actor: platformActorId,
|
|
290
296
|
reason: z.string(),
|
|
291
|
-
operationId:
|
|
297
|
+
operationId: auditOperationId,
|
|
292
298
|
at: instant,
|
|
293
299
|
});
|
|
294
300
|
// ============================================================================
|
|
@@ -376,6 +382,49 @@ export const entityLinkedPayload = z.object({
|
|
|
376
382
|
child: entityRef,
|
|
377
383
|
parent: entityRef,
|
|
378
384
|
});
|
|
385
|
+
/**
|
|
386
|
+
* A declared entity-grant SHAPE (`ENTITY_GRANTS`) grew, and a person who already held it on an
|
|
387
|
+
* entity was given the keys it gained (#2071). The kernel writes it at reconcile, one per
|
|
388
|
+
* (person, entity) topped up, so the entity's own history says which keys arrived, for whom,
|
|
389
|
+
* and when. The deploy whose declared shape did it is the outbox row's `version`. Entity: the
|
|
390
|
+
* entity the shape is held on.
|
|
391
|
+
*
|
|
392
|
+
* A top-up never brings back a key that was revoked from the person on that entity: the
|
|
393
|
+
* tombstone (K-21) is the record that someone took it back, and it is left as it is.
|
|
394
|
+
*/
|
|
395
|
+
export const ENTITY_GRANTS_TOPPED_UP = 'entity.grants-topped-up';
|
|
396
|
+
export const entityGrantsToppedUpPayload = z.object({
|
|
397
|
+
entity: entityRef,
|
|
398
|
+
principal: principalId,
|
|
399
|
+
/** The keys the shape gained that this person now holds on the entity, sorted. */
|
|
400
|
+
added: z.array(permissionKey).min(1),
|
|
401
|
+
});
|
|
402
|
+
/**
|
|
403
|
+
* A key a declared entity-grant SHAPE retired (#2082) was taken back from a person who held the
|
|
404
|
+
* shape on an entity. The kernel writes it at reconcile, one per (person, entity), when the
|
|
405
|
+
* reviewed registry of the version reached declares the key under the shape's `retired`. The
|
|
406
|
+
* key's row is TOMBSTONED (K-21), never deleted, and the deploy that did it is the outbox
|
|
407
|
+
* row's `version`. Entity: the entity the shape is held on.
|
|
408
|
+
*
|
|
409
|
+
* One tuple is one authority: a direct `ctx.grant` of the same key to the same person on the
|
|
410
|
+
* same entity is the same row, so it goes too.
|
|
411
|
+
*/
|
|
412
|
+
export const ENTITY_GRANTS_RETIRED = 'entity.grants-retired';
|
|
413
|
+
export const entityGrantsRetiredPayload = z.object({
|
|
414
|
+
entity: entityRef,
|
|
415
|
+
principal: principalId,
|
|
416
|
+
/** The retired keys this person no longer holds on the entity, sorted. */
|
|
417
|
+
removed: z.array(permissionKey).min(1),
|
|
418
|
+
});
|
|
419
|
+
/**
|
|
420
|
+
* The marker a declared shape's grant leaves beside its keys (#2071):
|
|
421
|
+
* `(principal:<id>, bootstrap, <entityType>:<id>)`. It says "this person was given the
|
|
422
|
+
* declared shape on this entity", which no set of keys can say — someone ctx.granted one of
|
|
423
|
+
* those keys holds a subset of the shape and is not a holder of it. The checker walks only
|
|
424
|
+
* `granted:` and `role:` relations, so the marker grants nothing by itself. Tombstoning it
|
|
425
|
+
* stops the top-ups for that person on that entity.
|
|
426
|
+
*/
|
|
427
|
+
export const ENTITY_SHAPE_MARKER_RELATION = 'bootstrap';
|
|
379
428
|
// 'member' | 'parent' | 'role:staff' | 'granted:workorder:read' …
|
|
380
429
|
export const relationName = z.string().regex(/^[a-z0-9_:-]+$/);
|
|
381
430
|
export const relationTuple = z.object({
|
package/dist/permission.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,aAAa,EACb,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,EACR,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAkB,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,aAAa,EAAwB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElG,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAO;IACZ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW;IACX,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAGH,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,gFAAgF;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,+EAA+E;IAC/E,mFAAmF;IACnF,gDAAgD;IAChD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACrD,mFAAmF;IACnF,kFAAkF;IAClF,sFAAsF;IACtF,iFAAiF;IACjF,mFAAmF;IACnF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;IAC7D,yFAAyF;IACzF,yFAAyF;IACzF,yFAAyF;IACzF,yFAAyF;IACzF,yFAAyF;IACzF,0FAA0F;IAC1F,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;CAC5E,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAqB,EAAU,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AAE7F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,QAAQ;IACR,uFAAuF;IACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,aAAa;IACzB;qFACiF;IACjF,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,aAAa;IACzB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW;IACX,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ;IACR,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC1C,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,gFAAgF;IAChF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,iFAAiF;IACjF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IACnC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC9C;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACtC;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC;IACvC,mBAAmB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxC,mBAAmB,CAAC,IAAI,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1F,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,
|
|
1
|
+
{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,aAAa,EACb,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,EACR,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAkB,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,aAAa,EAAwB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElG,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAO;IACZ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW;IACX,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAGH,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,gFAAgF;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,+EAA+E;IAC/E,mFAAmF;IACnF,gDAAgD;IAChD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACrD,mFAAmF;IACnF,kFAAkF;IAClF,sFAAsF;IACtF,iFAAiF;IACjF,mFAAmF;IACnF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;IAC7D,yFAAyF;IACzF,yFAAyF;IACzF,yFAAyF;IACzF,yFAAyF;IACzF,yFAAyF;IACzF,0FAA0F;IAC1F,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;CAC5E,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAqB,EAAU,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AAE7F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,QAAQ;IACR,uFAAuF;IACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,aAAa;IACzB;qFACiF;IACjF,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,aAAa;IACzB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW;IACX,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ;IACR,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC1C,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,gFAAgF;IAChF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,iFAAiF;IACjF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IACnC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC9C;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACtC;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC;IACvC,mBAAmB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxC,mBAAmB,CAAC,IAAI,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1F,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,gBAAgB;IAC7B,QAAQ;IACR,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IACnC;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ;IACR,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;CAC9C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,CAAC;IAChE,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,EAAE,EAAE,OAAO;KACZ,CAAC;SACD,QAAQ,EAAE;IACb;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,gBAAgB;IAC7B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,+EAA+E;AAE/E,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,gBAAgB;AAChB,EAAE;AACF,mFAAmF;AACnF,wFAAwF;AACxF,uFAAuF;AACvF,0FAA0F;AAC1F,yFAAyF;AACzF,2FAA2F;AAC3F,wEAAwE;AACxE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzE,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,EAAe,CAAC;AAG9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,MAAiB,EAAE,IAAY;IAC7D,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,OAAO,MAAM,EAAE,UAAU,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,uEAAuE;SACjF,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,IAAI,MAAM,CAAC,UAAU,2DAA2D;SAC1F,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,MAAM,EAAE,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,mBAAmB,EACnB,GAAG,IAAI,0BAA0B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,0BAA0B;YAC/E,gEAAgE,EAClE,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,OAAO,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAe,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,EAAE,EAAE,SAAS;CACd,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC;AAE7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,WAAW;IACtB,kFAAkF;IAClF,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrC,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,WAAW;IACtB,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,4DAA4D;AAC5D,+EAA+E;AAE/E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,OAAO,EAAE,aAAa;QACtB,IAAI;KACL,CAAC;CACH,CAAC,CAAC;AAGH,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5D,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAA0B,EAAE,OAAe,EAAE,GAAW,EAAU,EAAE,CAClG,cAAc,GAAG,KAAK,OAAO,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,KAA+B;IAE/B,MAAM,GAAG,GAAG,WAAW,UAAU,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW;IACX,IAAI;IACJ,WAAW,EAAE,CAAC,CAAC,KAAK,CAClB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CACH;CACF,CAAC,CAAC"}
|
package/dist/registry-diff.d.ts
CHANGED
|
@@ -18,6 +18,8 @@ export interface RegistryLike {
|
|
|
18
18
|
entityGrants: ReadonlyArray<{
|
|
19
19
|
entityType: string;
|
|
20
20
|
permissions: readonly string[];
|
|
21
|
+
bootstrap?: true;
|
|
22
|
+
retired?: readonly string[];
|
|
21
23
|
}>;
|
|
22
24
|
}
|
|
23
25
|
export interface RegistryDiff {
|
|
@@ -32,11 +34,18 @@ export interface RegistryDiff {
|
|
|
32
34
|
isNew: boolean;
|
|
33
35
|
isGone: boolean;
|
|
34
36
|
}>;
|
|
35
|
-
/**
|
|
37
|
+
/**
|
|
38
|
+
* Entity-narrowed grant SHAPES that changed — which keys a per-entity grant may carry. #2082:
|
|
39
|
+
* `retired` is the keys this version newly declares taken back from existing holders, and
|
|
40
|
+
* `kept` the keys it drops from a bootstrap shape WITHOUT retiring them, which existing holders
|
|
41
|
+
* keep. A sharing shape has no holders to keep or lose anything, so its `kept` is empty.
|
|
42
|
+
*/
|
|
36
43
|
grantChanges: Array<{
|
|
37
44
|
entityType: string;
|
|
38
45
|
added: string[];
|
|
39
46
|
removed: string[];
|
|
47
|
+
retired: string[];
|
|
48
|
+
kept: string[];
|
|
40
49
|
isNew: boolean;
|
|
41
50
|
isGone: boolean;
|
|
42
51
|
}>;
|
|
@@ -48,6 +57,14 @@ export interface RegistryDiff {
|
|
|
48
57
|
* to look before an update lands.
|
|
49
58
|
*/
|
|
50
59
|
export declare function diffRegistries(from: RegistryLike, to: RegistryLike): RegistryDiff;
|
|
60
|
+
/**
|
|
61
|
+
* #2082: what a grant-shape change does to the people who ALREADY hold the shape, one sentence
|
|
62
|
+
* per key, for every reader of the diff to show as written. A key retired is taken from every
|
|
63
|
+
* holder — and one tuple is one authority, so a direct grant of it on the same entity goes too.
|
|
64
|
+
* A key dropped without being retired stays with them: the reconcile takes back only what a
|
|
65
|
+
* version declares retired.
|
|
66
|
+
*/
|
|
67
|
+
export declare function grantShapeHolderNotes(g: Pick<RegistryDiff['grantChanges'][number], 'retired' | 'kept'>): string[];
|
|
51
68
|
/** Whether the diff holds anything at all — a key, a role or a grant shape moved. */
|
|
52
69
|
export declare function hasRegistryChange(d: RegistryDiff): boolean;
|
|
53
70
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry-diff.d.ts","sourceRoot":"","sources":["../src/registry-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,KAAK,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtE,YAAY,EAAE,aAAa,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"registry-diff.d.ts","sourceRoot":"","sources":["../src/registry-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,KAAK,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtE,YAAY,EAAE,aAAa,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACpI;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,uFAAuF;IACvF,WAAW,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACzG;;;;;OAKG;IACH,YAAY,EAAE,KAAK,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC,CAAC;CACJ;AAQD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,GAAG,YAAY,CAuCjF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,GAAG,MAAM,EAAE,CAKjH;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAQ1D;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtE,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,YAAY,GAAG,iBAAiB,CAepE;AAgBD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5C,EAAE,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1C,IAAI,GAAE,YAAuC,GAC5C,MAAM,EAAE,CAQV"}
|
package/dist/registry-diff.js
CHANGED
|
@@ -25,18 +25,22 @@ export function diffRegistries(from, to) {
|
|
|
25
25
|
if (added.length || removed.length || isNew || isGone)
|
|
26
26
|
roleChanges.push({ key, added, removed, isNew, isGone });
|
|
27
27
|
}
|
|
28
|
-
const fromGrants = new Map(from.entityGrants.map((g) => [g.entityType, g
|
|
29
|
-
const toGrants = new Map(to.entityGrants.map((g) => [g.entityType, g
|
|
28
|
+
const fromGrants = new Map(from.entityGrants.map((g) => [g.entityType, g]));
|
|
29
|
+
const toGrants = new Map(to.entityGrants.map((g) => [g.entityType, g]));
|
|
30
30
|
const grantChanges = [];
|
|
31
31
|
for (const entityType of new Set([...fromGrants.keys(), ...toGrants.keys()])) {
|
|
32
32
|
const before = fromGrants.get(entityType);
|
|
33
33
|
const after = toGrants.get(entityType);
|
|
34
|
-
const added = gained(before, after);
|
|
35
|
-
const removed = gained(after, before);
|
|
34
|
+
const added = gained(before?.permissions, after?.permissions);
|
|
35
|
+
const removed = gained(after?.permissions, before?.permissions);
|
|
36
|
+
const retired = gained(before?.retired, after?.retired);
|
|
37
|
+
const bootstrap = !!(before?.bootstrap || after?.bootstrap);
|
|
38
|
+
const kept = bootstrap ? removed.filter((k) => !(after?.retired ?? []).includes(k)) : [];
|
|
36
39
|
const isNew = !before && !!after;
|
|
37
40
|
const isGone = !!before && !after;
|
|
38
|
-
if (added.length || removed.length || isNew || isGone)
|
|
39
|
-
grantChanges.push({ entityType, added, removed, isNew, isGone });
|
|
41
|
+
if (added.length || removed.length || retired.length || isNew || isGone) {
|
|
42
|
+
grantChanges.push({ entityType, added, removed, retired, kept, isNew, isGone });
|
|
43
|
+
}
|
|
40
44
|
}
|
|
41
45
|
return {
|
|
42
46
|
addedKeys: [...toKeys.keys()].filter((k) => !fromKeys.has(k)),
|
|
@@ -46,6 +50,19 @@ export function diffRegistries(from, to) {
|
|
|
46
50
|
grantChanges,
|
|
47
51
|
};
|
|
48
52
|
}
|
|
53
|
+
/**
|
|
54
|
+
* #2082: what a grant-shape change does to the people who ALREADY hold the shape, one sentence
|
|
55
|
+
* per key, for every reader of the diff to show as written. A key retired is taken from every
|
|
56
|
+
* holder — and one tuple is one authority, so a direct grant of it on the same entity goes too.
|
|
57
|
+
* A key dropped without being retired stays with them: the reconcile takes back only what a
|
|
58
|
+
* version declares retired.
|
|
59
|
+
*/
|
|
60
|
+
export function grantShapeHolderNotes(g) {
|
|
61
|
+
return [
|
|
62
|
+
...g.retired.map((k) => `existing holders lose ${k}, including any direct grant of ${k} on the same entity`),
|
|
63
|
+
...g.kept.map((k) => `existing holders keep ${k}: dropped from the shape but not retired`),
|
|
64
|
+
];
|
|
65
|
+
}
|
|
49
66
|
/** Whether the diff holds anything at all — a key, a role or a grant shape moved. */
|
|
50
67
|
export function hasRegistryChange(d) {
|
|
51
68
|
return (d.addedKeys.length > 0 ||
|
|
@@ -60,7 +77,7 @@ export function registryDirection(d) {
|
|
|
60
77
|
d.grantChanges.some((g) => g.isNew || g.added.length > 0);
|
|
61
78
|
const removes = d.removedKeys.length > 0 ||
|
|
62
79
|
d.roleChanges.some((r) => r.isGone || r.removed.length > 0) ||
|
|
63
|
-
d.grantChanges.some((g) => g.isGone || g.removed.length > 0);
|
|
80
|
+
d.grantChanges.some((g) => g.isGone || g.removed.length > 0 || g.retired.length > 0);
|
|
64
81
|
// A description re-worded is a change that is neither: it keeps a diff from being "only".
|
|
65
82
|
const other = d.changedKeys.length > 0;
|
|
66
83
|
if (!hasRegistryChange(d))
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry-diff.js","sourceRoot":"","sources":["../src/registry-diff.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"registry-diff.js","sourceRoot":"","sources":["../src/registry-diff.ts"],"names":[],"mappings":"AAqCA,iGAAiG;AACjG,SAAS,MAAM,CAAC,MAAqC,EAAE,KAAoC;IACzF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAkB,EAAE,EAAgB;IACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,WAAW,GAAgC,EAAE,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,IAAI,MAAM;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAiC,EAAE,CAAC;IACtD,KAAK,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACxE,YAAY,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/D,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/G,WAAW;QACX,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAiE;IACrG,OAAO;QACL,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,mCAAmC,CAAC,qBAAqB,CAAC;QAC5G,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,0CAA0C,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,CAAe;IAC/C,OAAO,CACL,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAC1B,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,iBAAiB,CAAC,CAAe;IAC/C,MAAM,IAAI,GACR,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACxD,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GACX,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3D,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvF,0FAA0F;IAC1F,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+FAA+F;AAC/F,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/D,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;aACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;aACjC,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAA4C,EAC5C,EAA0C,EAC1C,IAAI,GAAiB,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;IAE7C,MAAM,QAAQ,GAA4B;QACxC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAC1F,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAClC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;KAC3C,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC"}
|
package/dist/registry.d.ts
CHANGED
|
@@ -49,6 +49,9 @@ export declare const vertical: z.ZodObject<{
|
|
|
49
49
|
installsBlocked: z.ZodDefault<z.ZodBoolean>;
|
|
50
50
|
provisions: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
51
51
|
sendsEmail: z.ZodOptional<z.ZodBoolean>;
|
|
52
|
+
lifecycle: z.ZodOptional<z.ZodEnum<{
|
|
53
|
+
router: "router";
|
|
54
|
+
}>>;
|
|
52
55
|
emailSender: z.ZodDefault<z.ZodBoolean>;
|
|
53
56
|
tenantProvisioner: z.ZodDefault<z.ZodBoolean>;
|
|
54
57
|
servingRef: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
@@ -98,6 +101,9 @@ export declare const registerVerticalInput: z.ZodObject<{
|
|
|
98
101
|
listed: z.ZodDefault<z.ZodBoolean>;
|
|
99
102
|
provisions: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
100
103
|
sendsEmail: z.ZodOptional<z.ZodBoolean>;
|
|
104
|
+
lifecycle: z.ZodOptional<z.ZodEnum<{
|
|
105
|
+
router: "router";
|
|
106
|
+
}>>;
|
|
101
107
|
slug: z.ZodString;
|
|
102
108
|
ownerTenant: z.ZodDefault<z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>>;
|
|
103
109
|
}, z.core.$strip>;
|
package/dist/registry.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc;;;;EAAoC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ
|
|
1
|
+
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc;;;;EAAoC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6HnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAchC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;EAA8C,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;iBAmBxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6B1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;iBAoB5B,CAAC;AACL,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW;;EAAmB,CAAC;AAC5C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,eAAe;;;;;;;;iBAe1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;iBAS9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB;;;;iBAUnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;kBAAgE,CAAC;AACjG,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
|
package/dist/registry.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
import { instant, permissionKey, tenantId, verticalSlug } from './ids.js';
|
|
3
|
-
import { envVarSpec, capability } from './manifest.js';
|
|
3
|
+
import { envVarSpec, capability, lifecycleHold } from './manifest.js';
|
|
4
4
|
import { declaredSurface } from './routing.js';
|
|
5
5
|
import { platformScriptCollision, platformScriptRefusal } from './script-names.js';
|
|
6
6
|
/**
|
|
@@ -99,6 +99,12 @@ export const vertical = z.object({
|
|
|
99
99
|
* re-push, exactly because it grants nothing by itself.
|
|
100
100
|
*/
|
|
101
101
|
sendsEmail: z.boolean().optional(),
|
|
102
|
+
/**
|
|
103
|
+
* Where the vertical's scope lifecycle is held (#1713), carried on push from the manifest's
|
|
104
|
+
* `lifecycle` (`lifecycleHold`). `'router'` keeps its scopes out of the lifecycle delivery
|
|
105
|
+
* and the heal sweep entirely. Rides the install_spec bag, refreshed on every re-push.
|
|
106
|
+
*/
|
|
107
|
+
lifecycle: lifecycleHold.optional(),
|
|
102
108
|
/**
|
|
103
109
|
* Holds the EMAIL-SENDER capability (#303) — this vertical's scopes may POST to the control
|
|
104
110
|
* plane's `/internal/email/send` relay and have transactional mail sent on their behalf. A
|
|
@@ -150,7 +156,7 @@ export const verticalServingState = z.object({
|
|
|
150
156
|
migrationTag: z.string().min(1),
|
|
151
157
|
});
|
|
152
158
|
export const registerVerticalInput = vertical
|
|
153
|
-
.pick({ slug: true, name: true, source: true, envSpec: true, entitlements: true, ownerGrants: true, provides: true, requires: true, provisions: true, sendsEmail: true, surfaces: true, listed: true })
|
|
159
|
+
.pick({ slug: true, name: true, source: true, envSpec: true, entitlements: true, ownerGrants: true, provides: true, requires: true, provisions: true, sendsEmail: true, lifecycle: true, surfaces: true, listed: true })
|
|
154
160
|
.extend({
|
|
155
161
|
/**
|
|
156
162
|
* #1923: a slug that would deploy under one of the platform's own script names is refused
|
package/dist/registry.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAEnF;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,YAAY,EAAE,iFAAiF;IACrG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,cAAc;IACtB;;;;;OAKG;IACH,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAChC;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACvC;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC,OAAO,EAAE;IACrC;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC;;;;;;;;OAQG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACvC;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAC7C,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ;KAC1C,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KACvN,MAAM,CAAC;IACR;;;;OAIG;IACH,IAAI,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,SAAS;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC;IACF,yEAAyE;IACzE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/C,CAAC,CAAC;AAKH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,+DAA+D;IAC/D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;OAUG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO;IAC9B,YAAY;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8DAA8D;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oFAAoF;IACpF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,eAAe;IAC1B,wDAAwD;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,sEAAsE;IACtE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE;IAC/B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACvC;;;;;OAKG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe;KAC/C,IAAI,CAAC;IACJ,EAAE,EAAE,IAAI;IACR,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;IACnB,MAAM,EAAE,IAAI;CACb,CAAC;KACD,MAAM,CAAC;IACN;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACnC,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAG5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;IAClB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;CAC9C,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,6BAA6B;IACpD,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gFAAgF;IAChF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC"}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
import { z } from 'zod';
|
|
2
|
+
/**
|
|
3
|
+
* WHO is calling the control plane's relay, as the platform knows it.
|
|
4
|
+
*
|
|
5
|
+
* A deployed vertical reaches the relay (`/internal/email/send`, `/internal/connections/*`)
|
|
6
|
+
* with a platform credential that proves "a platform script is calling" and nothing about
|
|
7
|
+
* which vertical, so a relay that read the tenant and scope from the body was reading them
|
|
8
|
+
* from the caller.
|
|
9
|
+
*
|
|
10
|
+
* This is the caller the ROUTER set when it dispatched the script — the same dispatch
|
|
11
|
+
* parameters a peer call's identity is read from (`peerCaller`, #1706). The egress worker
|
|
12
|
+
* attaches it on the way to the relay's `RelayGateway` entrypoint, which only a service
|
|
13
|
+
* binding can reach, and the control plane holds it to the request object rather than to
|
|
14
|
+
* anything a public request could carry. Never assembled from a request.
|
|
15
|
+
*/
|
|
16
|
+
export declare const relayCaller: z.ZodObject<{
|
|
17
|
+
vertical: z.ZodString;
|
|
18
|
+
tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
|
|
19
|
+
scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
|
|
20
|
+
}, z.core.$strip>;
|
|
21
|
+
export type RelayCaller = z.infer<typeof relayCaller>;
|
|
22
|
+
/**
|
|
23
|
+
* The header the egress worker hands the caller to the gateway in. Only ever read on the
|
|
24
|
+
* gateway's side of a service binding: the control plane's public `fetch` ignores it, and the
|
|
25
|
+
* egress worker drops any copy a script put on its own request before setting its own.
|
|
26
|
+
*/
|
|
27
|
+
export declare const RELAY_CALLER_HEADER = "x-substrat-relay-caller";
|
|
28
|
+
//# sourceMappingURL=relay-caller.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"relay-caller.d.ts","sourceRoot":"","sources":["../src/relay-caller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW;;;;iBAItB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,4BAA4B,CAAC"}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
import { z } from 'zod';
|
|
2
|
+
import { scopeId, tenantId, verticalSlug } from './ids.js';
|
|
3
|
+
/**
|
|
4
|
+
* WHO is calling the control plane's relay, as the platform knows it.
|
|
5
|
+
*
|
|
6
|
+
* A deployed vertical reaches the relay (`/internal/email/send`, `/internal/connections/*`)
|
|
7
|
+
* with a platform credential that proves "a platform script is calling" and nothing about
|
|
8
|
+
* which vertical, so a relay that read the tenant and scope from the body was reading them
|
|
9
|
+
* from the caller.
|
|
10
|
+
*
|
|
11
|
+
* This is the caller the ROUTER set when it dispatched the script — the same dispatch
|
|
12
|
+
* parameters a peer call's identity is read from (`peerCaller`, #1706). The egress worker
|
|
13
|
+
* attaches it on the way to the relay's `RelayGateway` entrypoint, which only a service
|
|
14
|
+
* binding can reach, and the control plane holds it to the request object rather than to
|
|
15
|
+
* anything a public request could carry. Never assembled from a request.
|
|
16
|
+
*/
|
|
17
|
+
export const relayCaller = z.object({
|
|
18
|
+
vertical: verticalSlug,
|
|
19
|
+
tenantId,
|
|
20
|
+
scopeId,
|
|
21
|
+
});
|
|
22
|
+
/**
|
|
23
|
+
* The header the egress worker hands the caller to the gateway in. Only ever read on the
|
|
24
|
+
* gateway's side of a service binding: the control plane's public `fetch` ignores it, and the
|
|
25
|
+
* egress worker drops any copy a script put on its own request before setting its own.
|
|
26
|
+
*/
|
|
27
|
+
export const RELAY_CALLER_HEADER = 'x-substrat-relay-caller';
|
|
28
|
+
//# sourceMappingURL=relay-caller.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"relay-caller.js","sourceRoot":"","sources":["../src/relay-caller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ,EAAE,YAAY;IACtB,QAAQ;IACR,OAAO;CACR,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC"}
|