@substrat-run/contracts 0.23.0 → 0.25.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/control-plane.d.ts +61 -0
- package/dist/control-plane.d.ts.map +1 -1
- package/dist/control-plane.js +77 -1
- package/dist/control-plane.js.map +1 -1
- package/dist/deploy.d.ts +96 -1
- package/dist/deploy.d.ts.map +1 -1
- package/dist/deploy.js +84 -2
- package/dist/deploy.js.map +1 -1
- package/dist/events.d.ts +21 -0
- package/dist/events.d.ts.map +1 -1
- package/dist/events.js +23 -1
- package/dist/events.js.map +1 -1
- package/dist/permission.d.ts +9 -0
- package/dist/permission.d.ts.map +1 -1
- package/dist/permission.js +17 -0
- package/dist/permission.js.map +1 -1
- package/dist/registry.d.ts +9 -0
- package/dist/registry.d.ts.map +1 -1
- package/dist/registry.js +20 -1
- package/dist/registry.js.map +1 -1
- package/dist/routing.d.ts +19 -0
- package/dist/routing.d.ts.map +1 -1
- package/dist/routing.js +18 -0
- package/dist/routing.js.map +1 -1
- package/dist/tenancy.d.ts +9 -1
- package/dist/tenancy.d.ts.map +1 -1
- package/dist/tenancy.js +36 -2
- package/dist/tenancy.js.map +1 -1
- package/package.json +1 -1
package/dist/control-plane.d.ts
CHANGED
|
@@ -23,6 +23,8 @@ export declare const adminAction: z.ZodEnum<{
|
|
|
23
23
|
provisionScope: "provisionScope";
|
|
24
24
|
pruneAccessLog: "pruneAccessLog";
|
|
25
25
|
publishVersion: "publishVersion";
|
|
26
|
+
reapScope: "reapScope";
|
|
27
|
+
reapTenant: "reapTenant";
|
|
26
28
|
registerIdentityPool: "registerIdentityPool";
|
|
27
29
|
registerVertical: "registerVertical";
|
|
28
30
|
rejectVersion: "rejectVersion";
|
|
@@ -48,6 +50,63 @@ export declare const adminAction: z.ZodEnum<{
|
|
|
48
50
|
updateConnectionSecret: "updateConnectionSecret";
|
|
49
51
|
}>;
|
|
50
52
|
export type AdminAction = z.infer<typeof adminAction>;
|
|
53
|
+
/**
|
|
54
|
+
* One entitlement grant, widened from a bare SKU flag to express a plan (#33):
|
|
55
|
+
* quota, expiry, tier. The paying customer is the vertical builder (D-33), so
|
|
56
|
+
* these fields describe the builder's subscription — the tenants underneath are
|
|
57
|
+
* what the plan is measured in.
|
|
58
|
+
*
|
|
59
|
+
* `expiresAt` is the subscription boundary and the one field the kernel itself
|
|
60
|
+
* enforces: an expired grant fails closed at the per-invoke gate, exactly as if
|
|
61
|
+
* revoked — checked lazily at read like permission tuples, never swept. The row
|
|
62
|
+
* stays visible in `listEntitlements` so a lapsed trial can be renewed.
|
|
63
|
+
*
|
|
64
|
+
* `quota` and `plan` are expression only: the store records "500 work orders/mo
|
|
65
|
+
* on 'pro'" but counting usage against it is the consumer's job (the builder
|
|
66
|
+
* portal, control-plane.md §5's meters). A null quota is today's boolean flag;
|
|
67
|
+
* a null plan is an ungrouped key.
|
|
68
|
+
*/
|
|
69
|
+
export declare const entitlementGrant: z.ZodObject<{
|
|
70
|
+
entitlementKey: z.ZodString;
|
|
71
|
+
expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
72
|
+
quota: z.ZodNullable<z.ZodNumber>;
|
|
73
|
+
plan: z.ZodNullable<z.ZodString>;
|
|
74
|
+
grantedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
75
|
+
grantedBy: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">>;
|
|
76
|
+
}, z.core.$strip>;
|
|
77
|
+
export type EntitlementGrant = z.infer<typeof entitlementGrant>;
|
|
78
|
+
/**
|
|
79
|
+
* What an operation handler reads through `ctx.entitlement(key)` / `ctx.entitlements()`
|
|
80
|
+
* (#304) — the request-time, in-scope view of a grant. A deliberately narrower shape than
|
|
81
|
+
* `entitlementGrant`: it drops the audit fields (`grantedAt`/`grantedBy`) a running vertical
|
|
82
|
+
* has no business acting on, and it only ever names a **currently-held** entitlement —
|
|
83
|
+
* expiry is applied at read (an expired grant is absent from the view, exactly as it is
|
|
84
|
+
* absent from the gate), so a returned view is by construction live.
|
|
85
|
+
*
|
|
86
|
+
* `plan` and `quota` are carried but **not** enforced by the kernel (#33): the vertical
|
|
87
|
+
* reads the number and enforces its own quota; the kernel enforces only presence + expiry.
|
|
88
|
+
* On a hosted vertical this is read from the scope-local projection (scope-local-permissions.md),
|
|
89
|
+
* never a control-plane binding.
|
|
90
|
+
*/
|
|
91
|
+
export declare const entitlementView: z.ZodObject<{
|
|
92
|
+
key: z.ZodString;
|
|
93
|
+
plan: z.ZodNullable<z.ZodString>;
|
|
94
|
+
quota: z.ZodNullable<z.ZodNumber>;
|
|
95
|
+
expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
96
|
+
}, z.core.$strip>;
|
|
97
|
+
export type EntitlementView = z.infer<typeof entitlementView>;
|
|
98
|
+
/**
|
|
99
|
+
* The plan half of a grant call. PATCH semantics, deliberately: an omitted field
|
|
100
|
+
* PRESERVES what the row already carries, an explicit null clears it. Re-granting
|
|
101
|
+
* on an idempotent path (re-provisioning grants keys freely) must not silently
|
|
102
|
+
* turn a trial perpetual by erasing its expiry.
|
|
103
|
+
*/
|
|
104
|
+
export declare const entitlementGrantInput: z.ZodObject<{
|
|
105
|
+
expiresAt: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>>;
|
|
106
|
+
quota: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
|
|
107
|
+
plan: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
108
|
+
}, z.core.$strip>;
|
|
109
|
+
export type EntitlementGrantInput = z.input<typeof entitlementGrantInput>;
|
|
51
110
|
/**
|
|
52
111
|
* The neutral identity seam (D-16; control-plane.md §6 "principal derivation").
|
|
53
112
|
* An auth adapter at the edge (Better Auth, an OIDC issuer, …) authenticates a
|
|
@@ -191,6 +250,8 @@ export declare const adminLogEntry: z.ZodObject<{
|
|
|
191
250
|
provisionScope: "provisionScope";
|
|
192
251
|
pruneAccessLog: "pruneAccessLog";
|
|
193
252
|
publishVersion: "publishVersion";
|
|
253
|
+
reapScope: "reapScope";
|
|
254
|
+
reapTenant: "reapTenant";
|
|
194
255
|
registerIdentityPool: "registerIdentityPool";
|
|
195
256
|
registerVertical: "registerVertical";
|
|
196
257
|
rejectVersion: "rejectVersion";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,WAAW
|
|
1
|
+
{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB;;;;;;;iBAa3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;iBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;iBAMvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAQrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
|
package/dist/control-plane.js
CHANGED
|
@@ -35,8 +35,16 @@ export const adminAction = z.enum([
|
|
|
35
35
|
'unbindHostname', // the inverse of bindHostname — a hard delete; the history is this log
|
|
36
36
|
'pruneAccessLog', // K-24 — deleting drained access rows is itself a mutation // K-23 — a provider declares its topology before it may link
|
|
37
37
|
'createTenant', // §4.1
|
|
38
|
-
|
|
38
|
+
// §4.1/§4.8 — before/after carry the transitioned status. Starting the delete grace
|
|
39
|
+
// window (→ deleting) and un-deleting (→ active) are ordinary status transitions here,
|
|
40
|
+
// exactly as suspend/unsuspend are — the reap that follows is its own action below.
|
|
41
|
+
'setTenantStatus',
|
|
39
42
|
'setTenantName', // §4.1 — display rename only; the slug (in registry ids) never moves
|
|
43
|
+
// §4.8 — the terminal tenant reap: wipe every scope's storage (via reapScope) and clear
|
|
44
|
+
// the tenant's PII/config directory rows, keeping the `tenants` row + admin log as a
|
|
45
|
+
// tombstone. Irreversible, so it only leaves `deleting`, never `active`. The tenant-level
|
|
46
|
+
// analogue of reapScope.
|
|
47
|
+
'reapTenant',
|
|
40
48
|
'provisionScope', // §4.2 — the first scope-lifecycle transition (→ active)
|
|
41
49
|
'importScope', // preview-and-snapshots.md §3 — provision a scope + load a dump (fork)
|
|
42
50
|
'restoreScope', // §8's write half — load a dump into an EXISTING scope in place (backup restore / backout)
|
|
@@ -46,6 +54,10 @@ export const adminAction = z.enum([
|
|
|
46
54
|
'unsuspendScope', // §4.2
|
|
47
55
|
'archiveScope', // §4.2
|
|
48
56
|
'unarchiveScope',
|
|
57
|
+
// §4.4 — the terminal reap: wipe an archived scope's DO storage (Cloudflare never GCs a
|
|
58
|
+
// DO) while keeping its directory row as a tombstone. Irreversible, so it only leaves
|
|
59
|
+
// `archived`, never `active`. Unlike `deleteSnapshot` this reaps a PRIMARY scope, not a fork.
|
|
60
|
+
'reapScope',
|
|
49
61
|
'activateScope', // §4.2 — an explicit restore, never a silent flag flip
|
|
50
62
|
'grantEntitlement', // §4.3 — the SKU flag turned on for a tenant
|
|
51
63
|
'revokeEntitlement', // §4.3
|
|
@@ -60,6 +72,70 @@ export const adminAction = z.enum([
|
|
|
60
72
|
// log has to be able to name.
|
|
61
73
|
'grantToConnection',
|
|
62
74
|
]);
|
|
75
|
+
/**
|
|
76
|
+
* One entitlement grant, widened from a bare SKU flag to express a plan (#33):
|
|
77
|
+
* quota, expiry, tier. The paying customer is the vertical builder (D-33), so
|
|
78
|
+
* these fields describe the builder's subscription — the tenants underneath are
|
|
79
|
+
* what the plan is measured in.
|
|
80
|
+
*
|
|
81
|
+
* `expiresAt` is the subscription boundary and the one field the kernel itself
|
|
82
|
+
* enforces: an expired grant fails closed at the per-invoke gate, exactly as if
|
|
83
|
+
* revoked — checked lazily at read like permission tuples, never swept. The row
|
|
84
|
+
* stays visible in `listEntitlements` so a lapsed trial can be renewed.
|
|
85
|
+
*
|
|
86
|
+
* `quota` and `plan` are expression only: the store records "500 work orders/mo
|
|
87
|
+
* on 'pro'" but counting usage against it is the consumer's job (the builder
|
|
88
|
+
* portal, control-plane.md §5's meters). A null quota is today's boolean flag;
|
|
89
|
+
* a null plan is an ungrouped key.
|
|
90
|
+
*/
|
|
91
|
+
export const entitlementGrant = z.object({
|
|
92
|
+
// min(1), not the manifest's key regex: this shape READS the store back, and a
|
|
93
|
+
// console-granted legacy key must round-trip rather than brick the list.
|
|
94
|
+
entitlementKey: z.string().min(1),
|
|
95
|
+
/** Null = perpetual. ISO instant, compared lexically against now at the gate. */
|
|
96
|
+
expiresAt: instant.nullable(),
|
|
97
|
+
/** Plan quantity for this key. Null = plain on/off SKU flag. Never enforced here. */
|
|
98
|
+
quota: z.number().int().positive().nullable(),
|
|
99
|
+
/** Tier grouping ('pro') — makes a plan data instead of operator convention. */
|
|
100
|
+
plan: z.string().min(1).nullable(),
|
|
101
|
+
/** Stamped platform-side at grant. Null only on rows born before #33. */
|
|
102
|
+
grantedAt: instant.nullable(),
|
|
103
|
+
grantedBy: platformActorId.nullable(),
|
|
104
|
+
});
|
|
105
|
+
/**
|
|
106
|
+
* What an operation handler reads through `ctx.entitlement(key)` / `ctx.entitlements()`
|
|
107
|
+
* (#304) — the request-time, in-scope view of a grant. A deliberately narrower shape than
|
|
108
|
+
* `entitlementGrant`: it drops the audit fields (`grantedAt`/`grantedBy`) a running vertical
|
|
109
|
+
* has no business acting on, and it only ever names a **currently-held** entitlement —
|
|
110
|
+
* expiry is applied at read (an expired grant is absent from the view, exactly as it is
|
|
111
|
+
* absent from the gate), so a returned view is by construction live.
|
|
112
|
+
*
|
|
113
|
+
* `plan` and `quota` are carried but **not** enforced by the kernel (#33): the vertical
|
|
114
|
+
* reads the number and enforces its own quota; the kernel enforces only presence + expiry.
|
|
115
|
+
* On a hosted vertical this is read from the scope-local projection (scope-local-permissions.md),
|
|
116
|
+
* never a control-plane binding.
|
|
117
|
+
*/
|
|
118
|
+
export const entitlementView = z.object({
|
|
119
|
+
/** The entitlement/SKU key. */
|
|
120
|
+
key: z.string().min(1),
|
|
121
|
+
/** Tier grouping ('pro'), or null for an ungrouped key. Expression only — not enforced. */
|
|
122
|
+
plan: z.string().min(1).nullable(),
|
|
123
|
+
/** Plan quantity, or null for a plain on/off flag. Expression only — the vertical counts usage. */
|
|
124
|
+
quota: z.number().int().positive().nullable(),
|
|
125
|
+
/** Null = perpetual. A non-null value is always in the future (an expired grant is not viewable). */
|
|
126
|
+
expiresAt: instant.nullable(),
|
|
127
|
+
});
|
|
128
|
+
/**
|
|
129
|
+
* The plan half of a grant call. PATCH semantics, deliberately: an omitted field
|
|
130
|
+
* PRESERVES what the row already carries, an explicit null clears it. Re-granting
|
|
131
|
+
* on an idempotent path (re-provisioning grants keys freely) must not silently
|
|
132
|
+
* turn a trial perpetual by erasing its expiry.
|
|
133
|
+
*/
|
|
134
|
+
export const entitlementGrantInput = z.object({
|
|
135
|
+
expiresAt: instant.nullable().optional(),
|
|
136
|
+
quota: z.number().int().positive().nullable().optional(),
|
|
137
|
+
plan: z.string().min(1).nullable().optional(),
|
|
138
|
+
});
|
|
63
139
|
/**
|
|
64
140
|
* The neutral identity seam (D-16; control-plane.md §6 "principal derivation").
|
|
65
141
|
* An auth adapter at the edge (Better Auth, an OIDC issuer, …) authenticates a
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,OAAO,EACP,KAAK,EACL,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAElB,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4CAA4C;AAE5C,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,YAAY;IACZ,YAAY;IACZ,cAAc,EAAE,+DAA+D;IAC/E,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,wDAAwD;IACrE,sBAAsB;IACtB,kBAAkB,EAAE,wCAAwC;IAC5D,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,mBAAmB,EAAE,0EAA0E;IAC/F,gBAAgB,EAAE,iFAAiF;IACnG,4BAA4B,EAAE,mEAAmE;IACjG,gBAAgB,EAAE,8EAA8E;IAChG,kBAAkB;IAClB,gBAAgB;IAChB,kFAAkF;IAClF,sFAAsF;IACtF,oBAAoB;IACpB,oBAAoB;IACpB,cAAc,EAAE,0BAA0B;IAC1C,mBAAmB,EAAE,oDAAoD;IACzE,gBAAgB,EAAE,uEAAuE;IACzF,gBAAgB,EAAE,yHAAyH;IAC3I,cAAc,EAAE,OAAO;IACvB,
|
|
1
|
+
{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,OAAO,EACP,KAAK,EACL,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAElB,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,4CAA4C;AAE5C,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,YAAY;IACZ,YAAY;IACZ,cAAc,EAAE,+DAA+D;IAC/E,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc,EAAE,2DAA2D;IAC3E,WAAW,EAAE,wDAAwD;IACrE,sBAAsB;IACtB,kBAAkB,EAAE,wCAAwC;IAC5D,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,mBAAmB,EAAE,0EAA0E;IAC/F,gBAAgB,EAAE,iFAAiF;IACnG,4BAA4B,EAAE,mEAAmE;IACjG,gBAAgB,EAAE,8EAA8E;IAChG,kBAAkB;IAClB,gBAAgB;IAChB,kFAAkF;IAClF,sFAAsF;IACtF,oBAAoB;IACpB,oBAAoB;IACpB,cAAc,EAAE,0BAA0B;IAC1C,mBAAmB,EAAE,oDAAoD;IACzE,gBAAgB,EAAE,uEAAuE;IACzF,gBAAgB,EAAE,yHAAyH;IAC3I,cAAc,EAAE,OAAO;IACvB,oFAAoF;IACpF,uFAAuF;IACvF,oFAAoF;IACpF,iBAAiB;IACjB,eAAe,EAAE,qEAAqE;IACtF,wFAAwF;IACxF,qFAAqF;IACrF,0FAA0F;IAC1F,yBAAyB;IACzB,YAAY;IACZ,gBAAgB,EAAE,yDAAyD;IAC3E,aAAa,EAAE,uEAAuE;IACtF,cAAc,EAAE,2FAA2F;IAC3G,aAAa,EAAE,qFAAqF;IACpG,gBAAgB,EAAE,8EAA8E;IAChG,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,OAAO;IACzB,cAAc,EAAE,OAAO;IACvB,gBAAgB;IAChB,wFAAwF;IACxF,sFAAsF;IACtF,8FAA8F;IAC9F,WAAW;IACX,eAAe,EAAE,uDAAuD;IACxE,kBAAkB,EAAE,6CAA6C;IACjE,mBAAmB,EAAE,OAAO;IAC5B,cAAc,EAAE,kDAAkD;IAClE,gBAAgB,EAAE,wDAAwD;IAC1E,+EAA+E;IAC/E,4EAA4E;IAC5E,kBAAkB;IAClB,wBAAwB,EAAE,2DAA2D;IACrF,kBAAkB;IAClB,8EAA8E;IAC9E,8BAA8B;IAC9B,mBAAmB;CACpB,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,+EAA+E;IAC/E,yEAAyE;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,qFAAqF;IACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,+BAA+B;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,2FAA2F;IAC3F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,mGAAmG;IACnG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,qGAAqG;IACrG,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD;IACrF,SAAS,EAAE,WAAW;IACtB,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,8BAA8B;CAC5D,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAGhE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE;IACxE,OAAO,EAAE,8DAA8D;CACxE,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oDAAoD;IAC3E,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,oFAAoF;IACpF,mFAAmF;IACnF,mDAAmD;IACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,6DAA6D;IAC7F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IACrD;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC"}
|
package/dist/deploy.d.ts
CHANGED
|
@@ -35,7 +35,34 @@ export declare const runtimeNeeds: z.ZodObject<{
|
|
|
35
35
|
}, z.core.$strip>>>;
|
|
36
36
|
}, z.core.$strip>;
|
|
37
37
|
export type RuntimeNeeds = z.infer<typeof runtimeNeeds>;
|
|
38
|
-
/**
|
|
38
|
+
/**
|
|
39
|
+
* The §4 sandbox allowlist: the binding types a hosted vertical may declare, because each
|
|
40
|
+
* is one of its OWN resources and carries no reach into platform infrastructure. This is a
|
|
41
|
+
* POSITIVE allowlist — anything not named here is refused (self-serve-deploy.md §4), the
|
|
42
|
+
* inverse of the original allow-by-omission denylist. It lives in `contracts` so both ends
|
|
43
|
+
* speak one list: the CLI can predict admission, the control plane enforces it, and "what
|
|
44
|
+
* passes" is a written set rather than an emergent property of what the check forgot to ban.
|
|
45
|
+
*
|
|
46
|
+
* Notable exclusions and why they are refused, not merely absent:
|
|
47
|
+
* - `service` — a hosted vertical is ONE serving script (the DO is the app); it reaches the
|
|
48
|
+
* platform through the router (K-27), never a service binding. No own sibling to bind.
|
|
49
|
+
* - `dispatch_namespace` — the platform's Workers-for-Platforms fabric, never a vertical's.
|
|
50
|
+
* - anything managed/egress-shaped (`ai`, `browser`, `vectorize`, `hyperdrive`, `send_email`,
|
|
51
|
+
* `mtls_certificate`) — the outside world is a connector concern, and outbound policy is an
|
|
52
|
+
* open question (§6 / #303); least-privilege means these are refused until decided.
|
|
53
|
+
*
|
|
54
|
+
* Caveat on `d1`: admissible as an own relational store (e.g. a Better-Auth `AUTH_DB`), but
|
|
55
|
+
* the check does not yet PROVE the declared `database_id` is the vertical's own rather than
|
|
56
|
+
* another tenant's — trusted under model-B human admission; platform provisioning closes that
|
|
57
|
+
* gap (#301). A `durable_object_namespace` is admissible only for the vertical's OWN classes
|
|
58
|
+
* (no `script_name`, `class_name` ∈ declared `doClasses`) — the control plane checks that.
|
|
59
|
+
*/
|
|
60
|
+
export declare const ADMISSIBLE_BINDING_TYPES: readonly ['durable_object_namespace', 'd1', 'kv_namespace', 'queue', 'r2_bucket', 'analytics_engine', 'secret_text', 'plain_text'];
|
|
61
|
+
export type AdmissibleBindingType = (typeof ADMISSIBLE_BINDING_TYPES)[number];
|
|
62
|
+
/** A binding the uploaded worker declares, as far as the sandbox contract check needs it.
|
|
63
|
+
* `type` stays a free string here — the §4 allowlist (`ADMISSIBLE_BINDING_TYPES`) is enforced
|
|
64
|
+
* by the control plane, not the schema, so a refused type produces a *named* rejection that
|
|
65
|
+
* points at the doc rather than a generic Zod parse error the builder can't act on. */
|
|
39
66
|
export declare const declaredBinding: z.ZodObject<{
|
|
40
67
|
type: z.ZodString;
|
|
41
68
|
name: z.ZodString;
|
|
@@ -44,6 +71,54 @@ export declare const declaredBinding: z.ZodObject<{
|
|
|
44
71
|
id: z.ZodOptional<z.ZodString>;
|
|
45
72
|
}, z.core.$strip>;
|
|
46
73
|
export type DeclaredBinding = z.infer<typeof declaredBinding>;
|
|
74
|
+
/**
|
|
75
|
+
* One row of the permission registry: a declared key, its description, and the module(s)
|
|
76
|
+
* that declare it (§1 of PERMISSIONS.md, made machine-readable). `declaredBy` lets a
|
|
77
|
+
* console group keys by owning engine without re-deriving from module code.
|
|
78
|
+
*/
|
|
79
|
+
export declare const permissionRegistryEntry: z.ZodObject<{
|
|
80
|
+
key: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
|
|
81
|
+
description: z.ZodString;
|
|
82
|
+
declaredBy: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ModuleId", "out">>;
|
|
83
|
+
}, z.core.$strip>;
|
|
84
|
+
export type PermissionRegistryEntry = z.infer<typeof permissionRegistryEntry>;
|
|
85
|
+
/** An entity-narrowed grant SHAPE — which keys a per-entity grant carries (§4 of
|
|
86
|
+
* PERMISSIONS.md). The grants themselves are per-principal, runtime, scope-local; only
|
|
87
|
+
* their declared shapes are a code fact and belong in the manifest. */
|
|
88
|
+
export declare const entityGrantShape: z.ZodObject<{
|
|
89
|
+
entityType: z.ZodString;
|
|
90
|
+
permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
91
|
+
}, z.core.$strip>;
|
|
92
|
+
export type EntityGrantShape = z.infer<typeof entityGrantShape>;
|
|
93
|
+
/**
|
|
94
|
+
* The vertical's declared permission surface, shipped in the deploy manifest (D-39) — the
|
|
95
|
+
* machine-readable twin of PERMISSIONS.md. Assembled at push from the SAME `MODULES` +
|
|
96
|
+
* `ROLES` + `ENTITY_GRANTS` the host registers (via the checked-in `permissions.json` that
|
|
97
|
+
* `tools/permission-diff.mts` emits and CI keeps fresh), so it cannot drift from what is
|
|
98
|
+
* enforced. `digests.permission` is its content hash: the platform now holds the registry
|
|
99
|
+
* it already committed to, not only the hash. Immutable per version; consumed by admission
|
|
100
|
+
* (a real permission diff between versions) and any tenant-facing permissions view.
|
|
101
|
+
*
|
|
102
|
+
* Deliberately NOT the runtime grant table: minted capability grants are scope-local tuples
|
|
103
|
+
* (control-plane.md §4.5), reachable only through the admin-query RPC, never mirrored here.
|
|
104
|
+
*/
|
|
105
|
+
export declare const permissionRegistry: z.ZodObject<{
|
|
106
|
+
permissions: z.ZodArray<z.ZodObject<{
|
|
107
|
+
key: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
|
|
108
|
+
description: z.ZodString;
|
|
109
|
+
declaredBy: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ModuleId", "out">>;
|
|
110
|
+
}, z.core.$strip>>;
|
|
111
|
+
roles: z.ZodArray<z.ZodObject<{
|
|
112
|
+
key: z.ZodString;
|
|
113
|
+
permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
114
|
+
source: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.ZodLiteral<"vertical">]>;
|
|
115
|
+
}, z.core.$strip>>;
|
|
116
|
+
entityGrants: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
|
117
|
+
entityType: z.ZodString;
|
|
118
|
+
permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
119
|
+
}, z.core.$strip>>>;
|
|
120
|
+
}, z.core.$strip>;
|
|
121
|
+
export type PermissionRegistry = z.infer<typeof permissionRegistry>;
|
|
47
122
|
/** The JSON part a `substrat push` sends alongside the module files. */
|
|
48
123
|
export declare const deployManifest: z.ZodObject<{
|
|
49
124
|
version: z.ZodString;
|
|
@@ -73,6 +148,26 @@ export declare const deployManifest: z.ZodObject<{
|
|
|
73
148
|
entitlements: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
74
149
|
provides: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
75
150
|
requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
151
|
+
surfaces: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
152
|
+
name: z.ZodString;
|
|
153
|
+
label: z.ZodString;
|
|
154
|
+
}, z.core.$strip>>>;
|
|
155
|
+
registry: z.ZodOptional<z.ZodObject<{
|
|
156
|
+
permissions: z.ZodArray<z.ZodObject<{
|
|
157
|
+
key: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
|
|
158
|
+
description: z.ZodString;
|
|
159
|
+
declaredBy: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ModuleId", "out">>;
|
|
160
|
+
}, z.core.$strip>>;
|
|
161
|
+
roles: z.ZodArray<z.ZodObject<{
|
|
162
|
+
key: z.ZodString;
|
|
163
|
+
permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
164
|
+
source: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.ZodLiteral<"vertical">]>;
|
|
165
|
+
}, z.core.$strip>>;
|
|
166
|
+
entityGrants: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
|
167
|
+
entityType: z.ZodString;
|
|
168
|
+
permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
169
|
+
}, z.core.$strip>>>;
|
|
170
|
+
}, z.core.$strip>>;
|
|
76
171
|
digests: z.ZodObject<{
|
|
77
172
|
manifest: z.ZodString;
|
|
78
173
|
permission: z.ZodString;
|
package/dist/deploy.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,SAAS;;;iBAKpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;;;iBAQvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,wBAAwB,YACnC,0BAA0B,EAC1B,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,YAAY,CACJ,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E;;;wFAGwF;AACxF,eAAO,MAAM,eAAe;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;wEAEwE;AACxE,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,wEAAwE;AACxE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoCzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}
|
package/dist/deploy.js
CHANGED
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
-
import { permissionKey } from './ids.js';
|
|
2
|
+
import { moduleId, permissionKey } from './ids.js';
|
|
3
3
|
import { envVarSpec, capability } from './manifest.js';
|
|
4
|
+
import { roleDefinition } from './permission.js';
|
|
5
|
+
import { declaredSurface } from './routing.js';
|
|
4
6
|
// The deploy manifest is the JSON part a `substrat push` sends alongside the
|
|
5
7
|
// module files (self-serve-deploy.md). It lives here — not in the transport
|
|
6
8
|
// package — because BOTH ends must speak the same shape: the CLI builds and
|
|
@@ -43,7 +45,42 @@ export const runtimeNeeds = z.object({
|
|
|
43
45
|
build: z.string().min(1).optional(),
|
|
44
46
|
stores: z.array(storeNeed).default([]),
|
|
45
47
|
});
|
|
46
|
-
/**
|
|
48
|
+
/**
|
|
49
|
+
* The §4 sandbox allowlist: the binding types a hosted vertical may declare, because each
|
|
50
|
+
* is one of its OWN resources and carries no reach into platform infrastructure. This is a
|
|
51
|
+
* POSITIVE allowlist — anything not named here is refused (self-serve-deploy.md §4), the
|
|
52
|
+
* inverse of the original allow-by-omission denylist. It lives in `contracts` so both ends
|
|
53
|
+
* speak one list: the CLI can predict admission, the control plane enforces it, and "what
|
|
54
|
+
* passes" is a written set rather than an emergent property of what the check forgot to ban.
|
|
55
|
+
*
|
|
56
|
+
* Notable exclusions and why they are refused, not merely absent:
|
|
57
|
+
* - `service` — a hosted vertical is ONE serving script (the DO is the app); it reaches the
|
|
58
|
+
* platform through the router (K-27), never a service binding. No own sibling to bind.
|
|
59
|
+
* - `dispatch_namespace` — the platform's Workers-for-Platforms fabric, never a vertical's.
|
|
60
|
+
* - anything managed/egress-shaped (`ai`, `browser`, `vectorize`, `hyperdrive`, `send_email`,
|
|
61
|
+
* `mtls_certificate`) — the outside world is a connector concern, and outbound policy is an
|
|
62
|
+
* open question (§6 / #303); least-privilege means these are refused until decided.
|
|
63
|
+
*
|
|
64
|
+
* Caveat on `d1`: admissible as an own relational store (e.g. a Better-Auth `AUTH_DB`), but
|
|
65
|
+
* the check does not yet PROVE the declared `database_id` is the vertical's own rather than
|
|
66
|
+
* another tenant's — trusted under model-B human admission; platform provisioning closes that
|
|
67
|
+
* gap (#301). A `durable_object_namespace` is admissible only for the vertical's OWN classes
|
|
68
|
+
* (no `script_name`, `class_name` ∈ declared `doClasses`) — the control plane checks that.
|
|
69
|
+
*/
|
|
70
|
+
export const ADMISSIBLE_BINDING_TYPES = [
|
|
71
|
+
'durable_object_namespace', // the vertical's own ScopeDO / state classes (own class only)
|
|
72
|
+
'd1', // an own relational store (id ownership deferred to #301)
|
|
73
|
+
'kv_namespace', // an own KV namespace
|
|
74
|
+
'queue', // an own queue (producer binding)
|
|
75
|
+
'r2_bucket', // an own R2 bucket
|
|
76
|
+
'analytics_engine', // an own Analytics Engine dataset
|
|
77
|
+
'secret_text', // an own secret (survives deploys via keep_bindings, #286)
|
|
78
|
+
'plain_text', // an own inline config value (inert, no authority)
|
|
79
|
+
];
|
|
80
|
+
/** A binding the uploaded worker declares, as far as the sandbox contract check needs it.
|
|
81
|
+
* `type` stays a free string here — the §4 allowlist (`ADMISSIBLE_BINDING_TYPES`) is enforced
|
|
82
|
+
* by the control plane, not the schema, so a refused type produces a *named* rejection that
|
|
83
|
+
* points at the doc rather than a generic Zod parse error the builder can't act on. */
|
|
47
84
|
export const declaredBinding = z.object({
|
|
48
85
|
type: z.string().min(1),
|
|
49
86
|
name: z.string().min(1),
|
|
@@ -52,6 +89,40 @@ export const declaredBinding = z.object({
|
|
|
52
89
|
/** For a `d1` binding: the database id — a vertical's OWN store (self-serve-deploy.md §4). */
|
|
53
90
|
id: z.string().optional(),
|
|
54
91
|
});
|
|
92
|
+
/**
|
|
93
|
+
* One row of the permission registry: a declared key, its description, and the module(s)
|
|
94
|
+
* that declare it (§1 of PERMISSIONS.md, made machine-readable). `declaredBy` lets a
|
|
95
|
+
* console group keys by owning engine without re-deriving from module code.
|
|
96
|
+
*/
|
|
97
|
+
export const permissionRegistryEntry = z.object({
|
|
98
|
+
key: permissionKey,
|
|
99
|
+
description: z.string().min(1),
|
|
100
|
+
declaredBy: z.array(moduleId).min(1),
|
|
101
|
+
});
|
|
102
|
+
/** An entity-narrowed grant SHAPE — which keys a per-entity grant carries (§4 of
|
|
103
|
+
* PERMISSIONS.md). The grants themselves are per-principal, runtime, scope-local; only
|
|
104
|
+
* their declared shapes are a code fact and belong in the manifest. */
|
|
105
|
+
export const entityGrantShape = z.object({
|
|
106
|
+
entityType: z.string().min(1),
|
|
107
|
+
permissions: z.array(permissionKey),
|
|
108
|
+
});
|
|
109
|
+
/**
|
|
110
|
+
* The vertical's declared permission surface, shipped in the deploy manifest (D-39) — the
|
|
111
|
+
* machine-readable twin of PERMISSIONS.md. Assembled at push from the SAME `MODULES` +
|
|
112
|
+
* `ROLES` + `ENTITY_GRANTS` the host registers (via the checked-in `permissions.json` that
|
|
113
|
+
* `tools/permission-diff.mts` emits and CI keeps fresh), so it cannot drift from what is
|
|
114
|
+
* enforced. `digests.permission` is its content hash: the platform now holds the registry
|
|
115
|
+
* it already committed to, not only the hash. Immutable per version; consumed by admission
|
|
116
|
+
* (a real permission diff between versions) and any tenant-facing permissions view.
|
|
117
|
+
*
|
|
118
|
+
* Deliberately NOT the runtime grant table: minted capability grants are scope-local tuples
|
|
119
|
+
* (control-plane.md §4.5), reachable only through the admin-query RPC, never mirrored here.
|
|
120
|
+
*/
|
|
121
|
+
export const permissionRegistry = z.object({
|
|
122
|
+
permissions: z.array(permissionRegistryEntry),
|
|
123
|
+
roles: z.array(roleDefinition),
|
|
124
|
+
entityGrants: z.array(entityGrantShape).default([]),
|
|
125
|
+
});
|
|
55
126
|
/** The JSON part a `substrat push` sends alongside the module files. */
|
|
56
127
|
export const deployManifest = z.object({
|
|
57
128
|
version: z.string().min(1),
|
|
@@ -72,9 +143,20 @@ export const deployManifest = z.object({
|
|
|
72
143
|
entitlements: z.array(z.string()).optional(),
|
|
73
144
|
provides: z.array(capability).optional(),
|
|
74
145
|
requires: z.array(capability).optional(),
|
|
146
|
+
/** The surfaces the vertical serves (package.json `substrat.surfaces`, K-26 multi-surface) —
|
|
147
|
+
* labels only, carried to the registry for the hostname-binding picker. Metadata, not code. */
|
|
148
|
+
surfaces: z.array(declaredSurface).optional(),
|
|
149
|
+
/** The vertical's declared permission surface (D-39): keys+descriptions, role templates,
|
|
150
|
+
* entity-grant shapes — the machine-readable PERMISSIONS.md. Optional + additive (D-28);
|
|
151
|
+
* `digests.permission` is its content hash. Absent ⇒ the vertical ships no registry here
|
|
152
|
+
* and the permission digest is over the empty surface. */
|
|
153
|
+
registry: permissionRegistry.optional(),
|
|
75
154
|
/** Computed by the builder's toolchain; what the promotion checkpoint compares. */
|
|
76
155
|
digests: z.object({
|
|
77
156
|
manifest: z.string().min(1),
|
|
157
|
+
/** Content hash of `registry` (D-39) — the promotion checkpoint's "permissions changed"
|
|
158
|
+
* signal. A pure function of the declared surface, so it moves iff a key, description,
|
|
159
|
+
* role, or grant shape moves. */
|
|
78
160
|
permission: z.string().min(1),
|
|
79
161
|
migration: z.string().min(1),
|
|
80
162
|
}),
|
package/dist/deploy.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wBAAwB;AAExB;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,oFAAoF;IACpF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,iDAAiD;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,qFAAqF;IACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,+FAA+F;IAC/F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,0BAA0B,EAAE,8DAA8D;IAC1F,IAAI,EAAE,0DAA0D;IAChE,cAAc,EAAE,sBAAsB;IACtC,OAAO,EAAE,kCAAkC;IAC3C,WAAW,EAAE,mBAAmB;IAChC,kBAAkB,EAAE,kCAAkC;IACtD,aAAa,EAAE,2DAA2D;IAC1E,YAAY,EAAE,mDAAmD;CACzD,CAAC;AAGX;;;wFAGwF;AACxF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,8FAA8F;IAC9F,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,aAAa;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrC,CAAC,CAAC;AAGH;;wEAEwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CACpC,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpD,CAAC,CAAC;AAGH,wEAAwE;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,oEAAoE;IACpE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,4DAA4D;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C;kGAC8F;IAC9F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACvC;+FAC2F;IAC3F,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC9C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC;oGACgG;IAChG,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;+DAG2D;IAC3D,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACvC,mFAAmF;IACnF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B;;0CAEkC;QAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;CACH,CAAC,CAAC"}
|
package/dist/events.d.ts
CHANGED
|
@@ -33,6 +33,23 @@ export declare const actor: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString,
|
|
|
33
33
|
connection: z.ZodString;
|
|
34
34
|
}, z.core.$strip>]>;
|
|
35
35
|
export type Actor = z.infer<typeof actor>;
|
|
36
|
+
/**
|
|
37
|
+
* What authorized a mutation (K-34). Each entry is a permission the emitting operation
|
|
38
|
+
* checked-and-passed; `grant` — present only when the allow resolved through a
|
|
39
|
+
* `granted:<perm>` tuple (an entity or node capability grant) rather than a role bundle —
|
|
40
|
+
* is that granting tuple's `object`, which names WHICH grant (e.g. `workorder:01J…`,
|
|
41
|
+
* `scope:01J…`). Absent `grant` ⇒ authorized by a role.
|
|
42
|
+
*
|
|
43
|
+
* Kernel-stamped: module code can neither supply it (it is not on `DomainEventInput`) nor
|
|
44
|
+
* suppress it. The full proof chain is deliberately NOT persisted — `explain` re-derives
|
|
45
|
+
* chains on demand; what re-derivation cannot recover, once tuples have since changed, is
|
|
46
|
+
* which permission and grant were consulted at write time. That pointer is what is kept.
|
|
47
|
+
*/
|
|
48
|
+
export declare const eventAuthorization: z.ZodObject<{
|
|
49
|
+
permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
|
|
50
|
+
grant: z.ZodOptional<z.ZodString>;
|
|
51
|
+
}, z.core.$strip>;
|
|
52
|
+
export type EventAuthorization = z.infer<typeof eventAuthorization>;
|
|
36
53
|
export declare const domainEventInput: z.ZodObject<{
|
|
37
54
|
type: z.ZodString;
|
|
38
55
|
schemaVersion: z.ZodNumber;
|
|
@@ -71,6 +88,10 @@ export declare const domainEvent: z.ZodObject<{
|
|
|
71
88
|
pseudonymous: "pseudonymous";
|
|
72
89
|
}>;
|
|
73
90
|
subjectId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "DataSubjectId", "out">>;
|
|
91
|
+
authorization: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
92
|
+
permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
|
|
93
|
+
grant: z.ZodOptional<z.ZodString>;
|
|
94
|
+
}, z.core.$strip>>>;
|
|
74
95
|
payload: z.ZodUnknown;
|
|
75
96
|
}, z.core.$strip>;
|
|
76
97
|
export type DomainEvent = z.infer<typeof domainEvent>;
|
package/dist/events.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,eAAO,MAAM,SAAS;;;iBAGpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD,eAAO,MAAM,QAAQ;;;;EAA6C,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAGhD,eAAO,MAAM,SAAS,aAA+C,CAAC;AAEtE,eAAO,MAAM,WAAW;;iBAAiC,CAAC;AAC1D;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc;;iBAA8C,CAAC;AAC1E,eAAO,MAAM,KAAK;;;;mBAAsD,CAAC;AACzE,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;iBAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAiBpE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBASD,CAAC;AAC7B,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAGhE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiBI,CAAC;AAC7B,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}
|
package/dist/events.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
-
import { dataSubjectId, eventId, instant, moduleId, principalId, scopeId, tenantId, } from './ids.js';
|
|
2
|
+
import { dataSubjectId, eventId, instant, moduleId, permissionKey, principalId, scopeId, tenantId, } from './ids.js';
|
|
3
3
|
// Opaque ref — the kernel owns no entities (D-1); attachment contracts bind here.
|
|
4
4
|
export const entityRef = z.object({
|
|
5
5
|
entityType: z.string().min(1),
|
|
@@ -23,6 +23,25 @@ export const systemActor = z.object({ system: moduleId });
|
|
|
23
23
|
*/
|
|
24
24
|
export const connectorActor = z.object({ connection: z.string().min(1) });
|
|
25
25
|
export const actor = z.union([principalId, systemActor, connectorActor]);
|
|
26
|
+
/**
|
|
27
|
+
* What authorized a mutation (K-34). Each entry is a permission the emitting operation
|
|
28
|
+
* checked-and-passed; `grant` — present only when the allow resolved through a
|
|
29
|
+
* `granted:<perm>` tuple (an entity or node capability grant) rather than a role bundle —
|
|
30
|
+
* is that granting tuple's `object`, which names WHICH grant (e.g. `workorder:01J…`,
|
|
31
|
+
* `scope:01J…`). Absent `grant` ⇒ authorized by a role.
|
|
32
|
+
*
|
|
33
|
+
* Kernel-stamped: module code can neither supply it (it is not on `DomainEventInput`) nor
|
|
34
|
+
* suppress it. The full proof chain is deliberately NOT persisted — `explain` re-derives
|
|
35
|
+
* chains on demand; what re-derivation cannot recover, once tuples have since changed, is
|
|
36
|
+
* which permission and grant were consulted at write time. That pointer is what is kept.
|
|
37
|
+
*/
|
|
38
|
+
export const eventAuthorization = z.object({
|
|
39
|
+
permission: permissionKey,
|
|
40
|
+
grant: z
|
|
41
|
+
.string()
|
|
42
|
+
.regex(/^[a-z0-9_-]+:[^\s]+$/)
|
|
43
|
+
.optional(),
|
|
44
|
+
});
|
|
26
45
|
const piiInvariant = (val, ctx) => {
|
|
27
46
|
if (val.piiClass !== 'none' && val.subjectId === undefined) {
|
|
28
47
|
ctx.addIssue({
|
|
@@ -57,6 +76,9 @@ export const domainEvent = z
|
|
|
57
76
|
entity: entityRef,
|
|
58
77
|
piiClass,
|
|
59
78
|
subjectId: dataSubjectId.optional(),
|
|
79
|
+
// K-34: the checks the emitting operation passed — stamped kernel-side, absent on
|
|
80
|
+
// events written before the field existed (honestly unrecorded, not empty).
|
|
81
|
+
authorization: z.array(eventAuthorization).optional(),
|
|
60
82
|
payload: z.unknown(),
|
|
61
83
|
})
|
|
62
84
|
.superRefine(piiInvariant);
|
package/dist/events.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EACb,OAAO,EACP,OAAO,EACP,QAAQ,EACR,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAElB,kFAAkF;AAClF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAGH,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAGzE,MAAM,YAAY,GAAG,CACnB,GAAgD,EAChD,GAAoB,EACd,EAAE;IACR,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,2CAA2C,GAAG,CAAC,QAAQ,sDAAsD;SACvH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,0EAA0E;AAC1E,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC;AAG7B,4CAA4C;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,EAAE,EAAE,OAAO,EAAE,uEAAuE;IACpF,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,OAAO,EAAE,oBAAoB;IACzC,QAAQ,EAAE,mEAAmE;IAC7E,OAAO,EAAE,oBAAoB;IAC7B,KAAK,EAAE,oDAAoD;IAC3D,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EACb,OAAO,EACP,OAAO,EACP,QAAQ,EACR,aAAa,EACb,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAElB,kFAAkF;AAClF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAGH,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAGzE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,aAAa;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,sBAAsB,CAAC;SAC7B,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,MAAM,YAAY,GAAG,CACnB,GAAgD,EAChD,GAAoB,EACd,EAAE;IACR,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,2CAA2C,GAAG,CAAC,QAAQ,sDAAsD;SACvH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,0EAA0E;AAC1E,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC;AAG7B,4CAA4C;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,EAAE,EAAE,OAAO,EAAE,uEAAuE;IACpF,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,OAAO,EAAE,oBAAoB;IACzC,QAAQ,EAAE,mEAAmE;IAC7E,OAAO,EAAE,oBAAoB;IAC7B,KAAK,EAAE,oDAAoD;IAC3D,MAAM,EAAE,SAAS;IACjB,QAAQ;IACR,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,kFAAkF;IAClF,4EAA4E;IAC5E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,WAAW,CAAC,YAAY,CAAC,CAAC"}
|
package/dist/permission.d.ts
CHANGED
|
@@ -115,6 +115,15 @@ export declare const decision: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
|
|
115
115
|
}, z.core.$strip>;
|
|
116
116
|
}, z.core.$strip>], "allowed">;
|
|
117
117
|
export type Decision = z.infer<typeof decision>;
|
|
118
|
+
/**
|
|
119
|
+
* The grant an allow resolved through (K-34), for stamping onto an emitted event's
|
|
120
|
+
* `authorization`. Every allow proof ends with a `granted:<permission>` tuple, but a ROLE
|
|
121
|
+
* expansion's has subject `role:<key>` while a capability grant's has a principal / org /
|
|
122
|
+
* connection subject — only the latter names a grant. Returns that granting tuple's
|
|
123
|
+
* `object` (the entity or node it targets), or `undefined` when the allow came via a role
|
|
124
|
+
* (or, defensively, when no matching tuple is present).
|
|
125
|
+
*/
|
|
126
|
+
export declare function grantRefFromProof(permission: string, proof: readonly RelationTuple[]): string | undefined;
|
|
118
127
|
export declare const effectivePermissions: z.ZodObject<{
|
|
119
128
|
principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
|
|
120
129
|
node: z.ZodObject<{
|
package/dist/permission.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,eAAO,MAAM,IAAI;;;iBAGf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,eAAO,MAAM,OAAO,aAAwD,CAAC;AAE7E,eAAO,MAAM,cAAc;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;iBAAsC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;mBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,YAAa,YAAY,KAAG,MAAyC,CAAC;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAgB9D,eAAO,MAAM,SAAS,qDAGC,CAAC;AACxB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGlD,eAAO,MAAM,YAAY,aAAqC,CAAC;AAE/D,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAQ1D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;8BAUnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,eAAO,MAAM,IAAI;;;iBAGf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,eAAO,MAAM,OAAO,aAAwD,CAAC;AAE7E,eAAO,MAAM,cAAc;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;iBAAsC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;mBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,YAAa,YAAY,KAAG,MAAyC,CAAC;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAgB9D,eAAO,MAAM,SAAS,qDAGC,CAAC;AACxB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGlD,eAAO,MAAM,YAAY,aAAqC,CAAC;AAE/D,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAQ1D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;8BAUnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,aAAa,EAAE,GAC9B,MAAM,GAAG,SAAS,CAOpB;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
|
package/dist/permission.js
CHANGED
|
@@ -119,6 +119,23 @@ export const decision = z.discriminatedUnion('allowed', [
|
|
|
119
119
|
node,
|
|
120
120
|
}),
|
|
121
121
|
]);
|
|
122
|
+
/**
|
|
123
|
+
* The grant an allow resolved through (K-34), for stamping onto an emitted event's
|
|
124
|
+
* `authorization`. Every allow proof ends with a `granted:<permission>` tuple, but a ROLE
|
|
125
|
+
* expansion's has subject `role:<key>` while a capability grant's has a principal / org /
|
|
126
|
+
* connection subject — only the latter names a grant. Returns that granting tuple's
|
|
127
|
+
* `object` (the entity or node it targets), or `undefined` when the allow came via a role
|
|
128
|
+
* (or, defensively, when no matching tuple is present).
|
|
129
|
+
*/
|
|
130
|
+
export function grantRefFromProof(permission, proof) {
|
|
131
|
+
const rel = `granted:${permission}`;
|
|
132
|
+
for (let i = proof.length - 1; i >= 0; i--) {
|
|
133
|
+
const t = proof[i];
|
|
134
|
+
if (t && t.relation === rel)
|
|
135
|
+
return t.subject.startsWith('role:') ? undefined : t.object;
|
|
136
|
+
}
|
|
137
|
+
return undefined;
|
|
138
|
+
}
|
|
122
139
|
export const effectivePermissions = z.object({
|
|
123
140
|
principalId,
|
|
124
141
|
node,
|
package/dist/permission.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,QAAQ,EACR,aAAa,EACb,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAO;IACZ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW;IACX,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAGH,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAqB,EAAU,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AAE7F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW;IACX,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,+EAA+E;AAE/E,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,gBAAgB;AAChB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,CAAC;KAC7B,KAAK,EAAe,CAAC;AAGxB,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,4DAA4D;AAC5D,+EAA+E;AAE/E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,OAAO,EAAE,aAAa;QACtB,IAAI;KACL,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW;IACX,IAAI;IACJ,WAAW,EAAE,CAAC,CAAC,KAAK,CAClB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CACH;CACF,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,QAAQ,EACR,aAAa,EACb,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAO;IACZ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW;IACX,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAGH,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAqB,EAAU,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AAE7F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW;IACX,UAAU,EAAE,aAAa;IACzB,IAAI;IACJ,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,+EAA+E;AAE/E,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,gBAAgB;AAChB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,CAAC;KAC7B,KAAK,EAAe,CAAC;AAGxB,kEAAkE;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,4DAA4D;AAC5D,+EAA+E;AAE/E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,OAAO,EAAE,aAAa;QACtB,IAAI;KACL,CAAC;CACH,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,KAA+B;IAE/B,MAAM,GAAG,GAAG,WAAW,UAAU,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW;IACX,IAAI;IACJ,WAAW,EAAE,CAAC,CAAC,KAAK,CAClB,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CACH;CACF,CAAC,CAAC"}
|
package/dist/registry.d.ts
CHANGED
|
@@ -40,6 +40,10 @@ export declare const vertical: z.ZodObject<{
|
|
|
40
40
|
ownerGrants: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>>;
|
|
41
41
|
provides: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
42
42
|
requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
43
|
+
surfaces: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
44
|
+
name: z.ZodString;
|
|
45
|
+
label: z.ZodString;
|
|
46
|
+
}, z.core.$strip>>>;
|
|
43
47
|
listed: z.ZodDefault<z.ZodBoolean>;
|
|
44
48
|
publishRequestedAt: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>>;
|
|
45
49
|
installsBlocked: z.ZodDefault<z.ZodBoolean>;
|
|
@@ -84,6 +88,10 @@ export declare const registerVerticalInput: z.ZodObject<{
|
|
|
84
88
|
ownerGrants: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>>;
|
|
85
89
|
provides: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
86
90
|
requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
91
|
+
surfaces: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
92
|
+
name: z.ZodString;
|
|
93
|
+
label: z.ZodString;
|
|
94
|
+
}, z.core.$strip>>>;
|
|
87
95
|
listed: z.ZodDefault<z.ZodBoolean>;
|
|
88
96
|
ownerTenant: z.ZodDefault<z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>>;
|
|
89
97
|
}, z.core.$strip>;
|
|
@@ -172,6 +180,7 @@ export declare const verticalChannel: z.ZodObject<{
|
|
|
172
180
|
}>;
|
|
173
181
|
versionId: z.ZodString;
|
|
174
182
|
updatedAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
|
|
183
|
+
servingVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
175
184
|
}, z.core.$strip>;
|
|
176
185
|
export type VerticalChannel = z.infer<typeof verticalChannel>;
|
|
177
186
|
/**
|
package/dist/registry.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc;;;;EAAoC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8EnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKhC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;EAA8C,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;iBAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;;iBAmB5B,CAAC;AACL,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;EAAqC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,eAAe;;;;;;;;;;iBAe1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBAS9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
|
package/dist/registry.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
import { instant, permissionKey, tenantId, verticalSlug } from './ids.js';
|
|
3
3
|
import { envVarSpec, capability } from './manifest.js';
|
|
4
|
+
import { declaredSurface } from './routing.js';
|
|
4
5
|
/**
|
|
5
6
|
* The vertical + version registry (#31 step 1; D-33's milestone one).
|
|
6
7
|
*
|
|
@@ -44,6 +45,14 @@ export const vertical = z.object({
|
|
|
44
45
|
ownerGrants: z.array(permissionKey).optional(),
|
|
45
46
|
provides: z.array(capability).optional(),
|
|
46
47
|
requires: z.array(capability).optional(),
|
|
48
|
+
/**
|
|
49
|
+
* The surfaces the vertical declares it serves (K-26 multi-surface; labels only —
|
|
50
|
+
* nothing platform-side branches on them). Rides the same install_spec bag as the
|
|
51
|
+
* fields above: a hostname-binding picker for the dashboard, and a push-time warning
|
|
52
|
+
* when a bound surface vanishes from a new version's declaration. Optional and
|
|
53
|
+
* additive (D-28); free-text surfaces stay valid for a vertical that declares none.
|
|
54
|
+
*/
|
|
55
|
+
surfaces: z.array(declaredSurface).optional(),
|
|
47
56
|
/**
|
|
48
57
|
* Published to the PUBLIC marketplace (marketplace-publish.md §2/§5). `false` = private to
|
|
49
58
|
* its `ownerTenant`. First-party verticals are seeded `true`; a builder vertical flips it via
|
|
@@ -99,7 +108,7 @@ export const verticalServingState = z.object({
|
|
|
99
108
|
migrationTag: z.string().min(1),
|
|
100
109
|
});
|
|
101
110
|
export const registerVerticalInput = vertical
|
|
102
|
-
.pick({ slug: true, name: true, source: true, envSpec: true, entitlements: true, ownerGrants: true, provides: true, requires: true, listed: true })
|
|
111
|
+
.pick({ slug: true, name: true, source: true, envSpec: true, entitlements: true, ownerGrants: true, provides: true, requires: true, surfaces: true, listed: true })
|
|
103
112
|
.extend({
|
|
104
113
|
// Optional on input — a staff/platform push omits it (⇒ platform-owned).
|
|
105
114
|
ownerTenant: tenantId.nullable().default(null),
|
|
@@ -180,6 +189,16 @@ export const verticalChannel = z.object({
|
|
|
180
189
|
channel: channelName,
|
|
181
190
|
versionId: z.string().min(1),
|
|
182
191
|
updatedAt: instant,
|
|
192
|
+
/**
|
|
193
|
+
* What the stable serving script (#286) is ACTUALLY running for this vertical — only
|
|
194
|
+
* meaningful for `prod`, which serves in place. A prod promote moves `versionId`
|
|
195
|
+
* (the pointer, audited) BEFORE the in-place serve; `servingVersionId` advances only
|
|
196
|
+
* after a serve succeeds. So `servingVersionId !== versionId` on prod is the honest
|
|
197
|
+
* signal that a serve failed (or is mid-flight): the channel was promoted but the
|
|
198
|
+
* scopes still run the previous code (#321). Null for dev/staging (no in-place serve)
|
|
199
|
+
* and for a vertical with no serving script yet.
|
|
200
|
+
*/
|
|
201
|
+
servingVersionId: z.string().min(1).nullish(),
|
|
183
202
|
});
|
|
184
203
|
/**
|
|
185
204
|
* One promotion, kept forever (append-only). The channel row is a pointer — it
|
package/dist/registry.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,YAAY,EAAE,iFAAiF;IACrG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,cAAc;IACtB;;;;;OAKG;IACH,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAChC;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACvC;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC,OAAO,EAAE;IACrC;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACvC;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAC7C,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ;KAC1C,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAClK,MAAM,CAAC;IACR,yEAAyE;IACzE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/C,CAAC,CAAC;AAKH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO;IAC9B,YAAY;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8DAA8D;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oFAAoF;IACpF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,eAAe;IAC1B,wDAAwD;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe;KAC/C,IAAI,CAAC;IACJ,EAAE,EAAE,IAAI;IACR,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;CACpB,CAAC;KACD,MAAM,CAAC;IACN;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACnC,CAAC,CAAC;AAGL;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;IAClB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;CAC9C,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,6BAA6B;IACpD,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gFAAgF;IAChF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC"}
|
package/dist/routing.d.ts
CHANGED
|
@@ -19,6 +19,25 @@ import { z } from 'zod';
|
|
|
19
19
|
* the request, and the vertical decides what that name means.
|
|
20
20
|
*/
|
|
21
21
|
export declare const surfaceName: z.ZodString;
|
|
22
|
+
/**
|
|
23
|
+
* A surface a vertical DECLARES it serves (package.json `substrat.surfaces` → the
|
|
24
|
+
* deploy manifest → the registry). Labels only, today — the kernel and router stay
|
|
25
|
+
* indifferent; what the declaration buys is operator UX: a hostname-binding picker
|
|
26
|
+
* instead of free text, and a push-time warning when a version stops declaring a
|
|
27
|
+
* surface that hostnames are still bound to. Free-text `surfaceName` remains valid
|
|
28
|
+
* everywhere — an undeclared surface is not an error.
|
|
29
|
+
*
|
|
30
|
+
* This object is also the anchor #111 ("app as a first-class surface") extends when a
|
|
31
|
+
* surface grows into a real authority boundary: a per-surface OPERATION-SET (the
|
|
32
|
+
* scoped subset an app token may call, and the filter its OAS view is cut by) attaches
|
|
33
|
+
* HERE, as optional additive fields — never as a second, competing surface list. Until
|
|
34
|
+
* then the declaration must not be read as enforcement: it names, it does not gate.
|
|
35
|
+
*/
|
|
36
|
+
export declare const declaredSurface: z.ZodObject<{
|
|
37
|
+
name: z.ZodString;
|
|
38
|
+
label: z.ZodString;
|
|
39
|
+
}, z.core.$strip>;
|
|
40
|
+
export type DeclaredSurface = z.infer<typeof declaredSurface>;
|
|
22
41
|
/**
|
|
23
42
|
* Where the hostname's traffic may be processed.
|
|
24
43
|
*
|
package/dist/routing.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,aAA4B,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc;;GAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc;;;;;EAAuD,CAAC;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,aAA2C,CAAC;AAEjE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAkB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;;;iBActB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,aAA4B,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc;;GAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc;;;;;EAAuD,CAAC;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,aAA2C,CAAC;AAEjE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAkB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;;;iBActB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}
|
package/dist/routing.js
CHANGED
|
@@ -20,6 +20,24 @@ import { instant, scopeId, tenantId, verticalSlug } from './ids.js';
|
|
|
20
20
|
* the request, and the vertical decides what that name means.
|
|
21
21
|
*/
|
|
22
22
|
export const surfaceName = z.string().min(1).max(32);
|
|
23
|
+
/**
|
|
24
|
+
* A surface a vertical DECLARES it serves (package.json `substrat.surfaces` → the
|
|
25
|
+
* deploy manifest → the registry). Labels only, today — the kernel and router stay
|
|
26
|
+
* indifferent; what the declaration buys is operator UX: a hostname-binding picker
|
|
27
|
+
* instead of free text, and a push-time warning when a version stops declaring a
|
|
28
|
+
* surface that hostnames are still bound to. Free-text `surfaceName` remains valid
|
|
29
|
+
* everywhere — an undeclared surface is not an error.
|
|
30
|
+
*
|
|
31
|
+
* This object is also the anchor #111 ("app as a first-class surface") extends when a
|
|
32
|
+
* surface grows into a real authority boundary: a per-surface OPERATION-SET (the
|
|
33
|
+
* scoped subset an app token may call, and the filter its OAS view is cut by) attaches
|
|
34
|
+
* HERE, as optional additive fields — never as a second, competing surface list. Until
|
|
35
|
+
* then the declaration must not be read as enforcement: it names, it does not gate.
|
|
36
|
+
*/
|
|
37
|
+
export const declaredSurface = z.object({
|
|
38
|
+
name: surfaceName,
|
|
39
|
+
label: z.string().min(1).max(80),
|
|
40
|
+
});
|
|
23
41
|
/**
|
|
24
42
|
* Where the hostname's traffic may be processed.
|
|
25
43
|
*
|
package/dist/routing.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"routing.js","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAEpE;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGxD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ;IACR,QAAQ;IACR,OAAO;IACP;kFAC8E;IAC9E,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC;IACpD,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,OAAO;IACP,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;IACrC;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;CACvB,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"routing.js","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAEpE;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGxD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ;IACR,QAAQ;IACR,OAAO;IACP;kFAC8E;IAC9E,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC;IACpD,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,OAAO;IACP,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;IACrC;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,cAAc;CACvB,CAAC,CAAC"}
|
package/dist/tenancy.d.ts
CHANGED
|
@@ -2,6 +2,7 @@ import { z } from 'zod';
|
|
|
2
2
|
export declare const tenantStatus: z.ZodEnum<{
|
|
3
3
|
active: "active";
|
|
4
4
|
deleting: "deleting";
|
|
5
|
+
reaped: "reaped";
|
|
5
6
|
suspended: "suspended";
|
|
6
7
|
}>;
|
|
7
8
|
export type TenantStatus = z.infer<typeof tenantStatus>;
|
|
@@ -12,9 +13,11 @@ export declare const tenant: z.ZodObject<{
|
|
|
12
13
|
status: z.ZodEnum<{
|
|
13
14
|
active: "active";
|
|
14
15
|
deleting: "deleting";
|
|
16
|
+
reaped: "reaped";
|
|
15
17
|
suspended: "suspended";
|
|
16
18
|
}>;
|
|
17
19
|
createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
|
|
20
|
+
deletingAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
18
21
|
}, z.core.$strip>;
|
|
19
22
|
export type Tenant = z.infer<typeof tenant>;
|
|
20
23
|
export declare const createTenantInput: z.ZodObject<{
|
|
@@ -57,6 +60,7 @@ export declare const scopeStatus: z.ZodEnum<{
|
|
|
57
60
|
archived: "archived";
|
|
58
61
|
archiving: "archiving";
|
|
59
62
|
provisioning: "provisioning";
|
|
63
|
+
reaped: "reaped";
|
|
60
64
|
suspended: "suspended";
|
|
61
65
|
}>;
|
|
62
66
|
export type ScopeStatus = z.infer<typeof scopeStatus>;
|
|
@@ -87,7 +91,9 @@ export type ProvisionableJurisdiction = z.infer<typeof provisionableJurisdiction
|
|
|
87
91
|
* Deliberately **not** a `scopeStatus` member: the scope already fails closed at the
|
|
88
92
|
* migration layer, so nothing about lifecycle gating changes, and the §3.3 machine
|
|
89
93
|
* (`provisioning → active → suspended ⇄ active → archiving → archived`) has no
|
|
90
|
-
* sensible transition for it.
|
|
94
|
+
* sensible transition for it. (`archived → reaped` extends that machine at the terminal
|
|
95
|
+
* end — a storage reap, K-34 §4.4 — but that is a real lifecycle transition, unlike a
|
|
96
|
+
* migration failure.) Structured rather than a flag because the
|
|
91
97
|
* reconciliation sweep (§5.3) retries with backoff and reports
|
|
92
98
|
* "487/500 migrated, 13 pending, 0 failed" — which needs the attempt count and the
|
|
93
99
|
* failing version, not a boolean.
|
|
@@ -185,6 +191,7 @@ export declare const scope: z.ZodObject<{
|
|
|
185
191
|
archived: "archived";
|
|
186
192
|
archiving: "archiving";
|
|
187
193
|
provisioning: "provisioning";
|
|
194
|
+
reaped: "reaped";
|
|
188
195
|
suspended: "suspended";
|
|
189
196
|
}>;
|
|
190
197
|
storageShape: z.ZodEnum<{
|
|
@@ -209,6 +216,7 @@ export declare const scope: z.ZodObject<{
|
|
|
209
216
|
forkedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
210
217
|
expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
211
218
|
servingRef: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
219
|
+
archivedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
212
220
|
createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
|
|
213
221
|
}, z.core.$strip>;
|
|
214
222
|
export type Scope = z.infer<typeof scope>;
|
package/dist/tenancy.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,YAAY
|
|
1
|
+
{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,YAAY;;;;;EAevB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,MAAM;;;;;;;;;;;;iBAUjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAI5C,eAAO,MAAM,iBAAiB;;;;iBAAoD,CAAC;AACnF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,GAAG;;;;;;iBAMd,CAAC;AACH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;AAGtC,eAAO,MAAM,cAAc;;;;;iBAAiE,CAAC;AAC7F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,WAAW;;;;;;;EAYtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,YAAY;;;EAAqB,CAAC;AAC/C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAcxD,eAAO,MAAM,YAAY;;;;EAAiC,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAUxD,eAAO,MAAM,yBAAyB;;EAAqB,CAAC;AAC5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,sBAAsB;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC5E,eAAO,MAAM,gBAAgB;;;;;kBAAoC,CAAC;AAClE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;iBAS7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+DhB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}
|
package/dist/tenancy.js
CHANGED
|
@@ -1,12 +1,31 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
import { instant, orgId, scopeId, slug, tenantId } from './ids.js';
|
|
3
|
-
export const tenantStatus = z.enum([
|
|
3
|
+
export const tenantStatus = z.enum([
|
|
4
|
+
'active',
|
|
5
|
+
'suspended',
|
|
6
|
+
// The reversible grace state before deletion (control-plane.md §4.1/§4.8): `getScope`
|
|
7
|
+
// fails closed for every scope under the tenant exactly as `suspended` does, so the
|
|
8
|
+
// tenant is inert, but no data has been reclaimed yet. `active` again (an un-delete)
|
|
9
|
+
// restores it. A tenant sits here until a staff reap or the retention window elapses.
|
|
10
|
+
'deleting',
|
|
11
|
+
// Terminal, past `deleting` (control-plane.md §4.8): every scope's DO storage has been
|
|
12
|
+
// reaped and the tenant's PII/config directory rows cleared, but the `tenants` row
|
|
13
|
+
// survives as a tombstone (audit history + burned slug) and `_substrat_admin_log` is
|
|
14
|
+
// kept whole (the compliance witness — never swept). Unlike `deleting` this is NOT
|
|
15
|
+
// reversible — the bytes are gone. Read gates fail closed on it exactly like a missing
|
|
16
|
+
// tenant. Reached only from `deleting` via the audited `reapTenant` action.
|
|
17
|
+
'reaped',
|
|
18
|
+
]);
|
|
4
19
|
export const tenant = z.object({
|
|
5
20
|
id: tenantId,
|
|
6
21
|
slug,
|
|
7
22
|
name: z.string().min(1),
|
|
8
23
|
status: tenantStatus,
|
|
9
24
|
createdAt: instant,
|
|
25
|
+
// When the tenant last entered `deleting`, or null when it is not being deleted. The
|
|
26
|
+
// reap sweep ages a tenant off this to decide when the grace window has elapsed
|
|
27
|
+
// (control-plane.md §4.8) — mirrors `scope.archivedAt`. Cleared on un-delete.
|
|
28
|
+
deletingAt: instant.nullable(),
|
|
10
29
|
});
|
|
11
30
|
// What the caller supplies to createTenant (control-plane.md §4.1); `status`
|
|
12
31
|
// (active) and `createdAt` are stamped host-side, never caller-supplied.
|
|
@@ -40,6 +59,12 @@ export const scopeStatus = z.enum([
|
|
|
40
59
|
'suspended',
|
|
41
60
|
'archiving',
|
|
42
61
|
'archived',
|
|
62
|
+
// Terminal, past `archived`: the directory row survives as a tombstone (audit
|
|
63
|
+
// history + burned slug, control-plane.md §4.4) but the scope DO's storage has been
|
|
64
|
+
// reaped (`storage.deleteAll()`). Unlike `archived`, this is NOT reversible — the
|
|
65
|
+
// bytes are gone, so there is no restore. Read gates fail closed on it exactly like a
|
|
66
|
+
// missing scope. Reached only from `archived` via the audited `reapScope` action.
|
|
67
|
+
'reaped',
|
|
43
68
|
]);
|
|
44
69
|
// §5.2 of the design doc: A = DO-embedded SQLite is primary; B = DO control plane + D1
|
|
45
70
|
export const storageShape = z.enum(['A', 'B']);
|
|
@@ -77,7 +102,9 @@ export const provisionableJurisdiction = z.enum(['global']);
|
|
|
77
102
|
* Deliberately **not** a `scopeStatus` member: the scope already fails closed at the
|
|
78
103
|
* migration layer, so nothing about lifecycle gating changes, and the §3.3 machine
|
|
79
104
|
* (`provisioning → active → suspended ⇄ active → archiving → archived`) has no
|
|
80
|
-
* sensible transition for it.
|
|
105
|
+
* sensible transition for it. (`archived → reaped` extends that machine at the terminal
|
|
106
|
+
* end — a storage reap, K-34 §4.4 — but that is a real lifecycle transition, unlike a
|
|
107
|
+
* migration failure.) Structured rather than a flag because the
|
|
81
108
|
* reconciliation sweep (§5.3) retries with backoff and reports
|
|
82
109
|
* "487/500 migrated, 13 pending, 0 failed" — which needs the attempt count and the
|
|
83
110
|
* failing version, not a boolean.
|
|
@@ -184,6 +211,13 @@ export const scope = z.object({
|
|
|
184
211
|
* away from the script that holds its Durable Objects resolves empty storage.
|
|
185
212
|
*/
|
|
186
213
|
servingRef: z.string().min(1).nullish(),
|
|
214
|
+
/**
|
|
215
|
+
* When the scope last entered `archived` (§4.4). Null if it never archived (every
|
|
216
|
+
* active scope) and cleared on unarchive. The reap sweep ages a scope off this — an
|
|
217
|
+
* `archived` scope older than the retention window has its DO storage reaped and moves
|
|
218
|
+
* to `reaped`. History-only for a `reaped` scope: the bytes are already gone.
|
|
219
|
+
*/
|
|
220
|
+
archivedAt: instant.nullable(),
|
|
187
221
|
createdAt: instant,
|
|
188
222
|
});
|
|
189
223
|
//# sourceMappingURL=tenancy.js.map
|
package/dist/tenancy.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEnE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEnE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,QAAQ;IACR,WAAW;IACX,sFAAsF;IACtF,oFAAoF;IACpF,qFAAqF;IACrF,sFAAsF;IACtF,UAAU;IACV,uFAAuF;IACvF,mFAAmF;IACnF,qFAAqF;IACrF,mFAAmF;IACnF,uFAAuF;IACvF,4EAA4E;IAC5E,QAAQ;CACT,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,QAAQ;IACZ,IAAI;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,OAAO;IAClB,qFAAqF;IACrF,gFAAgF;IAChF,8EAA8E;IAC9E,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAGnF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,EAAE,EAAE,KAAK;IACT,QAAQ;IACR,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAG7F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;IACX,UAAU;IACV,8EAA8E;IAC9E,oFAAoF;IACpF,kFAAkF;IAClF,sFAAsF;IACtF,kFAAkF;IAClF,QAAQ;CACT,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAG/C,+EAA+E;AAC/E,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAChF,sFAAsF;AACtF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AAG3D,gFAAgF;AAChF,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AACjF,+EAA+E;AAC/E,2EAA2E;AAC3E,iFAAiF;AACjF,sBAAsB;AACtB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAG5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kCAAkC;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,6CAA6C;IACpF,aAAa,EAAE,OAAO;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,QAAQ,EAAE,CAAC;AAGlE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpC,OAAO,EAAE,gBAAgB,EAAE,uCAAuC;IAClE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,OAAO,EAAE,6EAA6E;IAC1F,QAAQ;IACR,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,4DAA4D;IAC/F,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qEAAqE;IAC9F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,WAAW;IACnB,YAAY;IACZ,YAAY;IACZ,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC;;;;;;;OAOG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,6EAA6E;IAC7E,iFAAiF;IACjF,gFAAgF;IAChF,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gBAAgB;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B;;;;;;OAMG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACvC;;;;;OAKG;IACH,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@substrat-run/contracts",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.25.0",
|
|
4
4
|
"description": "Substrat kernel contract schemas — Zod is the source of truth (master plan D-22); OAS/JSON Schema are emitted artifacts",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|