@uniflowed/config 0.0.0-alpha.13 → 0.0.0-alpha.14

package/index.js

@@ -5,6 +5,7 @@
 export type {
   CapabilityJsHost,
   CoverageThresholds,
+  Permissions,
   RuleLevel,
   TaskDefinition,
   UniflowedConfig,

package/internal/schema.js

@@ -25,6 +25,37 @@ export type TaskDefinition =
 
 export type CapabilityJsHost = "node" | "deno" | "bun";
 
+/**
+ * What the project's own code may reach.
+ *
+ * Absent from `uf.config.js` means no permission model: the toolchain starts
+ * its host the way it always has. Present means **deny by default** — the
+ * project's code gets what is listed and nothing else — and `permissions: {}`
+ * is a legitimate thing to write, meaning "nothing beyond what uf itself needs
+ * to load and transform the project". There is deliberately no way to spell
+ * "everything"; a project that wants everything does not declare a set.
+ *
+ * Every field is a list of literal strings, because `uf.config.js` is read as
+ * text and parsed as JSON5 rather than executed: a computed path or a
+ * `process.env` read here would not parse.
+ *
+ * The set is uf's, not a runtime's. Node.js enforces `read` and `write`, Deno
+ * enforces all five, and Bun has no permission model at all — a host that
+ * cannot enforce what is declared **refuses the run** rather than applying part
+ * of it. `docs/hosts.md` is the table.
+ *
+ * The declared paths are *added to* the ones uf needs to run the project, so
+ * what a set denies is the rest of the machine — `~/.ssh`, the network, the
+ * environment — and not the project's own files.
+ */
+export type Permissions = {
+  readonly read?: $ReadOnlyArray<string>,
+  readonly write?: $ReadOnlyArray<string>,
+  readonly net?: $ReadOnlyArray<string>,
+  readonly env?: $ReadOnlyArray<string>,
+  readonly run?: $ReadOnlyArray<string>,
+};
+
 /**
  * Percentages a coverage gate requires, as whole numbers between 0 and 100.
  *
@@ -161,9 +192,16 @@ export type UniflowedConfig = {
   readonly build?: {
     readonly entries?: $ReadOnlyArray<string>,
     readonly outDir?: string,
+    // Prerender every route and leave no server bundle behind. Read together
+    // with `app.rendering.modes`; see docs/app/reference/config.
     readonly staticBuild?: boolean,
     readonly sourcemap?: boolean,
   },
+  // Which builder uf drives. Vite is the default, not a dependency: any module
+  // satisfying the contract in docs/architecture.md can be named here.
+  readonly builder?: {
+    readonly module?: string,
+  },
   readonly dev?: {
     readonly host?: string,
     readonly port?: number,
@@ -216,12 +254,50 @@ export type UniflowedConfig = {
     >,
     readonly typescriptDeclarationsToFlow?: true,
   },
+  readonly permissions?: Permissions,
   readonly pm?: {
     readonly module?: "@uniflowed/pm",
     readonly resolver?: "uf-native",
     readonly lockfile?: "uf.lock",
     readonly storeDir?: string,
     readonly allowLifecycleScripts?: false,
+    /**
+     * The registry uf *reads* from: packuments, provenance attestations, and
+     * the versions `uf update` reports against.
+     *
+     * Unset means `publish.registry`, which is where this lived until it
+     * turned out to be answering two questions with one value. A project that
+     * publishes to a company registry and installs through a read-through
+     * mirror sets both; one that has only ever set `publish.registry` keeps
+     * working and is told, once, which key to move to.
+     */
+    readonly registry?: string,
+    /**
+     * Which registry answers for which scope: `{ "@company": "https://…" }`.
+     *
+     * A scope named here resolves from that registry **and nowhere else**.
+     * There is no fallback to the public registry, deliberately: publishing
+     * `@company/internal-thing` to npmjs and waiting for a resolver to fall
+     * back to it is the dependency-confusion attack, so the fallback is the
+     * vulnerability rather than a recovery from it. A name the bound registry
+     * does not have is an error that names the scope and the registry.
+     *
+     * uf refuses an install whose lockfile resolves a bound scope from
+     * somewhere else. It does not rewrite the project's `.npmrc`: the manager
+     * that resolves is the manager that has to be told, in its own
+     * configuration.
+     */
+    readonly scopes?: { readonly [scope: string]: string },
+    /**
+     * How hard `uf install` looks at npm provenance attestations.
+     *
+     * `"report"`, the default, reads the attestation of every package the
+     * install brought in or moved: an attestation that is not about the
+     * tarball being installed stops the install, and a package with none is a
+     * line in the summary. `"off"` reads none, for a machine with no route to
+     * a registry.
+     */
+    readonly provenance?: "report" | "off",
   },
   readonly rm?: {
     readonly module?: "@uniflowed/rm",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniflowed/config",
-  "version": "0.0.0-alpha.13",
+  "version": "0.0.0-alpha.14",
   "description": "Flow declarations for @uniflowed/config, part of the Unified Toolchain for Flow.",
   "type": "module",
   "license": "MIT",