@uns-kit/core 3.0.27 → 3.0.30

package/dist/runtime/configuration-group-contract.js

@@ -0,0 +1,233 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { readConfigurationSelector } from "./process-group-contract.js";
+import { readProcessGroupResource } from "./process-group-resources.js";
+const identity = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);
+const digest = z.string().regex(/^[a-f0-9]{64}$/);
+const selector = z
+    .array(z
+    .string()
+    .regex(/^[a-zA-Z][a-zA-Z0-9_-]{0,99}$/)
+    .refine((v) => !["__proto__", "prototype", "constructor"].includes(v)))
+    .min(1)
+    .max(8);
+const MAX_BYTES = 1024 * 1024;
+/** Versioned canonical JSON: binary key order, no locale, executable values or accessors. */
+export function configurationResourceJson(value) {
+    let nodes = 0, bytes = 0;
+    const ancestors = new Set();
+    const charge = (size) => {
+        bytes += size;
+        if (bytes > MAX_BYTES)
+            throw Error("Configuration resource exceeds 1 MiB");
+    };
+    function visit(v, depth) {
+        if (++nodes > 65536 || depth > 32)
+            throw Error("Configuration resource exceeds its structural budget");
+        if (v === null || typeof v === "boolean") {
+            charge(v === null ? 4 : v ? 4 : 5);
+            return JSON.stringify(v);
+        }
+        if (typeof v === "string") {
+            if (Buffer.byteLength(v) > MAX_BYTES)
+                throw Error("Configuration resource string exceeds 1 MiB");
+            const encoded = JSON.stringify(v);
+            charge(Buffer.byteLength(encoded));
+            return encoded;
+        }
+        if (typeof v === "number" && Number.isFinite(v)) {
+            const encoded = JSON.stringify(v);
+            charge(encoded.length);
+            return encoded;
+        }
+        if (!v || typeof v !== "object" || ancestors.has(v))
+            throw Error("Configuration resource must contain finite plain JSON only");
+        if (Array.isArray(v)
+            ? Object.getPrototypeOf(v) !== Array.prototype
+            : Object.getPrototypeOf(v) !== Object.prototype && Object.getPrototypeOf(v) !== null)
+            throw Error("Configuration resource must contain plain JSON objects");
+        if (Object.getOwnPropertySymbols(v).length)
+            throw Error("Configuration resource cannot contain symbol properties");
+        const descriptors = Object.getOwnPropertyDescriptors(v);
+        for (const [key, d] of Object.entries(descriptors)) {
+            if (Array.isArray(v) && key === "length")
+                continue;
+            if (!d.enumerable || !Object.hasOwn(d, "value"))
+                throw Error("Configuration resource cannot contain hidden properties or accessors");
+        }
+        ancestors.add(v);
+        charge(2); // Container brackets/braces.
+        let result;
+        if (Array.isArray(v)) {
+            if (v.length > 65536 || Object.keys(v).length !== v.length || Object.keys(v).some((k, i) => k !== String(i)))
+                throw Error("Configuration resource arrays must be dense JSON arrays");
+            charge(Math.max(0, v.length - 1));
+            result = "[" + Array.from({ length: v.length }, (_, i) => visit(descriptors[String(i)].value, depth + 1)).join(",") + "]";
+        }
+        else
+            result =
+                "{" +
+                    Object.keys(v)
+                        .sort()
+                        .map((k, i) => {
+                        if (Buffer.byteLength(k) > MAX_BYTES)
+                            throw Error("Configuration resource key exceeds 1 MiB");
+                        charge(Buffer.byteLength(JSON.stringify(k)) + 1 + (i ? 1 : 0));
+                        return JSON.stringify(k) + ":" + visit(descriptors[k].value, depth + 1);
+                    })
+                        .join(",") +
+                    "}";
+        ancestors.delete(v);
+        return result;
+    }
+    const json = visit(value, 0);
+    if (Buffer.byteLength(json) > MAX_BYTES)
+        throw Error("Configuration resource exceeds 1 MiB");
+    return json;
+}
+export function configurationResourceHash(value) {
+    return createHash("sha256").update("uns-configuration-json-v1\n").update(configurationResourceJson(value)).digest("hex");
+}
+export const configurationGroupProfileSchema = z.strictObject({
+    id: identity,
+    processName: identity,
+    dataGroup: identity,
+    resource: z.unknown(),
+});
+export const configurationGroupSchema = z.strictObject({
+    schemaVersion: z.literal(2),
+    id: identity,
+    inputTopic: z
+        .string()
+        .min(1)
+        .max(512)
+        .regex(/^[^#+\0]+$/),
+    processName: identity,
+    receiverProcessName: identity,
+    profiles: z.array(configurationGroupProfileSchema).min(2).max(16),
+});
+export const configurationGroupDescriptorSchema = z
+    .strictObject({
+    protocolVersion: z.literal(2),
+    namespace: identity,
+    publisherPath: selector,
+    groupPath: selector,
+    memberPath: selector,
+    journalPath: selector,
+    runtimeRolePath: selector,
+    receiverRole: identity,
+    match: z.strictObject({ path: selector, value: z.string().min(1).max(100) }).optional(),
+})
+    .superRefine((d, context) => {
+    const independent = [d.publisherPath, d.journalPath, d.runtimeRolePath].map((p) => p.join("."));
+    if (new Set(independent).size !== independent.length || independent.some((p, i) => independent.some((q, j) => i !== j && q.startsWith(p + "."))))
+        context.addIssue({ code: "custom", message: "Independent publisher, journal and role selectors required" });
+    const parent = d.publisherPath.join(".") + ".", group = d.groupPath.join("."), member = d.memberPath.join(".");
+    if (!group.startsWith(parent) ||
+        !member.startsWith(parent) ||
+        group === member ||
+        group.startsWith(member + ".") ||
+        member.startsWith(group + "."))
+        context.addIssue({ code: "custom", message: "Distinct group/member selectors within the publisher required" });
+});
+const snapshots = new WeakSet();
+function freeze(value) {
+    if (value && typeof value === "object") {
+        for (const child of Object.values(value))
+            freeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+export function configurationGroupSnapshot(value) {
+    // Bound and copy before schema traversal; caller mutation cannot change a running revision.
+    const group = configurationGroupSchema.parse(JSON.parse(configurationResourceJson(value)));
+    const names = [group.processName, group.receiverProcessName, ...group.profiles.map((p) => p.processName)];
+    if (new Set(names).size !== names.length || new Set(group.profiles.map((p) => p.id)).size !== group.profiles.length)
+        throw Error("Configuration group identities overlap");
+    const profiles = group.profiles.map((p) => ({ ...p, resourceSha256: configurationResourceHash(p.resource) }));
+    const result = freeze({ group, sha256: configurationResourceHash(group), profiles });
+    snapshots.add(result);
+    return result;
+}
+export function assertConfigurationGroupSnapshot(value) {
+    if (!snapshots.has(value))
+        throw Error("Exact SDK-issued configuration group snapshot required");
+}
+/** Optional data-only capability; packages without it keep their existing behavior. */
+export function configurationGroupDescriptor(packageRoot) {
+    const file = path.join(packageRoot, "package.json");
+    // Ordinary Node/Python deployments do not opt in by existing on the host.
+    if (!fs.existsSync(file))
+        return undefined;
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    let bytes;
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.size > MAX_BYTES)
+            throw Error("Invalid installed runtime metadata");
+        bytes = fs.readFileSync(fd);
+        if (bytes.length > MAX_BYTES)
+            throw Error("Installed runtime metadata is too large");
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    const pkg = JSON.parse(bytes.toString());
+    const value = pkg.unsDatahub?.processGroupConfigurationRuntime;
+    if (value !== undefined && !readProcessGroupResource(file).equals(bytes))
+        throw Error("Installed runtime metadata changed during discovery");
+    return value === undefined ? undefined : configurationGroupDescriptorSchema.parse(value);
+}
+export function selectedConfigurationGroup(packageRoot, raw) {
+    const descriptor = configurationGroupDescriptor(packageRoot);
+    if (!descriptor)
+        return undefined;
+    const value = readConfigurationSelector(raw, descriptor.groupPath);
+    if (value === undefined)
+        return undefined;
+    if (descriptor.match && readConfigurationSelector(raw, descriptor.match.path) !== descriptor.match.value)
+        throw Error("Configuration group capability selector does not match");
+    return { descriptor, snapshot: configurationGroupSnapshot(value) };
+}
+export const configurationGroupJournalSchema = z.strictObject({
+    directory: z.string().startsWith("/").max(512),
+    journalId: z.string().uuid().optional(),
+    generationId: identity,
+    groupSha256: digest,
+    minFreeBytes: z
+        .number()
+        .int()
+        .min(1024 * 1024)
+        .max(1024 * 1024 * 1024)
+        .default(64 * 1024 * 1024),
+    maxRecords: z.number().int().min(1).max(100000).default(20000),
+    maxBytes: z
+        .number()
+        .int()
+        .min(1024)
+        .max(256 * 1024 * 1024)
+        .default(32 * 1024 * 1024),
+});
+export function configurationGroupJournalContract(snapshot, sourceIdentity, config, profiles) {
+    assertConfigurationGroupSnapshot(snapshot);
+    const journal = configurationGroupJournalSchema.parse(config);
+    if (journal.groupSha256 !== snapshot.sha256 || !digest.safeParse(sourceIdentity).success)
+        throw Error("Configuration group journal revision differs");
+    const expected = snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup }));
+    const normalize = (v) => [...v].sort((a, b) => (a.processName < b.processName ? -1 : a.processName > b.processName ? 1 : 0));
+    if (configurationResourceHash(normalize([...profiles])) !== configurationResourceHash(normalize(expected)))
+        throw Error("Configuration group journal profiles differ");
+    return configurationResourceJson({
+        version: 2,
+        generationId: journal.generationId,
+        groupSha256: snapshot.sha256,
+        sourceIdentity,
+        maxRecords: journal.maxRecords,
+        maxBytes: journal.maxBytes,
+        profiles: normalize(expected),
+    });
+}
+//# sourceMappingURL=configuration-group-contract.js.map

package/dist/runtime/configuration-group-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-group-contract.js","sourceRoot":"","sources":["../../src/runtime/configuration-group-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,CAAC;KACf,KAAK,CACJ,CAAC;KACE,MAAM,EAAE;KACR,KAAK,CAAC,+BAA+B,CAAC;KACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACzE;KACA,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,CAAC,CAAC,CAAC;AACV,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9B,6FAA6F;AAC7F,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,KAAK,GAAG,CAAC,EACX,KAAK,GAAG,CAAC,CAAC;IACZ,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;QAC9B,KAAK,IAAI,IAAI,CAAC;QACd,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,SAAS,KAAK,CAAC,CAAU,EAAE,KAAa;QACtC,IAAI,EAAE,KAAK,GAAG,KAAK,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACvG,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS;gBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjG,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YACnC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC/H,IACE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YACd,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,SAAS;YAC9C,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,IAAI;YAEtF,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACnH,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,QAAQ;gBAAE,SAAS;YACnD,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC;gBAAE,MAAM,KAAK,CAAC,sEAAsE,CAAC,CAAC;QACvI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B;QACxC,IAAI,MAAc,CAAC;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,MAAM,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC1G,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACzE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAC7H,CAAC;;YACC,MAAM;gBACJ,GAAG;oBACH,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;yBACX,IAAI,EAAE;yBACN,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;wBACZ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS;4BAAE,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;wBAC9F,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC/D,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC3E,CAAC,CAAC;yBACD,IAAI,CAAC,GAAG,CAAC;oBACZ,GAAG,CAAC;QACR,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,SAAS;QAAE,MAAM,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3H,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,SAAS,EAAE,QAAQ;IACnB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE,EAAE,QAAQ;IACZ,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,YAAY,CAAC;IACtB,WAAW,EAAE,QAAQ;IACrB,mBAAmB,EAAE,QAAQ;IAC7B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAClE,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,YAAY,CAAC;IACZ,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,QAAQ;IACnB,aAAa,EAAE,QAAQ;IACvB,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,QAAQ;IACrB,eAAe,EAAE,QAAQ;IACzB,YAAY,EAAE,QAAQ;IACtB,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxF,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;IAC1B,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChG,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC9I,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAC5C,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAC7B,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QACzB,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,KAAK,KAAK,MAAM;QAChB,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;QAC9B,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC;QAE9B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;AACnH,CAAC,CAAC,CAAC;AAeL,MAAM,SAAS,GAAG,IAAI,OAAO,EAAU,CAAC;AACxC,SAAS,MAAM,CAAI,KAAQ;IACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,4FAA4F;IAC5F,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,mBAAmB,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1G,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;QACjH,MAAM,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,EAAE,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrF,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,gCAAgC,CAAC,KAAiC;IAChF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;AACnG,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,4BAA4B,CAAC,WAAmB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACpD,0EAA0E;IAC1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/F,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACvF,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,EAAE,gCAAgC,CAAC;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC7I,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AACD,MAAM,UAAU,0BAA0B,CACxC,WAAmB,EACnB,GAA4B;IAO5B,MAAM,UAAU,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,UAAU,CAAC,KAAK,IAAI,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK;QACtG,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACxE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,MAAM;IACnB,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;SAChB,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;SACvB,OAAO,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;SACtB,OAAO,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,UAAU,iCAAiC,CAC/C,QAAoC,EACpC,cAAsB,EACtB,MAAiC,EACjC,QAAuF;IAEvF,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,OAAO;QACtF,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACrI,MAAM,SAAS,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9I,IAAI,yBAAyB,CAAC,SAAS,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxG,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC7D,OAAO,yBAAyB,CAAC;QAC/B,OAAO,EAAE,CAAC;QACV,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport { readConfigurationSelector } from \"./process-group-contract.js\";\nimport { readProcessGroupResource } from \"./process-group-resources.js\";\n\nconst identity = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);\nconst digest = z.string().regex(/^[a-f0-9]{64}$/);\nconst selector = z\n  .array(\n    z\n      .string()\n      .regex(/^[a-zA-Z][a-zA-Z0-9_-]{0,99}$/)\n      .refine((v) => ![\"__proto__\", \"prototype\", \"constructor\"].includes(v)),\n  )\n  .min(1)\n  .max(8);\nconst MAX_BYTES = 1024 * 1024;\n\n/** Versioned canonical JSON: binary key order, no locale, executable values or accessors. */\nexport function configurationResourceJson(value: unknown): string {\n  let nodes = 0,\n    bytes = 0;\n  const ancestors = new Set<object>();\n  const charge = (size: number) => {\n    bytes += size;\n    if (bytes > MAX_BYTES) throw Error(\"Configuration resource exceeds 1 MiB\");\n  };\n  function visit(v: unknown, depth: number): string {\n    if (++nodes > 65536 || depth > 32) throw Error(\"Configuration resource exceeds its structural budget\");\n    if (v === null || typeof v === \"boolean\") {\n      charge(v === null ? 4 : v ? 4 : 5);\n      return JSON.stringify(v);\n    }\n    if (typeof v === \"string\") {\n      if (Buffer.byteLength(v) > MAX_BYTES) throw Error(\"Configuration resource string exceeds 1 MiB\");\n      const encoded = JSON.stringify(v);\n      charge(Buffer.byteLength(encoded));\n      return encoded;\n    }\n    if (typeof v === \"number\" && Number.isFinite(v)) {\n      const encoded = JSON.stringify(v);\n      charge(encoded.length);\n      return encoded;\n    }\n    if (!v || typeof v !== \"object\" || ancestors.has(v)) throw Error(\"Configuration resource must contain finite plain JSON only\");\n    if (\n      Array.isArray(v)\n        ? Object.getPrototypeOf(v) !== Array.prototype\n        : Object.getPrototypeOf(v) !== Object.prototype && Object.getPrototypeOf(v) !== null\n    )\n      throw Error(\"Configuration resource must contain plain JSON objects\");\n    if (Object.getOwnPropertySymbols(v).length) throw Error(\"Configuration resource cannot contain symbol properties\");\n    const descriptors = Object.getOwnPropertyDescriptors(v);\n    for (const [key, d] of Object.entries(descriptors)) {\n      if (Array.isArray(v) && key === \"length\") continue;\n      if (!d.enumerable || !Object.hasOwn(d, \"value\")) throw Error(\"Configuration resource cannot contain hidden properties or accessors\");\n    }\n    ancestors.add(v);\n    charge(2); // Container brackets/braces.\n    let result: string;\n    if (Array.isArray(v)) {\n      if (v.length > 65536 || Object.keys(v).length !== v.length || Object.keys(v).some((k, i) => k !== String(i)))\n        throw Error(\"Configuration resource arrays must be dense JSON arrays\");\n      charge(Math.max(0, v.length - 1));\n      result = \"[\" + Array.from({ length: v.length }, (_, i) => visit(descriptors[String(i)]!.value, depth + 1)).join(\",\") + \"]\";\n    } else\n      result =\n        \"{\" +\n        Object.keys(v)\n          .sort()\n          .map((k, i) => {\n            if (Buffer.byteLength(k) > MAX_BYTES) throw Error(\"Configuration resource key exceeds 1 MiB\");\n            charge(Buffer.byteLength(JSON.stringify(k)) + 1 + (i ? 1 : 0));\n            return JSON.stringify(k) + \":\" + visit(descriptors[k]!.value, depth + 1);\n          })\n          .join(\",\") +\n        \"}\";\n    ancestors.delete(v);\n    return result;\n  }\n  const json = visit(value, 0);\n  if (Buffer.byteLength(json) > MAX_BYTES) throw Error(\"Configuration resource exceeds 1 MiB\");\n  return json;\n}\n\nexport function configurationResourceHash(value: unknown): string {\n  return createHash(\"sha256\").update(\"uns-configuration-json-v1\\n\").update(configurationResourceJson(value)).digest(\"hex\");\n}\n\nexport const configurationGroupProfileSchema = z.strictObject({\n  id: identity,\n  processName: identity,\n  dataGroup: identity,\n  resource: z.unknown(),\n});\nexport const configurationGroupSchema = z.strictObject({\n  schemaVersion: z.literal(2),\n  id: identity,\n  inputTopic: z\n    .string()\n    .min(1)\n    .max(512)\n    .regex(/^[^#+\\0]+$/),\n  processName: identity,\n  receiverProcessName: identity,\n  profiles: z.array(configurationGroupProfileSchema).min(2).max(16),\n});\nexport const configurationGroupDescriptorSchema = z\n  .strictObject({\n    protocolVersion: z.literal(2),\n    namespace: identity,\n    publisherPath: selector,\n    groupPath: selector,\n    memberPath: selector,\n    journalPath: selector,\n    runtimeRolePath: selector,\n    receiverRole: identity,\n    match: z.strictObject({ path: selector, value: z.string().min(1).max(100) }).optional(),\n  })\n  .superRefine((d, context) => {\n    const independent = [d.publisherPath, d.journalPath, d.runtimeRolePath].map((p) => p.join(\".\"));\n    if (new Set(independent).size !== independent.length || independent.some((p, i) => independent.some((q, j) => i !== j && q.startsWith(p + \".\"))))\n      context.addIssue({ code: \"custom\", message: \"Independent publisher, journal and role selectors required\" });\n    const parent = d.publisherPath.join(\".\") + \".\",\n      group = d.groupPath.join(\".\"),\n      member = d.memberPath.join(\".\");\n    if (\n      !group.startsWith(parent) ||\n      !member.startsWith(parent) ||\n      group === member ||\n      group.startsWith(member + \".\") ||\n      member.startsWith(group + \".\")\n    )\n      context.addIssue({ code: \"custom\", message: \"Distinct group/member selectors within the publisher required\" });\n  });\nexport type ConfigurationGroupDescriptor = z.infer<typeof configurationGroupDescriptorSchema>;\nexport type ConfigurationGroup = z.infer<typeof configurationGroupSchema>;\nexport interface ConfigurationGroupProfile {\n  readonly id: string;\n  readonly processName: string;\n  readonly dataGroup: string;\n  readonly resourceSha256: string;\n  readonly resource: unknown;\n}\nexport interface ConfigurationGroupSnapshot {\n  readonly group: Readonly<ConfigurationGroup>;\n  readonly sha256: string;\n  readonly profiles: readonly ConfigurationGroupProfile[];\n}\nconst snapshots = new WeakSet<object>();\nfunction freeze<T>(value: T): T {\n  if (value && typeof value === \"object\") {\n    for (const child of Object.values(value)) freeze(child);\n    Object.freeze(value);\n  }\n  return value;\n}\nexport function configurationGroupSnapshot(value: unknown): ConfigurationGroupSnapshot {\n  // Bound and copy before schema traversal; caller mutation cannot change a running revision.\n  const group = configurationGroupSchema.parse(JSON.parse(configurationResourceJson(value)));\n  const names = [group.processName, group.receiverProcessName, ...group.profiles.map((p) => p.processName)];\n  if (new Set(names).size !== names.length || new Set(group.profiles.map((p) => p.id)).size !== group.profiles.length)\n    throw Error(\"Configuration group identities overlap\");\n  const profiles = group.profiles.map((p) => ({ ...p, resourceSha256: configurationResourceHash(p.resource) }));\n  const result = freeze({ group, sha256: configurationResourceHash(group), profiles });\n  snapshots.add(result);\n  return result;\n}\nexport function assertConfigurationGroupSnapshot(value: ConfigurationGroupSnapshot): void {\n  if (!snapshots.has(value)) throw Error(\"Exact SDK-issued configuration group snapshot required\");\n}\n\n/** Optional data-only capability; packages without it keep their existing behavior. */\nexport function configurationGroupDescriptor(packageRoot: string): ConfigurationGroupDescriptor | undefined {\n  const file = path.join(packageRoot, \"package.json\");\n  // Ordinary Node/Python deployments do not opt in by existing on the host.\n  if (!fs.existsSync(file)) return undefined;\n  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n  let bytes: Buffer;\n  try {\n    const stat = fs.fstatSync(fd);\n    if (!stat.isFile() || stat.size > MAX_BYTES) throw Error(\"Invalid installed runtime metadata\");\n    bytes = fs.readFileSync(fd);\n    if (bytes.length > MAX_BYTES) throw Error(\"Installed runtime metadata is too large\");\n  } finally {\n    fs.closeSync(fd);\n  }\n  const pkg = JSON.parse(bytes.toString());\n  const value = pkg.unsDatahub?.processGroupConfigurationRuntime;\n  if (value !== undefined && !readProcessGroupResource(file).equals(bytes)) throw Error(\"Installed runtime metadata changed during discovery\");\n  return value === undefined ? undefined : configurationGroupDescriptorSchema.parse(value);\n}\nexport function selectedConfigurationGroup(\n  packageRoot: string,\n  raw: Record<string, unknown>,\n):\n  | {\n      descriptor: ConfigurationGroupDescriptor;\n      snapshot: ConfigurationGroupSnapshot;\n    }\n  | undefined {\n  const descriptor = configurationGroupDescriptor(packageRoot);\n  if (!descriptor) return undefined;\n  const value = readConfigurationSelector(raw, descriptor.groupPath);\n  if (value === undefined) return undefined;\n  if (descriptor.match && readConfigurationSelector(raw, descriptor.match.path) !== descriptor.match.value)\n    throw Error(\"Configuration group capability selector does not match\");\n  return { descriptor, snapshot: configurationGroupSnapshot(value) };\n}\n\nexport const configurationGroupJournalSchema = z.strictObject({\n  directory: z.string().startsWith(\"/\").max(512),\n  journalId: z.string().uuid().optional(),\n  generationId: identity,\n  groupSha256: digest,\n  minFreeBytes: z\n    .number()\n    .int()\n    .min(1024 * 1024)\n    .max(1024 * 1024 * 1024)\n    .default(64 * 1024 * 1024),\n  maxRecords: z.number().int().min(1).max(100000).default(20000),\n  maxBytes: z\n    .number()\n    .int()\n    .min(1024)\n    .max(256 * 1024 * 1024)\n    .default(32 * 1024 * 1024),\n});\nexport type ConfigurationGroupJournal = z.infer<typeof configurationGroupJournalSchema>;\nexport function configurationGroupJournalContract(\n  snapshot: ConfigurationGroupSnapshot,\n  sourceIdentity: string,\n  config: ConfigurationGroupJournal,\n  profiles: readonly { processName: string; resourceSha256: string; dataGroup: string }[],\n): string {\n  assertConfigurationGroupSnapshot(snapshot);\n  const journal = configurationGroupJournalSchema.parse(config);\n  if (journal.groupSha256 !== snapshot.sha256 || !digest.safeParse(sourceIdentity).success)\n    throw Error(\"Configuration group journal revision differs\");\n  const expected = snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup }));\n  const normalize = (v: typeof expected) => [...v].sort((a, b) => (a.processName < b.processName ? -1 : a.processName > b.processName ? 1 : 0));\n  if (configurationResourceHash(normalize([...profiles])) !== configurationResourceHash(normalize(expected)))\n    throw Error(\"Configuration group journal profiles differ\");\n  return configurationResourceJson({\n    version: 2,\n    generationId: journal.generationId,\n    groupSha256: snapshot.sha256,\n    sourceIdentity,\n    maxRecords: journal.maxRecords,\n    maxBytes: journal.maxBytes,\n    profiles: normalize(expected),\n  });\n}\n"]}

package/dist/runtime/process-group-authorization.d.ts

@@ -52,6 +52,8 @@ interface GenericAuthorization {
     readonly groupId: string;
     readonly groupProcessName: string;
     readonly namespace: string;
+    readonly generationId?: string;
+    readonly configurationGroupSha256?: string;
 }
 export type ProcessGroupAuthorization = legacy.HvAuthorization | GenericAuthorization;
 export type HvAuthorization = ProcessGroupAuthorization;
@@ -95,7 +97,11 @@ export interface ProcessGroupAuthorizationContext {
     stateRoot?: string;
     initialize?: boolean;
 }
+/** Live authority always comes from the current canonical private policy. */
 export declare function authorizeProcessGroupRuntime(context: ProcessGroupAuthorizationContext): ProcessGroupAuthorization;
+/** Review only: never issues an authorization accepted by runtime/launch checks. */
+export declare function validateProcessGroupPolicyCandidate(context: ProcessGroupAuthorizationContext, bytes: Buffer): void;
+export declare function processGroupAuthorizationFile(context: ProcessGroupAuthorizationContext): string;
 export declare const authorizeHvRuntime: typeof authorizeProcessGroupRuntime;
 export declare function authorizeConfiguredProcessGroupRuntime(pkg: string, dir: string, raw: Record<string, unknown>, controllerName: string, initialize?: boolean): ProcessGroupAuthorization;
 export declare function assertProcessGroupJournalAuthorization(value: ProcessGroupAuthorization | undefined, directory: string, journalId: string | undefined): void;

package/dist/runtime/process-group-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-authorization.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AAexE,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,eAAO,MAAM,4BAA4B,4CAAsC,CAAC;AAahF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiB1C,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAC9F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;kBAarC,CAAC;AACH,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,eAAe,GAAG,oBAAoB,CAAC;AACtF,MAAM,MAAM,eAAe,GAAG,yBAAyB,CAAC;AACxD,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AACjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;kBAA+B,CAAC;AAClE,eAAO,MAAM,kBAAkB,8BAA4B,CAAC;AAsC5D;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,GAAG,CAAC,MAAM,CAAC,CAgFzD;AACD,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AACD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAkGjH;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,sCAAsC,CACpD,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,cAAc,EAAE,MAAM,EACtB,UAAU,UAAQ,6BAUnB;AACD,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAON;AACD,eAAO,MAAM,4BAA4B,+CAAyC,CAAC;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBjG;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,IAAI,CAsBN;AACD,eAAO,MAAM,oBAAoB,uCAAiC,CAAC"}
+{"version":3,"file":"process-group-authorization.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AAiBxE,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,eAAO,MAAM,4BAA4B,4CAAsC,CAAC;AAahF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiB1C,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAC9F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;kBAarC,CAAC;AACH,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAC5C;AACD,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,eAAe,GAAG,oBAAoB,CAAC;AACtF,MAAM,MAAM,eAAe,GAAG,yBAAyB,CAAC;AACxD,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AACjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;kBAA+B,CAAC;AAClE,eAAO,MAAM,kBAAkB,8BAA4B,CAAC;AAiD5D;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,GAAG,CAAC,MAAM,CAAC,CAiFzD;AACD,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA4GD,6EAA6E;AAC7E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAEjH;AACD,oFAAoF;AACpF,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAElH;AACD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,gCAAgC,GAAG,MAAM,CAI/F;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,sCAAsC,CACpD,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,cAAc,EAAE,MAAM,EACtB,UAAU,UAAQ,6BAUnB;AACD,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAON;AACD,eAAO,MAAM,4BAA4B,+CAAyC,CAAC;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBjG;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,IAAI,CAwBN;AACD,eAAO,MAAM,oBAAoB,uCAAiC,CAAC"}

package/dist/runtime/process-group-authorization.js

@@ -2,8 +2,9 @@ import fs from "node:fs";
 import path from "node:path";
 import { z } from "zod";
 import * as legacy from "./compatibility/energenti-authorization-v1.js";
+import { configurationGroupAuthorizationSchema, configurationGroupPolicyIdentity, verifyConfigurationGroupPolicy } from "./configuration-group-authorization.js";
 import { normalizeProcessGroupConfiguration, processGroupDescriptor, resolvedProcessGroupChannels, } from "./process-group-contract.js";
-import { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash, readProcessGroupResource as read, sha256 as sha, } from "./process-group-resources.js";
+import { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash, readProcessGroupResource as read, sha256 as sha, assertPrivateProcessGroupDirectory, } from "./process-group-resources.js";
 export { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash } from "./process-group-resources.js";
 export const hasProcessGroupAuthorization = legacy.hasProcessGroupAuthorization;
 const digest = z.string().regex(/^[a-f0-9]{64}$/), id = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);
@@ -52,14 +53,7 @@ export const processGroupManifestSchema = z.strictObject({
 export const hvAuthorizationSchema = legacy.hvAuthorizationSchema;
 export const productionGroupIds = legacy.productionGroupIds;
 const issued = new WeakSet();
-function privateDirectory(dir) {
-    for (let p = dir; p !== path.dirname(p); p = path.dirname(p))
-        if (fs.lstatSync(p).isSymbolicLink())
-            throw Error("Linked policy directory");
-    const s = fs.lstatSync(dir);
-    if (!s.isDirectory() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0)
-        throw Error("Insecure policy directory");
-}
+const privateDirectory = assertPrivateProcessGroupDirectory;
 function registryRoot(root, dir) {
     if (!path.isAbsolute(root) || path.resolve(root) !== root || path.resolve(dir) !== dir)
         throw Error("Invalid policy registry");
@@ -74,6 +68,24 @@ function registryRoot(root, dir) {
     return relative.split("/")[0];
 }
 function selectedFile(pkg, raw, root, explicit) {
+    const configured = configurationGroupPolicyIdentity(pkg, raw);
+    if (configured) {
+        if (explicit)
+            return explicit;
+        const directory = process.env["UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY"];
+        if (directory) {
+            const selected = registryRoot(root, directory);
+            if (selected !== "*" && selected !== configured.namespace)
+                throw Error("Foreign runtime registry");
+            const registry = selected === "*" ? path.join(root, configured.namespace, "authorizations") : directory;
+            privateDirectory(registry);
+            return path.join(registry, configured.generationId + ".json");
+        }
+        const single = process.env["UNS_PROCESS_GROUP_AUTHORIZATION_FILE"];
+        if (!single)
+            throw Error("No selected policy");
+        return single;
+    }
     const descriptor = processGroupDescriptor(pkg);
     if (!descriptor)
         throw Error("Missing runtime contract");
@@ -175,10 +187,11 @@ export function configuredGroupProcessNames() {
         const result = new Set();
         for (const file of files) {
             const raw = JSON.parse(read(file, true).toString());
-            const p = raw.schemaVersion === 3
+            const p = raw.schemaVersion === 4 ? configurationGroupAuthorizationSchema.parse(raw) : raw.schemaVersion === 3
                 ? processGroupAuthorizationSchema.parse(raw)
                 : z.union([legacy.hvAuthorizationSchema, legacy.processGroupAuthorizationSchema]).parse(raw);
-            const { namespace, group } = p.schemaVersion === 3 ? { namespace: p.namespace, group: p.groupId } : legacy.legacyPolicyIdentity(p);
+            const { namespace, group } = p.schemaVersion === 4 ? { namespace: p.namespace, group: p.generationId }
+                : p.schemaVersion === 3 ? { namespace: p.namespace, group: p.groupId } : legacy.legacyPolicyIdentity(p);
             if (p.stateRoot !== root ||
                 file !== path.join(root, namespace, "authorizations", group + ".json") ||
                 p.directory !== path.join(root, namespace, "admission", group))
@@ -194,14 +207,23 @@ export function configuredGroupProcessNames() {
         throw Error("Process-group authorization registry is missing, changed or insecure; review required");
     }
 }
-export function authorizeProcessGroupRuntime(context) {
+function verifyRuntimePolicy(context, candidate) {
     try {
         const root = context.stateRoot ?? process.env["UNS_PROCESS_GROUP_STATE_ROOT"];
         if (!root || !context.controllerName)
             throw Error();
-        const file = selectedFile(context.packageRoot, context.rawConfiguration, root, context.file), bytes = read(file, true), unparsed = JSON.parse(bytes.toString());
-        if (unparsed.schemaVersion !== 3)
+        const file = selectedFile(context.packageRoot, context.rawConfiguration, root, context.file), bytes = candidate ?? read(file, true), unparsed = JSON.parse(bytes.toString());
+        if (unparsed.schemaVersion === 4) {
+            const result = verifyConfigurationGroupPolicy(context, bytes, root, file);
+            if (!candidate)
+                issued.add(result);
+            return result;
+        }
+        if (unparsed.schemaVersion !== 3) {
+            if (candidate)
+                throw Error("Only generic policies can be staged");
             return legacy.authorizeHvRuntime({ ...context, file, stateRoot: root });
+        }
         const p = processGroupAuthorizationSchema.parse(unparsed), d = processGroupDescriptor(context.packageRoot);
         if (!d || d.legacy)
             throw Error("Generic runtime descriptor required");
@@ -280,13 +302,28 @@ export function authorizeProcessGroupRuntime(context) {
             groupProcessName: m.processName,
             namespace: d.namespace,
         });
-        issued.add(result);
+        if (!candidate)
+            issued.add(result);
         return result;
     }
     catch {
         throw Error("Process-group runtime authorization is missing, changed or does not match this installed placement; review required");
     }
 }
+/** Live authority always comes from the current canonical private policy. */
+export function authorizeProcessGroupRuntime(context) {
+    return verifyRuntimePolicy(context);
+}
+/** Review only: never issues an authorization accepted by runtime/launch checks. */
+export function validateProcessGroupPolicyCandidate(context, bytes) {
+    verifyRuntimePolicy(context, bytes);
+}
+export function processGroupAuthorizationFile(context) {
+    const root = context.stateRoot ?? process.env["UNS_PROCESS_GROUP_STATE_ROOT"];
+    if (!root)
+        throw Error("Missing process-group state root");
+    return selectedFile(context.packageRoot, context.rawConfiguration, root, context.file);
+}
 export const authorizeHvRuntime = authorizeProcessGroupRuntime;
 export function authorizeConfiguredProcessGroupRuntime(pkg, dir, raw, controllerName, initialize = false) {
     return authorizeProcessGroupRuntime({
@@ -313,7 +350,7 @@ export function assertProcessGroupStateMount(value, root) {
         return;
     }
     assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);
-    if (process.platform !== "linux" || !("namespace" in value) || value.directory !== path.join(root, value.namespace, "admission", value.groupId))
+    if (process.platform !== "linux" || !("namespace" in value) || value.directory !== path.join(root, value.namespace, "admission", value.generationId ?? value.groupId))
         throw Error("Process group requires its reviewed Linux state mount");
     const mount = fs
         .readFileSync("/proc/self/mountinfo", "utf8")
@@ -343,6 +380,9 @@ export function assertProcessGroupTargetLaunch(value, dir, operationId, launchId
             !z.string().uuid().safeParse(r.lastLaunch?.requestId).success ||
             !digest.safeParse(r.configurationChecksum).success)
             throw Error();
+        if ("configurationGroupSha256" in value && value.configurationGroupSha256 !== undefined &&
+            (r.configurationGroupSha256 !== value.configurationGroupSha256 || r.generationId !== value.generationId))
+            throw Error();
     }
     catch {
         throw Error("Target requires its exact reviewed group reservation and launch identity");