@uns-kit/core 3.0.46 → 3.0.47

package/MIGRATIONS.md

@@ -9,6 +9,25 @@ Agents must inspect the application's existing ownership and shutdown flow
 before editing it. The examples below describe the intended behavior, not a
 mechanical search-and-replace operation.
 
+## 3.0.47 - Common Service access and publications
+
+When crossing `<3.0.47` to `>=3.0.47`, adoption is explicit; existing endpoint authorization and caller forwarding do
+not change automatically. Ship `service-access.json` referenced by
+`package.json` `unsDatahub.serviceAccess`, retaining the data file in the build.
+Use `parseServiceAccessDeclaration` and review the exact installed release in
+Controller Service access. Background services need no Catalog/API. Optional
+`publications` reuse the catalog manifest, `CatalogPublicationClient`, and API
+`catalogPublicationHandler`; call `api.registerCatalogRoute()` for signed launch
+route publication. Source approval remains separate from raw workload rights.
+The unpublished earlier `catalogAccess` marker is a compatibility reader only;
+never declare both. Read the [bundled Service access guide](dist/runtime/service-access-guide.md).
+
+Do not remove existing credentials until the new path passes deployed
+acceptance. The matching Controller capability must be installed and reviewed
+before enabling the declaration. SDK publication and consumer frozen-lock
+updates remain separate steps. This bounded adapter covers UNS history; it
+does not create SQL, broker or arbitrary external-resource permissions.
+
 ## 3.0.46 - Verified retained-store copy and recovery
 
 When crossing `<3.0.46` to `>=3.0.46`, existing rename and unbound consumers

package/dist/runtime/catalog-publication-client.d.ts

@@ -0,0 +1,21 @@
+import { type AccessTokenProvider } from "../tools/auth/service-token-provider.js";
+import { type CatalogPublicationManifest } from "./catalog-publication.js";
+/** No caller-token fallback and no arbitrary source URL or topic. */
+export declare class CatalogPublicationClient {
+    private readonly options;
+    constructor(options: {
+        controllerBase: string;
+        rttNode: string;
+        version: string;
+        instanceId: string;
+        manifest: CatalogPublicationManifest;
+        tokenProvider?: AccessTokenProvider;
+        fetch?: typeof fetch;
+    });
+    private call;
+    execute<T>(operationId: string, input: Record<string, unknown>, callerToken: string, transform: (context: {
+        signal: AbortSignal;
+        history: (sourceId: string) => Promise<unknown>;
+    }) => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=catalog-publication-client.d.ts.map

package/dist/runtime/catalog-publication-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-publication-client.d.ts","sourceRoot":"","sources":["../../src/runtime/catalog-publication-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,mBAAmB,EAAwB,MAAM,yCAAyC,CAAC;AACzG,OAAO,EAIL,KAAK,0BAA0B,EAIhC,MAAM,0BAA0B,CAAC;AAElC,qEAAqE;AACrE,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE;QACxB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,0BAA0B,CAAC;QACrC,aAAa,CAAC,EAAE,mBAAmB,CAAC;QACpC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;KACtB;YAEW,IAAI;IAmDZ,OAAO,CAAC,CAAC,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3G,OAAO,CAAC,CAAC,CAAC;CA6Bd"}

package/dist/runtime/catalog-publication-client.js

@@ -0,0 +1,92 @@
+import { ServiceTokenProvider } from "../tools/auth/service-token-provider.js";
+import { CatalogAccessError, assertCatalogRequest, assertCatalogResponse, catalogAccessDigest, } from "./catalog-publication.js";
+/** No caller-token fallback and no arbitrary source URL or topic. */
+export class CatalogPublicationClient {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async call(action, operation, input, callerToken, sourceId, signal) {
+        assertCatalogRequest(operation, input);
+        const token = await (this.options.tokenProvider ?? new ServiceTokenProvider()).getAccessToken();
+        if (!token)
+            throw Error("Catalog service credential unavailable.");
+        const body = {
+            rttNode: this.options.rttNode,
+            version: this.options.version,
+            instanceId: this.options.instanceId,
+            operationId: operation.id,
+            manifestDigest: catalogAccessDigest(this.options.manifest),
+            input,
+            callerToken,
+        };
+        const response = await (this.options.fetch ?? fetch)(new URL(`/api/catalog-publications/${action}`, this.options.controllerBase), {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+            body: JSON.stringify({ ...body, ...(sourceId ? { sourceId } : {}) }),
+            signal: signal ?? AbortSignal.timeout(operation.timeoutMs),
+            redirect: "error",
+        });
+        if (!response.ok)
+            throw new CatalogAccessError("catalog_access_denied", [400, 401, 403, 409, 429].includes(response.status) ? response.status : 503);
+        if (!response.body)
+            throw new CatalogAccessError("catalog_source_unavailable", 503);
+        const reader = response.body.getReader();
+        let size = 0, text = "";
+        const decoder = new TextDecoder();
+        try {
+            while (true) {
+                const r = await reader.read();
+                if (r.done)
+                    break;
+                size += r.value.byteLength;
+                if (size > 1048576) {
+                    await reader.cancel();
+                    throw new CatalogAccessError("catalog_source_budget", 503);
+                }
+                text += decoder.decode(r.value, { stream: true });
+            }
+            text += decoder.decode();
+            return JSON.parse(text);
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
+    async execute(operationId, input, callerToken, transform) {
+        const operation = this.options.manifest.operations.find((op) => op.id === operationId);
+        if (!operation)
+            throw Error("Catalog operation not declared.");
+        const signal = AbortSignal.timeout(operation.timeoutMs);
+        await this.call("authorize", operation, input, callerToken, undefined, signal);
+        const work = transform({
+            signal,
+            history: async (sourceId) => {
+                if (!operation.sources.some((source) => source.id === sourceId))
+                    throw Error("Catalog source not declared.");
+                return this.call("history", operation, input, callerToken, sourceId, signal);
+            },
+        });
+        let stop;
+        const deadline = new Promise((_resolve, reject) => {
+            stop = () => reject(new CatalogAccessError("catalog_execution_timeout", 504));
+            if (signal.aborted)
+                stop();
+            else
+                signal.addEventListener("abort", stop, { once: true });
+        });
+        let result;
+        try {
+            result = await Promise.race([work, deadline]);
+        }
+        finally {
+            if (stop)
+                signal.removeEventListener("abort", stop);
+        }
+        // Recheck after asynchronous processing, including a cached application result.
+        await this.call("authorize", operation, input, callerToken, undefined, signal);
+        assertCatalogResponse(operation, result);
+        return result;
+    }
+}
+//# sourceMappingURL=catalog-publication-client.js.map

package/dist/runtime/catalog-publication-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-publication-client.js","sourceRoot":"","sources":["../../src/runtime/catalog-publication-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACzG,OAAO,EACL,kBAAkB,EAIlB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAElC,qEAAqE;AACrE,MAAM,OAAO,wBAAwB;IAEhB;IADnB,YACmB,OAQhB;QARgB,YAAO,GAAP,OAAO,CAQvB;IACA,CAAC;IACI,KAAK,CAAC,IAAI,CAChB,MAA+B,EAC/B,SAA2B,EAC3B,KAA8B,EAC9B,WAAmB,EACnB,QAAiB,EACjB,MAAoB;QAEpB,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,IAAI,oBAAoB,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;QAChG,IAAI,CAAC,KAAK;YAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACnE,MAAM,IAAI,GAAsB;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,cAAc,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC1D,KAAK;YACL,WAAW;SACZ,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,6BAA6B,MAAM,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE;YAChI,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,EAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;YAC1D,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YACd,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACrI,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,IAAI,GAAG,CAAC,EACV,IAAI,GAAG,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,CAAC,CAAC,IAAI;oBAAE,MAAM;gBAClB,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC3B,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;oBACnB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;oBACtB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IACD,KAAK,CAAC,OAAO,CACX,WAAmB,EACnB,KAA8B,EAC9B,WAAmB,EACnB,SAA4G;QAE5G,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;QACvF,IAAI,CAAC,SAAS;YAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,SAAS,CAAC;YACrB,MAAM;YACN,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC1B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC;oBAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAC7G,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/E,CAAC;SACF,CAAC,CAAC;QACH,IAAI,IAA8B,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACvD,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9E,IAAI,MAAM,CAAC,OAAO;gBAAE,IAAI,EAAE,CAAC;;gBACtB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,IAAI,MAAS,CAAC;QACd,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI;gBAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;QACD,gFAAgF;QAChF,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/E,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;CACF","sourcesContent":["import { type AccessTokenProvider, ServiceTokenProvider } from \"../tools/auth/service-token-provider.js\";\nimport {\n  CatalogAccessError,\n  type CatalogInvocation,\n  type CatalogOperation,\n  type CatalogPublicationManifest,\n  assertCatalogRequest,\n  assertCatalogResponse,\n  catalogAccessDigest,\n} from \"./catalog-publication.js\";\n\n/** No caller-token fallback and no arbitrary source URL or topic. */\nexport class CatalogPublicationClient {\n  constructor(\n    private readonly options: {\n      controllerBase: string;\n      rttNode: string;\n      version: string;\n      instanceId: string;\n      manifest: CatalogPublicationManifest;\n      tokenProvider?: AccessTokenProvider;\n      fetch?: typeof fetch;\n    },\n  ) {}\n  private async call(\n    action: \"authorize\" | \"history\",\n    operation: CatalogOperation,\n    input: Record<string, unknown>,\n    callerToken: string,\n    sourceId?: string,\n    signal?: AbortSignal,\n  ): Promise<unknown> {\n    assertCatalogRequest(operation, input);\n    const token = await (this.options.tokenProvider ?? new ServiceTokenProvider()).getAccessToken();\n    if (!token) throw Error(\"Catalog service credential unavailable.\");\n    const body: CatalogInvocation = {\n      rttNode: this.options.rttNode,\n      version: this.options.version,\n      instanceId: this.options.instanceId,\n      operationId: operation.id,\n      manifestDigest: catalogAccessDigest(this.options.manifest),\n      input,\n      callerToken,\n    };\n    const response = await (this.options.fetch ?? fetch)(new URL(`/api/catalog-publications/${action}`, this.options.controllerBase), {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\", Authorization: `Bearer ${token}` },\n      body: JSON.stringify({ ...body, ...(sourceId ? { sourceId } : {}) }),\n      signal: signal ?? AbortSignal.timeout(operation.timeoutMs),\n      redirect: \"error\",\n    });\n    if (!response.ok)\n      throw new CatalogAccessError(\"catalog_access_denied\", [400, 401, 403, 409, 429].includes(response.status) ? response.status : 503);\n    if (!response.body) throw new CatalogAccessError(\"catalog_source_unavailable\", 503);\n    const reader = response.body.getReader();\n    let size = 0,\n      text = \"\";\n    const decoder = new TextDecoder();\n    try {\n      while (true) {\n        const r = await reader.read();\n        if (r.done) break;\n        size += r.value.byteLength;\n        if (size > 1048576) {\n          await reader.cancel();\n          throw new CatalogAccessError(\"catalog_source_budget\", 503);\n        }\n        text += decoder.decode(r.value, { stream: true });\n      }\n      text += decoder.decode();\n      return JSON.parse(text);\n    } finally {\n      reader.releaseLock();\n    }\n  }\n  async execute<T>(\n    operationId: string,\n    input: Record<string, unknown>,\n    callerToken: string,\n    transform: (context: { signal: AbortSignal; history: (sourceId: string) => Promise<unknown> }) => Promise<T>,\n  ): Promise<T> {\n    const operation = this.options.manifest.operations.find((op) => op.id === operationId);\n    if (!operation) throw Error(\"Catalog operation not declared.\");\n    const signal = AbortSignal.timeout(operation.timeoutMs);\n    await this.call(\"authorize\", operation, input, callerToken, undefined, signal);\n    const work = transform({\n      signal,\n      history: async (sourceId) => {\n        if (!operation.sources.some((source) => source.id === sourceId)) throw Error(\"Catalog source not declared.\");\n        return this.call(\"history\", operation, input, callerToken, sourceId, signal);\n      },\n    });\n    let stop: (() => void) | undefined;\n    const deadline = new Promise<never>((_resolve, reject) => {\n      stop = () => reject(new CatalogAccessError(\"catalog_execution_timeout\", 504));\n      if (signal.aborted) stop();\n      else signal.addEventListener(\"abort\", stop, { once: true });\n    });\n    let result: T;\n    try {\n      result = await Promise.race([work, deadline]);\n    } finally {\n      if (stop) signal.removeEventListener(\"abort\", stop);\n    }\n    // Recheck after asynchronous processing, including a cached application result.\n    await this.call(\"authorize\", operation, input, callerToken, undefined, signal);\n    assertCatalogResponse(operation, result);\n    return result;\n  }\n}\n"]}

package/dist/runtime/catalog-publication.d.ts

@@ -0,0 +1,97 @@
+import { z } from "zod";
+export declare const CATALOG_PUBLICATION_PROTOCOL = 1;
+export declare const CATALOG_SOURCE_SCOPE = "catalog:sources:read";
+export declare const CATALOG_MANIFEST_FIELD = "catalogAccess";
+export declare class CatalogAccessError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, status?: number);
+}
+declare const historySource: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodLiteral<"history">;
+    topic: z.ZodString;
+    maxWindowMs: z.ZodDefault<z.ZodNumber>;
+    maxRows: z.ZodDefault<z.ZodNumber>;
+    fromParameter: z.ZodDefault<z.ZodString>;
+    toParameter: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+declare const operation: z.ZodObject<{
+    id: z.ZodString;
+    title: z.ZodString;
+    method: z.ZodLiteral<"GET">;
+    path: z.ZodString;
+    mode: z.ZodEnum<{
+        caller: "caller";
+        "approved-service": "approved-service";
+    }>;
+    requestSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    responseSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    sources: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"history">;
+        topic: z.ZodString;
+        maxWindowMs: z.ZodDefault<z.ZodNumber>;
+        maxRows: z.ZodDefault<z.ZodNumber>;
+        fromParameter: z.ZodDefault<z.ZodString>;
+        toParameter: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>>;
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+    maxResponseBytes: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+declare const manifest: z.ZodObject<{
+    protocol: z.ZodLiteral<1>;
+    operations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+        method: z.ZodLiteral<"GET">;
+        path: z.ZodString;
+        mode: z.ZodEnum<{
+            caller: "caller";
+            "approved-service": "approved-service";
+        }>;
+        requestSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        responseSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        sources: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            kind: z.ZodLiteral<"history">;
+            topic: z.ZodString;
+            maxWindowMs: z.ZodDefault<z.ZodNumber>;
+            maxRows: z.ZodDefault<z.ZodNumber>;
+            fromParameter: z.ZodDefault<z.ZodString>;
+            toParameter: z.ZodDefault<z.ZodString>;
+        }, z.core.$strict>>;
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        maxResponseBytes: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type CatalogOperationInput = z.input<typeof operation>;
+export type CatalogOperation = z.output<typeof operation>;
+export type CatalogHistorySource = z.output<typeof historySource>;
+export type CatalogPublicationManifest = z.output<typeof manifest>;
+export declare const catalogAccessDigest: (value: unknown) => string;
+/** Catalog routes use the same UNS resource path as SDK endpoint guards. */
+export declare const catalogOperationResource: (path: string) => string;
+/** Inspection consumes bounded JSON data, never application JavaScript. */
+export declare function parseCatalogPublicationManifest(input: unknown): CatalogPublicationManifest;
+export declare function assertCatalogRequest(op: CatalogOperation, input: unknown): void;
+export declare function assertCatalogResponse(op: CatalogOperation, value: unknown): void;
+export declare function catalogHistoryQuery(source: CatalogHistorySource, input: unknown): {
+    topics: string[];
+    from: string;
+    to: string;
+    limit: number;
+    dedupe: false;
+};
+export declare const catalogInvocationSchema: z.ZodObject<{
+    rttNode: z.ZodString;
+    version: z.ZodString;
+    instanceId: z.ZodString;
+    operationId: z.ZodString;
+    manifestDigest: z.ZodString;
+    input: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    callerToken: z.ZodString;
+}, z.core.$strict>;
+export type CatalogInvocation = z.infer<typeof catalogInvocationSchema>;
+export {};
+//# sourceMappingURL=catalog-publication.d.ts.map

package/dist/runtime/catalog-publication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-publication.d.ts","sourceRoot":"","sources":["../../src/runtime/catalog-publication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAkBtD,qBAAa,kBAAmB,SAAQ,KAAK;aAEzB,IAAI,EAAE,MAAM;aACZ,MAAM;gBADN,IAAI,EAAE,MAAM,EACZ,MAAM,SAAM;CAI/B;AACD,QAAA,MAAM,aAAa;;;;;;;;kBAeR,CAAC;AACZ,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;kBAaJ,CAAC;AACZ,QAAA,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;kBAA+F,CAAC;AAC9G,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAC9D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;AAC1D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAClE,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,QAAQ,CAAC,CAAC;AACnE,eAAO,MAAM,mBAAmB,4BAAiB,CAAC;AAClD,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,GAAI,MAAM,MAAM,KAAG,MAAsC,CAAC;AAE/F,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAmC1F;AAiDD,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAI/E;AACD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAEhF;AACD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,OAAO,GACb;IACD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,KAAK,CAAC;CACf,CAWA;AAED,eAAO,MAAM,uBAAuB;;;;;;;;kBAUzB,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/runtime/catalog-publication.js

@@ -0,0 +1,185 @@
+import { z } from "zod";
+import { operatorDigest, operatorJson, operatorRequestSchema } from "./operator-api.js";
+export const CATALOG_PUBLICATION_PROTOCOL = 1;
+export const CATALOG_SOURCE_SCOPE = "catalog:sources:read";
+export const CATALOG_MANIFEST_FIELD = "catalogAccess";
+const id = z
+    .string()
+    .min(1)
+    .max(120)
+    .regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/);
+const topic = z
+    .string()
+    .min(1)
+    .max(512)
+    .regex(/^[A-Za-z0-9-]+(?:\/[A-Za-z0-9-]+)*$/)
+    .refine((value) => !value.split("/").some((part) => part === "." || part === ".."));
+const localPath = z
+    .string()
+    .min(1)
+    .max(1024)
+    .regex(/^\/api\/[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_.-]+)*$/)
+    .refine((value) => !value.split("/").some((part) => part === "." || part === ".."));
+export class CatalogAccessError extends Error {
+    code;
+    status;
+    constructor(code, status = 400) {
+        super(code);
+        this.code = code;
+        this.status = status;
+    }
+}
+const historySource = z
+    .object({
+    id,
+    kind: z.literal("history"),
+    topic,
+    maxWindowMs: z
+        .number()
+        .int()
+        .min(1000)
+        .max(31 * 86400000)
+        .default(7 * 86400000),
+    maxRows: z.number().int().min(1).max(27000).default(1000),
+    fromParameter: id.default("from"),
+    toParameter: id.default("to"),
+})
+    .strict();
+const operation = z
+    .object({
+    id,
+    title: z.string().min(1).max(160),
+    method: z.literal("GET"),
+    path: localPath,
+    mode: z.enum(["caller", "approved-service"]),
+    requestSchema: z.record(z.string(), z.unknown()),
+    responseSchema: z.record(z.string(), z.unknown()),
+    sources: z.array(historySource).min(1).max(16),
+    timeoutMs: z.number().int().min(500).max(30000).default(10000),
+    maxResponseBytes: z.number().int().min(256).max(1048576).default(262144),
+})
+    .strict();
+const manifest = z.object({ protocol: z.literal(1), operations: z.array(operation).min(1).max(32) }).strict();
+export const catalogAccessDigest = operatorDigest;
+/** Catalog routes use the same UNS resource path as SDK endpoint guards. */
+export const catalogOperationResource = (path) => path.replace(/^\/api\//, "");
+/** Inspection consumes bounded JSON data, never application JavaScript. */
+export function parseCatalogPublicationManifest(input) {
+    try {
+        operatorJson(input);
+        const parsed = manifest.parse(input), ids = new Set(), paths = new Set();
+        for (const op of parsed.operations) {
+            if (ids.has(op.id) || paths.has(op.path))
+                throw Error("duplicate operation");
+            ids.add(op.id);
+            paths.add(op.path);
+            op.requestSchema = catalogSchema(op.requestSchema);
+            op.responseSchema = catalogSchema(op.responseSchema);
+            if (op.requestSchema["type"] !== "object")
+                throw Error("request must be an object");
+            if (Object.values(op.requestSchema["properties"] ?? {}).some((p) => p["type"] !== "string"))
+                throw Error("GET parameters must be strings");
+            const sources = new Set();
+            for (const source of op.sources) {
+                if (sources.has(source.id) || source.fromParameter === source.toParameter)
+                    throw Error("source binding");
+                sources.add(source.id);
+                const properties = op.requestSchema["properties"];
+                for (const key of [source.fromParameter, source.toParameter]) {
+                    const parameter = properties?.[key];
+                    if (parameter?.["type"] !== "string" ||
+                        parameter["format"] !== "date-time" ||
+                        !op.requestSchema["required"]?.includes(key))
+                        throw Error("time parameter binding");
+                }
+            }
+        }
+        return parsed;
+    }
+    catch {
+        throw new CatalogAccessError("catalog_manifest_invalid");
+    }
+}
+function catalogSchema(value) {
+    const schema = operatorRequestSchema(value);
+    const visit = (node) => {
+        if (!["object", "array", "string", "integer", "number", "boolean", "null"].includes(String(node["type"])) ||
+            ["oneOf", "anyOf", "allOf", "default"].some((key) => key in node))
+            throw Error("unsupported catalog schema");
+        if (node["properties"])
+            for (const child of Object.values(node["properties"]))
+                visit(child);
+        if (node["items"])
+            visit(node["items"]);
+    };
+    visit(schema);
+    return schema;
+}
+/** Zod's JSON Schema importer limits date-time to UTC. JSON Schema permits
+ * explicit offsets. Check these formats separately without altering input. */
+function offsetSchema(schema, value) {
+    const copy = { ...schema };
+    if (copy["format"] === "date-time") {
+        if (value !== undefined && !z.iso.datetime({ offset: true }).safeParse(value).success)
+            throw Error("date-time");
+        delete copy["format"];
+    }
+    if (copy["properties"])
+        copy["properties"] = Object.fromEntries(Object.entries(copy["properties"]).map(([key, child]) => [
+            key,
+            offsetSchema(child, value && typeof value === "object" ? value[key] : undefined),
+        ]));
+    if (copy["items"]) {
+        const child = copy["items"];
+        if (Array.isArray(value))
+            for (const item of value)
+                offsetSchema(child, item);
+        copy["items"] = offsetSchema(child, undefined);
+    }
+    return copy;
+}
+function assertSchema(schema, value, code, maxBytes) {
+    try {
+        const json = JSON.stringify(value);
+        if (json === undefined || Buffer.byteLength(json, "utf8") > maxBytes)
+            throw Error("size");
+        // fromJSONSchema strips unknown keys by default, so validate the unchanged
+        // value against a strict schema rather than returning parsed/transformed data.
+        if (!z.fromJSONSchema(offsetSchema(schema, value)).safeParse(value).success)
+            throw Error("schema");
+    }
+    catch {
+        throw new CatalogAccessError(code, code === "catalog_response_invalid" ? 502 : 400);
+    }
+}
+export function assertCatalogRequest(op, input) {
+    operatorJson(input);
+    assertSchema(op.requestSchema, input, "catalog_request_invalid", 65536);
+    for (const source of op.sources)
+        catalogHistoryQuery(source, input);
+}
+export function assertCatalogResponse(op, value) {
+    assertSchema(op.responseSchema, value, "catalog_response_invalid", op.maxResponseBytes);
+}
+export function catalogHistoryQuery(source, input) {
+    const values = input;
+    const from = values?.[source.fromParameter], to = values?.[source.toParameter];
+    if (!z.iso.datetime({ offset: true }).safeParse(from).success || !z.iso.datetime({ offset: true }).safeParse(to).success)
+        throw new CatalogAccessError("catalog_window_invalid");
+    const start = Date.parse(from), end = Date.parse(to);
+    if (!Number.isFinite(start) || !Number.isFinite(end) || start > end || end - start > source.maxWindowMs)
+        throw new CatalogAccessError("catalog_window_invalid");
+    return { topics: [source.topic], from: new Date(start).toISOString(), to: new Date(end).toISOString(), limit: source.maxRows, dedupe: false };
+}
+export const catalogInvocationSchema = z
+    .object({
+    rttNode: id,
+    version: id,
+    instanceId: id,
+    operationId: id,
+    manifestDigest: z.string().regex(/^[a-f0-9]{64}$/),
+    input: z.record(z.string(), z.unknown()),
+    callerToken: z.string().min(1).max(16384),
+})
+    .strict();
+//# sourceMappingURL=catalog-publication.js.map

package/dist/runtime/catalog-publication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-publication.js","sourceRoot":"","sources":["../../src/runtime/catalog-publication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAExF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAC3D,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC;AACtD,MAAM,EAAE,GAAG,CAAC;KACT,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,8BAA8B,CAAC,CAAC;AACzC,MAAM,KAAK,GAAG,CAAC;KACZ,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,qCAAqC,CAAC;KAC5C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;AACtF,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,IAAI,CAAC;KACT,KAAK,CAAC,+CAA+C,CAAC;KACtD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;AACtF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEzB;IACA;IAFlB,YACkB,IAAY,EACZ,SAAS,GAAG;QAE5B,KAAK,CAAC,IAAI,CAAC,CAAC;QAHI,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAM;IAG9B,CAAC;CACF;AACD,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,EAAE;IACF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,KAAK;IACL,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,EAAE,GAAG,QAAQ,CAAC;SAClB,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACzD,aAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,EAAE;IACF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACzE,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAK9G,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAClD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAE/F,2EAA2E;AAC3E,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAClC,GAAG,GAAG,IAAI,GAAG,EAAU,EACvB,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;gBAAE,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAC7E,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACnB,EAAE,CAAC,aAAa,GAAG,aAAa,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;YACnD,EAAE,CAAC,cAAc,GAAG,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;YACrD,IAAI,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACpF,IAAI,MAAM,CAAC,MAAM,CAAE,EAAE,CAAC,aAAa,CAAC,YAAY,CAA6C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;gBACtI,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;YAClC,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;gBAChC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,WAAW;oBAAE,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBACzG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvB,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,YAAY,CAAwC,CAAC;gBACzF,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7D,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC,GAAG,CAAwC,CAAC;oBAC3E,IACE,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ;wBAChC,SAAS,CAAC,QAAQ,CAAC,KAAK,WAAW;wBACnC,CAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAA0B,EAAE,QAAQ,CAAC,GAAG,CAAC;wBAEtE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,IAA6B,EAAQ,EAAE;QACpD,IACE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACrG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC;YAEjE,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,YAAY,CAAC;YAAE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAA4C,CAAC;gBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACvI,IAAI,IAAI,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAA4B,CAAC,CAAC;IACrE,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,CAAC;IACd,OAAO,MAAM,CAAC;AAChB,CAAC;AACD;8EAC8E;AAC9E,SAAS,YAAY,CAAC,MAA+B,EAAE,KAAc;IACnE,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,WAAW,EAAE,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,CAAC;QACpB,IAAI,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,WAAW,CACrC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAA4C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YAClG,GAAG;YACH,YAAY,CAAC,KAAK,EAAE,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAC9G,CAAC,CACH,CAAC;IACJ,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAA4B,CAAC;QACvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,YAAY,CAAC,MAA+B,EAAE,KAAc,EAAE,IAAY,EAAE,QAAgB;IACnG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ;YAAE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1F,2EAA2E;QAC3E,+EAA+E;QAC/E,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAU,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9G,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,IAAI,KAAK,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,EAAoB,EAAE,KAAc;IACvE,YAAY,CAAC,KAAK,CAAC,CAAC;IACpB,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACxE,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,OAAO;QAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,EAAoB,EAAE,KAAc;IACxE,YAAY,CAAC,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC;AAC1F,CAAC;AACD,MAAM,UAAU,mBAAmB,CACjC,MAA4B,EAC5B,KAAc;IAQd,MAAM,MAAM,GAAG,KAAuC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EACzC,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO;QACtH,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAc,CAAC,EACtC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAY,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,WAAW;QACrG,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACzD,OAAO,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAChJ,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,UAAU,EAAE,EAAE;IACd,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { operatorDigest, operatorJson, operatorRequestSchema } from \"./operator-api.js\";\n\nexport const CATALOG_PUBLICATION_PROTOCOL = 1;\nexport const CATALOG_SOURCE_SCOPE = \"catalog:sources:read\";\nexport const CATALOG_MANIFEST_FIELD = \"catalogAccess\";\nconst id = z\n  .string()\n  .min(1)\n  .max(120)\n  .regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/);\nconst topic = z\n  .string()\n  .min(1)\n  .max(512)\n  .regex(/^[A-Za-z0-9-]+(?:\\/[A-Za-z0-9-]+)*$/)\n  .refine((value) => !value.split(\"/\").some((part) => part === \".\" || part === \"..\"));\nconst localPath = z\n  .string()\n  .min(1)\n  .max(1024)\n  .regex(/^\\/api\\/[A-Za-z0-9_-]+(?:\\/[A-Za-z0-9_.-]+)*$/)\n  .refine((value) => !value.split(\"/\").some((part) => part === \".\" || part === \"..\"));\nexport class CatalogAccessError extends Error {\n  constructor(\n    public readonly code: string,\n    public readonly status = 400,\n  ) {\n    super(code);\n  }\n}\nconst historySource = z\n  .object({\n    id,\n    kind: z.literal(\"history\"),\n    topic,\n    maxWindowMs: z\n      .number()\n      .int()\n      .min(1000)\n      .max(31 * 86400000)\n      .default(7 * 86400000),\n    maxRows: z.number().int().min(1).max(27000).default(1000),\n    fromParameter: id.default(\"from\"),\n    toParameter: id.default(\"to\"),\n  })\n  .strict();\nconst operation = z\n  .object({\n    id,\n    title: z.string().min(1).max(160),\n    method: z.literal(\"GET\"),\n    path: localPath,\n    mode: z.enum([\"caller\", \"approved-service\"]),\n    requestSchema: z.record(z.string(), z.unknown()),\n    responseSchema: z.record(z.string(), z.unknown()),\n    sources: z.array(historySource).min(1).max(16),\n    timeoutMs: z.number().int().min(500).max(30000).default(10000),\n    maxResponseBytes: z.number().int().min(256).max(1048576).default(262144),\n  })\n  .strict();\nconst manifest = z.object({ protocol: z.literal(1), operations: z.array(operation).min(1).max(32) }).strict();\nexport type CatalogOperationInput = z.input<typeof operation>;\nexport type CatalogOperation = z.output<typeof operation>;\nexport type CatalogHistorySource = z.output<typeof historySource>;\nexport type CatalogPublicationManifest = z.output<typeof manifest>;\nexport const catalogAccessDigest = operatorDigest;\n/** Catalog routes use the same UNS resource path as SDK endpoint guards. */\nexport const catalogOperationResource = (path: string): string => path.replace(/^\\/api\\//, \"\");\n\n/** Inspection consumes bounded JSON data, never application JavaScript. */\nexport function parseCatalogPublicationManifest(input: unknown): CatalogPublicationManifest {\n  try {\n    operatorJson(input);\n    const parsed = manifest.parse(input),\n      ids = new Set<string>(),\n      paths = new Set<string>();\n    for (const op of parsed.operations) {\n      if (ids.has(op.id) || paths.has(op.path)) throw Error(\"duplicate operation\");\n      ids.add(op.id);\n      paths.add(op.path);\n      op.requestSchema = catalogSchema(op.requestSchema);\n      op.responseSchema = catalogSchema(op.responseSchema);\n      if (op.requestSchema[\"type\"] !== \"object\") throw Error(\"request must be an object\");\n      if (Object.values((op.requestSchema[\"properties\"] as Record<string, Record<string, unknown>>) ?? {}).some((p) => p[\"type\"] !== \"string\"))\n        throw Error(\"GET parameters must be strings\");\n      const sources = new Set<string>();\n      for (const source of op.sources) {\n        if (sources.has(source.id) || source.fromParameter === source.toParameter) throw Error(\"source binding\");\n        sources.add(source.id);\n        const properties = op.requestSchema[\"properties\"] as Record<string, unknown> | undefined;\n        for (const key of [source.fromParameter, source.toParameter]) {\n          const parameter = properties?.[key] as Record<string, unknown> | undefined;\n          if (\n            parameter?.[\"type\"] !== \"string\" ||\n            parameter[\"format\"] !== \"date-time\" ||\n            !(op.requestSchema[\"required\"] as string[] | undefined)?.includes(key)\n          )\n            throw Error(\"time parameter binding\");\n        }\n      }\n    }\n    return parsed;\n  } catch {\n    throw new CatalogAccessError(\"catalog_manifest_invalid\");\n  }\n}\n\nfunction catalogSchema(value: unknown): Record<string, unknown> {\n  const schema = operatorRequestSchema(value);\n  const visit = (node: Record<string, unknown>): void => {\n    if (\n      ![\"object\", \"array\", \"string\", \"integer\", \"number\", \"boolean\", \"null\"].includes(String(node[\"type\"])) ||\n      [\"oneOf\", \"anyOf\", \"allOf\", \"default\"].some((key) => key in node)\n    )\n      throw Error(\"unsupported catalog schema\");\n    if (node[\"properties\"]) for (const child of Object.values(node[\"properties\"] as Record<string, Record<string, unknown>>)) visit(child);\n    if (node[\"items\"]) visit(node[\"items\"] as Record<string, unknown>);\n  };\n  visit(schema);\n  return schema;\n}\n/** Zod's JSON Schema importer limits date-time to UTC. JSON Schema permits\n * explicit offsets. Check these formats separately without altering input. */\nfunction offsetSchema(schema: Record<string, unknown>, value: unknown): Record<string, unknown> {\n  const copy = { ...schema };\n  if (copy[\"format\"] === \"date-time\") {\n    if (value !== undefined && !z.iso.datetime({ offset: true }).safeParse(value).success) throw Error(\"date-time\");\n    delete copy[\"format\"];\n  }\n  if (copy[\"properties\"])\n    copy[\"properties\"] = Object.fromEntries(\n      Object.entries(copy[\"properties\"] as Record<string, Record<string, unknown>>).map(([key, child]) => [\n        key,\n        offsetSchema(child, value && typeof value === \"object\" ? (value as Record<string, unknown>)[key] : undefined),\n      ]),\n    );\n  if (copy[\"items\"]) {\n    const child = copy[\"items\"] as Record<string, unknown>;\n    if (Array.isArray(value)) for (const item of value) offsetSchema(child, item);\n    copy[\"items\"] = offsetSchema(child, undefined);\n  }\n  return copy;\n}\nfunction assertSchema(schema: Record<string, unknown>, value: unknown, code: string, maxBytes: number): void {\n  try {\n    const json = JSON.stringify(value);\n    if (json === undefined || Buffer.byteLength(json, \"utf8\") > maxBytes) throw Error(\"size\");\n    // fromJSONSchema strips unknown keys by default, so validate the unchanged\n    // value against a strict schema rather than returning parsed/transformed data.\n    if (!z.fromJSONSchema(offsetSchema(schema, value) as never).safeParse(value).success) throw Error(\"schema\");\n  } catch {\n    throw new CatalogAccessError(code, code === \"catalog_response_invalid\" ? 502 : 400);\n  }\n}\nexport function assertCatalogRequest(op: CatalogOperation, input: unknown): void {\n  operatorJson(input);\n  assertSchema(op.requestSchema, input, \"catalog_request_invalid\", 65536);\n  for (const source of op.sources) catalogHistoryQuery(source, input);\n}\nexport function assertCatalogResponse(op: CatalogOperation, value: unknown): void {\n  assertSchema(op.responseSchema, value, \"catalog_response_invalid\", op.maxResponseBytes);\n}\nexport function catalogHistoryQuery(\n  source: CatalogHistorySource,\n  input: unknown,\n): {\n  topics: string[];\n  from: string;\n  to: string;\n  limit: number;\n  dedupe: false;\n} {\n  const values = input as Record<string, unknown> | null;\n  const from = values?.[source.fromParameter],\n    to = values?.[source.toParameter];\n  if (!z.iso.datetime({ offset: true }).safeParse(from).success || !z.iso.datetime({ offset: true }).safeParse(to).success)\n    throw new CatalogAccessError(\"catalog_window_invalid\");\n  const start = Date.parse(from as string),\n    end = Date.parse(to as string);\n  if (!Number.isFinite(start) || !Number.isFinite(end) || start > end || end - start > source.maxWindowMs)\n    throw new CatalogAccessError(\"catalog_window_invalid\");\n  return { topics: [source.topic], from: new Date(start).toISOString(), to: new Date(end).toISOString(), limit: source.maxRows, dedupe: false };\n}\n\nexport const catalogInvocationSchema = z\n  .object({\n    rttNode: id,\n    version: id,\n    instanceId: id,\n    operationId: id,\n    manifestDigest: z.string().regex(/^[a-f0-9]{64}$/),\n    input: z.record(z.string(), z.unknown()),\n    callerToken: z.string().min(1).max(16384),\n  })\n  .strict();\nexport type CatalogInvocation = z.infer<typeof catalogInvocationSchema>;\n"]}

package/dist/runtime/service-access-guide.md

@@ -0,0 +1,130 @@
+# Service access and publications (3.0.47)
+
+This opt-in protocol separates permission to call a catalog operation from
+permission to read its source. It is not a sandbox for arbitrary application
+code or a substitute for restricted database and MQTT identities.
+
+Package metadata requests authority; it never grants it. Keep existing JWT/JWKS
+endpoint guards. Do not forward caller tokens to privileged sources or retry a
+denied caller read with stronger credentials.
+
+## Declaration
+
+Ship a bounded JSON file with the installed package, and retain it in the build:
+
+```json
+{"unsDatahub":{"serviceAccess":"service-access.json"}}
+```
+
+Use `parseServiceAccessDeclaration` from `@uns-kit/core/runtime/service-access.js`:
+
+```json
+{
+  "protocol": 1,
+  "permissions": {
+    "scopes": ["read:uns"],
+    "accessRules": ["example/background/#"]
+  }
+}
+```
+
+This works without a catalog, HTTP endpoint, or human requester. The declaration
+requests a ceiling; an administrator must apply the effective policy under
+**Microservices → instance → Service access** before the service can start with
+a managed identity. Review the exact installed version and declaration digest.
+The administrator can select fewer capabilities and narrower MQTT path filters;
+unknown or administrative scopes are rejected. The identity, revocation and
+same-request reissue mechanisms are the existing managed workload mechanisms.
+UNS resource rules bound direct UNS reads; other recognized runtime scopes retain
+their existing authorization semantics. This protocol does not create new
+SQL, broker, filesystem or arbitrary external-service permissions.
+
+A combined service adds optional `publications`, containing the manifest parsed
+by `parseCatalogPublicationManifest`, to the same envelope. A publication-only
+service uses empty `permissions.scopes` and `permissions.accessRules`. Its
+managed token then has `catalog:sources:read` and **no raw UNS paths**. Adding
+publication sources never adds them to the service's direct `read:uns` rules.
+Publication approval is a separate operation/audience grant and never silently
+grants other package-requested capabilities. Review both in Service access.
+The Catalog contains execution/status and an administrator link to that editor.
+There is one writable publication editor.
+
+The earlier unpublished `unsDatahub.catalogAccess` marker remains an isolated
+compatibility adapter for the first local fixtures. New consumers use
+`serviceAccess`; declaring both markers is rejected. No released applications
+are automatically migrated.
+
+The optional publication manifest supports GET JSON,
+closed JSON schemas (primitive, object and array types; no references, defaults,
+or composition), string query parameters, and exact history source topics.
+Source path segments follow the existing managed-identity resource vocabulary:
+ASCII letters, digits and hyphens. Each source binds required `from`/`to` date-time parameters, a maximum window
+(at most 31 days) and row count (at most 27000). Dates require a UTC offset.
+Wildcard topics, arbitrary URLs/SQL/source selectors and undeclared input fields
+are rejected. The broker caps source responses at 1 MiB; published responses
+have a separately declared cap of at most 1 MiB.
+
+Each operation declares `caller` or `approved-service`. Both require an explicit
+administrator publication review and current caller permission on the SDK UNS
+resource path (the operation path without `/api/`). In caller mode, source rules
+and `read:uns` must also belong to the caller. Service mode never grants these
+raw permissions to the caller.
+
+## Runtime
+
+Use `CatalogPublicationClient` with the installed, normalized manifest and the
+Controller-provided runtime identity (`RTT_NODE`, `version`, `RTT_INSTANCE_ID`,
+`UNS_CONTROLLER_PUBLIC_BASE`). The default `ServiceTokenProvider` reads the
+Controller's rotating token file. There is no caller-token fallback.
+
+Use `catalogPublicationHandler(client, operationId, transform)` in an existing
+`registerApiCatalog` handler. Call `api.registerCatalogRoute()` to opt into the
+existing signed launch route lease. The transform receives `history(sourceId)`
+and the already validated input. It owns the derived result, not authorization.
+The HTTP helper sets `Cache-Control: no-store` and rejects undeclared result
+fields. Each execution rechecks current authority after asynchronous work,
+including cached application results. Custom downloads and other handlers must
+use the same mediated path; this candidate adds no persistent result cache.
+
+A publication-only workload token has `catalog:sources:read` and no direct
+`read:uns` authority. A combined service may separately receive `read:uns` on
+its reviewed background paths, without receiving raw access to publication
+sources. The Controller broker checks current user policy, active machine
+identity/token generation, reviewed identity binding, launch, loaded portable
+configuration, publication revision, audience and source bounds. Its internal
+history token is exact-topic, lasts 15 seconds, and never leaves the broker.
+Neither token bytes nor raw records belong in logs, review receipts or audit.
+
+Two local acceptance consumers (energy intervals and quality sample counts) use
+the same helper and Controller path. No application-name branch is needed.
+
+## Adoption boundary
+
+The SDK contract is introduced in 3.0.47. A matching Controller implementation
+must also be installed; an SDK upgrade alone does not enable the host capability.
+Existing applications do not change mode
+implicitly. Install the shared SDK release first, update consumer lockfiles,
+then review the matching installed declaration through the Controller.
+Controller publication is bound to the installed declaration and portable
+configuration; edits require review. A changed loaded configuration requires a
+new launch, not token refresh. With the matching Controller candidate, the
+signed digest of the same confirmed live launch survives ordinary credential
+expiry and Controller restart. Current identity, policy, generation and approval
+are still checked; expired bearer tokens remain invalid. Missing, corrupt,
+foreign or changed-launch evidence requires explicit reviewed recovery.
+
+
+## Local common-contract acceptance
+
+An unrelated background history processor, with no API or Catalog offer, was
+reviewed, narrowed live, revoked, reissued with the same identity and cold-moved
+to another Controller. It retained the same policy and generation across the
+move. A combined service read its separate background source directly, while a
+catalog-only user consumed a derived result from a different approved source.
+Both the user and workload were denied direct access to that publication source.
+A publication-only empty raw policy stayed empty in storage and actual tokens.
+
+These are local candidate checks, including clean packed-SDK installs. They are
+not production, arbitrary-code isolation or external-resource adapter acceptance.
+SDK publication and downstream frozen dependency updates
+remain separate steps.

package/dist/runtime/service-access.d.ts

@@ -0,0 +1,23 @@
+import { type CatalogPublicationManifest } from "./catalog-publication.js";
+export declare const SERVICE_ACCESS_PROTOCOL = 1;
+export declare const SERVICE_ACCESS_MANIFEST_FIELD = "serviceAccess";
+export declare const SERVICE_RESOURCE_SCOPES: readonly ["read:uns", "identity:asset:publish", "runtime:captures:read", "runtime:captures:write", "runtime:triggers:read"];
+export type ServiceAccessDeclaration = {
+    protocol: 1;
+    permissions: {
+        scopes: string[];
+        accessRules: string[];
+    };
+    publications?: CatalogPublicationManifest;
+};
+export declare function parseServiceAccessDeclaration(value: unknown): ServiceAccessDeclaration;
+export declare const serviceAccessDigest: (value: unknown) => string;
+/** Publication source rules are deliberately not raw UNS permissions. A service
+ * combining a background reader with a catalog must not gain their cross-product. */
+export declare function serviceAccessCeiling(declaration: ServiceAccessDeclaration): {
+    scopes: string[];
+    accessRules: string[];
+};
+/** Conservative MQTT filter inclusion, not matching a filter as if it were data. */
+export declare function serviceRuleWithin(requested: string, allowed: string): boolean;
+//# sourceMappingURL=service-access.d.ts.map

package/dist/runtime/service-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access.d.ts","sourceRoot":"","sources":["../../src/runtime/service-access.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwB,KAAK,0BAA0B,EAAmC,MAAM,0BAA0B,CAAC;AAGlI,eAAO,MAAM,uBAAuB,IAAI,CAAC;AACzC,eAAO,MAAM,6BAA6B,kBAAkB,CAAC;AAI7D,eAAO,MAAM,uBAAuB,6HAM1B,CAAC;AAaX,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,CAAC,CAAC;IACZ,WAAW,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzD,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C,CAAC;AACF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAQtF;AACD,eAAO,MAAM,mBAAmB,4BAAiB,CAAC;AAClD;qFACqF;AACrF,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,wBAAwB;;;EAKzE;AACD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAU7E"}

package/dist/runtime/service-access.js

@@ -0,0 +1,62 @@
+import { z } from "zod";
+import { CATALOG_SOURCE_SCOPE, parseCatalogPublicationManifest } from "./catalog-publication.js";
+import { operatorDigest, operatorJson } from "./operator-api.js";
+export const SERVICE_ACCESS_PROTOCOL = 1;
+export const SERVICE_ACCESS_MANIFEST_FIELD = "serviceAccess";
+// Only existing platform data/runtime capabilities. Administrative authority is
+// never a package-requestable scope. UNS rules bound direct UNS reads; other
+// runtime capabilities retain their existing platform authorization semantics.
+export const SERVICE_RESOURCE_SCOPES = [
+    "read:uns",
+    "identity:asset:publish",
+    "runtime:captures:read",
+    "runtime:captures:write",
+    "runtime:triggers:read",
+];
+const rule = z
+    .string()
+    .min(1)
+    .max(512)
+    .refine((s) => s.split("/").every((p, i, a) => p === "+" || (p === "#" && i === a.length - 1) || /^[A-Za-z0-9-]+$/.test(p)));
+const envelope = z
+    .object({
+    protocol: z.literal(1),
+    permissions: z.object({ scopes: z.array(z.enum(SERVICE_RESOURCE_SCOPES)).max(5), accessRules: z.array(rule).max(64) }).strict(),
+    publications: z.unknown().optional(),
+})
+    .strict();
+export function parseServiceAccessDeclaration(value) {
+    operatorJson(value);
+    const parsed = envelope.parse(value);
+    const permissions = { scopes: [...new Set(parsed.permissions.scopes)].sort(), accessRules: [...new Set(parsed.permissions.accessRules)].sort() };
+    if (!!permissions.scopes.length !== !!permissions.accessRules.length)
+        throw Error("service_access_resources_required");
+    const publications = parsed.publications === undefined ? undefined : parseCatalogPublicationManifest(parsed.publications);
+    if (!permissions.scopes.length && !publications)
+        throw Error("service_access_capability_required");
+    return { protocol: 1, permissions, ...(publications ? { publications } : {}) };
+}
+export const serviceAccessDigest = operatorDigest;
+/** Publication source rules are deliberately not raw UNS permissions. A service
+ * combining a background reader with a catalog must not gain their cross-product. */
+export function serviceAccessCeiling(declaration) {
+    return {
+        scopes: [...declaration.permissions.scopes, ...(declaration.publications ? [CATALOG_SOURCE_SCOPE] : [])].sort(),
+        accessRules: [...declaration.permissions.accessRules],
+    };
+}
+/** Conservative MQTT filter inclusion, not matching a filter as if it were data. */
+export function serviceRuleWithin(requested, allowed) {
+    const a = allowed.split("/"), r = requested.split("/");
+    let i = 0;
+    for (; i < a.length; i++) {
+        if (a[i] === "#")
+            return true;
+        if (r[i] === undefined || r[i] === "#")
+            return false;
+        if (a[i] !== r[i] && a[i] !== "+")
+            return false;
+    }
+    return i === r.length;
+}
+//# sourceMappingURL=service-access.js.map

package/dist/runtime/service-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access.js","sourceRoot":"","sources":["../../src/runtime/service-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAmC,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAClI,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG,eAAe,CAAC;AAC7D,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU;IACV,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,uBAAuB;CACf,CAAC;AACX,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/H,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/H,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,YAAY,CAAC,KAAK,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACjJ,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvH,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1H,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnG,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AACD,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAClD;qFACqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,WAAqC;IACxE,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAC/G,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC;KACtD,CAAC;AACJ,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,OAAe;IAClE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAC1B,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AACxB,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { CATALOG_SOURCE_SCOPE, type CatalogPublicationManifest, parseCatalogPublicationManifest } from \"./catalog-publication.js\";\nimport { operatorDigest, operatorJson } from \"./operator-api.js\";\n\nexport const SERVICE_ACCESS_PROTOCOL = 1;\nexport const SERVICE_ACCESS_MANIFEST_FIELD = \"serviceAccess\";\n// Only existing platform data/runtime capabilities. Administrative authority is\n// never a package-requestable scope. UNS rules bound direct UNS reads; other\n// runtime capabilities retain their existing platform authorization semantics.\nexport const SERVICE_RESOURCE_SCOPES = [\n  \"read:uns\",\n  \"identity:asset:publish\",\n  \"runtime:captures:read\",\n  \"runtime:captures:write\",\n  \"runtime:triggers:read\",\n] as const;\nconst rule = z\n  .string()\n  .min(1)\n  .max(512)\n  .refine((s) => s.split(\"/\").every((p, i, a) => p === \"+\" || (p === \"#\" && i === a.length - 1) || /^[A-Za-z0-9-]+$/.test(p)));\nconst envelope = z\n  .object({\n    protocol: z.literal(1),\n    permissions: z.object({ scopes: z.array(z.enum(SERVICE_RESOURCE_SCOPES)).max(5), accessRules: z.array(rule).max(64) }).strict(),\n    publications: z.unknown().optional(),\n  })\n  .strict();\nexport type ServiceAccessDeclaration = {\n  protocol: 1;\n  permissions: { scopes: string[]; accessRules: string[] };\n  publications?: CatalogPublicationManifest;\n};\nexport function parseServiceAccessDeclaration(value: unknown): ServiceAccessDeclaration {\n  operatorJson(value);\n  const parsed = envelope.parse(value);\n  const permissions = { scopes: [...new Set(parsed.permissions.scopes)].sort(), accessRules: [...new Set(parsed.permissions.accessRules)].sort() };\n  if (!!permissions.scopes.length !== !!permissions.accessRules.length) throw Error(\"service_access_resources_required\");\n  const publications = parsed.publications === undefined ? undefined : parseCatalogPublicationManifest(parsed.publications);\n  if (!permissions.scopes.length && !publications) throw Error(\"service_access_capability_required\");\n  return { protocol: 1, permissions, ...(publications ? { publications } : {}) };\n}\nexport const serviceAccessDigest = operatorDigest;\n/** Publication source rules are deliberately not raw UNS permissions. A service\n * combining a background reader with a catalog must not gain their cross-product. */\nexport function serviceAccessCeiling(declaration: ServiceAccessDeclaration) {\n  return {\n    scopes: [...declaration.permissions.scopes, ...(declaration.publications ? [CATALOG_SOURCE_SCOPE] : [])].sort(),\n    accessRules: [...declaration.permissions.accessRules],\n  };\n}\n/** Conservative MQTT filter inclusion, not matching a filter as if it were data. */\nexport function serviceRuleWithin(requested: string, allowed: string): boolean {\n  const a = allowed.split(\"/\"),\n    r = requested.split(\"/\");\n  let i = 0;\n  for (; i < a.length; i++) {\n    if (a[i] === \"#\") return true;\n    if (r[i] === undefined || r[i] === \"#\") return false;\n    if (a[i] !== r[i] && a[i] !== \"+\") return false;\n  }\n  return i === r.length;\n}\n"]}

package/dist/runtime/service-access.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service-access.test.d.ts.map

package/dist/runtime/service-access.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access.test.d.ts","sourceRoot":"","sources":["../../src/runtime/service-access.test.ts"],"names":[],"mappings":""}

package/dist/runtime/service-access.test.js

@@ -0,0 +1,57 @@
+import { expect, it } from "vitest";
+import { parseServiceAccessDeclaration, serviceAccessCeiling, serviceAccessDigest } from "./service-access.js";
+import { serviceRuleWithin } from "./service-access.js";
+const background = { protocol: 1, permissions: { scopes: ["read:uns"], accessRules: ["factory/sensors/#"] } };
+it("supports an unrelated background service without catalog or HTTP", () => {
+    const d = parseServiceAccessDeclaration(background);
+    expect(d.publications).toBeUndefined();
+    expect(serviceAccessCeiling(d)).toEqual(background.permissions);
+});
+it.each(["admin:all", "catalog:sources:read", "write:anything"])("rejects package-requested privileged or unknown scope %s", (scope) => {
+    expect(() => parseServiceAccessDeclaration({ ...background, permissions: { ...background.permissions, scopes: [scope] } })).toThrow();
+});
+it.each([
+    { protocol: 2 },
+    { unknown: true },
+    { permissions: { scopes: ["read:uns"], accessRules: [] } },
+    { permissions: { scopes: [], accessRules: [] } },
+    { permissions: { scopes: ["read:uns"], accessRules: ["factory/#/escape"] } },
+])("fails closed on malformed declaration %j", (patch) => expect(() => parseServiceAccessDeclaration({ ...background, ...patch })).toThrow());
+it("normalizes duplicate requirements for stable review digests", () => expect(serviceAccessDigest(parseServiceAccessDeclaration({
+    ...background,
+    permissions: { scopes: ["read:uns", "read:uns"], accessRules: ["factory/sensors/#", "factory/sensors/#"] },
+}))).toBe(serviceAccessDigest(parseServiceAccessDeclaration(background))));
+it.each([
+    ["plant/a", "plant/#", true],
+    ["plant/+", "plant/#", true],
+    ["plant/#", "plant/+", false],
+    ["#", "plant/#", false],
+    ["other/a", "plant/#", false],
+])("validates resource narrowing %s within %s", (r, a, expected) => expect(serviceRuleWithin(r, a)).toBe(expected));
+it("does not combine publication sources with raw background rules", () => {
+    const d = parseServiceAccessDeclaration({
+        ...background,
+        publications: {
+            protocol: 1,
+            operations: [
+                {
+                    id: "summary",
+                    title: "Summary",
+                    method: "GET",
+                    path: "/api/derived/summary",
+                    mode: "approved-service",
+                    requestSchema: {
+                        type: "object",
+                        additionalProperties: false,
+                        required: ["from", "to"],
+                        properties: { from: { type: "string", format: "date-time" }, to: { type: "string", format: "date-time" } },
+                    },
+                    responseSchema: { type: "integer" },
+                    sources: [{ id: "history", kind: "history", topic: "private/published" }],
+                },
+            ],
+        },
+    });
+    expect(serviceAccessCeiling(d)).toEqual({ scopes: ["catalog:sources:read", "read:uns"], accessRules: ["factory/sensors/#"] });
+});
+//# sourceMappingURL=service-access.test.js.map

package/dist/runtime/service-access.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access.test.js","sourceRoot":"","sources":["../../src/runtime/service-access.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,UAAU,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC;AAC9G,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC1E,MAAM,CAAC,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAC;IACvC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AACH,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,sBAAsB,EAAE,gBAAgB,CAAC,CAAC,CAAC,0DAA0D,EAAE,CAAC,KAAK,EAAE,EAAE;IACrI,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,EAAE,GAAG,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AACxI,CAAC,CAAC,CAAC;AACH,EAAE,CAAC,IAAI,CAAC;IACN,EAAE,QAAQ,EAAE,CAAC,EAAE;IACf,EAAE,OAAO,EAAE,IAAI,EAAE;IACjB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE;IAC1D,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE;IAChD,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE;CAC7E,CAAC,CAAC,0CAA0C,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAC9I,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE,CACrE,MAAM,CACJ,mBAAmB,CACjB,6BAA6B,CAAC;IAC5B,GAAG,UAAU;IACb,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,EAAE;CAC3G,CAAC,CACH,CACF,CAAC,IAAI,CAAC,mBAAmB,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1E,EAAE,CAAC,IAAI,CAAC;IACN,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC;IAC5B,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC;IAC5B,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC;IAC7B,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC;IACvB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC;CAC9B,CAAC,CAAC,2CAA2C,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAW,EAAE,CAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxI,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;IACxE,MAAM,CAAC,GAAG,6BAA6B,CAAC;QACtC,GAAG,UAAU;QACb,YAAY,EAAE;YACZ,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE;gBACV;oBACE,EAAE,EAAE,SAAS;oBACb,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,kBAAkB;oBACxB,aAAa,EAAE;wBACb,IAAI,EAAE,QAAQ;wBACd,oBAAoB,EAAE,KAAK;wBAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC;wBACxB,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;qBAC3G;oBACD,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBACnC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;iBAC1E;aACF;SACF;KACF,CAAC,CAAC;IACH,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,sBAAsB,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;AAChI,CAAC,CAAC,CAAC","sourcesContent":["import { expect, it } from \"vitest\";\n\nimport { parseServiceAccessDeclaration, serviceAccessCeiling, serviceAccessDigest } from \"./service-access.js\";\nimport { serviceRuleWithin } from \"./service-access.js\";\n\nconst background = { protocol: 1, permissions: { scopes: [\"read:uns\"], accessRules: [\"factory/sensors/#\"] } };\nit(\"supports an unrelated background service without catalog or HTTP\", () => {\n  const d = parseServiceAccessDeclaration(background);\n  expect(d.publications).toBeUndefined();\n  expect(serviceAccessCeiling(d)).toEqual(background.permissions);\n});\nit.each([\"admin:all\", \"catalog:sources:read\", \"write:anything\"])(\"rejects package-requested privileged or unknown scope %s\", (scope) => {\n  expect(() => parseServiceAccessDeclaration({ ...background, permissions: { ...background.permissions, scopes: [scope] } })).toThrow();\n});\nit.each([\n  { protocol: 2 },\n  { unknown: true },\n  { permissions: { scopes: [\"read:uns\"], accessRules: [] } },\n  { permissions: { scopes: [], accessRules: [] } },\n  { permissions: { scopes: [\"read:uns\"], accessRules: [\"factory/#/escape\"] } },\n])(\"fails closed on malformed declaration %j\", (patch) => expect(() => parseServiceAccessDeclaration({ ...background, ...patch })).toThrow());\nit(\"normalizes duplicate requirements for stable review digests\", () =>\n  expect(\n    serviceAccessDigest(\n      parseServiceAccessDeclaration({\n        ...background,\n        permissions: { scopes: [\"read:uns\", \"read:uns\"], accessRules: [\"factory/sensors/#\", \"factory/sensors/#\"] },\n      }),\n    ),\n  ).toBe(serviceAccessDigest(parseServiceAccessDeclaration(background))));\n\nit.each([\n  [\"plant/a\", \"plant/#\", true],\n  [\"plant/+\", \"plant/#\", true],\n  [\"plant/#\", \"plant/+\", false],\n  [\"#\", \"plant/#\", false],\n  [\"other/a\", \"plant/#\", false],\n])(\"validates resource narrowing %s within %s\", (r, a, expected) => expect(serviceRuleWithin(r as string, a as string)).toBe(expected));\nit(\"does not combine publication sources with raw background rules\", () => {\n  const d = parseServiceAccessDeclaration({\n    ...background,\n    publications: {\n      protocol: 1,\n      operations: [\n        {\n          id: \"summary\",\n          title: \"Summary\",\n          method: \"GET\",\n          path: \"/api/derived/summary\",\n          mode: \"approved-service\",\n          requestSchema: {\n            type: \"object\",\n            additionalProperties: false,\n            required: [\"from\", \"to\"],\n            properties: { from: { type: \"string\", format: \"date-time\" }, to: { type: \"string\", format: \"date-time\" } },\n          },\n          responseSchema: { type: \"integer\" },\n          sources: [{ id: \"history\", kind: \"history\", topic: \"private/published\" }],\n        },\n      ],\n    },\n  });\n  expect(serviceAccessCeiling(d)).toEqual({ scopes: [\"catalog:sources:read\", \"read:uns\"], accessRules: [\"factory/sensors/#\"] });\n});\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uns-kit/core",
-  "version": "3.0.46",
+  "version": "3.0.47",
   "description": "Core utilities and runtime building blocks for UNS-based realtime transformers.",
   "type": "module",
   "license": "MIT",
@@ -23,6 +23,19 @@
     "MIGRATIONS.md"
   ],
   "exports": {
+    "./runtime/service-access.js": {
+      "types": "./dist/runtime/service-access.d.ts",
+      "import": "./dist/runtime/service-access.js"
+    },
+    "./runtime/catalog-publication.js": {
+      "types": "./dist/runtime/catalog-publication.d.ts",
+      "import": "./dist/runtime/catalog-publication.js"
+    },
+    "./runtime/catalog-publication-client.js": {
+      "types": "./dist/runtime/catalog-publication-client.d.ts",
+      "import": "./dist/runtime/catalog-publication-client.js"
+    },
+    "./runtime/service-access-guide.md": "./dist/runtime/service-access-guide.md",
     "./runtime/retained-store.js": {
       "types": "./dist/runtime/retained-store.d.ts",
       "import": "./dist/runtime/retained-store.js"