@uns-kit/core 3.0.47 → 3.0.49

package/dist/runtime/service-access-guide.md

@@ -1,130 +1,277 @@
-# Service access and publications (3.0.47)
+# Service access: from declaration to a running service
 
-This opt-in protocol separates permission to call a catalog operation from
-permission to read its source. It is not a sandbox for arbitrary application
-code or a substitute for restricted database and MQTT identities.
+For application developers and coding agents using **SDK 3.0.49 or later**.
+Common Service access also requires a matching Controller; these workflows were
+originally verified with Controller **2.2.95** using file declarations. Inline
+package declarations require a Controller advertising `rttServiceAccessInline`.
+Controller 2.2.96 does not support inline declarations. SDK installation alone
+enables no host rights. The configuration-save approval UI is a separate planned
+Controller change; the approval steps below describe the existing released UI.
 
-Package metadata requests authority; it never grants it. Keep existing JWT/JWKS
-endpoint guards. Do not forward caller tokens to privileged sources or retry a
-denied caller read with stronger credentials.
+The developer declares a permission ceiling and uses the SDK. An administrator
+reviews the installed release in **Micro services → instance → Service access**.
+The Controller stores that decision, issues the instance credential and supplies
+its file path. The SDK reads the current credential when making a request. The UI
+is a policy editor, not a place to copy a bearer token into application code.
 
-## Declaration
+## Choose the access model
 
-Ship a bounded JSON file with the installed package, and retain it in the build:
+| Application activity | Credential used | Administrator approves | Mechanism |
+| --- | --- | --- | --- |
+| Background UNS API read | Service token only | `read:uns` and explicit UNS paths | `ServiceTokenProvider` / API client |
+| Approved derived catalog operation | Service token plus the incoming user's token | Service capability, exact publication sources/output and audience; user separately needs operation access | `CatalogPublicationClient` + `catalogPublicationHandler` |
+| Direct MQTT subscribe/publish | Broker credentials | Broker ACLs for the relevant topics | MQTT connection settings and broker authorization |
+| Direct SQL/external API access | That resource's credential | Database/external-system grants | Application adapter and secret references |
+
+**`read:uns` protects OpenHub API reads. It does not install MQTT ACLs.**
+MQTT-style filters in Service access describe API resource paths; their syntax
+does not make the HTTP service token a broker password. `infra.host` and the
+example's `mqtt.username/password` concern runtime MQTT connectivity. Configure
+broker ACLs separately, including the runtime signaling topics your deployment
+requires. A direct database connection is governed by its database identity.
+This capability is not an arbitrary-code sandbox.
+
+## Runnable examples and package contents
+
+Both examples are independent Node.js 22+ projects with complete source,
+credential-free configuration, a declaration, build script and package metadata:
+
+- [Background reader](https://github.com/uns-openhub/uns-kit/tree/master/examples/service-access/background-reader)
+- [Catalog summary](https://github.com/uns-openhub/uns-kit/tree/master/examples/service-access/catalog-summary)
+
+The npm core package also ships this guide at
+`@uns-kit/core/runtime/service-access-guide.md` and both projects under
+`node_modules/@uns-kit/core/dist/runtime/service-access-examples/`. Copy a project
+to your own directory before installing/building it; do not edit `node_modules`.
+Source code, not repeated prose fragments, is the complete runnable example.
+
+For new services, put the declaration directly in `package.json`:
 
 ```json
-{"unsDatahub":{"serviceAccess":"service-access.json"}}
+{
+  "files": ["dist", "config-example.json"],
+  "unsDatahub": {
+    "schemaVersion": 1,
+    "kind": "addon",
+    "controllerCompatibility": ">=2 <3",
+    "serviceAccess": {
+      "protocol": 1,
+      "permissions": {
+        "scopes": ["read:uns"],
+        "accessRules": ["example/background/line-1/equipment/main/temperature"]
+      }
+    }
+  }
+}
 ```
 
-Use `parseServiceAccessDeclaration` from `@uns-kit/core/runtime/service-access.js`:
+This is metadata to merge into the application's existing package.json. Keep the
+real name/version/dependencies/scripts. The SDK is imported as published packages;
+no copied validators, source overlays or application-name Controller branches.
+Do not declare the historical `catalogAccess` marker alongside `serviceAccess`.
+
+Existing `"serviceAccess": "service-access.json"` references remain supported.
+Retain that file in `files` when using the file form, including for Controllers
+without inline support. Use one representation; the normalized declaration and
+its digest are identical when the content is identical. Neither form contains
+tokens or an administrator's approval.
+
+Runtime code can read the same definition without duplicating it:
+
+```js
+import { loadServiceAccessDeclaration } from '@uns-kit/core/runtime/service-access-package.js';
+const declaration = await loadServiceAccessDeclaration(new URL('../package.json', import.meta.url));
+if (!declaration) throw new Error('Declare the service requirements in package.json.');
+```
+
+This example path is for an entry point directly inside `dist/`. The loader
+reads bounded JSON data; it never imports application code. File references are
+relative to the package, with traversal/symlink escapes rejected. Each JSON file,
+including package.json, is limited to 64 KiB. Host integrations can use the pure
+`resolveServiceAccessDeclaration(packageData, readDeclaration)` with their own
+bounded reader and the exported `serviceAccessPackageReferenceSchema`.
+
+In either copied example:
+
+```sh
+pnpm install
+pnpm run build
+cp config-example.json config.json
+```
+
+Select your local MQTT/Controller endpoints and use environment or secret-provider
+references for credentials. Never commit config.json, .env, keys or tokens. Under
+a Controller deployment, instance configuration is managed by that Controller.
+The examples declare ordinary cold operation, not state-preserving hot handover.
+
+## 1. Background service: no Catalog and no HTTP listener
+
+The background reader asks for one source through the OpenHub history API:
 
 ```json
 {
   "protocol": 1,
   "permissions": {
     "scopes": ["read:uns"],
-    "accessRules": ["example/background/#"]
+    "accessRules": ["example/background/line-1/equipment/main/temperature"]
   }
 }
 ```
 
-This works without a catalog, HTTP endpoint, or human requester. The declaration
-requests a ceiling; an administrator must apply the effective policy under
-**Microservices → instance → Service access** before the service can start with
-a managed identity. Review the exact installed version and declaration digest.
-The administrator can select fewer capabilities and narrower MQTT path filters;
-unknown or administrative scopes are rejected. The identity, revocation and
-same-request reissue mechanisms are the existing managed workload mechanisms.
-UNS resource rules bound direct UNS reads; other recognized runtime scopes retain
-their existing authorization semantics. This protocol does not create new
-SQL, broker, filesystem or arbitrary external-service permissions.
-
-A combined service adds optional `publications`, containing the manifest parsed
-by `parseCatalogPublicationManifest`, to the same envelope. A publication-only
-service uses empty `permissions.scopes` and `permissions.accessRules`. Its
-managed token then has `catalog:sources:read` and **no raw UNS paths**. Adding
-publication sources never adds them to the service's direct `read:uns` rules.
-Publication approval is a separate operation/audience grant and never silently
-grants other package-requested capabilities. Review both in Service access.
-The Catalog contains execution/status and an administrator link to that editor.
-There is one writable publication editor.
-
-The earlier unpublished `unsDatahub.catalogAccess` marker remains an isolated
-compatibility adapter for the first local fixtures. New consumers use
-`serviceAccess`; declaring both markers is rejected. No released applications
-are automatically migrated.
-
-The optional publication manifest supports GET JSON,
-closed JSON schemas (primitive, object and array types; no references, defaults,
-or composition), string query parameters, and exact history source topics.
-Source path segments follow the existing managed-identity resource vocabulary:
-ASCII letters, digits and hyphens. Each source binds required `from`/`to` date-time parameters, a maximum window
-(at most 31 days) and row count (at most 27000). Dates require a UTC offset.
-Wildcard topics, arbitrary URLs/SQL/source selectors and undeclared input fields
-are rejected. The broker caps source responses at 1 MiB; published responses
-have a separately declared cap of at most 1 MiB.
-
-Each operation declares `caller` or `approved-service`. Both require an explicit
-administrator publication review and current caller permission on the SDK UNS
-resource path (the operation path without `/api/`). In caller mode, source rules
-and `read:uns` must also belong to the caller. Service mode never grants these
-raw permissions to the caller.
-
-## Runtime
-
-Use `CatalogPublicationClient` with the installed, normalized manifest and the
-Controller-provided runtime identity (`RTT_NODE`, `version`, `RTT_INSTANCE_ID`,
-`UNS_CONTROLLER_PUBLIC_BASE`). The default `ServiceTokenProvider` reads the
-Controller's rotating token file. There is no caller-token fallback.
-
-Use `catalogPublicationHandler(client, operationId, transform)` in an existing
-`registerApiCatalog` handler. Call `api.registerCatalogRoute()` to opt into the
-existing signed launch route lease. The transform receives `history(sourceId)`
-and the already validated input. It owns the derived result, not authorization.
-The HTTP helper sets `Cache-Control: no-store` and rejects undeclared result
-fields. Each execution rechecks current authority after asynchronous work,
-including cached application results. Custom downloads and other handlers must
-use the same mediated path; this candidate adds no persistent result cache.
-
-A publication-only workload token has `catalog:sources:read` and no direct
-`read:uns` authority. A combined service may separately receive `read:uns` on
-its reviewed background paths, without receiving raw access to publication
-sources. The Controller broker checks current user policy, active machine
-identity/token generation, reviewed identity binding, launch, loaded portable
-configuration, publication revision, audience and source bounds. Its internal
-history token is exact-topic, lasts 15 seconds, and never leaves the broker.
-Neither token bytes nor raw records belong in logs, review receipts or audit.
-
-Two local acceptance consumers (energy intervals and quality sample counts) use
-the same helper and Controller path. No application-name branch is needed.
-
-## Adoption boundary
-
-The SDK contract is introduced in 3.0.47. A matching Controller implementation
-must also be installed; an SDK upgrade alone does not enable the host capability.
-Existing applications do not change mode
-implicitly. Install the shared SDK release first, update consumer lockfiles,
-then review the matching installed declaration through the Controller.
-Controller publication is bound to the installed declaration and portable
-configuration; edits require review. A changed loaded configuration requires a
-new launch, not token refresh. With the matching Controller candidate, the
-signed digest of the same confirmed live launch survives ordinary credential
-expiry and Controller restart. Current identity, policy, generation and approval
-are still checked; expired bearer tokens remain invalid. Missing, corrupt,
-foreign or changed-launch evidence requires explicit reviewed recovery.
-
-
-## Local common-contract acceptance
-
-An unrelated background history processor, with no API or Catalog offer, was
-reviewed, narrowed live, revoked, reissued with the same identity and cold-moved
-to another Controller. It retained the same policy and generation across the
-move. A combined service read its separate background source directly, while a
-catalog-only user consumed a derived result from a different approved source.
-Both the user and workload were denied direct access to that publication source.
-A publication-only empty raw policy stayed empty in storage and actual tokens.
-
-These are local candidate checks, including clean packed-SDK installs. They are
-not production, arbitrary-code isolation or external-resource adapter acceptance.
-SDK publication and downstream frozen dependency updates
-remain separate steps.
+There is no `publications` section and no human caller. The complete
+`background-reader/src/reader.mjs` imports:
+
+```js
+import { ServiceTokenProvider } from '@uns-kit/core/tools/auth/service-token-provider.js';
+const tokens = new ServiceTokenProvider();
+// Inside each request, not once at application startup:
+const token = await tokens.getAccessToken();
+```
+
+It sends the token as `Authorization: Bearer …` to
+`/api/catchall/batch/range` at `UNS_CONTROLLER_PUBLIC_BASE`, with a fixed declared
+source, explicit from/to, a row limit, timeout and no redirects. Missing credentials
+or 401/403 fail the request; no retry with a human or more powerful credential.
+`src/index.mjs` schedules reads only while the runtime is active. Shutdown stops
+admission, aborts the pending read and cleans up the runtime on SIGINT/SIGTERM.
+
+Administrator steps after deployment:
+
+1. Open **Service access** for the exact installed example release and instance.
+2. Use **Restore defaults** to populate the draft, or select `read:uns` and the
+   exact declared path manually. Defaults do not save or grant anything.
+3. Review **Permitted UNS paths**, then **Apply access policy** and confirm.
+   Only declared paths or narrower filters are allowed; do not replace them with `#`.
+4. **Start** the prepared instance. First managed launch requires reviewed access.
+   There is no catalog publication to approve.
+
+The Controller supplies `UNS_SERVICE_TOKEN_FILE` and runtime endpoint/identity
+metadata. `ServiceTokenProvider` rereads that file for every request, so atomic
+credential rotation is visible without an application restart. When the file is
+configured it is authoritative: missing/empty/unreadable means failure, not fallback.
+Do not cache the returned token for the lifetime of the process.
+
+Acceptance on your local stack: create some history for the declared example
+source. Expect 200 for that source and 403 for another source with the same service
+credential. Verify a policy narrowing or revocation takes effect without granting
+additional paths. Zero rows is a valid response if the selected window has no data.
+
+## 2. Catalog: a user requests a derived result
+
+The catalog summary has empty direct `permissions.scopes` and `accessRules`. Its
+optional `publications` declaration defines `sample-count`, GET JSON, from/to with
+a timezone, at most one hour/1000 rows from
+`example/private/line-1/equipment/main/temperature`, and a closed result containing
+only `{count, hasMore}`. The response cap is 4096 bytes. See its complete
+`package.json.unsDatahub.serviceAccess`; the source and response schema are reviewed data.
+
+`catalog-summary/src/index.mjs` reads and validates that declaration with
+`loadServiceAccessDeclaration`, then constructs `CatalogPublicationClient` using
+the real Controller-injected `RTT_NODE`, `RTT_INSTANCE_ID`, `version` and
+`UNS_CONTROLLER_PUBLIC_BASE`. It configures JWT/JWKS authentication, calls
+`api.registerCatalogRoute()` for the signed installed-launch route lease, and
+registers the offer with `registerApiCatalog`. Do not manufacture these launch
+variables to make a directly started process appear Controller-managed.
+
+`src/offer.mjs` wraps its business transform with the actual SDK helper:
+
+```js
+catalogPublicationHandler(client, 'sample-count', async ({ history }) => {
+  const rows = await history('temperature');
+  return { count: rows.data.length, hasMore: rows.truncated };
+});
+```
+
+`temperature` is the declared source ID, not an arbitrary topic or URL from the
+request. The complete source also validates the source response. The helper takes
+the caller's bearer from the incoming HTTP request. The client separately reads
+the service token through `ServiceTokenProvider`; they are never substituted for
+each other. The business transform owns the count, not the authorization policy.
+
+Administrator steps after preparation:
+
+1. Apply only `catalog:sources:read` in **Service access**, with **no direct UNS
+   paths**. This capability permits the reviewed catalog workflow, not raw reads.
+2. Expand **Published operations → Review access**. Check the exact source,
+   maximum interval/rows, **Published fields** and intended audience.
+3. **Review publication**, then **Approve publication**. A selected audience role
+   does not itself grant every user access to the catalog operation.
+4. Give a test reader access to the operation's SDK resource path:
+   `example/public/line-1/equipment/dataset/sample-count/json` (without `/api/`).
+   Do not grant the private source path just to make Execute work.
+5. Start the prepared instance and Execute the operation as that reader, for
+   example `from=2026-01-01T00:00:00Z` and `to=2026-01-01T01:00:00Z`.
+
+When moving an existing service from legacy credentials to this declaration,
+prepare the new version first. Use **Stop → review Service access/publication →
+Start prepared version** on the chosen owner. A still-live older version can
+block inspection of the prepared release; the same-instance Apply guard requires
+this first-adoption sequence. Retain the old configuration for controlled rollback
+until acceptance; do not grant raw access to get past an adoption error.
+
+The request path is:
+
+1. Browser sends the user's token to the service API through the Controller.
+2. The SDK sends its service credential and the caller context to the Controller.
+3. Controller checks current user operation access, audience, active service
+   identity/generation, live launch, loaded configuration, declaration and approval.
+4. Controller obtains bounded source data using a short-lived exact-source
+   credential internally. It never sends that credential to the service/browser.
+5. The service transforms the data; SDK rechecks authority after the asynchronous
+   work and validates the closed output schema before returning JSON.
+
+Only SDK-integrated execution gets that output validation. Preserve ordinary
+endpoint JWT/JWKS guards; a custom endpoint or custom download must use the same
+mediated path. Arbitrary app code with independent DB/MQTT credentials is outside
+this enforcement. Revocation cannot erase bytes already delivered.
+
+Acceptance: reader Execute 200/{count,hasMore}; caller and service direct source
+reads 403; unapproved/revoked publication 403; invalid window/unknown parameter
+400; no raw source fields or credentials in result/logs. The caller needs no
+source permission in `approved-service` mode. `caller` mode instead requires the
+caller's own source permissions as well; it never retries with stronger authority.
+
+## Contract limits
+
+The publication protocol supports GET JSON, string query parameters, exact history
+topics and closed primitive/object/array schemas. Schema references, defaults and
+composition, wildcard source topics, arbitrary URLs/SQL and undeclared inputs are
+rejected. Source path segments use ASCII letters, digits and hyphens. Each source
+binds the required timezone-qualified `from`/`to`, at most 31 days and 27000 rows.
+The broker caps source responses at 1 MiB; the separately declared output cap is
+also at most 1 MiB. The example intentionally chooses narrower limits.
+
+A combined service can declare background `read:uns` paths and `publications` in
+the same envelope. Review both separately. A publication source never becomes a
+directly readable background path just because it appears in the manifest.
+Unknown or administrative service scopes are rejected.
+
+Ordinary credential renewal and Controller restart preserve a confirmed live
+launch binding. They do not approve a different identity, declaration, policy,
+configuration or launch. Missing or changed evidence requires reviewed recovery;
+an expired bearer remains invalid.
+
+## Troubleshooting and agent checklist
+
+| Symptom | Check |
+| --- | --- |
+| Start requires access review | Exact installed release and `unsDatahub.serviceAccess`; admin must apply the policy |
+| Credential file missing | Real Controller launch/file access; never copy a human token into config |
+| Background read 403 | Active workload identity, `read:uns`, matching permitted path, current generation |
+| Catalog 403 | Caller operation access, audience, service capability and current publication approval |
+| Placement/access changed | Current owner/version/loaded config; stop the legacy owner for first adoption and review the prepared release |
+| API works, MQTT denied | Broker credentials/ACLs; API scopes do not create broker access |
+| Configuration changed | Review the new configuration/contract and restart as required; token refresh cannot replace loaded-launch evidence |
+
+For an agent generating a service: choose the model above, use the published SDK
+imports, ship/validate the declaration, preserve local cleanup, and list the admin
+review needed. Do not create identities, modify user rules or broker ACLs, disable
+JWT checks, synthesize launch metadata, or broaden paths as an automatic fix.
+Keep install/build, review, start, release and production deployment separate.
+
+Maintainers run `pnpm run ts:build` and `pnpm run test:service-access-examples`.
+The latter verifies packaged imports/assets, rotating token use, failures and the
+real catalog HTTP helper using synthetic loopback endpoints. It does not certify
+real MQTT ACLs, Controller RBAC/cluster ownership, or production resource grants.
+Additional SQL, filesystem, broker and external-resource permission adapters are
+outside this protocol. Follow the version-bounded core MIGRATIONS.md on adoption.

package/dist/runtime/service-access-package.d.ts

@@ -0,0 +1,6 @@
+import { type ServiceAccessDeclaration } from "./service-access.js";
+/** Read the application's package data without importing application code.
+ * Pass new URL('../package.json', import.meta.url) from a dist entry point.
+ * Referenced declarations stay inside that package and cannot traverse symlinks. */
+export declare function loadServiceAccessDeclaration(packageFile: string | URL): Promise<ServiceAccessDeclaration | null>;
+//# sourceMappingURL=service-access-package.d.ts.map

package/dist/runtime/service-access-package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access-package.d.ts","sourceRoot":"","sources":["../../src/runtime/service-access-package.ts"],"names":[],"mappings":"AAKA,OAAO,EAAmC,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAuBrG;;oFAEoF;AACpF,wBAAsB,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAWtH"}

package/dist/runtime/service-access-package.js

@@ -0,0 +1,45 @@
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveServiceAccessDeclaration } from "./service-access.js";
+const MAX_BYTES = 65536;
+async function readJson(file) {
+    const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size > MAX_BYTES)
+            throw Error("service_access_file_invalid");
+        const buffer = Buffer.alloc(MAX_BYTES + 1);
+        let size = 0;
+        while (size < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, size, buffer.length - size, size);
+            if (!bytesRead)
+                break;
+            size += bytesRead;
+        }
+        if (size > MAX_BYTES)
+            throw Error("service_access_file_invalid");
+        return JSON.parse(buffer.subarray(0, size).toString("utf8"));
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Read the application's package data without importing application code.
+ * Pass new URL('../package.json', import.meta.url) from a dist entry point.
+ * Referenced declarations stay inside that package and cannot traverse symlinks. */
+export async function loadServiceAccessDeclaration(packageFile) {
+    const file = path.resolve(packageFile instanceof URL ? fileURLToPath(packageFile) : packageFile);
+    const root = await realpath(path.dirname(file));
+    return resolveServiceAccessDeclaration(await readJson(path.join(root, path.basename(file))), async (relative) => {
+        let current = root;
+        for (const segment of relative.split("/")) {
+            current = path.join(current, segment);
+            if ((await lstat(current)).isSymbolicLink())
+                throw Error("service_access_file_invalid");
+        }
+        return readJson(current);
+    });
+}
+//# sourceMappingURL=service-access-package.js.map

package/dist/runtime/service-access-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access-package.js","sourceRoot":"","sources":["../../src/runtime/service-access-package.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,+BAA+B,EAAiC,MAAM,qBAAqB,CAAC;AAErG,MAAM,SAAS,GAAG,KAAK,CAAC;AAExB,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;YAClF,IAAI,CAAC,SAAS;gBAAE,MAAM;YACtB,IAAI,IAAI,SAAS,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;oFAEoF;AACpF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,WAAyB;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,YAAY,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,+BAA+B,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC9G,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { constants } from \"node:fs\";\nimport { lstat, open, realpath } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nimport { resolveServiceAccessDeclaration, type ServiceAccessDeclaration } from \"./service-access.js\";\n\nconst MAX_BYTES = 65536;\n\nasync function readJson(file: string): Promise<unknown> {\n  const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);\n  try {\n    const stat = await handle.stat();\n    if (!stat.isFile() || stat.size > MAX_BYTES) throw Error(\"service_access_file_invalid\");\n    const buffer = Buffer.alloc(MAX_BYTES + 1);\n    let size = 0;\n    while (size < buffer.length) {\n      const { bytesRead } = await handle.read(buffer, size, buffer.length - size, size);\n      if (!bytesRead) break;\n      size += bytesRead;\n    }\n    if (size > MAX_BYTES) throw Error(\"service_access_file_invalid\");\n    return JSON.parse(buffer.subarray(0, size).toString(\"utf8\"));\n  } finally {\n    await handle.close();\n  }\n}\n\n/** Read the application's package data without importing application code.\n * Pass new URL('../package.json', import.meta.url) from a dist entry point.\n * Referenced declarations stay inside that package and cannot traverse symlinks. */\nexport async function loadServiceAccessDeclaration(packageFile: string | URL): Promise<ServiceAccessDeclaration | null> {\n  const file = path.resolve(packageFile instanceof URL ? fileURLToPath(packageFile) : packageFile);\n  const root = await realpath(path.dirname(file));\n  return resolveServiceAccessDeclaration(await readJson(path.join(root, path.basename(file))), async (relative) => {\n    let current = root;\n    for (const segment of relative.split(\"/\")) {\n      current = path.join(current, segment);\n      if ((await lstat(current)).isSymbolicLink()) throw Error(\"service_access_file_invalid\");\n    }\n    return readJson(current);\n  });\n}\n"]}

package/dist/runtime/service-access-package.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service-access-package.test.d.ts.map

package/dist/runtime/service-access-package.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access-package.test.d.ts","sourceRoot":"","sources":["../../src/runtime/service-access-package.test.ts"],"names":[],"mappings":""}

package/dist/runtime/service-access-package.test.js

@@ -0,0 +1,61 @@
+import { expect, it, vi } from "vitest";
+import { mkdtemp, mkdir, writeFile, symlink, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { loadServiceAccessDeclaration } from "./service-access-package.js";
+import { resolveServiceAccessDeclaration, serviceAccessDigest } from "./service-access.js";
+const declaration = { protocol: 1, permissions: { scopes: ["read:uns"], accessRules: ["plant/sensor/#"] } };
+const pkg = (serviceAccess) => ({ unsDatahub: { serviceAccess } });
+it("normalizes inline/file representations identically without reading a file for inline data", async () => {
+    const read = vi.fn(async () => declaration);
+    const inline = await resolveServiceAccessDeclaration(pkg(declaration), read);
+    expect(read).not.toHaveBeenCalled();
+    const file = await resolveServiceAccessDeclaration(pkg("access.json"), read);
+    expect(read).toHaveBeenCalledExactlyOnceWith("access.json");
+    expect(inline).toEqual(file);
+    expect(serviceAccessDigest(inline)).toBe(serviceAccessDigest(file));
+});
+it.each([null, 42, [], {}, { ...declaration, protocol: 2 }, { ...declaration, approved: true },
+    "../access.json", "/access.json", "C:/access.json", "a\\access.json", "a//access.json", "./access.json"])("fails closed on an invalid package reference %j", async (reference) => {
+    const read = vi.fn();
+    await expect(resolveServiceAccessDeclaration(pkg(reference), read)).rejects.toThrow();
+    expect(read).not.toHaveBeenCalled();
+});
+it("keeps absence optional and rejects ambiguous legacy metadata before reading", async () => {
+    const read = vi.fn();
+    expect(await resolveServiceAccessDeclaration({ name: "ordinary-service" }, read)).toBeNull();
+    expect(await resolveServiceAccessDeclaration({ unsDatahub: { catalogAccess: "legacy.json" } }, read)).toBeNull();
+    await expect(resolveServiceAccessDeclaration({ unsDatahub: { serviceAccess: declaration, catalogAccess: "old.json" } }, read)).rejects.toThrow("conflict");
+    expect(read).not.toHaveBeenCalled();
+});
+it("loads package data and compatible files, refusing symlinks, oversized data and missing declarations", async () => {
+    const root = await mkdtemp(path.join(tmpdir(), "service-access-package-"));
+    const file = path.join(root, "package.json");
+    try {
+        const save = (reference) => writeFile(file, JSON.stringify(pkg(reference)));
+        await save(declaration);
+        expect(await loadServiceAccessDeclaration(pathToFileURL(file))).toEqual(declaration);
+        await mkdir(path.join(root, "metadata"));
+        await writeFile(path.join(root, "metadata/access.json"), JSON.stringify(declaration));
+        await save("metadata/access.json");
+        expect(await loadServiceAccessDeclaration(file)).toEqual(declaration);
+        await symlink(path.join(root, "metadata"), path.join(root, "linked"));
+        await save("linked/access.json");
+        await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();
+        await save("missing.json");
+        await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();
+        await writeFile(path.join(root, "huge.json"), " ".repeat(65537));
+        await save("huge.json");
+        await expect(loadServiceAccessDeclaration(file)).rejects.toThrow("file_invalid");
+        await writeFile(file, JSON.stringify({ ...pkg(declaration), description: "x".repeat(65536) }));
+        await expect(loadServiceAccessDeclaration(file)).rejects.toThrow("file_invalid");
+        await rm(file);
+        await symlink(path.join(root, "metadata/access.json"), file);
+        await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();
+    }
+    finally {
+        await rm(root, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=service-access-package.test.js.map

package/dist/runtime/service-access-package.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access-package.test.js","sourceRoot":"","sources":["../../src/runtime/service-access-package.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE3F,MAAM,WAAW,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;AAC5G,MAAM,GAAG,GAAG,CAAC,aAAsB,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;AAE5E,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;IACzG,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,+BAA+B,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,CAAC,CAAC,+BAA+B,CAAC,aAAa,CAAC,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5F,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAC1G,iDAAiD,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;IACtE,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACrB,MAAM,MAAM,CAAC,+BAA+B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;AACtC,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;IAC3F,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACrB,MAAM,CAAC,MAAM,+BAA+B,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7F,MAAM,CAAC,MAAM,+BAA+B,CAAC,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjH,MAAM,MAAM,CAAC,+BAA+B,CAAC,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3J,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;AACtC,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,qGAAqG,EAAE,KAAK,IAAI,EAAE;IACnH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,SAAkB,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrF,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,CAAC,MAAM,4BAA4B,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACrF,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QACzC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACtF,MAAM,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,MAAM,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/F,MAAM,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["import { expect, it, vi } from \"vitest\";\nimport { mkdtemp, mkdir, writeFile, symlink, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\n\nimport { loadServiceAccessDeclaration } from \"./service-access-package.js\";\nimport { resolveServiceAccessDeclaration, serviceAccessDigest } from \"./service-access.js\";\n\nconst declaration = { protocol: 1, permissions: { scopes: [\"read:uns\"], accessRules: [\"plant/sensor/#\"] } };\nconst pkg = (serviceAccess: unknown) => ({ unsDatahub: { serviceAccess } });\n\nit(\"normalizes inline/file representations identically without reading a file for inline data\", async () => {\n  const read = vi.fn(async () => declaration);\n  const inline = await resolveServiceAccessDeclaration(pkg(declaration), read);\n  expect(read).not.toHaveBeenCalled();\n  const file = await resolveServiceAccessDeclaration(pkg(\"access.json\"), read);\n  expect(read).toHaveBeenCalledExactlyOnceWith(\"access.json\");\n  expect(inline).toEqual(file);\n  expect(serviceAccessDigest(inline)).toBe(serviceAccessDigest(file));\n});\n\nit.each([null, 42, [], {}, { ...declaration, protocol: 2 }, { ...declaration, approved: true },\n  \"../access.json\", \"/access.json\", \"C:/access.json\", \"a\\\\access.json\", \"a//access.json\", \"./access.json\"])\n(\"fails closed on an invalid package reference %j\", async (reference) => {\n  const read = vi.fn();\n  await expect(resolveServiceAccessDeclaration(pkg(reference), read)).rejects.toThrow();\n  expect(read).not.toHaveBeenCalled();\n});\n\nit(\"keeps absence optional and rejects ambiguous legacy metadata before reading\", async () => {\n  const read = vi.fn();\n  expect(await resolveServiceAccessDeclaration({ name: \"ordinary-service\" }, read)).toBeNull();\n  expect(await resolveServiceAccessDeclaration({ unsDatahub: { catalogAccess: \"legacy.json\" } }, read)).toBeNull();\n  await expect(resolveServiceAccessDeclaration({ unsDatahub: { serviceAccess: declaration, catalogAccess: \"old.json\" } }, read)).rejects.toThrow(\"conflict\");\n  expect(read).not.toHaveBeenCalled();\n});\n\nit(\"loads package data and compatible files, refusing symlinks, oversized data and missing declarations\", async () => {\n  const root = await mkdtemp(path.join(tmpdir(), \"service-access-package-\"));\n  const file = path.join(root, \"package.json\");\n  try {\n    const save = (reference: unknown) => writeFile(file, JSON.stringify(pkg(reference)));\n    await save(declaration);\n    expect(await loadServiceAccessDeclaration(pathToFileURL(file))).toEqual(declaration);\n    await mkdir(path.join(root, \"metadata\"));\n    await writeFile(path.join(root, \"metadata/access.json\"), JSON.stringify(declaration));\n    await save(\"metadata/access.json\");\n    expect(await loadServiceAccessDeclaration(file)).toEqual(declaration);\n    await symlink(path.join(root, \"metadata\"), path.join(root, \"linked\"));\n    await save(\"linked/access.json\");\n    await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();\n    await save(\"missing.json\");\n    await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();\n    await writeFile(path.join(root, \"huge.json\"), \" \".repeat(65537));\n    await save(\"huge.json\");\n    await expect(loadServiceAccessDeclaration(file)).rejects.toThrow(\"file_invalid\");\n    await writeFile(file, JSON.stringify({ ...pkg(declaration), description: \"x\".repeat(65536) }));\n    await expect(loadServiceAccessDeclaration(file)).rejects.toThrow(\"file_invalid\");\n    await rm(file);\n    await symlink(path.join(root, \"metadata/access.json\"), file);\n    await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();\n  } finally {\n    await rm(root, { recursive: true, force: true });\n  }\n});\n"]}

package/dist/runtime/service-access.d.ts

@@ -1,3 +1,4 @@
+import { z } from "zod";
 import { type CatalogPublicationManifest } from "./catalog-publication.js";
 export declare const SERVICE_ACCESS_PROTOCOL = 1;
 export declare const SERVICE_ACCESS_MANIFEST_FIELD = "serviceAccess";
@@ -11,6 +12,31 @@ export type ServiceAccessDeclaration = {
     publications?: CatalogPublicationManifest;
 };
 export declare function parseServiceAccessDeclaration(value: unknown): ServiceAccessDeclaration;
+/** Package metadata accepts one inline declaration or one safe relative JSON
+ * reference. Both normalize through the same parser; neither grants authority. */
+export declare const serviceAccessPackageReferenceSchema: z.ZodUnion<readonly [z.ZodString, z.ZodPipe<z.ZodObject<{
+    protocol: z.ZodLiteral<1>;
+    permissions: z.ZodObject<{
+        scopes: z.ZodArray<z.ZodEnum<{
+            "read:uns": "read:uns";
+            "identity:asset:publish": "identity:asset:publish";
+            "runtime:captures:read": "runtime:captures:read";
+            "runtime:captures:write": "runtime:captures:write";
+            "runtime:triggers:read": "runtime:triggers:read";
+        }>>;
+        accessRules: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    publications: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strict>, z.ZodTransform<ServiceAccessDeclaration, {
+    protocol: 1;
+    permissions: {
+        scopes: ("read:uns" | "identity:asset:publish" | "runtime:captures:read" | "runtime:captures:write" | "runtime:triggers:read")[];
+        accessRules: string[];
+    };
+    publications?: unknown;
+}>>]>;
+export type ServiceAccessPackageReference = string | ServiceAccessDeclaration;
+export declare function resolveServiceAccessDeclaration(packageJson: unknown, readDeclaration: (relativePath: string) => Promise<unknown>): Promise<ServiceAccessDeclaration | null>;
 export declare const serviceAccessDigest: (value: unknown) => string;
 /** Publication source rules are deliberately not raw UNS permissions. A service
  * combining a background reader with a catalog must not gain their cross-product. */

package/dist/runtime/service-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-access.d.ts","sourceRoot":"","sources":["../../src/runtime/service-access.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwB,KAAK,0BAA0B,EAAmC,MAAM,0BAA0B,CAAC;AAGlI,eAAO,MAAM,uBAAuB,IAAI,CAAC;AACzC,eAAO,MAAM,6BAA6B,kBAAkB,CAAC;AAI7D,eAAO,MAAM,uBAAuB,6HAM1B,CAAC;AAaX,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,CAAC,CAAC;IACZ,WAAW,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzD,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C,CAAC;AACF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAQtF;AACD,eAAO,MAAM,mBAAmB,4BAAiB,CAAC;AAClD;qFACqF;AACrF,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,wBAAwB;;;EAKzE;AACD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAU7E"}
+{"version":3,"file":"service-access.d.ts","sourceRoot":"","sources":["../../src/runtime/service-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAwB,KAAK,0BAA0B,EAAmC,MAAM,0BAA0B,CAAC;AAGlI,eAAO,MAAM,uBAAuB,IAAI,CAAC;AACzC,eAAO,MAAM,6BAA6B,kBAAkB,CAAC;AAI7D,eAAO,MAAM,uBAAuB,6HAM1B,CAAC;AAaX,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,CAAC,CAAC;IACZ,WAAW,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzD,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C,CAAC;AACF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAQtF;AAED;kFACkF;AAClF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;KAQ9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,MAAM,GAAG,wBAAwB,CAAC;AAE9E,wBAAsB,+BAA+B,CACnD,WAAW,EAAE,OAAO,EACpB,eAAe,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAC1D,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C;AACD,eAAO,MAAM,mBAAmB,4BAAiB,CAAC;AAClD;qFACqF;AACrF,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,wBAAwB;;;EAKzE;AACD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAU7E"}