@uns-kit/core 3.0.48 → 3.0.49

package/MIGRATIONS.md

@@ -9,6 +9,23 @@ Agents must inspect the application's existing ownership and shutdown flow
 before editing it. The examples below describe the intended behavior, not a
 mechanical search-and-replace operation.
 
+## 3.0.49 - Inline Service access package declarations
+
+Existing file declarations remain compatible; no permission is granted by this
+upgrade. New services may put the declaration object directly at
+`package.json.unsDatahub.serviceAccess`. Use `loadServiceAccessDeclaration` from
+`@uns-kit/core/runtime/service-access-package.js` for runtime reads, or the pure
+resolver/schema from `runtime/service-access.js` for host integrations. Both forms
+normalize to the same semantic digest. Do not declare both `serviceAccess` and
+historical `catalogAccess`.
+
+Inline metadata requires a Controller advertising `rttServiceAccessInline`;
+Controller 2.2.96 accepts only the file form. Keep the file form until the target
+Controller supports inline declarations. This patch does not implement the planned
+configuration-save approval UI or automatic installation grants. Administrator
+review, caller authorization, MQTT ACLs and rotating token use remain separate.
+Both complete examples now use inline metadata and require the matching host.
+
 ## 3.0.48 - Checked Service access documentation and examples
 
 This patch clarifies existing 3.0.47 contracts; no new permission mode or automatic

package/README.md

@@ -95,7 +95,7 @@ const cron = await proc.createCrontabProxy("*/5 * * * *", { event: "tick" });
 
 ## Datahub client (last value + history)
 
-`UnsClient` provides a minimal REST client for the UNS OpenHub API, including batch last-value, single-topic catch-all history, and batch range endpoints. Use `ServiceTokenProvider` for Controller-managed services so credential rotation is picked up on every request. Review the service's declared scopes and resource paths before Start; never cache a managed token at application startup.
+`UnsClient` provides a minimal REST client for the UNS OpenHub API, including batch last-value, single-topic catch-all history, and batch range endpoints. Use `ServiceTokenProvider` for Controller-managed services so credential rotation is picked up on every request. Declare requirements in `package.json.unsDatahub.serviceAccess` (SDK 3.0.49+ and an inline-capable Controller), or retain the compatible JSON file reference. Review the service's declared scopes and resource paths before Start; never cache a managed token at application startup.
 
 Read the [source Service access walkthrough](https://github.com/uns-openhub/uns-kit/blob/master/docs/catalog-publication-access.md)
 or bundled `@uns-kit/core/runtime/service-access-guide.md`. Complete background-reader

package/dist/runtime/service-access-examples/README.md

@@ -4,8 +4,9 @@
 - `catalog-summary/`: a catalog-only caller requests a bounded derived count; the workload has no direct source permission.
 
 Each folder is an independent, credential-free Node.js package. Copy one folder
-to a new project, install dependencies and build. Deploy/review/start with a
-Controller supporting common Service access (verified with Controller 2.2.95).
+to a new project, install dependencies and build. The declarations are inline in package.json (SDK 3.0.49+). Deploy/review/start
+with a Controller advertising rttServiceAccessInline; Controller 2.2.96 requires
+the compatible file form instead.
 The [walkthrough](https://github.com/uns-openhub/uns-kit/blob/master/docs/catalog-publication-access.md)
 explains what the developer, administrator, Controller, SDK and caller each own.
 

package/dist/runtime/service-access-examples/background-reader/README.md

@@ -1,6 +1,6 @@
 # background-reader
 
-A complete Node.js 22+ example using published SDK APIs from 3.0.47 onward.
+A complete Node.js 22+ example using SDK APIs from 3.0.49 onward.
 Read the [Service access walkthrough](https://github.com/uns-openhub/uns-kit/blob/master/docs/catalog-publication-access.md) for the declaration, Controller review and acceptance steps.
 
 ```sh
@@ -23,3 +23,7 @@ This worker has no API or catalog. It polls five minutes of history, at most
 your own test environment; zero rows is a valid result. Its token can read that
 source, while another source must return 403. SIGINT/SIGTERM aborts the current
 request and stops polling before runtime cleanup.
+
+The access declaration is inline in package.json. This representation requires
+Controller capability `rttServiceAccessInline`; it is unsupported by 2.2.96.
+The SDK also accepts a package-relative JSON file reference for older hosts.

package/dist/runtime/service-access-examples/background-reader/package.json

@@ -9,7 +9,6 @@
   "main": "dist/index.js",
   "files": [
     "dist",
-    "service-access.json",
     "config-example.json"
   ],
   "scripts": {
@@ -17,12 +16,22 @@
     "start": "node dist/index.js"
   },
   "dependencies": {
-    "@uns-kit/core": "^3.0.47"
+    "@uns-kit/core": "^3.0.49"
   },
   "unsDatahub": {
     "schemaVersion": 1,
     "kind": "addon",
     "controllerCompatibility": ">=2 <3",
-    "serviceAccess": "service-access.json"
+    "serviceAccess": {
+      "protocol": 1,
+      "permissions": {
+        "scopes": [
+          "read:uns"
+        ],
+        "accessRules": [
+          "example/background/line-1/equipment/main/temperature"
+        ]
+      }
+    }
   }
 }

package/dist/runtime/service-access-examples/background-reader/src/reader.mjs

@@ -1,6 +1,11 @@
 import { ServiceTokenProvider } from "@uns-kit/core/tools/auth/service-token-provider.js";
+import { loadServiceAccessDeclaration } from "@uns-kit/core/runtime/service-access-package.js";
 
-export const sourceTopic = "example/background/line-1/equipment/main/temperature";
+const declaration = await loadServiceAccessDeclaration(new URL("../package.json", import.meta.url));
+if (declaration?.permissions.scopes.length !== 1 || declaration.permissions.scopes[0] !== "read:uns" ||
+    declaration.permissions.accessRules.length !== 1 || /[+#]/.test(declaration.permissions.accessRules[0]))
+  throw new Error("This example requires one exact declared background source.");
+export const sourceTopic = declaration.permissions.accessRules[0];
 
 /** A background API read has a workload identity and no human caller token. */
 export async function readHistory(controllerBase, from, to, { tokenProvider = new ServiceTokenProvider(), fetch: request = fetch, signal } = {}) {

package/dist/runtime/service-access-examples/catalog-summary/README.md

@@ -1,6 +1,6 @@
 # catalog-summary
 
-A complete Node.js 22+ example using published SDK APIs from 3.0.47 onward.
+A complete Node.js 22+ example using SDK APIs from 3.0.49 onward.
 Read the [Service access walkthrough](https://github.com/uns-openhub/uns-kit/blob/master/docs/catalog-publication-access.md) for the declaration, Controller review and acceptance steps.
 
 ```sh
@@ -24,3 +24,7 @@ and approve the publication for the intended audience. Give a test reader access
 to the operation path, not the private source path. Execute a timezone-qualified
 window of at most one hour. Expect {count, hasMore}; raw source fields are excluded.
 A direct source request with the reader or service token must return 403.
+
+The access declaration is inline in package.json. This representation requires
+Controller capability `rttServiceAccessInline`; it is unsupported by 2.2.96.
+The SDK also accepts a package-relative JSON file reference for older hosts.

package/dist/runtime/service-access-examples/catalog-summary/build.mjs

@@ -4,4 +4,4 @@ await rm("dist", { recursive: true, force: true });
 await mkdir("dist");
 await copyFile("src/index.mjs", "dist/index.js");
 await copyFile("src/offer.mjs", "dist/offer.mjs");
-// service-access.json stays at the package root, as declared in package.json.
+// The declaration lives in package.json, which npm always retains.

package/dist/runtime/service-access-examples/catalog-summary/package.json

@@ -9,7 +9,6 @@
   "main": "dist/index.js",
   "files": [
     "dist",
-    "service-access.json",
     "config-example.json"
   ],
   "scripts": {
@@ -17,13 +16,77 @@
     "start": "node dist/index.js"
   },
   "dependencies": {
-    "@uns-kit/core": "^3.0.47",
-    "@uns-kit/api": "^3.0.47"
+    "@uns-kit/core": "^3.0.49",
+    "@uns-kit/api": "^3.0.49"
   },
   "unsDatahub": {
     "schemaVersion": 1,
     "kind": "addon",
     "controllerCompatibility": ">=2 <3",
-    "serviceAccess": "service-access.json"
+    "serviceAccess": {
+      "protocol": 1,
+      "permissions": {
+        "scopes": [],
+        "accessRules": []
+      },
+      "publications": {
+        "protocol": 1,
+        "operations": [
+          {
+            "id": "sample-count",
+            "title": "Temperature sample count",
+            "method": "GET",
+            "path": "/api/example/public/line-1/equipment/dataset/sample-count/json",
+            "mode": "approved-service",
+            "requestSchema": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "from",
+                "to"
+              ],
+              "properties": {
+                "from": {
+                  "type": "string",
+                  "format": "date-time"
+                },
+                "to": {
+                  "type": "string",
+                  "format": "date-time"
+                }
+              }
+            },
+            "responseSchema": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "count",
+                "hasMore"
+              ],
+              "properties": {
+                "count": {
+                  "type": "integer",
+                  "minimum": 0
+                },
+                "hasMore": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "sources": [
+              {
+                "id": "temperature",
+                "kind": "history",
+                "topic": "example/private/line-1/equipment/main/temperature",
+                "maxWindowMs": 3600000,
+                "maxRows": 1000
+              }
+            ],
+            "timeoutMs": 10000,
+            "maxResponseBytes": 4096
+          }
+        ]
+      }
+    }
   }
 }

package/dist/runtime/service-access-examples/catalog-summary/src/index.mjs

@@ -2,8 +2,7 @@ import "@uns-kit/api";
 import { registerApiCatalog } from "@uns-kit/api";
 import { ConfigFile, UnsProxyProcess } from "@uns-kit/core";
 import { CatalogPublicationClient } from "@uns-kit/core/runtime/catalog-publication-client.js";
-import { parseServiceAccessDeclaration } from "@uns-kit/core/runtime/service-access.js";
-import { readFile } from "node:fs/promises";
+import { loadServiceAccessDeclaration } from "@uns-kit/core/runtime/service-access-package.js";
 
 import { createSummaryOffer } from "./offer.mjs";
 
@@ -12,7 +11,8 @@ const required = (key) => {
   if (!value) throw new Error(`Missing managed runtime value: ${key}`);
   return value;
 };
-const declaration = parseServiceAccessDeclaration(JSON.parse(await readFile(new URL("../service-access.json", import.meta.url), "utf8")));
+const declaration = await loadServiceAccessDeclaration(new URL("../package.json", import.meta.url));
+if (!declaration?.publications) throw new Error("Package must declare its catalog operations.");
 const client = new CatalogPublicationClient({
   controllerBase: required("UNS_CONTROLLER_PUBLIC_BASE"),
   rttNode: required("RTT_NODE"),

package/dist/runtime/service-access-guide.md

@@ -1,8 +1,12 @@
 # Service access: from declaration to a running service
 
-For application developers and coding agents using **SDK 3.0.47 or later**.
+For application developers and coding agents using **SDK 3.0.49 or later**.
 Common Service access also requires a matching Controller; these workflows were
-verified with Controller **2.2.95**. SDK installation alone enables no host rights.
+originally verified with Controller **2.2.95** using file declarations. Inline
+package declarations require a Controller advertising `rttServiceAccessInline`.
+Controller 2.2.96 does not support inline declarations. SDK installation alone
+enables no host rights. The configuration-save approval UI is a separate planned
+Controller change; the approval steps below describe the existing released UI.
 
 The developer declares a permission ceiling and uses the SDK. An administrator
 reviews the installed release in **Micro services → instance → Service access**.
@@ -41,16 +45,22 @@ The npm core package also ships this guide at
 to your own directory before installing/building it; do not edit `node_modules`.
 Source code, not repeated prose fragments, is the complete runnable example.
 
-Each `package.json` points at the root declaration and retains it in the artifact:
+For new services, put the declaration directly in `package.json`:
 
 ```json
 {
-  "files": ["dist", "service-access.json", "config-example.json"],
+  "files": ["dist", "config-example.json"],
   "unsDatahub": {
     "schemaVersion": 1,
     "kind": "addon",
     "controllerCompatibility": ">=2 <3",
-    "serviceAccess": "service-access.json"
+    "serviceAccess": {
+      "protocol": 1,
+      "permissions": {
+        "scopes": ["read:uns"],
+        "accessRules": ["example/background/line-1/equipment/main/temperature"]
+      }
+    }
   }
 }
 ```
@@ -60,6 +70,27 @@ real name/version/dependencies/scripts. The SDK is imported as published package
 no copied validators, source overlays or application-name Controller branches.
 Do not declare the historical `catalogAccess` marker alongside `serviceAccess`.
 
+Existing `"serviceAccess": "service-access.json"` references remain supported.
+Retain that file in `files` when using the file form, including for Controllers
+without inline support. Use one representation; the normalized declaration and
+its digest are identical when the content is identical. Neither form contains
+tokens or an administrator's approval.
+
+Runtime code can read the same definition without duplicating it:
+
+```js
+import { loadServiceAccessDeclaration } from '@uns-kit/core/runtime/service-access-package.js';
+const declaration = await loadServiceAccessDeclaration(new URL('../package.json', import.meta.url));
+if (!declaration) throw new Error('Declare the service requirements in package.json.');
+```
+
+This example path is for an entry point directly inside `dist/`. The loader
+reads bounded JSON data; it never imports application code. File references are
+relative to the package, with traversal/symlink escapes rejected. Each JSON file,
+including package.json, is limited to 64 KiB. Host integrations can use the pure
+`resolveServiceAccessDeclaration(packageData, readDeclaration)` with their own
+bounded reader and the exported `serviceAccessPackageReferenceSchema`.
+
 In either copied example:
 
 ```sh
@@ -132,10 +163,10 @@ optional `publications` declaration defines `sample-count`, GET JSON, from/to wi
 a timezone, at most one hour/1000 rows from
 `example/private/line-1/equipment/main/temperature`, and a closed result containing
 only `{count, hasMore}`. The response cap is 4096 bytes. See its complete
-`service-access.json`; the source and response schema are reviewed data.
+`package.json.unsDatahub.serviceAccess`; the source and response schema are reviewed data.
 
 `catalog-summary/src/index.mjs` reads and validates that declaration with
-`parseServiceAccessDeclaration`, then constructs `CatalogPublicationClient` using
+`loadServiceAccessDeclaration`, then constructs `CatalogPublicationClient` using
 the real Controller-injected `RTT_NODE`, `RTT_INSTANCE_ID`, `version` and
 `UNS_CONTROLLER_PUBLIC_BASE`. It configures JWT/JWKS authentication, calls
 `api.registerCatalogRoute()` for the signed installed-launch route lease, and

package/dist/runtime/service-access-package.d.ts

@@ -0,0 +1,6 @@
+import { type ServiceAccessDeclaration } from "./service-access.js";
+/** Read the application's package data without importing application code.
+ * Pass new URL('../package.json', import.meta.url) from a dist entry point.
+ * Referenced declarations stay inside that package and cannot traverse symlinks. */
+export declare function loadServiceAccessDeclaration(packageFile: string | URL): Promise<ServiceAccessDeclaration | null>;
+//# sourceMappingURL=service-access-package.d.ts.map

package/dist/runtime/service-access-package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access-package.d.ts","sourceRoot":"","sources":["../../src/runtime/service-access-package.ts"],"names":[],"mappings":"AAKA,OAAO,EAAmC,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAuBrG;;oFAEoF;AACpF,wBAAsB,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAWtH"}

package/dist/runtime/service-access-package.js

@@ -0,0 +1,45 @@
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveServiceAccessDeclaration } from "./service-access.js";
+const MAX_BYTES = 65536;
+async function readJson(file) {
+    const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size > MAX_BYTES)
+            throw Error("service_access_file_invalid");
+        const buffer = Buffer.alloc(MAX_BYTES + 1);
+        let size = 0;
+        while (size < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, size, buffer.length - size, size);
+            if (!bytesRead)
+                break;
+            size += bytesRead;
+        }
+        if (size > MAX_BYTES)
+            throw Error("service_access_file_invalid");
+        return JSON.parse(buffer.subarray(0, size).toString("utf8"));
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Read the application's package data without importing application code.
+ * Pass new URL('../package.json', import.meta.url) from a dist entry point.
+ * Referenced declarations stay inside that package and cannot traverse symlinks. */
+export async function loadServiceAccessDeclaration(packageFile) {
+    const file = path.resolve(packageFile instanceof URL ? fileURLToPath(packageFile) : packageFile);
+    const root = await realpath(path.dirname(file));
+    return resolveServiceAccessDeclaration(await readJson(path.join(root, path.basename(file))), async (relative) => {
+        let current = root;
+        for (const segment of relative.split("/")) {
+            current = path.join(current, segment);
+            if ((await lstat(current)).isSymbolicLink())
+                throw Error("service_access_file_invalid");
+        }
+        return readJson(current);
+    });
+}
+//# sourceMappingURL=service-access-package.js.map

package/dist/runtime/service-access-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access-package.js","sourceRoot":"","sources":["../../src/runtime/service-access-package.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,+BAA+B,EAAiC,MAAM,qBAAqB,CAAC;AAErG,MAAM,SAAS,GAAG,KAAK,CAAC;AAExB,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;YAClF,IAAI,CAAC,SAAS;gBAAE,MAAM;YACtB,IAAI,IAAI,SAAS,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;oFAEoF;AACpF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,WAAyB;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,YAAY,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,+BAA+B,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC9G,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { constants } from \"node:fs\";\nimport { lstat, open, realpath } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nimport { resolveServiceAccessDeclaration, type ServiceAccessDeclaration } from \"./service-access.js\";\n\nconst MAX_BYTES = 65536;\n\nasync function readJson(file: string): Promise<unknown> {\n  const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);\n  try {\n    const stat = await handle.stat();\n    if (!stat.isFile() || stat.size > MAX_BYTES) throw Error(\"service_access_file_invalid\");\n    const buffer = Buffer.alloc(MAX_BYTES + 1);\n    let size = 0;\n    while (size < buffer.length) {\n      const { bytesRead } = await handle.read(buffer, size, buffer.length - size, size);\n      if (!bytesRead) break;\n      size += bytesRead;\n    }\n    if (size > MAX_BYTES) throw Error(\"service_access_file_invalid\");\n    return JSON.parse(buffer.subarray(0, size).toString(\"utf8\"));\n  } finally {\n    await handle.close();\n  }\n}\n\n/** Read the application's package data without importing application code.\n * Pass new URL('../package.json', import.meta.url) from a dist entry point.\n * Referenced declarations stay inside that package and cannot traverse symlinks. */\nexport async function loadServiceAccessDeclaration(packageFile: string | URL): Promise<ServiceAccessDeclaration | null> {\n  const file = path.resolve(packageFile instanceof URL ? fileURLToPath(packageFile) : packageFile);\n  const root = await realpath(path.dirname(file));\n  return resolveServiceAccessDeclaration(await readJson(path.join(root, path.basename(file))), async (relative) => {\n    let current = root;\n    for (const segment of relative.split(\"/\")) {\n      current = path.join(current, segment);\n      if ((await lstat(current)).isSymbolicLink()) throw Error(\"service_access_file_invalid\");\n    }\n    return readJson(current);\n  });\n}\n"]}

package/dist/runtime/service-access-package.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service-access-package.test.d.ts.map

package/dist/runtime/service-access-package.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access-package.test.d.ts","sourceRoot":"","sources":["../../src/runtime/service-access-package.test.ts"],"names":[],"mappings":""}

package/dist/runtime/service-access-package.test.js

@@ -0,0 +1,61 @@
+import { expect, it, vi } from "vitest";
+import { mkdtemp, mkdir, writeFile, symlink, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { loadServiceAccessDeclaration } from "./service-access-package.js";
+import { resolveServiceAccessDeclaration, serviceAccessDigest } from "./service-access.js";
+const declaration = { protocol: 1, permissions: { scopes: ["read:uns"], accessRules: ["plant/sensor/#"] } };
+const pkg = (serviceAccess) => ({ unsDatahub: { serviceAccess } });
+it("normalizes inline/file representations identically without reading a file for inline data", async () => {
+    const read = vi.fn(async () => declaration);
+    const inline = await resolveServiceAccessDeclaration(pkg(declaration), read);
+    expect(read).not.toHaveBeenCalled();
+    const file = await resolveServiceAccessDeclaration(pkg("access.json"), read);
+    expect(read).toHaveBeenCalledExactlyOnceWith("access.json");
+    expect(inline).toEqual(file);
+    expect(serviceAccessDigest(inline)).toBe(serviceAccessDigest(file));
+});
+it.each([null, 42, [], {}, { ...declaration, protocol: 2 }, { ...declaration, approved: true },
+    "../access.json", "/access.json", "C:/access.json", "a\\access.json", "a//access.json", "./access.json"])("fails closed on an invalid package reference %j", async (reference) => {
+    const read = vi.fn();
+    await expect(resolveServiceAccessDeclaration(pkg(reference), read)).rejects.toThrow();
+    expect(read).not.toHaveBeenCalled();
+});
+it("keeps absence optional and rejects ambiguous legacy metadata before reading", async () => {
+    const read = vi.fn();
+    expect(await resolveServiceAccessDeclaration({ name: "ordinary-service" }, read)).toBeNull();
+    expect(await resolveServiceAccessDeclaration({ unsDatahub: { catalogAccess: "legacy.json" } }, read)).toBeNull();
+    await expect(resolveServiceAccessDeclaration({ unsDatahub: { serviceAccess: declaration, catalogAccess: "old.json" } }, read)).rejects.toThrow("conflict");
+    expect(read).not.toHaveBeenCalled();
+});
+it("loads package data and compatible files, refusing symlinks, oversized data and missing declarations", async () => {
+    const root = await mkdtemp(path.join(tmpdir(), "service-access-package-"));
+    const file = path.join(root, "package.json");
+    try {
+        const save = (reference) => writeFile(file, JSON.stringify(pkg(reference)));
+        await save(declaration);
+        expect(await loadServiceAccessDeclaration(pathToFileURL(file))).toEqual(declaration);
+        await mkdir(path.join(root, "metadata"));
+        await writeFile(path.join(root, "metadata/access.json"), JSON.stringify(declaration));
+        await save("metadata/access.json");
+        expect(await loadServiceAccessDeclaration(file)).toEqual(declaration);
+        await symlink(path.join(root, "metadata"), path.join(root, "linked"));
+        await save("linked/access.json");
+        await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();
+        await save("missing.json");
+        await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();
+        await writeFile(path.join(root, "huge.json"), " ".repeat(65537));
+        await save("huge.json");
+        await expect(loadServiceAccessDeclaration(file)).rejects.toThrow("file_invalid");
+        await writeFile(file, JSON.stringify({ ...pkg(declaration), description: "x".repeat(65536) }));
+        await expect(loadServiceAccessDeclaration(file)).rejects.toThrow("file_invalid");
+        await rm(file);
+        await symlink(path.join(root, "metadata/access.json"), file);
+        await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();
+    }
+    finally {
+        await rm(root, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=service-access-package.test.js.map

package/dist/runtime/service-access-package.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-access-package.test.js","sourceRoot":"","sources":["../../src/runtime/service-access-package.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE3F,MAAM,WAAW,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;AAC5G,MAAM,GAAG,GAAG,CAAC,aAAsB,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;AAE5E,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;IACzG,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,+BAA+B,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,CAAC,CAAC,+BAA+B,CAAC,aAAa,CAAC,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5F,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAC1G,iDAAiD,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;IACtE,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACrB,MAAM,MAAM,CAAC,+BAA+B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;AACtC,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;IAC3F,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACrB,MAAM,CAAC,MAAM,+BAA+B,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7F,MAAM,CAAC,MAAM,+BAA+B,CAAC,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjH,MAAM,MAAM,CAAC,+BAA+B,CAAC,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3J,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;AACtC,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,qGAAqG,EAAE,KAAK,IAAI,EAAE;IACnH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,SAAkB,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrF,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,CAAC,MAAM,4BAA4B,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACrF,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QACzC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACtF,MAAM,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,MAAM,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/F,MAAM,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["import { expect, it, vi } from \"vitest\";\nimport { mkdtemp, mkdir, writeFile, symlink, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\n\nimport { loadServiceAccessDeclaration } from \"./service-access-package.js\";\nimport { resolveServiceAccessDeclaration, serviceAccessDigest } from \"./service-access.js\";\n\nconst declaration = { protocol: 1, permissions: { scopes: [\"read:uns\"], accessRules: [\"plant/sensor/#\"] } };\nconst pkg = (serviceAccess: unknown) => ({ unsDatahub: { serviceAccess } });\n\nit(\"normalizes inline/file representations identically without reading a file for inline data\", async () => {\n  const read = vi.fn(async () => declaration);\n  const inline = await resolveServiceAccessDeclaration(pkg(declaration), read);\n  expect(read).not.toHaveBeenCalled();\n  const file = await resolveServiceAccessDeclaration(pkg(\"access.json\"), read);\n  expect(read).toHaveBeenCalledExactlyOnceWith(\"access.json\");\n  expect(inline).toEqual(file);\n  expect(serviceAccessDigest(inline)).toBe(serviceAccessDigest(file));\n});\n\nit.each([null, 42, [], {}, { ...declaration, protocol: 2 }, { ...declaration, approved: true },\n  \"../access.json\", \"/access.json\", \"C:/access.json\", \"a\\\\access.json\", \"a//access.json\", \"./access.json\"])\n(\"fails closed on an invalid package reference %j\", async (reference) => {\n  const read = vi.fn();\n  await expect(resolveServiceAccessDeclaration(pkg(reference), read)).rejects.toThrow();\n  expect(read).not.toHaveBeenCalled();\n});\n\nit(\"keeps absence optional and rejects ambiguous legacy metadata before reading\", async () => {\n  const read = vi.fn();\n  expect(await resolveServiceAccessDeclaration({ name: \"ordinary-service\" }, read)).toBeNull();\n  expect(await resolveServiceAccessDeclaration({ unsDatahub: { catalogAccess: \"legacy.json\" } }, read)).toBeNull();\n  await expect(resolveServiceAccessDeclaration({ unsDatahub: { serviceAccess: declaration, catalogAccess: \"old.json\" } }, read)).rejects.toThrow(\"conflict\");\n  expect(read).not.toHaveBeenCalled();\n});\n\nit(\"loads package data and compatible files, refusing symlinks, oversized data and missing declarations\", async () => {\n  const root = await mkdtemp(path.join(tmpdir(), \"service-access-package-\"));\n  const file = path.join(root, \"package.json\");\n  try {\n    const save = (reference: unknown) => writeFile(file, JSON.stringify(pkg(reference)));\n    await save(declaration);\n    expect(await loadServiceAccessDeclaration(pathToFileURL(file))).toEqual(declaration);\n    await mkdir(path.join(root, \"metadata\"));\n    await writeFile(path.join(root, \"metadata/access.json\"), JSON.stringify(declaration));\n    await save(\"metadata/access.json\");\n    expect(await loadServiceAccessDeclaration(file)).toEqual(declaration);\n    await symlink(path.join(root, \"metadata\"), path.join(root, \"linked\"));\n    await save(\"linked/access.json\");\n    await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();\n    await save(\"missing.json\");\n    await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();\n    await writeFile(path.join(root, \"huge.json\"), \" \".repeat(65537));\n    await save(\"huge.json\");\n    await expect(loadServiceAccessDeclaration(file)).rejects.toThrow(\"file_invalid\");\n    await writeFile(file, JSON.stringify({ ...pkg(declaration), description: \"x\".repeat(65536) }));\n    await expect(loadServiceAccessDeclaration(file)).rejects.toThrow(\"file_invalid\");\n    await rm(file);\n    await symlink(path.join(root, \"metadata/access.json\"), file);\n    await expect(loadServiceAccessDeclaration(file)).rejects.toThrow();\n  } finally {\n    await rm(root, { recursive: true, force: true });\n  }\n});\n"]}

package/dist/runtime/service-access.d.ts

@@ -1,3 +1,4 @@
+import { z } from "zod";
 import { type CatalogPublicationManifest } from "./catalog-publication.js";
 export declare const SERVICE_ACCESS_PROTOCOL = 1;
 export declare const SERVICE_ACCESS_MANIFEST_FIELD = "serviceAccess";
@@ -11,6 +12,31 @@ export type ServiceAccessDeclaration = {
     publications?: CatalogPublicationManifest;
 };
 export declare function parseServiceAccessDeclaration(value: unknown): ServiceAccessDeclaration;
+/** Package metadata accepts one inline declaration or one safe relative JSON
+ * reference. Both normalize through the same parser; neither grants authority. */
+export declare const serviceAccessPackageReferenceSchema: z.ZodUnion<readonly [z.ZodString, z.ZodPipe<z.ZodObject<{
+    protocol: z.ZodLiteral<1>;
+    permissions: z.ZodObject<{
+        scopes: z.ZodArray<z.ZodEnum<{
+            "read:uns": "read:uns";
+            "identity:asset:publish": "identity:asset:publish";
+            "runtime:captures:read": "runtime:captures:read";
+            "runtime:captures:write": "runtime:captures:write";
+            "runtime:triggers:read": "runtime:triggers:read";
+        }>>;
+        accessRules: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    publications: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strict>, z.ZodTransform<ServiceAccessDeclaration, {
+    protocol: 1;
+    permissions: {
+        scopes: ("read:uns" | "identity:asset:publish" | "runtime:captures:read" | "runtime:captures:write" | "runtime:triggers:read")[];
+        accessRules: string[];
+    };
+    publications?: unknown;
+}>>]>;
+export type ServiceAccessPackageReference = string | ServiceAccessDeclaration;
+export declare function resolveServiceAccessDeclaration(packageJson: unknown, readDeclaration: (relativePath: string) => Promise<unknown>): Promise<ServiceAccessDeclaration | null>;
 export declare const serviceAccessDigest: (value: unknown) => string;
 /** Publication source rules are deliberately not raw UNS permissions. A service
  * combining a background reader with a catalog must not gain their cross-product. */

package/dist/runtime/service-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-access.d.ts","sourceRoot":"","sources":["../../src/runtime/service-access.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwB,KAAK,0BAA0B,EAAmC,MAAM,0BAA0B,CAAC;AAGlI,eAAO,MAAM,uBAAuB,IAAI,CAAC;AACzC,eAAO,MAAM,6BAA6B,kBAAkB,CAAC;AAI7D,eAAO,MAAM,uBAAuB,6HAM1B,CAAC;AAaX,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,CAAC,CAAC;IACZ,WAAW,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzD,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C,CAAC;AACF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAQtF;AACD,eAAO,MAAM,mBAAmB,4BAAiB,CAAC;AAClD;qFACqF;AACrF,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,wBAAwB;;;EAKzE;AACD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAU7E"}
+{"version":3,"file":"service-access.d.ts","sourceRoot":"","sources":["../../src/runtime/service-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAwB,KAAK,0BAA0B,EAAmC,MAAM,0BAA0B,CAAC;AAGlI,eAAO,MAAM,uBAAuB,IAAI,CAAC;AACzC,eAAO,MAAM,6BAA6B,kBAAkB,CAAC;AAI7D,eAAO,MAAM,uBAAuB,6HAM1B,CAAC;AAaX,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,CAAC,CAAC;IACZ,WAAW,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzD,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C,CAAC;AACF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAQtF;AAED;kFACkF;AAClF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;KAQ9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,MAAM,GAAG,wBAAwB,CAAC;AAE9E,wBAAsB,+BAA+B,CACnD,WAAW,EAAE,OAAO,EACpB,eAAe,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAC1D,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C;AACD,eAAO,MAAM,mBAAmB,4BAAiB,CAAC;AAClD;qFACqF;AACrF,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,wBAAwB;;;EAKzE;AACD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAU7E"}

package/dist/runtime/service-access.js

@@ -36,6 +36,29 @@ export function parseServiceAccessDeclaration(value) {
         throw Error("service_access_capability_required");
     return { protocol: 1, permissions, ...(publications ? { publications } : {}) };
 }
+/** Package metadata accepts one inline declaration or one safe relative JSON
+ * reference. Both normalize through the same parser; neither grants authority. */
+export const serviceAccessPackageReferenceSchema = z.union([
+    z.string().min(1).max(512).refine((value) => !value.includes("\\") && !value.startsWith("/") &&
+        !/^[A-Za-z]:/.test(value) &&
+        value.split("/").every((part) => !!part && part !== "." && part !== ".."), "Expected a package-relative declaration path"),
+    envelope.transform(parseServiceAccessDeclaration),
+]);
+export async function resolveServiceAccessDeclaration(packageJson, readDeclaration) {
+    const pkg = z.object({
+        unsDatahub: z.object({
+            serviceAccess: z.unknown().optional(),
+            catalogAccess: z.unknown().optional(),
+        }).passthrough().optional(),
+    }).passthrough().parse(packageJson);
+    const metadata = pkg.unsDatahub;
+    if (metadata?.serviceAccess === undefined)
+        return null;
+    if (metadata.catalogAccess !== undefined)
+        throw Error("service_access_declaration_conflict");
+    const reference = serviceAccessPackageReferenceSchema.parse(metadata.serviceAccess);
+    return parseServiceAccessDeclaration(typeof reference === "string" ? await readDeclaration(reference) : reference);
+}
 export const serviceAccessDigest = operatorDigest;
 /** Publication source rules are deliberately not raw UNS permissions. A service
  * combining a background reader with a catalog must not gain their cross-product. */

package/dist/runtime/service-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-access.js","sourceRoot":"","sources":["../../src/runtime/service-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAmC,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAClI,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG,eAAe,CAAC;AAC7D,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU;IACV,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,uBAAuB;CACf,CAAC;AACX,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/H,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/H,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,YAAY,CAAC,KAAK,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACjJ,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvH,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1H,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnG,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AACD,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAClD;qFACqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,WAAqC;IACxE,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAC/G,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC;KACtD,CAAC;AACJ,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,OAAe;IAClE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAC1B,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AACxB,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { CATALOG_SOURCE_SCOPE, type CatalogPublicationManifest, parseCatalogPublicationManifest } from \"./catalog-publication.js\";\nimport { operatorDigest, operatorJson } from \"./operator-api.js\";\n\nexport const SERVICE_ACCESS_PROTOCOL = 1;\nexport const SERVICE_ACCESS_MANIFEST_FIELD = \"serviceAccess\";\n// Only existing platform data/runtime capabilities. Administrative authority is\n// never a package-requestable scope. UNS rules bound direct UNS reads; other\n// runtime capabilities retain their existing platform authorization semantics.\nexport const SERVICE_RESOURCE_SCOPES = [\n  \"read:uns\",\n  \"identity:asset:publish\",\n  \"runtime:captures:read\",\n  \"runtime:captures:write\",\n  \"runtime:triggers:read\",\n] as const;\nconst rule = z\n  .string()\n  .min(1)\n  .max(512)\n  .refine((s) => s.split(\"/\").every((p, i, a) => p === \"+\" || (p === \"#\" && i === a.length - 1) || /^[A-Za-z0-9-]+$/.test(p)));\nconst envelope = z\n  .object({\n    protocol: z.literal(1),\n    permissions: z.object({ scopes: z.array(z.enum(SERVICE_RESOURCE_SCOPES)).max(5), accessRules: z.array(rule).max(64) }).strict(),\n    publications: z.unknown().optional(),\n  })\n  .strict();\nexport type ServiceAccessDeclaration = {\n  protocol: 1;\n  permissions: { scopes: string[]; accessRules: string[] };\n  publications?: CatalogPublicationManifest;\n};\nexport function parseServiceAccessDeclaration(value: unknown): ServiceAccessDeclaration {\n  operatorJson(value);\n  const parsed = envelope.parse(value);\n  const permissions = { scopes: [...new Set(parsed.permissions.scopes)].sort(), accessRules: [...new Set(parsed.permissions.accessRules)].sort() };\n  if (!!permissions.scopes.length !== !!permissions.accessRules.length) throw Error(\"service_access_resources_required\");\n  const publications = parsed.publications === undefined ? undefined : parseCatalogPublicationManifest(parsed.publications);\n  if (!permissions.scopes.length && !publications) throw Error(\"service_access_capability_required\");\n  return { protocol: 1, permissions, ...(publications ? { publications } : {}) };\n}\nexport const serviceAccessDigest = operatorDigest;\n/** Publication source rules are deliberately not raw UNS permissions. A service\n * combining a background reader with a catalog must not gain their cross-product. */\nexport function serviceAccessCeiling(declaration: ServiceAccessDeclaration) {\n  return {\n    scopes: [...declaration.permissions.scopes, ...(declaration.publications ? [CATALOG_SOURCE_SCOPE] : [])].sort(),\n    accessRules: [...declaration.permissions.accessRules],\n  };\n}\n/** Conservative MQTT filter inclusion, not matching a filter as if it were data. */\nexport function serviceRuleWithin(requested: string, allowed: string): boolean {\n  const a = allowed.split(\"/\"),\n    r = requested.split(\"/\");\n  let i = 0;\n  for (; i < a.length; i++) {\n    if (a[i] === \"#\") return true;\n    if (r[i] === undefined || r[i] === \"#\") return false;\n    if (a[i] !== r[i] && a[i] !== \"+\") return false;\n  }\n  return i === r.length;\n}\n"]}
+{"version":3,"file":"service-access.js","sourceRoot":"","sources":["../../src/runtime/service-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAmC,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAClI,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG,eAAe,CAAC;AAC7D,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU;IACV,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,uBAAuB;CACf,CAAC;AACX,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/H,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/H,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,YAAY,CAAC,KAAK,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACjJ,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvH,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1H,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnG,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;kFACkF;AAClF,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC;IACzD,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACxD,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QACzB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EAC3E,8CAA8C,CAC/C;IACD,QAAQ,CAAC,SAAS,CAAC,6BAA6B,CAAC;CAClD,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,WAAoB,EACpB,eAA2D;IAE3D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACnB,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACrC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SACtC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC;IAChC,IAAI,QAAQ,EAAE,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS;QAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,mCAAmC,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACpF,OAAO,6BAA6B,CAClC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAC7E,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAClD;qFACqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,WAAqC;IACxE,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAC/G,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC;KACtD,CAAC;AACJ,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,OAAe;IAClE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAC1B,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AACxB,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { CATALOG_SOURCE_SCOPE, type CatalogPublicationManifest, parseCatalogPublicationManifest } from \"./catalog-publication.js\";\nimport { operatorDigest, operatorJson } from \"./operator-api.js\";\n\nexport const SERVICE_ACCESS_PROTOCOL = 1;\nexport const SERVICE_ACCESS_MANIFEST_FIELD = \"serviceAccess\";\n// Only existing platform data/runtime capabilities. Administrative authority is\n// never a package-requestable scope. UNS rules bound direct UNS reads; other\n// runtime capabilities retain their existing platform authorization semantics.\nexport const SERVICE_RESOURCE_SCOPES = [\n  \"read:uns\",\n  \"identity:asset:publish\",\n  \"runtime:captures:read\",\n  \"runtime:captures:write\",\n  \"runtime:triggers:read\",\n] as const;\nconst rule = z\n  .string()\n  .min(1)\n  .max(512)\n  .refine((s) => s.split(\"/\").every((p, i, a) => p === \"+\" || (p === \"#\" && i === a.length - 1) || /^[A-Za-z0-9-]+$/.test(p)));\nconst envelope = z\n  .object({\n    protocol: z.literal(1),\n    permissions: z.object({ scopes: z.array(z.enum(SERVICE_RESOURCE_SCOPES)).max(5), accessRules: z.array(rule).max(64) }).strict(),\n    publications: z.unknown().optional(),\n  })\n  .strict();\nexport type ServiceAccessDeclaration = {\n  protocol: 1;\n  permissions: { scopes: string[]; accessRules: string[] };\n  publications?: CatalogPublicationManifest;\n};\nexport function parseServiceAccessDeclaration(value: unknown): ServiceAccessDeclaration {\n  operatorJson(value);\n  const parsed = envelope.parse(value);\n  const permissions = { scopes: [...new Set(parsed.permissions.scopes)].sort(), accessRules: [...new Set(parsed.permissions.accessRules)].sort() };\n  if (!!permissions.scopes.length !== !!permissions.accessRules.length) throw Error(\"service_access_resources_required\");\n  const publications = parsed.publications === undefined ? undefined : parseCatalogPublicationManifest(parsed.publications);\n  if (!permissions.scopes.length && !publications) throw Error(\"service_access_capability_required\");\n  return { protocol: 1, permissions, ...(publications ? { publications } : {}) };\n}\n\n/** Package metadata accepts one inline declaration or one safe relative JSON\n * reference. Both normalize through the same parser; neither grants authority. */\nexport const serviceAccessPackageReferenceSchema = z.union([\n  z.string().min(1).max(512).refine(\n    (value) => !value.includes(\"\\\\\") && !value.startsWith(\"/\") &&\n      !/^[A-Za-z]:/.test(value) &&\n      value.split(\"/\").every((part) => !!part && part !== \".\" && part !== \"..\"),\n    \"Expected a package-relative declaration path\",\n  ),\n  envelope.transform(parseServiceAccessDeclaration),\n]);\n\nexport type ServiceAccessPackageReference = string | ServiceAccessDeclaration;\n\nexport async function resolveServiceAccessDeclaration(\n  packageJson: unknown,\n  readDeclaration: (relativePath: string) => Promise<unknown>,\n): Promise<ServiceAccessDeclaration | null> {\n  const pkg = z.object({\n    unsDatahub: z.object({\n      serviceAccess: z.unknown().optional(),\n      catalogAccess: z.unknown().optional(),\n    }).passthrough().optional(),\n  }).passthrough().parse(packageJson);\n  const metadata = pkg.unsDatahub;\n  if (metadata?.serviceAccess === undefined) return null;\n  if (metadata.catalogAccess !== undefined) throw Error(\"service_access_declaration_conflict\");\n  const reference = serviceAccessPackageReferenceSchema.parse(metadata.serviceAccess);\n  return parseServiceAccessDeclaration(\n    typeof reference === \"string\" ? await readDeclaration(reference) : reference,\n  );\n}\nexport const serviceAccessDigest = operatorDigest;\n/** Publication source rules are deliberately not raw UNS permissions. A service\n * combining a background reader with a catalog must not gain their cross-product. */\nexport function serviceAccessCeiling(declaration: ServiceAccessDeclaration) {\n  return {\n    scopes: [...declaration.permissions.scopes, ...(declaration.publications ? [CATALOG_SOURCE_SCOPE] : [])].sort(),\n    accessRules: [...declaration.permissions.accessRules],\n  };\n}\n/** Conservative MQTT filter inclusion, not matching a filter as if it were data. */\nexport function serviceRuleWithin(requested: string, allowed: string): boolean {\n  const a = allowed.split(\"/\"),\n    r = requested.split(\"/\");\n  let i = 0;\n  for (; i < a.length; i++) {\n    if (a[i] === \"#\") return true;\n    if (r[i] === undefined || r[i] === \"#\") return false;\n    if (a[i] !== r[i] && a[i] !== \"+\") return false;\n  }\n  return i === r.length;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uns-kit/core",
-  "version": "3.0.48",
+  "version": "3.0.49",
   "description": "Core utilities and runtime building blocks for UNS-based realtime transformers.",
   "type": "module",
   "license": "MIT",

package/dist/runtime/service-access-examples/background-reader/service-access.json

@@ -1,11 +0,0 @@
-{
-  "protocol": 1,
-  "permissions": {
-    "scopes": [
-      "read:uns"
-    ],
-    "accessRules": [
-      "example/background/line-1/equipment/main/temperature"
-    ]
-  }
-}

package/dist/runtime/service-access-examples/catalog-summary/service-access.json

@@ -1,65 +0,0 @@
-{
-  "protocol": 1,
-  "permissions": {
-    "scopes": [],
-    "accessRules": []
-  },
-  "publications": {
-    "protocol": 1,
-    "operations": [
-      {
-        "id": "sample-count",
-        "title": "Temperature sample count",
-        "method": "GET",
-        "path": "/api/example/public/line-1/equipment/dataset/sample-count/json",
-        "mode": "approved-service",
-        "requestSchema": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": [
-            "from",
-            "to"
-          ],
-          "properties": {
-            "from": {
-              "type": "string",
-              "format": "date-time"
-            },
-            "to": {
-              "type": "string",
-              "format": "date-time"
-            }
-          }
-        },
-        "responseSchema": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": [
-            "count",
-            "hasMore"
-          ],
-          "properties": {
-            "count": {
-              "type": "integer",
-              "minimum": 0
-            },
-            "hasMore": {
-              "type": "boolean"
-            }
-          }
-        },
-        "sources": [
-          {
-            "id": "temperature",
-            "kind": "history",
-            "topic": "example/private/line-1/equipment/main/temperature",
-            "maxWindowMs": 3600000,
-            "maxRows": 1000
-          }
-        ],
-        "timeoutMs": 10000,
-        "maxResponseBytes": 4096
-      }
-    ]
-  }
-}