@xemahq/contracts 0.70.0 → 0.72.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.source-stamp.json +2 -2
- package/dist/authorization-module/lib/platform-authorization-modules.d.ts.map +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.js +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.js.map +1 -1
- package/dist/authorization-module/platform/xema_capability.fga +4 -2
- package/dist/authorization-module/platform/xema_capability.fga.yaml +10 -0
- package/dist/authorization-module/platform/xema_core.fga +25 -5
- package/dist/authorization-module/platform/xema_core.fga.yaml +121 -0
- package/dist/authzen/lib/org-authority-contextual-tuple.d.ts +17 -0
- package/dist/authzen/lib/org-authority-contextual-tuple.d.ts.map +1 -1
- package/dist/authzen/lib/org-authority-contextual-tuple.js +66 -8
- package/dist/authzen/lib/org-authority-contextual-tuple.js.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.d.ts.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.js.map +1 -1
- package/dist/biome/lib/biome-component-process-facts.d.ts.map +1 -1
- package/dist/biome/lib/biome-component-process-facts.js.map +1 -1
- package/dist/biome/lib/biome-component.d.ts +5 -0
- package/dist/biome/lib/biome-component.d.ts.map +1 -1
- package/dist/biome/lib/biome-component.js +9 -2
- package/dist/biome/lib/biome-component.js.map +1 -1
- package/dist/biome/lib/biome-manifest.d.ts +6 -0
- package/dist/biome/lib/biome-manifest.d.ts.map +1 -1
- package/dist/biome/lib/biome-manifest.js +6 -10
- package/dist/biome/lib/biome-manifest.js.map +1 -1
- package/dist/biome/xema-biome.schema.json +10 -0
- package/dist/deployment/index.d.ts +3 -0
- package/dist/deployment/index.d.ts.map +1 -1
- package/dist/deployment/index.js +3 -0
- package/dist/deployment/index.js.map +1 -1
- package/dist/deployment/lib/artifact-signer-trust.d.ts +60 -0
- package/dist/deployment/lib/artifact-signer-trust.d.ts.map +1 -0
- package/dist/deployment/lib/artifact-signer-trust.js +154 -0
- package/dist/deployment/lib/artifact-signer-trust.js.map +1 -0
- package/dist/deployment/lib/resolved-deployment.d.ts +38 -0
- package/dist/deployment/lib/resolved-deployment.d.ts.map +1 -0
- package/dist/deployment/lib/resolved-deployment.js +103 -0
- package/dist/deployment/lib/resolved-deployment.js.map +1 -0
- package/dist/deployment/lib/trust-domain.d.ts +3 -0
- package/dist/deployment/lib/trust-domain.d.ts.map +1 -1
- package/dist/deployment/lib/trust-domain.js +17 -1
- package/dist/deployment/lib/trust-domain.js.map +1 -1
- package/dist/deployment/lib/trust-partition.d.ts +28 -0
- package/dist/deployment/lib/trust-partition.d.ts.map +1 -0
- package/dist/deployment/lib/trust-partition.js +93 -0
- package/dist/deployment/lib/trust-partition.js.map +1 -0
- package/dist/distribution/index.d.ts +2 -0
- package/dist/distribution/index.d.ts.map +1 -1
- package/dist/distribution/index.js +1 -0
- package/dist/distribution/index.js.map +1 -1
- package/dist/distribution/lib/distribution-lock.d.ts +36 -1
- package/dist/distribution/lib/distribution-lock.d.ts.map +1 -1
- package/dist/distribution/lib/distribution-lock.js +171 -3
- package/dist/distribution/lib/distribution-lock.js.map +1 -1
- package/dist/distribution/lib/distribution.d.ts +2 -0
- package/dist/distribution/lib/distribution.d.ts.map +1 -1
- package/dist/distribution/lib/distribution.js +2 -0
- package/dist/distribution/lib/distribution.js.map +1 -1
- package/dist/distribution/lib/nexus-endpoint-specs.d.ts +1 -0
- package/dist/distribution/lib/nexus-endpoint-specs.d.ts.map +1 -1
- package/dist/distribution/lib/nexus-endpoint-specs.js +4 -4
- package/dist/distribution/lib/nexus-endpoint-specs.js.map +1 -1
- package/dist/distribution/lib/verified-resolved-deployment.d.ts +7 -0
- package/dist/distribution/lib/verified-resolved-deployment.d.ts.map +1 -0
- package/dist/distribution/lib/verified-resolved-deployment.js +3 -0
- package/dist/distribution/lib/verified-resolved-deployment.js.map +1 -0
- package/dist/distribution/lib/verify-resolved-deployment.d.ts +30 -0
- package/dist/distribution/lib/verify-resolved-deployment.d.ts.map +1 -0
- package/dist/distribution/lib/verify-resolved-deployment.js +117 -0
- package/dist/distribution/lib/verify-resolved-deployment.js.map +1 -0
- package/dist/process-topology/lib/process-topology.d.ts +18 -2
- package/dist/process-topology/lib/process-topology.d.ts.map +1 -1
- package/dist/process-topology/lib/process-topology.js +43 -2
- package/dist/process-topology/lib/process-topology.js.map +1 -1
- package/dist/process-topology/lib/resolve-process-topology.d.ts +3 -0
- package/dist/process-topology/lib/resolve-process-topology.d.ts.map +1 -1
- package/dist/process-topology/lib/resolve-process-topology.js +32 -3
- package/dist/process-topology/lib/resolve-process-topology.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,117 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.ResolvedDeploymentRefusalCode = void 0;
|
|
4
|
+
exports.verifyResolvedDeployment = verifyResolvedDeployment;
|
|
5
|
+
exports.assertResolvedDeployment = assertResolvedDeployment;
|
|
6
|
+
const content_address_1 = require("../../content-address");
|
|
7
|
+
const deployment_1 = require("../../deployment");
|
|
8
|
+
const process_topology_1 = require("../../process-topology");
|
|
9
|
+
const distribution_lock_1 = require("./distribution-lock");
|
|
10
|
+
var ResolvedDeploymentRefusalCode;
|
|
11
|
+
(function (ResolvedDeploymentRefusalCode) {
|
|
12
|
+
ResolvedDeploymentRefusalCode["MalformedArtifact"] = "malformed-artifact";
|
|
13
|
+
ResolvedDeploymentRefusalCode["LockDigestMismatch"] = "lock-digest-mismatch";
|
|
14
|
+
ResolvedDeploymentRefusalCode["MalformedLock"] = "malformed-lock";
|
|
15
|
+
ResolvedDeploymentRefusalCode["BiomeMissing"] = "biome-missing";
|
|
16
|
+
ResolvedDeploymentRefusalCode["BiomeNotInLock"] = "biome-not-in-lock";
|
|
17
|
+
ResolvedDeploymentRefusalCode["TrustCeilingMismatch"] = "trust-ceiling-mismatch";
|
|
18
|
+
ResolvedDeploymentRefusalCode["UnknownComponent"] = "unknown-component";
|
|
19
|
+
})(ResolvedDeploymentRefusalCode || (exports.ResolvedDeploymentRefusalCode = ResolvedDeploymentRefusalCode = {}));
|
|
20
|
+
async function verifyResolvedDeployment(resolved, lockBytes) {
|
|
21
|
+
const parsed = deployment_1.ResolvedDeploymentSchema.safeParse(resolved);
|
|
22
|
+
if (!parsed.success) {
|
|
23
|
+
return refuse({
|
|
24
|
+
code: ResolvedDeploymentRefusalCode.MalformedArtifact,
|
|
25
|
+
message: `the resolved deployment does not parse: ` +
|
|
26
|
+
parsed.error.issues
|
|
27
|
+
.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`)
|
|
28
|
+
.join('; '),
|
|
29
|
+
});
|
|
30
|
+
}
|
|
31
|
+
const artifact = parsed.data;
|
|
32
|
+
const digest = await (0, content_address_1.sha256Hex)(lockBytes);
|
|
33
|
+
if (digest !== artifact.edition.lockSha256) {
|
|
34
|
+
return refuse({
|
|
35
|
+
code: ResolvedDeploymentRefusalCode.LockDigestMismatch,
|
|
36
|
+
message: `the lock bytes hash to ${digest}, but the resolved deployment was resolved from ` +
|
|
37
|
+
`${artifact.edition.lockSha256}; it is not this lock's resolution.`,
|
|
38
|
+
});
|
|
39
|
+
}
|
|
40
|
+
let lock;
|
|
41
|
+
try {
|
|
42
|
+
lock = (0, distribution_lock_1.parseDistributionLockForReading)(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(lockBytes)));
|
|
43
|
+
}
|
|
44
|
+
catch (error) {
|
|
45
|
+
return refuse({
|
|
46
|
+
code: ResolvedDeploymentRefusalCode.MalformedLock,
|
|
47
|
+
message: `the lock bytes are not a readable distribution lock: ${error.message}`,
|
|
48
|
+
});
|
|
49
|
+
}
|
|
50
|
+
const refusals = [];
|
|
51
|
+
const lockBiomes = new Map(lock.biomes.map((biome) => [biome.id, biome]));
|
|
52
|
+
const placed = new Set(artifact.biomes.map((biome) => biome.id));
|
|
53
|
+
for (const id of [...lockBiomes.keys()].sort(codeUnit)) {
|
|
54
|
+
if (!placed.has(id)) {
|
|
55
|
+
refusals.push({
|
|
56
|
+
code: ResolvedDeploymentRefusalCode.BiomeMissing,
|
|
57
|
+
biome: id,
|
|
58
|
+
message: `the lock carries biome "${id}", but the resolved deployment does not place it.`,
|
|
59
|
+
});
|
|
60
|
+
}
|
|
61
|
+
}
|
|
62
|
+
for (const biome of artifact.biomes) {
|
|
63
|
+
const locked = lockBiomes.get(biome.id);
|
|
64
|
+
if (locked === undefined) {
|
|
65
|
+
refusals.push({
|
|
66
|
+
code: ResolvedDeploymentRefusalCode.BiomeNotInLock,
|
|
67
|
+
biome: biome.id,
|
|
68
|
+
message: `the resolved deployment places biome "${biome.id}", which the lock does not carry.`,
|
|
69
|
+
});
|
|
70
|
+
continue;
|
|
71
|
+
}
|
|
72
|
+
const stated = 'trustCeiling' in locked ? locked.trustCeiling : undefined;
|
|
73
|
+
const ceiling = stated ?? (0, process_topology_1.defaultTrustDomain)(locked.id, locked.origin);
|
|
74
|
+
if (biome.trustCeiling !== ceiling) {
|
|
75
|
+
refusals.push({
|
|
76
|
+
code: ResolvedDeploymentRefusalCode.TrustCeilingMismatch,
|
|
77
|
+
biome: biome.id,
|
|
78
|
+
message: `the resolved deployment states biome "${biome.id}"'s trust ceiling as ` +
|
|
79
|
+
`"${biome.trustCeiling}", but the lock's is "${ceiling}".`,
|
|
80
|
+
});
|
|
81
|
+
}
|
|
82
|
+
}
|
|
83
|
+
for (const account of artifact.serviceAccounts) {
|
|
84
|
+
for (const { biome, component } of account.actsFor) {
|
|
85
|
+
const locked = lockBiomes.get(biome);
|
|
86
|
+
if (locked === undefined || locked.services.includes(component))
|
|
87
|
+
continue;
|
|
88
|
+
refusals.push({
|
|
89
|
+
code: ResolvedDeploymentRefusalCode.UnknownComponent,
|
|
90
|
+
biome,
|
|
91
|
+
serviceAccount: account.name,
|
|
92
|
+
message: `ServiceAccount "${account.name}" acts for ${biome}/${component}, but the lock's ` +
|
|
93
|
+
`biome "${biome}" ships no component "${component}".`,
|
|
94
|
+
});
|
|
95
|
+
}
|
|
96
|
+
}
|
|
97
|
+
if (refusals.length > 0)
|
|
98
|
+
return { ok: false, refusals };
|
|
99
|
+
return { ok: true, resolved: artifact, lock };
|
|
100
|
+
}
|
|
101
|
+
async function assertResolvedDeployment(resolved, lockBytes) {
|
|
102
|
+
const verification = await verifyResolvedDeployment(resolved, lockBytes);
|
|
103
|
+
if (!verification.ok) {
|
|
104
|
+
throw new Error(`resolved deployment is refused:\n` +
|
|
105
|
+
verification.refusals
|
|
106
|
+
.map((refusal) => ` - [${refusal.code}] ${refusal.message}`)
|
|
107
|
+
.join('\n'));
|
|
108
|
+
}
|
|
109
|
+
return { resolved: verification.resolved, lock: verification.lock };
|
|
110
|
+
}
|
|
111
|
+
function refuse(refusal) {
|
|
112
|
+
return { ok: false, refusals: [refusal] };
|
|
113
|
+
}
|
|
114
|
+
function codeUnit(a, b) {
|
|
115
|
+
return a < b ? -1 : a > b ? 1 : 0;
|
|
116
|
+
}
|
|
117
|
+
//# sourceMappingURL=verify-resolved-deployment.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"verify-resolved-deployment.js","sourceRoot":"","sources":["../../../src/distribution/lib/verify-resolved-deployment.ts"],"names":[],"mappings":";;;AA+EA,4DA4FC;AAGD,4DAcC;AA5LD,2DAAkD;AAClD,iDAE0B;AAC1B,6DAA4D;AAC5D,2DAG6B;AA4B7B,IAAY,6BAeX;AAfD,WAAY,6BAA6B;IAEvC,yEAAwC,CAAA;IAExC,4EAA2C,CAAA;IAE3C,iEAAgC,CAAA;IAEhC,+DAA8B,CAAA;IAE9B,qEAAoC,CAAA;IAEpC,gFAA+C,CAAA;IAE/C,uEAAsC,CAAA;AACxC,CAAC,EAfW,6BAA6B,6CAA7B,6BAA6B,QAexC;AA4BM,KAAK,UAAU,wBAAwB,CAC5C,QAAiB,EACjB,SAAqB;IAErB,MAAM,MAAM,GAAG,qCAAwB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;YACZ,IAAI,EAAE,6BAA6B,CAAC,iBAAiB;YACrD,OAAO,EACL,0CAA0C;gBAC1C,MAAM,CAAC,KAAK,CAAC,MAAM;qBAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;qBACvE,IAAI,CAAC,IAAI,CAAC;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IAE7B,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAS,EAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC;YACZ,IAAI,EAAE,6BAA6B,CAAC,kBAAkB;YACtD,OAAO,EACL,0BAA0B,MAAM,kDAAkD;gBAClF,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,qCAAqC;SACtE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAA8B,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,mDAA+B,EACpC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;YACZ,IAAI,EAAE,6BAA6B,CAAC,aAAa;YACjD,OAAO,EAAE,wDAAyD,KAAe,CAAC,OAAO,EAAE;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B,CAAC,YAAY;gBAChD,KAAK,EAAE,EAAE;gBACT,OAAO,EAAE,2BAA2B,EAAE,mDAAmD;aAC1F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B,CAAC,cAAc;gBAClD,KAAK,EAAE,KAAK,CAAC,EAAE;gBACf,OAAO,EAAE,yCAAyC,KAAK,CAAC,EAAE,mCAAmC;aAC9F,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,OAAO,GAAG,MAAM,IAAI,IAAA,qCAAkB,EAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B,CAAC,oBAAoB;gBACxD,KAAK,EAAE,KAAK,CAAC,EAAE;gBACf,OAAO,EACL,yCAAyC,KAAK,CAAC,EAAE,uBAAuB;oBACxE,IAAI,KAAK,CAAC,YAAY,yBAAyB,OAAO,IAAI;aAC7D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC/C,KAAK,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAErC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAC1E,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B,CAAC,gBAAgB;gBACpD,KAAK;gBACL,cAAc,EAAE,OAAO,CAAC,IAAI;gBAC5B,OAAO,EACL,mBAAmB,OAAO,CAAC,IAAI,cAAc,KAAK,IAAI,SAAS,mBAAmB;oBAClF,UAAU,KAAK,yBAAyB,SAAS,IAAI;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAExD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAsC,EAAE,IAAI,EAAE,CAAC;AAC9E,CAAC;AAGM,KAAK,UAAU,wBAAwB,CAC5C,QAAiB,EACjB,SAAqB;IAErB,MAAM,YAAY,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,mCAAmC;YACjC,YAAY,CAAC,QAAQ;iBAClB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;iBAC5D,IAAI,CAAC,IAAI,CAAC,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,MAAM,CAAC,OAAkC;IAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
import { BiomeOrigin } from '../../biome';
|
|
3
|
-
import { FIRST_PARTY_TRUST_DOMAIN, THIRD_PARTY_TRUST_DOMAIN_PREFIX } from '../../deployment';
|
|
3
|
+
import { FIRST_PARTY_TRUST_DOMAIN, THIRD_PARTY_TRUST_DOMAIN_PREFIX, type TrustPartitionViolation } from '../../deployment';
|
|
4
4
|
export { FIRST_PARTY_TRUST_DOMAIN, THIRD_PARTY_TRUST_DOMAIN_PREFIX };
|
|
5
5
|
export declare const ProcessMemberSchema: z.ZodObject<{
|
|
6
6
|
biomeId: z.ZodString;
|
|
@@ -43,7 +43,23 @@ export declare const ProcessTrustPolicySchema: z.ZodObject<{
|
|
|
43
43
|
}, z.core.$strict>>;
|
|
44
44
|
}, z.core.$strict>;
|
|
45
45
|
export type ProcessTrustPolicy = z.infer<typeof ProcessTrustPolicySchema>;
|
|
46
|
-
export declare function resolveTrustDomain(biomeId: string, origin: BiomeOrigin, policy: ProcessTrustPolicy | undefined): string;
|
|
46
|
+
export declare function resolveTrustDomain(biomeId: string, origin: BiomeOrigin, policy: ProcessTrustPolicy | undefined, ceiling: string | undefined): string;
|
|
47
|
+
export declare function deriveTrustCeiling(biomeId: string, origin: BiomeOrigin, editionCeiling: ProcessTrustPolicy | undefined): string | undefined;
|
|
48
|
+
export interface TrustPartitionBiome {
|
|
49
|
+
readonly id: string;
|
|
50
|
+
readonly origin: BiomeOrigin;
|
|
51
|
+
readonly trustCeiling?: string | undefined;
|
|
52
|
+
}
|
|
53
|
+
export interface TrustPartition {
|
|
54
|
+
readonly domainOf: Readonly<Record<string, string>>;
|
|
55
|
+
readonly ceilingOf: Readonly<Record<string, string>>;
|
|
56
|
+
readonly violations: readonly TrustPartitionViolation[];
|
|
57
|
+
}
|
|
58
|
+
export declare function resolveTrustPartition(input: {
|
|
59
|
+
readonly biomes: readonly TrustPartitionBiome[];
|
|
60
|
+
readonly policy?: ProcessTrustPolicy | undefined;
|
|
61
|
+
}): TrustPartition;
|
|
62
|
+
export declare function assertTrustPartition(input: Parameters<typeof resolveTrustPartition>[0]): TrustPartition;
|
|
47
63
|
export declare const PROCESS_TOPOLOGY_SCHEMA_VERSION: 1;
|
|
48
64
|
export declare const ProcessTopologySchema: z.ZodObject<{
|
|
49
65
|
schemaVersion: z.ZodLiteral<1>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"process-topology.d.ts","sourceRoot":"","sources":["../../../src/process-topology/lib/process-topology.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,+BAA+B,
|
|
1
|
+
{"version":3,"file":"process-topology.d.ts","sourceRoot":"","sources":["../../../src/process-topology/lib/process-topology.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAI/B,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,CAAC;AAwCrE,eAAO,MAAM,mBAAmB;;;kBAWrB,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAE9D;AAgBD,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;kBAsFhC,CAAC;AACL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAiCxE,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,MAAM,CAIR;AAGD,eAAO,MAAM,4BAA4B;;;kBAY9B,CAAC;AACZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAmBF,eAAO,MAAM,wBAAwB;;;;;kBAkCjC,CAAC;AACL,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAY1E,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,MAAM,CAKR;AAQD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,kBAAkB,GAAG,SAAS,GAC7C,MAAM,GAAG,SAAS,CAGpB;AAGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAE7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAE7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEpD,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAErD,QAAQ,CAAC,UAAU,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACzD;AAQD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAClD,GAAG,cAAc,CA0BjB;AAGD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,GACjD,cAAc,CAShB;AAED,eAAO,MAAM,+BAA+B,EAAG,CAAU,CAAC;AAG1D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqC9B,CAAC;AACL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}
|
|
@@ -4,6 +4,9 @@ exports.ProcessTopologySchema = exports.PROCESS_TOPOLOGY_SCHEMA_VERSION = export
|
|
|
4
4
|
exports.processMemberKey = processMemberKey;
|
|
5
5
|
exports.defaultTrustDomain = defaultTrustDomain;
|
|
6
6
|
exports.resolveTrustDomain = resolveTrustDomain;
|
|
7
|
+
exports.deriveTrustCeiling = deriveTrustCeiling;
|
|
8
|
+
exports.resolveTrustPartition = resolveTrustPartition;
|
|
9
|
+
exports.assertTrustPartition = assertTrustPartition;
|
|
7
10
|
const zod_1 = require("zod");
|
|
8
11
|
const biome_1 = require("../../biome");
|
|
9
12
|
const deployment_1 = require("../../deployment");
|
|
@@ -128,12 +131,50 @@ exports.ProcessTrustPolicySchema = zod_1.z
|
|
|
128
131
|
}
|
|
129
132
|
});
|
|
130
133
|
});
|
|
131
|
-
function resolveTrustDomain(biomeId, origin, policy) {
|
|
134
|
+
function resolveTrustDomain(biomeId, origin, policy, ceiling) {
|
|
132
135
|
for (const assignment of policy?.assignments ?? []) {
|
|
133
136
|
if (assignment.biomes.includes(biomeId))
|
|
134
137
|
return assignment.domain;
|
|
135
138
|
}
|
|
136
|
-
return defaultTrustDomain(biomeId, origin);
|
|
139
|
+
return ceiling ?? defaultTrustDomain(biomeId, origin);
|
|
140
|
+
}
|
|
141
|
+
function deriveTrustCeiling(biomeId, origin, editionCeiling) {
|
|
142
|
+
const ceiling = resolveTrustDomain(biomeId, origin, editionCeiling, undefined);
|
|
143
|
+
return ceiling === defaultTrustDomain(biomeId, origin) ? undefined : ceiling;
|
|
144
|
+
}
|
|
145
|
+
function resolveTrustPartition(input) {
|
|
146
|
+
const domainOf = {};
|
|
147
|
+
const ceilingOf = {};
|
|
148
|
+
const partitioned = input.biomes.map((biome) => {
|
|
149
|
+
const trustCeiling = biome.trustCeiling ?? defaultTrustDomain(biome.id, biome.origin);
|
|
150
|
+
const trustDomain = resolveTrustDomain(biome.id, biome.origin, input.policy, trustCeiling);
|
|
151
|
+
domainOf[biome.id] = trustDomain;
|
|
152
|
+
ceilingOf[biome.id] = trustCeiling;
|
|
153
|
+
return { id: biome.id, trustCeiling, trustDomain };
|
|
154
|
+
});
|
|
155
|
+
const violations = [];
|
|
156
|
+
for (const assignment of input.policy?.assignments ?? []) {
|
|
157
|
+
for (const biomeId of assignment.biomes) {
|
|
158
|
+
if (!Object.prototype.hasOwnProperty.call(domainOf, biomeId)) {
|
|
159
|
+
violations.push({
|
|
160
|
+
code: deployment_1.TrustPartitionViolationCode.UnknownBiome,
|
|
161
|
+
domain: assignment.domain,
|
|
162
|
+
message: `the trust policy assigns biome "${biomeId}" to "${assignment.domain}", but the ` +
|
|
163
|
+
`edition carries no biome "${biomeId}".`,
|
|
164
|
+
});
|
|
165
|
+
}
|
|
166
|
+
}
|
|
167
|
+
}
|
|
168
|
+
violations.push(...(0, deployment_1.gradeTrustRefinement)(partitioned));
|
|
169
|
+
return { domainOf, ceilingOf, violations };
|
|
170
|
+
}
|
|
171
|
+
function assertTrustPartition(input) {
|
|
172
|
+
const partition = resolveTrustPartition(input);
|
|
173
|
+
if (partition.violations.length > 0) {
|
|
174
|
+
throw new Error(`trust policy is refused:\n` +
|
|
175
|
+
partition.violations.map((violation) => ` - [${violation.code}] ${violation.message}`).join('\n'));
|
|
176
|
+
}
|
|
177
|
+
return partition;
|
|
137
178
|
}
|
|
138
179
|
exports.PROCESS_TOPOLOGY_SCHEMA_VERSION = 1;
|
|
139
180
|
exports.ProcessTopologySchema = zod_1.z
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"process-topology.js","sourceRoot":"","sources":["../../../src/process-topology/lib/process-topology.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"process-topology.js","sourceRoot":"","sources":["../../../src/process-topology/lib/process-topology.ts"],"names":[],"mappings":";;;AA0EA,4CAEC;AAwID,gDAOC;AAoFD,gDAUC;AAQD,gDAOC;AAyBD,sDA6BC;AAGD,oDAWC;AA5YD,6BAAwB;AAExB,uCAA0C;AAC1C,iDAO0B;AAMjB,yGAZP,qCAAwB,OAYO;AAAE,gHAXjC,4CAA+B,OAWiC;AAwCrD,QAAA,mBAAmB,GAAG,OAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,OAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;IACtE,YAAY,EAAE,OAAC;SACZ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,mBAAmB,EAAE,4CAA4C,CAAC;CAC5E,CAAC;KACD,MAAM,EAAE,CAAC;AAOZ,SAAgB,gBAAgB,CAAC,MAAqB;IACpD,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,iBAAiB,GAAG,OAAC;KACxB,MAAM,EAAE;KACR,KAAK,CACJ,6EAA6E,EAC7E,+GAA+G,CAChH,CAAC;AACJ,MAAM,kBAAkB,GAAG,OAAC;KACzB,MAAM,EAAE;KACR,KAAK,CACJ,2BAA2B,EAC3B,kEAAkE,CACnE,CAAC;AAGS,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IAQN,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CACJ,8BAA8B,EAC9B,4CAA4C,CAC7C;IACH,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,2BAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,OAAC;SACR,MAAM,CAAC;QACN,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE;QAClD,OAAO,EAAE,2CAA2C;QACpD,IAAI,EAAE,CAAC,KAAK,CAAC;KACd,CAAC;IAsBJ,MAAM,EAAE,OAAC;SACN,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;KACzC,CAAC;SACD,MAAM,EAAE;IACX,SAAS,EAAE,OAAC;SACT,MAAM,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;SAC9D,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,QAAQ,EAAE,OAAC;SACR,MAAM,CAAC;QAQN,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC7C,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;gBACxB,OAAO,EAAE,qBAAqB,GAAG,iBAAiB,OAAO,CAAC,IAAI,GAAG;aAClE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAkCL,SAAgB,kBAAkB,CAChC,OAAe,EACf,MAAmB;IAEnB,OAAO,MAAM,KAAK,mBAAW,CAAC,UAAU;QACtC,CAAC,CAAC,qCAAwB;QAC1B,CAAC,CAAC,GAAG,4CAA+B,GAAG,OAAO,EAAE,CAAC;AACrD,CAAC;AAGY,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,MAAM,EAAE,kCAAqB;IAC7B,MAAM,EAAE,OAAC;SACN,KAAK,CACJ,OAAC;SACE,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CACvE;SACA,GAAG,CAAC,CAAC,CAAC;CACV,CAAC;KACD,MAAM,EAAE,CAAC;AAsBC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,oCAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;QAC/C,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC;gBACtC,OAAO,EACL,iBAAiB,UAAU,CAAC,MAAM,iCAAiC;oBACnE,0BAA0B;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC;oBACtC,OAAO,EACL,UAAU,OAAO,0BAA0B,QAAQ,QAAQ;wBAC3D,IAAI,UAAU,CAAC,MAAM,4CAA4C;iBACpE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAaL,SAAgB,kBAAkB,CAChC,OAAe,EACf,MAAmB,EACnB,MAAsC,EACtC,OAA2B;IAE3B,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAQD,SAAgB,kBAAkB,CAChC,OAAe,EACf,MAAmB,EACnB,cAA8C;IAE9C,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IAC/E,OAAO,OAAO,KAAK,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/E,CAAC;AAyBD,SAAgB,qBAAqB,CAAC,KAGrC;IACC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtF,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3F,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC;QACjC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;QACzD,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC7D,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,wCAA2B,CAAC,YAAY;oBAC9C,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,OAAO,EACL,mCAAmC,OAAO,SAAS,UAAU,CAAC,MAAM,aAAa;wBACjF,6BAA6B,OAAO,IAAI;iBAC3C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,GAAG,IAAA,iCAAoB,EAAC,WAAW,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC7C,CAAC;AAGD,SAAgB,oBAAoB,CAClC,KAAkD;IAElD,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,4BAA4B;YAC1B,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAEY,QAAA,+BAA+B,GAAG,CAAU,CAAC;AAG7C,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,uCAA+B,CAAC;IAEzD,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,+BAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,WAAW,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5C,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;gBAClC,OAAO,EAAE,2BAA2B,OAAO,CAAC,IAAI,GAAG;aACpD,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC;oBACrC,OAAO,EACL,cAAc,GAAG,0BAA0B,KAAK,QAAQ;wBACxD,IAAI,OAAO,CAAC,IAAI,gDAAgD;iBACnE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
|
@@ -11,6 +11,7 @@ export declare enum ProcessTopologyViolationCode {
|
|
|
11
11
|
KernelMajorDisagreement = "kernel-major-disagreement",
|
|
12
12
|
MixedBuildSources = "mixed-build-sources",
|
|
13
13
|
MixedTrustDomains = "mixed-trust-domains",
|
|
14
|
+
TrustPolicyExceedsCeiling = "trust-policy-exceeds-ceiling",
|
|
14
15
|
ForeignCodeBesideCustody = "foreign-code-beside-custody",
|
|
15
16
|
CustodyBesideNonCustody = "custody-beside-non-custody",
|
|
16
17
|
ForeignCodeBesideGovernedEgress = "foreign-code-beside-governed-egress"
|
|
@@ -33,6 +34,7 @@ export interface ProcessMemberFacts {
|
|
|
33
34
|
readonly scalingMode: BiomeScalingMode;
|
|
34
35
|
readonly processFacts?: BiomeComponentProcessFacts;
|
|
35
36
|
readonly origin: BiomeOrigin;
|
|
37
|
+
readonly trustCeiling?: string;
|
|
36
38
|
readonly version: string;
|
|
37
39
|
readonly buildSource: ProcessMemberBuildSource;
|
|
38
40
|
readonly kernelMajor?: number;
|
|
@@ -40,6 +42,7 @@ export interface ProcessMemberFacts {
|
|
|
40
42
|
export interface ProcessMemberContext {
|
|
41
43
|
readonly biomeId: string;
|
|
42
44
|
readonly origin: BiomeOrigin;
|
|
45
|
+
readonly trustCeiling?: string;
|
|
43
46
|
readonly version: string;
|
|
44
47
|
readonly buildSource: ProcessMemberBuildSource;
|
|
45
48
|
readonly kernelMajor?: number;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resolve-process-topology.d.ts","sourceRoot":"","sources":["../../../src/process-topology/lib/resolve-process-topology.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,WAAW,EACX,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAChC,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"resolve-process-topology.d.ts","sourceRoot":"","sources":["../../../src/process-topology/lib/resolve-process-topology.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,WAAW,EACX,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAChC,MAAM,aAAa,CAAC;AAErB,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AA2C5B,oBAAY,4BAA4B;IAEtC,aAAa,mBAAmB;IAOhC,oBAAoB,4BAA4B;IAEhD,gBAAgB,sBAAsB;IAEtC,oBAAoB,2BAA2B;IAE/C,eAAe,qBAAqB;IAEpC,eAAe,qBAAqB;IAEpC,qBAAqB,4BAA4B;IAEjD,uBAAuB,8BAA8B;IAErD,iBAAiB,wBAAwB;IAEzC,iBAAiB,wBAAwB;IAEzC,yBAAyB,iCAAiC;IAE1D,wBAAwB,gCAAgC;IAExD,uBAAuB,+BAA+B;IAEtD,+BAA+B,wCAAwC;CACxE;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAE5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAWD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;IAM3C,QAAQ,CAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IAEvC,QAAQ,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC;IAMnD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAK7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAM/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAMzB,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAM/C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAQD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE,oBAAoB,GAC5B,kBAAkB,CAsBpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAMnC,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACrD;AASD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AAyDD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,2BAA2B,GACjC,SAAS,wBAAwB,EAAE,CAwPrC;AAMD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,2BAA2B,GACjC,IAAI,CAWN"}
|
|
@@ -6,6 +6,7 @@ exports.isExactVersion = isExactVersion;
|
|
|
6
6
|
exports.resolveProcessTopology = resolveProcessTopology;
|
|
7
7
|
exports.assertProcessTopology = assertProcessTopology;
|
|
8
8
|
const biome_1 = require("../../biome");
|
|
9
|
+
const deployment_1 = require("../../deployment");
|
|
9
10
|
const process_topology_1 = require("./process-topology");
|
|
10
11
|
var ProcessTopologyViolationCode;
|
|
11
12
|
(function (ProcessTopologyViolationCode) {
|
|
@@ -19,6 +20,7 @@ var ProcessTopologyViolationCode;
|
|
|
19
20
|
ProcessTopologyViolationCode["KernelMajorDisagreement"] = "kernel-major-disagreement";
|
|
20
21
|
ProcessTopologyViolationCode["MixedBuildSources"] = "mixed-build-sources";
|
|
21
22
|
ProcessTopologyViolationCode["MixedTrustDomains"] = "mixed-trust-domains";
|
|
23
|
+
ProcessTopologyViolationCode["TrustPolicyExceedsCeiling"] = "trust-policy-exceeds-ceiling";
|
|
22
24
|
ProcessTopologyViolationCode["ForeignCodeBesideCustody"] = "foreign-code-beside-custody";
|
|
23
25
|
ProcessTopologyViolationCode["CustodyBesideNonCustody"] = "custody-beside-non-custody";
|
|
24
26
|
ProcessTopologyViolationCode["ForeignCodeBesideGovernedEgress"] = "foreign-code-beside-governed-egress";
|
|
@@ -36,6 +38,9 @@ function deriveProcessMemberFacts(component, context) {
|
|
|
36
38
|
? {}
|
|
37
39
|
: { processFacts: component.processFacts }),
|
|
38
40
|
origin: context.origin,
|
|
41
|
+
...(context.trustCeiling === undefined
|
|
42
|
+
? {}
|
|
43
|
+
: { trustCeiling: context.trustCeiling }),
|
|
39
44
|
version: context.version,
|
|
40
45
|
buildSource: context.buildSource,
|
|
41
46
|
...(context.kernelMajor === undefined
|
|
@@ -180,7 +185,7 @@ function resolveProcessTopology(input) {
|
|
|
180
185
|
`time, so two installs of one edition could differ.`,
|
|
181
186
|
});
|
|
182
187
|
}
|
|
183
|
-
group(domains, (0, process_topology_1.resolveTrustDomain)(component.biomeId, component.origin, policy), key);
|
|
188
|
+
group(domains, (0, process_topology_1.resolveTrustDomain)(component.biomeId, component.origin, policy, component.trustCeiling), key);
|
|
184
189
|
group(buildSources, buildSourceKey(component.buildSource), key);
|
|
185
190
|
if (component.kernelMajor !== undefined) {
|
|
186
191
|
group(kernelMajors, String(component.kernelMajor), key);
|
|
@@ -200,8 +205,8 @@ function resolveProcessTopology(input) {
|
|
|
200
205
|
process: process.name,
|
|
201
206
|
message: `process "${process.name}" mixes trust domains: ${summarise(domains)}. ` +
|
|
202
207
|
`One process is ONE security boundary, so its members must be one ` +
|
|
203
|
-
`domain.
|
|
204
|
-
`
|
|
208
|
+
`domain. Members may share one only when their edition's trustCeiling ` +
|
|
209
|
+
`groups their biomes; otherwise declare more processes.`,
|
|
205
210
|
});
|
|
206
211
|
}
|
|
207
212
|
const foreignOnly = (keys) => foreign.filter((key) => !keys.includes(key));
|
|
@@ -254,6 +259,30 @@ function resolveProcessTopology(input) {
|
|
|
254
259
|
});
|
|
255
260
|
}
|
|
256
261
|
}
|
|
262
|
+
const placed = new Map();
|
|
263
|
+
for (const process of input.topology.processes) {
|
|
264
|
+
for (const member of process.members) {
|
|
265
|
+
const component = facts.get((0, process_topology_1.processMemberKey)(member));
|
|
266
|
+
if (component !== undefined)
|
|
267
|
+
placed.set(component.biomeId, component);
|
|
268
|
+
}
|
|
269
|
+
}
|
|
270
|
+
const partition = (0, process_topology_1.resolveTrustPartition)({
|
|
271
|
+
biomes: [...placed.values()].map((component) => ({
|
|
272
|
+
id: component.biomeId,
|
|
273
|
+
origin: component.origin,
|
|
274
|
+
trustCeiling: component.trustCeiling,
|
|
275
|
+
})),
|
|
276
|
+
policy,
|
|
277
|
+
});
|
|
278
|
+
for (const violation of partition.violations) {
|
|
279
|
+
if (violation.code !== deployment_1.TrustPartitionViolationCode.ExceedsCeiling)
|
|
280
|
+
continue;
|
|
281
|
+
violations.push({
|
|
282
|
+
code: ProcessTopologyViolationCode.TrustPolicyExceedsCeiling,
|
|
283
|
+
message: violation.message,
|
|
284
|
+
});
|
|
285
|
+
}
|
|
257
286
|
return violations;
|
|
258
287
|
}
|
|
259
288
|
function assertProcessTopology(input) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resolve-process-topology.js","sourceRoot":"","sources":["../../../src/process-topology/lib/resolve-process-topology.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"resolve-process-topology.js","sourceRoot":"","sources":["../../../src/process-topology/lib/resolve-process-topology.ts"],"names":[],"mappings":";;;AAkLA,4DAyBC;AAmBD,wCAEC;AAyDD,wDA0PC;AAMD,sDAaC;AAtiBD,uCAOqB;AACrB,iDAA+D;AAC/D,yDAK4B;AA2C5B,IAAY,4BAkCX;AAlCD,WAAY,4BAA4B;IAEtC,gEAAgC,CAAA;IAOhC,gFAAgD,CAAA;IAEhD,sEAAsC,CAAA;IAEtC,+EAA+C,CAAA;IAE/C,oEAAoC,CAAA;IAEpC,oEAAoC,CAAA;IAEpC,iFAAiD,CAAA;IAEjD,qFAAqD,CAAA;IAErD,yEAAyC,CAAA;IAEzC,yEAAyC,CAAA;IAEzC,0FAA0D,CAAA;IAE1D,wFAAwD,CAAA;IAExD,sFAAsD,CAAA;IAEtD,uGAAuE,CAAA;AACzE,CAAC,EAlCW,4BAA4B,4CAA5B,4BAA4B,QAkCvC;AAuFD,SAAgB,wBAAwB,CACtC,SAAyB,EACzB,OAA6B;IAE7B,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,SAAS,CAAC,GAAG;QAC3B,aAAa,EAAE,SAAS,CAAC,IAAI;QAC7B,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;QACvC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI;QAChD,GAAG,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAgBD,MAAM,aAAa,GACjB,2HAA2H,CAAC;AAE9H,SAAgB,cAAc,CAAC,KAAa;IAC1C,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAiBD,MAAM,sBAAsB,GAAoC,IAAI,GAAG,CAAC;IACtE,0BAAkB,CAAC,OAAO;IAC1B,0BAAkB,CAAC,MAAM;CAC1B,CAAC,CAAC;AAGH,MAAM,wBAAwB,GAAkC,IAAI,GAAG,CAAC;IACtE,wBAAgB,CAAC,UAAU;IAC3B,wBAAgB,CAAC,WAAW;CAC7B,CAAC,CAAC;AAGH,SAAS,aAAa,CAAC,KAAyB;IAC9C,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,mBAAW,CAAC,UAAU;QACvC,KAAK,CAAC,YAAY,EAAE,oBAAoB,KAAK,IAAI,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAgC;IACtD,OAAO,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,MAA6B;IAC9C,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SACzD,IAAI,EAAE;SACN,IAAI,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,KAAK,CAAC,GAA0B,EAAE,GAAW,EAAE,MAAc;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACxB,CAAC;AAMD,SAAgB,sBAAsB,CACpC,KAAkC;IAElC,MAAM,UAAU,GAA+B,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,KAAK,CAAC,GAAG,CACP,IAAA,mCAAgB,EAAC;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,EACF,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;IAE1C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;QACjD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;QACjD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAE1C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAAA,mCAAgB,EAAC,MAAM,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,4BAA4B,CAAC,aAAa;oBAChD,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,MAAM,EAAE,GAAG;oBACX,OAAO,EACL,YAAY,OAAO,CAAC,IAAI,mBAAmB,GAAG,kBAAkB;wBAChE,kDAAkD;wBAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,mCAAmC;wBACpE,mEAAmE;wBACnE,oCAAoC;iBACvC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAGD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzD,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,4BAA4B,CAAC,oBAAoB;oBACvD,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,MAAM,EAAE,GAAG;oBACX,OAAO,EACL,IAAI,GAAG,UAAU,SAAS,CAAC,aAAa,8BAA8B;wBACtE,wBAAwB,OAAO,CAAC,IAAI,8BAA8B;wBAClE,eAAe,SAAS,CAAC,aAAa,uCAAuC;iBAChF,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,SAAS,CAAC,SAAS,KAAK,+BAAuB,CAAC,OAAO,EAAE,CAAC;gBACnE,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,4BAA4B,CAAC,gBAAgB;oBACnD,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,MAAM,EAAE,GAAG;oBACX,OAAO,EACL,IAAI,GAAG,0DAA0D;wBACjE,oEAAoE;wBACpE,2BAA2B,OAAO,CAAC,IAAI,IAAI;iBAC9C,CAAC,CAAC;YACL,CAAC;iBAAM,IACL,SAAS,CAAC,aAAa,KAAK,0BAAkB,CAAC,MAAM;gBACrD,SAAS,CAAC,SAAS,KAAK,SAAS,EACjC,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,4BAA4B,CAAC,oBAAoB;oBACvD,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,MAAM,EAAE,GAAG;oBACX,OAAO,EACL,IAAI,GAAG,wDAAwD;wBAC/D,oEAAoE;wBACpE,kCAAkC,OAAO,CAAC,IAAI,IAAI;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,SAAS,CAAC,WAAW,KAAK,wBAAgB,CAAC,cAAc,EAAE,CAAC;gBAC9D,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,4BAA4B,CAAC,oBAAoB;oBACvD,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,MAAM,EAAE,GAAG;oBACX,OAAO,EACL,IAAI,GAAG,4DAA4D;wBACnE,kDAAkD,OAAO,CAAC,IAAI,IAAI;iBACrE,CAAC,CAAC;YACL,CAAC;iBAAM,IACL,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;gBACxB,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EACpD,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,4BAA4B,CAAC,eAAe;oBAClD,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,MAAM,EAAE,GAAG;oBACX,OAAO,EACL,IAAI,GAAG,4BAA4B,SAAS,CAAC,WAAW,gBAAgB;wBACxE,IAAI,OAAO,CAAC,IAAI,8CAA8C;wBAC9D,gBAAgB,OAAO,CAAC,QAAQ,CAAC,GAAG,kCAAkC;wBACtE,gDAAgD;iBACnD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC;YACpD,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,4BAA4B,CAAC,eAAe;oBAClD,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,MAAM,EAAE,GAAG;oBACX,OAAO,EACL,IAAI,GAAG,4CAA4C,SAAS,CAAC,MAAM,MAAM;wBACzE,+BAA+B,OAAO,CAAC,IAAI,0BAA0B;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,4BAA4B,CAAC,qBAAqB;oBACxD,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,MAAM,EAAE,GAAG;oBACX,OAAO,EACL,IAAI,GAAG,kBAAkB,SAAS,CAAC,OAAO,2BAA2B;wBACrE,uEAAuE;wBACvE,oDAAoD;iBACvD,CAAC,CAAC;YACL,CAAC;YAGD,KAAK,CACH,OAAO,EACP,IAAA,qCAAkB,EAChB,SAAS,CAAC,OAAO,EACjB,SAAS,CAAC,MAAM,EAChB,MAAM,EACN,SAAS,CAAC,YAAY,CACvB,EACD,GAAG,CACJ,CAAC;YACF,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;YAChE,IAAI,SAAS,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACxC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,SAAS,CAAC,YAAY,EAAE,iBAAiB,KAAK,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;gBACrE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,SAAS,CAAC,YAAY,EAAE,kBAAkB,KAAK,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1E,IAAI,aAAa,CAAC,SAAS,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,4BAA4B,CAAC,iBAAiB;gBACpD,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,OAAO,EACL,YAAY,OAAO,CAAC,IAAI,0BAA0B,SAAS,CAAC,OAAO,CAAC,IAAI;oBACxE,mEAAmE;oBACnE,uEAAuE;oBACvE,wDAAwD;aAC3D,CAAC,CAAC;QACL,CAAC;QAID,MAAM,WAAW,GAAG,CAAC,IAAuB,EAAE,EAAE,CAC9C,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,4BAA4B,CAAC,wBAAwB;gBAC3D,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,OAAO,EACL,YAAY,OAAO,CAAC,IAAI,0BAA0B,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACrF,uCAAuC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB;oBAC1E,8DAA8D;aACjE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,4BAA4B,CAAC,uBAAuB;gBAC1D,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,OAAO,EACL,YAAY,OAAO,CAAC,IAAI,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAC9E,2CAA2C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;oBACvE,0EAA0E;oBAC1E,wBAAwB;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,4BAA4B,CAAC,+BAA+B;gBAClE,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,OAAO,EACL,YAAY,OAAO,CAAC,IAAI,0BAA0B,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACpF,kCAAkC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB;oBAC3E,wEAAwE;oBACxE,uCAAuC;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,4BAA4B,CAAC,iBAAiB;gBACpD,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,OAAO,EACL,YAAY,OAAO,CAAC,IAAI,mBAAmB,SAAS,CAAC,YAAY,CAAC,IAAI;oBACtE,sEAAsE;oBACtE,yEAAyE;oBACzE,sBAAsB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,4BAA4B,CAAC,uBAAuB;gBAC1D,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,OAAO,EACL,YAAY,OAAO,CAAC,IAAI,0BAA0B,SAAS,CAAC,YAAY,CAAC,IAAI;oBAC7E,0EAA0E;oBAC1E,0BAA0B;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAKD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,IAAA,mCAAgB,EAAC,MAAM,CAAC,CAAC,CAAC;YACtD,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,wCAAqB,EAAC;QACtC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC/C,EAAE,EAAE,SAAS,CAAC,OAAO;YACrB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,YAAY,EAAE,SAAS,CAAC,YAAY;SACrC,CAAC,CAAC;QACH,MAAM;KACP,CAAC,CAAC;IACH,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QAC7C,IAAI,SAAS,CAAC,IAAI,KAAK,wCAA2B,CAAC,cAAc;YAAE,SAAS;QAC5E,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,4BAA4B,CAAC,yBAAyB;YAC5D,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAMD,SAAgB,qBAAqB,CACnC,KAAkC;IAElC,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAC1B,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,OAAO,EAAE,CAC9D,CAAC;IACF,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,CAAC,QAAQ,CAAC,cAAc,eAAe;QAChF,IAAI,UAAU,CAAC,MAAM,aAAa,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM;QAC1E,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CACnB,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/contracts",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.72.0",
|
|
4
4
|
"description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework deps; the one runtime dependency beside zod is the OpenFGA syntax transformer the authorization-module composer runs.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|