@xemahq/contracts 0.72.0 → 0.74.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.source-stamp.json +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.d.ts.map +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.js.map +1 -1
- package/dist/authorization-module/platform/xema_capability.fga +3 -4
- package/dist/authorization-module/platform/xema_capability.fga.yaml +0 -10
- package/dist/authorization-module/platform/xema_core.fga +8 -15
- package/dist/authorization-module/platform/xema_core.fga.yaml +0 -51
- package/dist/authzen/lib/org-authority-contextual-tuple.d.ts +0 -1
- package/dist/authzen/lib/org-authority-contextual-tuple.d.ts.map +1 -1
- package/dist/authzen/lib/org-authority-contextual-tuple.js +3 -17
- package/dist/authzen/lib/org-authority-contextual-tuple.js.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.d.ts +8 -16
- package/dist/authzen/lib/xema-authzen-profile.d.ts.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.js +6 -9
- package/dist/authzen/lib/xema-authzen-profile.js.map +1 -1
- package/dist/deployment/lib/resolved-deployment.d.ts +5 -6
- package/dist/deployment/lib/resolved-deployment.d.ts.map +1 -1
- package/dist/deployment/lib/resolved-deployment.js +11 -5
- package/dist/deployment/lib/resolved-deployment.js.map +1 -1
- package/dist/process-topology/lib/composed-process-contract.d.ts.map +1 -1
- package/dist/process-topology/lib/composed-process-contract.js +2 -0
- package/dist/process-topology/lib/composed-process-contract.js.map +1 -1
- package/package.json +1 -1
package/dist/.source-stamp.json
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA4BxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;AAQZ,eAAO,MAAM,4BAA4B,2BAA2C,CAAC;AAGrF,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAU7C,oBAAY,0BAA0B;IACpC,MAAM,gBAAgB;CACvB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,+BAA+B,oDAIjC,CAAC;AAGZ,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC,CAGrD,CAAC;
|
|
1
|
+
{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA4BxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;AAQZ,eAAO,MAAM,4BAA4B,2BAA2C,CAAC;AAGrF,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAU7C,oBAAY,0BAA0B;IACpC,MAAM,gBAAgB;CACvB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,+BAA+B,oDAIjC,CAAC;AAGZ,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC,CAGrD,CAAC;AAeH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CACnD,MAAM,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAehF,CAAC;AAGH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAsBD,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA2D3E,CAAC;AAGL,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAQ7C"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;AAiOA,kEAUC;AA3OD,6BAAwB;AAExB,2CAGuB;AAuBvB,IAAY,2BAIX;AAJD,WAAY,2BAA2B;IACrC,iDAAkB,CAAA;IAClB,6DAA8B,CAAA;IAC9B,uDAAwB,CAAA;AAC1B,CAAC,EAJW,2BAA2B,2CAA3B,2BAA2B,QAItC;AAEY,QAAA,iCAAiC,GAAG,OAAC,CAAC,UAAU,CAC3D,2BAA2B,CAC5B,CAAC;AAQW,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAShD,QAAA,kBAAkB,GAAG,WAAW,CAAC;AAGjC,QAAA,yBAAyB,GACpC,MAAM,CAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;AAG1C,QAAA,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1D,SAAS;IACT,eAAe;IACf,cAAc;CACN,CAAC,CAAC;AAQC,QAAA,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAU,CAAC,CAAC;AAGxE,QAAA,oBAAoB,GAAG,QAAQ,CAAC;AAU7C,IAAY,0BAEX;AAFD,WAAY,0BAA0B;IACpC,oDAAsB,CAAA;AACxB,CAAC,EAFW,0BAA0B,0CAA1B,0BAA0B,QAErC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAEW,QAAA,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,WAAW;IACX,YAAY;IACZ,YAAY;CACJ,CAAC,CAAC;AAGC,QAAA,sCAAsC,GAE/C,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,uCAA+B;CACrE,CAAC,CAAC;AAeU,QAAA,8BAA8B,GAEvC,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;KAClC,CAAC;IACF,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC;AA4BU,QAAA,qBAAqB,GAChC,MAAM,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;KAC3E,CAAC;IACF,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;KACjF,CAAC;IACF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;KAC9C,CAAC;IAUF,CAAC,sCAA4B,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5C,KAAK,EAAE,oBAAoB;QAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,iCAAuB,CAAC,MAAM;YAC9B,iCAAuB,CAAC,MAAM;YAC9B,iCAAuB,CAAC,MAAM;YAC9B,iCAAuB,CAAC,UAAU;YAClC,iCAAuB,CAAC,UAAU;SACnC,CAAC;KACH,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;KAC3F,CAAC;IACF,GAAG,MAAM,CAAC,WAAW,CAEjB;QACE,CAAC,eAAe,EAAE,gBAAgB,CAAC;QACnC,CAAC,cAAc,EAAE,SAAS,CAAC;QAG3B,CAAC,0BAA0B,EAAE,gBAAgB,CAAC;QAC9C,CAAC,oBAAoB,EAAE,YAAY,CAAC;QACpC,CAAC,+BAA+B,EAAE,YAAY,CAAC;QAC/C,CAAC,aAAa,EAAE,QAAQ,CAAC;QACzB,CAAC,uBAAuB,EAAE,eAAe,CAAC;QAC1C,CAAC,mBAAmB,EAAE,eAAe,CAAC;KAEzC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACvB,IAAI;QACJ,MAAM,CAAC,MAAM,CAAC;YACZ,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACjF,CAAC;KACH,CAAC,CACH;CACF,CAAC,CAAC;AAGL,SAAgB,2BAA2B,CACzC,OAAe;IAEf,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,6BAAqB,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CACrD,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -13,10 +13,9 @@ module xema_capability
|
|
|
13
13
|
# wildcard, written only by authorization-api's grant door.
|
|
14
14
|
#
|
|
15
15
|
# `org#admin` is the org's ADMINISTRATORS — org owner or org admin. A grant to
|
|
16
|
-
# `org:<o>#admin` never admits installation authority (
|
|
17
|
-
#
|
|
18
|
-
#
|
|
19
|
-
# as a CONTEXTUAL tuple from the verified org-authority instrument
|
|
16
|
+
# `org:<o>#admin` never admits installation authority (owner directive 2026-10-08: no
|
|
17
|
+
# implication across scopes). It is never a stored tuple: the PDP adds it per
|
|
18
|
+
# decision as a CONTEXTUAL tuple from the verified org-authority instrument
|
|
20
19
|
# (`buildOrgAuthorityContextualTuples`, `@xemahq/contracts/authzen`), so a
|
|
21
20
|
# grant to `org:<o>#admin` admits exactly the subjects that instrument names
|
|
22
21
|
# for THIS decision, and nobody once their authority is withdrawn.
|
|
@@ -130,16 +130,6 @@ tests:
|
|
|
130
130
|
object: capability:o1|notification~3aannouncement.publish@1|org
|
|
131
131
|
assertions:
|
|
132
132
|
granted_to: false
|
|
133
|
-
- name: an administrator grant denies a platform admin of the SAME org (installation authority is not org#admin)
|
|
134
|
-
tuples:
|
|
135
|
-
- user: user:carol
|
|
136
|
-
relation: platform_admin
|
|
137
|
-
object: org:o1
|
|
138
|
-
check:
|
|
139
|
-
- user: user:carol
|
|
140
|
-
object: capability:o1|notification~3aannouncement.publish@1|org
|
|
141
|
-
assertions:
|
|
142
|
-
granted_to: false
|
|
143
133
|
- name: an administrator grant denies an administrator of a DIFFERENT org
|
|
144
134
|
tuples:
|
|
145
135
|
- user: user:carol
|
|
@@ -11,10 +11,9 @@ module xema_core
|
|
|
11
11
|
#
|
|
12
12
|
# DEFAULT DENY. Org membership grants nothing by itself: a relation that
|
|
13
13
|
# admits org members says so (`org#member` as a direct subject type), and is
|
|
14
|
-
# evaluated by READING a tuple. `org#owner
|
|
15
|
-
#
|
|
16
|
-
#
|
|
17
|
-
# `buildOrgAuthorityContextualTuples`).
|
|
14
|
+
# evaluated by READING a tuple. `org#owner` and `org#admin` are never written:
|
|
15
|
+
# each reaches the PDP as a CONTEXTUAL tuple derived per request from the
|
|
16
|
+
# verified token (D2, `buildOrgAuthorityContextualTuples`).
|
|
18
17
|
#
|
|
19
18
|
# NO IMPLICATION ACROSS SCOPES (owner directive 2026-10-08, binding):
|
|
20
19
|
# - `owner` — the org OWNER. Owner >= admin is stated HERE, in the
|
|
@@ -22,16 +21,11 @@ module xema_core
|
|
|
22
21
|
# writer; an application's top role (`owner from org`)
|
|
23
22
|
# is this.
|
|
24
23
|
# - `admin` — the org's OWN administrators (org owner or org admin).
|
|
25
|
-
#
|
|
26
|
-
#
|
|
27
|
-
#
|
|
28
|
-
#
|
|
29
|
-
#
|
|
30
|
-
# operator gains authority in an org is identity-api's
|
|
31
|
-
# explicit, audited recovery grant (which makes them an
|
|
32
|
-
# org owner/admin, i.e. `owner`/`admin` here). The
|
|
33
|
-
# relation stays defined only so a PDP that still states
|
|
34
|
-
# the fact as a contextual tuple is not refused.
|
|
24
|
+
#
|
|
25
|
+
# The org type has NO installation relation. Installation authority is not org
|
|
26
|
+
# authority; the ONLY way an installation operator gains authority in an org is
|
|
27
|
+
# identity-api's explicit, audited recovery grant (which makes them an org
|
|
28
|
+
# owner/admin, i.e. `owner`/`admin` here).
|
|
35
29
|
#
|
|
36
30
|
# `org` implements `xema.parent` as the ROOT parent: an object parented by the
|
|
37
31
|
# org (an org-level project, artifact or session) inherits only the org
|
|
@@ -71,7 +65,6 @@ type org
|
|
|
71
65
|
define member: [user, agent, app, service]
|
|
72
66
|
define owner: [user]
|
|
73
67
|
define admin: [user] or owner
|
|
74
|
-
define platform_admin: [user]
|
|
75
68
|
define xema_admin: admin
|
|
76
69
|
define xema_write: admin
|
|
77
70
|
define xema_read: admin
|
|
@@ -20,12 +20,6 @@ tuples:
|
|
|
20
20
|
- user: user:root
|
|
21
21
|
relation: admin
|
|
22
22
|
object: org:org1
|
|
23
|
-
# The INSTALLATION operator's realm role as the PDP states it for org1
|
|
24
|
-
# (contextual in production). INERT: it admits nothing in the org (owner
|
|
25
|
-
# directive 2026-10-08, no implication across scopes).
|
|
26
|
-
- user: user:ops
|
|
27
|
-
relation: platform_admin
|
|
28
|
-
object: org:org1
|
|
29
23
|
# The org OWNER alone, with NO `admin` tuple: the model itself derives
|
|
30
24
|
# owner >= admin (`admin: [user] or owner`).
|
|
31
25
|
- user: user:own
|
|
@@ -422,49 +416,6 @@ tests:
|
|
|
422
416
|
object: xema_integration:org1|i1
|
|
423
417
|
assertions:
|
|
424
418
|
bound_scope: false
|
|
425
|
-
- name: installation authority alone admits nothing in the org (no implication across scopes)
|
|
426
|
-
check:
|
|
427
|
-
- user: user:ops
|
|
428
|
-
object: org:org1
|
|
429
|
-
assertions:
|
|
430
|
-
owner: false
|
|
431
|
-
admin: false
|
|
432
|
-
platform_admin: true
|
|
433
|
-
xema_admin: false
|
|
434
|
-
xema_write: false
|
|
435
|
-
xema_read: false
|
|
436
|
-
may_delegate_for: false
|
|
437
|
-
- user: user:ops
|
|
438
|
-
object: project:org1|p1
|
|
439
|
-
assertions:
|
|
440
|
-
xema_admin: false
|
|
441
|
-
xema_write: false
|
|
442
|
-
xema_read: false
|
|
443
|
-
- user: user:ops
|
|
444
|
-
object: xema_artifact:org1|a1
|
|
445
|
-
assertions:
|
|
446
|
-
can_read: false
|
|
447
|
-
can_write: false
|
|
448
|
-
can_delete: false
|
|
449
|
-
- user: user:ops
|
|
450
|
-
object: xema_artifact:org1|a2
|
|
451
|
-
assertions:
|
|
452
|
-
can_read: false
|
|
453
|
-
can_delete: false
|
|
454
|
-
- user: user:ops
|
|
455
|
-
object: xema_session:org1|s1
|
|
456
|
-
assertions:
|
|
457
|
-
xema_read: false
|
|
458
|
-
can_act: false
|
|
459
|
-
- user: user:ops
|
|
460
|
-
object: xema_artifact:org2|a9
|
|
461
|
-
assertions:
|
|
462
|
-
can_read: false
|
|
463
|
-
list_objects:
|
|
464
|
-
- user: user:ops
|
|
465
|
-
type: xema_artifact
|
|
466
|
-
assertions:
|
|
467
|
-
can_read: []
|
|
468
419
|
- name: an org admin administers the org, and is not its owner
|
|
469
420
|
check:
|
|
470
421
|
- user: user:root
|
|
@@ -472,7 +423,6 @@ tests:
|
|
|
472
423
|
assertions:
|
|
473
424
|
owner: false
|
|
474
425
|
admin: true
|
|
475
|
-
platform_admin: false
|
|
476
426
|
xema_admin: true
|
|
477
427
|
xema_write: true
|
|
478
428
|
xema_read: true
|
|
@@ -492,7 +442,6 @@ tests:
|
|
|
492
442
|
assertions:
|
|
493
443
|
owner: true
|
|
494
444
|
admin: true
|
|
495
|
-
platform_admin: false
|
|
496
445
|
xema_admin: true
|
|
497
446
|
xema_write: true
|
|
498
447
|
xema_read: true
|
|
@@ -2,7 +2,6 @@ import type { XemaOrgAuthorityInstrument } from './xema-authzen-profile';
|
|
|
2
2
|
export declare const XEMA_ORG_OBJECT_TYPE = "org";
|
|
3
3
|
export declare const XEMA_ORG_ADMIN_RELATION = "admin";
|
|
4
4
|
export declare const XEMA_ORG_OWNER_RELATION = "owner";
|
|
5
|
-
export declare const XEMA_ORG_PLATFORM_ADMIN_RELATION = "platform_admin";
|
|
6
5
|
export interface AuthzContextualTuple {
|
|
7
6
|
readonly user: string;
|
|
8
7
|
readonly relation: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"org-authority-contextual-tuple.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"org-authority-contextual-tuple.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAoCzE,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAC1C,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAM/C,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAE/C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,oBAAY,kCAAkC;IAE5C,cAAc,qBAAqB;IAEnC,cAAc,qBAAqB;CACpC;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,kCAAkC;gBAA3C,OAAO,EAAE,kCAAkC;CAQjE;AAGD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAQD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAQD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,0BAA0B,GAAG,SAAS,CAAC;CAC7D,GAAG,SAAS,oBAAoB,EAAE,CAsBlC;AAGD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAE5D,QAAQ,CAAC,MAAM,EACX;QAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAA;KAAE,GACpD;QAAE,QAAQ,CAAC,OAAO,EAAE,kCAAkC,CAAA;KAAE,CAAC;CAC9D;AAOD,eAAO,MAAM,sCAAsC,EAAE,SAAS,iCAAiC,EA0C3F,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = exports.OrgAuthorityContextualTupleError = exports.OrgAuthorityContextualTupleRefusal = exports.
|
|
3
|
+
exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = exports.OrgAuthorityContextualTupleError = exports.OrgAuthorityContextualTupleRefusal = exports.XEMA_ORG_OWNER_RELATION = exports.XEMA_ORG_ADMIN_RELATION = exports.XEMA_ORG_OBJECT_TYPE = void 0;
|
|
4
4
|
exports.buildXemaOrgObject = buildXemaOrgObject;
|
|
5
5
|
exports.buildOrgAdministratorsUserset = buildOrgAdministratorsUserset;
|
|
6
6
|
exports.buildOrgAuthorityContextualTuples = buildOrgAuthorityContextualTuples;
|
|
@@ -11,7 +11,6 @@ const xema_capability_resource_1 = require("./xema-capability-resource");
|
|
|
11
11
|
exports.XEMA_ORG_OBJECT_TYPE = 'org';
|
|
12
12
|
exports.XEMA_ORG_ADMIN_RELATION = 'admin';
|
|
13
13
|
exports.XEMA_ORG_OWNER_RELATION = 'owner';
|
|
14
|
-
exports.XEMA_ORG_PLATFORM_ADMIN_RELATION = 'platform_admin';
|
|
15
14
|
var OrgAuthorityContextualTupleRefusal;
|
|
16
15
|
(function (OrgAuthorityContextualTupleRefusal) {
|
|
17
16
|
OrgAuthorityContextualTupleRefusal["SubjectNotUser"] = "subject_not_user";
|
|
@@ -41,15 +40,11 @@ function buildOrgAuthorityContextualTuples(input) {
|
|
|
41
40
|
if (subject.kind !== subject_1.SubjectKind.User) {
|
|
42
41
|
throw new OrgAuthorityContextualTupleError(OrgAuthorityContextualTupleRefusal.SubjectNotUser);
|
|
43
42
|
}
|
|
44
|
-
if (instrument.
|
|
45
|
-
!(0, tenant_1.orgRoleSatisfies)(instrument.orgRole, tenant_1.OrgRole.Admin)) {
|
|
43
|
+
if (!(0, tenant_1.orgRoleSatisfies)(instrument.orgRole, tenant_1.OrgRole.Admin)) {
|
|
46
44
|
throw new OrgAuthorityContextualTupleError(OrgAuthorityContextualTupleRefusal.RoleBelowAdmin);
|
|
47
45
|
}
|
|
48
46
|
const user = (0, subject_1.subjectRefToString)({ kind: subject_1.SubjectKind.User, id: subject.id });
|
|
49
47
|
const object = buildXemaOrgObject(orgId);
|
|
50
|
-
if (instrument.kind === audit_1.AuditAuthorityKind.PlatformAdmin) {
|
|
51
|
-
return [{ user, relation: exports.XEMA_ORG_PLATFORM_ADMIN_RELATION, object }];
|
|
52
|
-
}
|
|
53
48
|
if (instrument.orgRole === tenant_1.OrgRole.Owner) {
|
|
54
49
|
return [
|
|
55
50
|
{ user, relation: exports.XEMA_ORG_OWNER_RELATION, object },
|
|
@@ -85,15 +80,6 @@ exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = Object.freeze([
|
|
|
85
80
|
],
|
|
86
81
|
},
|
|
87
82
|
},
|
|
88
|
-
{
|
|
89
|
-
name: 'a platform admin with no org role is installation authority, never org#admin',
|
|
90
|
-
subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
|
|
91
|
-
orgId: 'o1',
|
|
92
|
-
instrument: { kind: audit_1.AuditAuthorityKind.PlatformAdmin },
|
|
93
|
-
expect: {
|
|
94
|
-
tuples: [{ user: 'user:u1', relation: exports.XEMA_ORG_PLATFORM_ADMIN_RELATION, object: 'org:o1' }],
|
|
95
|
-
},
|
|
96
|
-
},
|
|
97
83
|
{
|
|
98
84
|
name: 'a member instrument is refused',
|
|
99
85
|
subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
|
|
@@ -105,7 +91,7 @@ exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = Object.freeze([
|
|
|
105
91
|
name: 'an instrument on a non-user subject is refused',
|
|
106
92
|
subject: { kind: subject_1.SubjectKind.Agent, id: 'a1' },
|
|
107
93
|
orgId: 'o1',
|
|
108
|
-
instrument: { kind: audit_1.AuditAuthorityKind.
|
|
94
|
+
instrument: { kind: audit_1.AuditAuthorityKind.OrgRole, orgRole: tenant_1.OrgRole.Admin },
|
|
109
95
|
expect: { refusal: OrgAuthorityContextualTupleRefusal.SubjectNotUser },
|
|
110
96
|
},
|
|
111
97
|
]);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"org-authority-contextual-tuple.js","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"org-authority-contextual-tuple.js","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":";;;AA4EA,gDAEC;AAQD,sEAEC;AAQD,8EA0BC;AA1HD,uCAAiD;AACjD,2CAAgE;AAChE,yCAAyD;AAEzD,yEAAiE;AAqCpD,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAC7B,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAMlC,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAS/C,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAE5C,yEAAmC,CAAA;IAEnC,yEAAmC,CAAA;AACrC,CAAC,EALW,kCAAkC,kDAAlC,kCAAkC,QAK7C;AAED,MAAa,gCAAiC,SAAQ,KAAK;IACpC;IAArB,YAAqB,OAA2C;QAC9D,KAAK,CACH,OAAO,KAAK,kCAAkC,CAAC,cAAc;YAC3D,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,yFAAyF,CAC9F,CAAC;QALiB,YAAO,GAAP,OAAO,CAAoC;QAM9D,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AATD,4EASC;AAGD,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,OAAO,GAAG,4BAAoB,IAAI,IAAA,8CAAmB,EAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAQD,SAAgB,6BAA6B,CAAC,KAAa;IACzD,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,+BAAuB,EAAE,CAAC;AACnE,CAAC;AAQD,SAAgB,iCAAiC,CAAC,KAIjD;IACC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,gCAAgC,CACxC,kCAAkC,CAAC,cAAc,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAA,yBAAgB,EAAC,UAAU,CAAC,OAAO,EAAE,gBAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,gCAAgC,CACxC,kCAAkC,CAAC,cAAc,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,OAAO,KAAK,gBAAO,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE;YACnD,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/D,CAAC;AAmBY,QAAA,sCAAsC,GACjD,MAAM,CAAC,MAAM,CAAC;IACZ;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;KACvB;IACD;QACE,IAAI,EAAE,6DAA6D;QACnE,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE;KAC/F;IACD;QACE,IAAI,EAAE,wDAAwD;QAC9D,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACxE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE;aACzE;SACF;KACF;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,MAAM,EAAE;QACzE,MAAM,EAAE,EAAE,OAAO,EAAE,kCAAkC,CAAC,cAAc,EAAE;KACvE;IACD;QACE,IAAI,EAAE,gDAAgD;QACtD,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE;QAC9C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE,EAAE,OAAO,EAAE,kCAAkC,CAAC,cAAc,EAAE;KACvE;CACF,CAAC,CAAC"}
|
|
@@ -10,20 +10,16 @@ export declare const XemaAuthzenSubjectKindSchema: z.ZodEnum<{
|
|
|
10
10
|
service: SubjectKind.Service;
|
|
11
11
|
"external-subject": SubjectKind.ExternalSubject;
|
|
12
12
|
}>;
|
|
13
|
-
export declare const XemaOrgAuthorityInstrumentSchema: z.
|
|
13
|
+
export declare const XemaOrgAuthorityInstrumentSchema: z.ZodObject<{
|
|
14
14
|
kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
|
|
15
15
|
orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
|
|
16
|
-
}, z.core.$strict
|
|
17
|
-
kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
|
|
18
|
-
}, z.core.$strict>], "kind">;
|
|
16
|
+
}, z.core.$strict>;
|
|
19
17
|
export type XemaOrgAuthorityInstrument = z.infer<typeof XemaOrgAuthorityInstrumentSchema>;
|
|
20
18
|
export declare const XemaAuthzenSubjectPropertiesSchema: z.ZodObject<{
|
|
21
|
-
orgAuthority: z.ZodOptional<z.
|
|
19
|
+
orgAuthority: z.ZodOptional<z.ZodObject<{
|
|
22
20
|
kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
|
|
23
21
|
orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
|
|
24
|
-
}, z.core.$strict
|
|
25
|
-
kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
|
|
26
|
-
}, z.core.$strict>], "kind">>;
|
|
22
|
+
}, z.core.$strict>>;
|
|
27
23
|
}, z.core.$strict>;
|
|
28
24
|
export type XemaAuthzenSubjectProperties = z.infer<typeof XemaAuthzenSubjectPropertiesSchema>;
|
|
29
25
|
export declare const XemaAuthzenSubjectSchema: z.ZodObject<{
|
|
@@ -36,12 +32,10 @@ export declare const XemaAuthzenSubjectSchema: z.ZodObject<{
|
|
|
36
32
|
}>;
|
|
37
33
|
id: z.ZodString;
|
|
38
34
|
properties: z.ZodOptional<z.ZodObject<{
|
|
39
|
-
orgAuthority: z.ZodOptional<z.
|
|
35
|
+
orgAuthority: z.ZodOptional<z.ZodObject<{
|
|
40
36
|
kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
|
|
41
37
|
orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
|
|
42
|
-
}, z.core.$strict
|
|
43
|
-
kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
|
|
44
|
-
}, z.core.$strict>], "kind">>;
|
|
38
|
+
}, z.core.$strict>>;
|
|
45
39
|
}, z.core.$strict>>;
|
|
46
40
|
}, z.core.$strict>;
|
|
47
41
|
export type XemaAuthzenSubject = z.infer<typeof XemaAuthzenSubjectSchema>;
|
|
@@ -128,12 +122,10 @@ export declare const XemaAccessEvaluationRequestSchema: z.ZodObject<{
|
|
|
128
122
|
}>;
|
|
129
123
|
id: z.ZodString;
|
|
130
124
|
properties: z.ZodOptional<z.ZodObject<{
|
|
131
|
-
orgAuthority: z.ZodOptional<z.
|
|
125
|
+
orgAuthority: z.ZodOptional<z.ZodObject<{
|
|
132
126
|
kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
|
|
133
127
|
orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
|
|
134
|
-
}, z.core.$strict
|
|
135
|
-
kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
|
|
136
|
-
}, z.core.$strict>], "kind">>;
|
|
128
|
+
}, z.core.$strict>>;
|
|
137
129
|
}, z.core.$strict>>;
|
|
138
130
|
}, z.core.$strict>;
|
|
139
131
|
action: z.ZodObject<{
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAGL,WAAW,EACZ,MAAM,eAAe,CAAC;AA6BvB,eAAO,MAAM,0BAA0B,mHAS5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;;EAAqC,CAAC;
|
|
1
|
+
{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAGL,WAAW,EACZ,MAAM,eAAe,CAAC;AA6BvB,eAAO,MAAM,0BAA0B,mHAS5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;;EAAqC,CAAC;AAa/E,eAAO,MAAM,gCAAgC;;;kBAKlC,CAAC;AACZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAQF,eAAO,MAAM,kCAAkC;;;;;kBAIpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAY1E,eAAO,MAAM,oCAAoC,qCAEtC,CAAC;AAGZ,eAAO,MAAM,iCAAiC;;;;;kBAKnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AASF,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAO5C,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAG/C,eAAO,MAAM,iCAAiC,QAAe,CAAC;AAE9D,eAAO,MAAM,6BAA6B,aAKtC,CAAC;AAGL,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYxE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,CAQ5E;AAiBD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxD,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAgBT;AAGD,eAAO,MAAM,yBAAyB;;;;kBAAwB,CAAC;AAM/D,eAAO,MAAM,uBAAuB;;;kBAIlC,CAAC;AA6BH,eAAO,MAAM,2BAA2B;;;;;;;;;kBAW7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAahF,eAAO,MAAM,yBAAyB;;;kBAK3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AA2B5E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;kBAU1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAWF,oBAAY,qBAAqB;IAE/B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,oBAAoB,2BAA2B;IAE/C,kBAAkB,wBAAwB;IAE1C,sBAAsB,6BAA6B;IAEnD,6BAA6B,qCAAqC;IAElE,yBAAyB,gCAAgC;IAEzD,cAAc,oBAAoB;IAElC,kBAAkB,wBAAwB;IAQ1C,mBAAmB,0BAA0B;CAC9C;AAED,eAAO,MAAM,2BAA2B,yCAAsC,CAAC;AAO/E,oBAAY,oBAAoB;IAE9B,YAAY,mBAAmB;IAE/B,eAAe,qBAAqB;IAEpC,oBAAoB,0BAA0B;IAE9C,WAAW,iBAAiB;IAE5B,aAAa,mBAAmB;IAEhC,gBAAgB,sBAAsB;CACvC;AAED,eAAO,MAAM,0BAA0B,wCAAqC,CAAC;AAG7E,eAAO,MAAM,0BAA0B;;;;kBAM5B,CAAC;AAOZ,eAAO,MAAM,gCAAgC;;;;;;;;iBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAOF,eAAO,MAAM,0BAA0B;;;0DAKR,CAAC"}
|
|
@@ -22,15 +22,12 @@ exports.XEMA_AUTHZEN_SUBJECT_KINDS = Object.freeze([
|
|
|
22
22
|
subject_1.SubjectKind.ExternalSubject,
|
|
23
23
|
]);
|
|
24
24
|
exports.XemaAuthzenSubjectKindSchema = zod_1.z.enum(exports.XEMA_AUTHZEN_SUBJECT_KINDS);
|
|
25
|
-
exports.XemaOrgAuthorityInstrumentSchema = zod_1.z
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
.strict(),
|
|
32
|
-
zod_1.z.object({ kind: zod_1.z.literal(audit_1.AuditAuthorityKind.PlatformAdmin) }).strict(),
|
|
33
|
-
]);
|
|
25
|
+
exports.XemaOrgAuthorityInstrumentSchema = zod_1.z
|
|
26
|
+
.object({
|
|
27
|
+
kind: zod_1.z.literal(audit_1.AuditAuthorityKind.OrgRole),
|
|
28
|
+
orgRole: tenant_1.OrgRoleSchema,
|
|
29
|
+
})
|
|
30
|
+
.strict();
|
|
34
31
|
exports.XemaAuthzenSubjectPropertiesSchema = zod_1.z
|
|
35
32
|
.object({
|
|
36
33
|
orgAuthority: exports.XemaOrgAuthorityInstrumentSchema.optional(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;AAyKA,8CAYC;AAQD,4DAQC;AAiBD,oDAmBC;AAzOD,6BAAwB;AAExB,yEAGoC;AAEpC,uCAAiD;AACjD,iDAA4D;AAC5D,+DAIiC;AACjC,uCAAuD;AACvD,2CAIuB;AACvB,yCAA6C;AAE7C,yDAI4B;AAC5B,yDAAkE;AAqBrD,QAAA,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,qBAAW,CAAC,IAAI;IAChB,qBAAW,CAAC,KAAK;IACjB,qBAAW,CAAC,OAAO;IAInB,qBAAW,CAAC,GAAG;IACf,qBAAW,CAAC,eAAe;CACnB,CAAC,CAAC;AAIC,QAAA,4BAA4B,GAAG,OAAC,CAAC,IAAI,CAAC,kCAA0B,CAAC,CAAC;AAalE,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,OAAO,CAAC;IAC3C,OAAO,EAAE,sBAAa;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAWC,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,YAAY,EAAE,wCAAgC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,oCAA4B;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,0CAAkC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAaC,QAAA,oCAAoC,GAAG,MAAM,CAAC,MAAM,CAAC;IAChE,qBAAW,CAAC,YAAY;CAChB,CAAC,CAAC;AAGC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,4CAAoC,CAAC;IAClD,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAYC,QAAA,sBAAsB,GAAG,KAAK,CAAC;AAO/B,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAGlC,QAAA,iCAAiC,GAAG,YAAY,CAAC;AAEjD,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,EAAE;IAC7B,OAAO,EACL,8GAA8G;CACjH,CAAC,CAAC;AAGL,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AALD,oEAKC;AAGD,SAAgB,iBAAiB,CAAC,KAAa,EAAE,OAAe;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,SAAS,EAAE,OAAO,CAAC;KACZ,EAAE,CAAC;QACX,IAAI,CAAC,yCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CACpC,sBAAsB,IAAI,KAAK,OAAO,oDAAoD,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,GAAG,mCAA2B,GAAG,OAAO,EAAE,CAAC;AAC5D,CAAC;AAQD,SAAgB,wBAAwB,CAAC,EAAU;IACjD,IAAI,CAAC,qCAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,4BAA4B,CACpC,8BAA8B,EAAE,iCAAiC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,mCAA2B,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAiBD,SAAgB,oBAAoB,CAClC,QAAwD,EACxD,KAAoB;IAEpB,IAAI,QAAQ,CAAC,IAAI,KAAK,wDAA6B,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,oDAAyB,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAsB,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,qCAA6B,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;AAC/D,CAAC;AAGY,QAAA,yBAAyB,GAAG,wCAAqB,CAAC;AAMlD,QAAA,uBAAuB,GAAG,sCAAmB,CAAC,MAAM,CAAC;IAChE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC1C,OAAO,EAAE,iDAAiD;KAC3D,CAAC;CACH,CAAC,CAAC;AA6BU,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,gCAAY,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,+CAA2B,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,+BAAqB,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,qCAAwB,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,qDAAiC,CAAC,QAAQ,EAAE;IACzD,sBAAsB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;IAC3D,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAcC,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AA4BC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,kCAAwB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,iCAAyB,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,gCAAwB;IACjC,MAAM,EAAE,+BAAuB;IAC/B,QAAQ,EAAE,iCAAyB;IACnC,OAAO,EAAE,gCAAwB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAcZ,IAAY,qBA2BX;AA3BD,WAAY,qBAAqB;IAE/B,2DAAkC,CAAA;IAElC,8DAAqC,CAAA;IAErC,wEAA+C,CAAA;IAE/C,mEAA0C,CAAA;IAE1C,4EAAmD,CAAA;IAEnD,2FAAkE,CAAA;IAElE,kFAAyD,CAAA;IAEzD,2DAAkC,CAAA;IAElC,mEAA0C,CAAA;IAQ1C,sEAA6C,CAAA;AAC/C,CAAC,EA3BW,qBAAqB,qCAArB,qBAAqB,QA2BhC;AAEY,QAAA,2BAA2B,GAAG,OAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAO/E,IAAY,oBAaX;AAbD,WAAY,oBAAoB;IAE9B,uDAA+B,CAAA;IAE/B,4DAAoC,CAAA;IAEpC,sEAA8C,CAAA;IAE9C,oDAA4B,CAAA;IAE5B,wDAAgC,CAAA;IAEhC,8DAAsC,CAAA;AACxC,CAAC,EAbW,oBAAoB,oCAApB,oBAAoB,QAa/B;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAGhE,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,kCAA0B;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,gCAAgC,GAAG,OAAC,CAAC,MAAM,CAAC;IACvD,WAAW,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,kCAA0B,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAUU,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,kCAA0B;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,GAAG,CAAC,0CAAuB,CAAC,CAAC"}
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
export declare const RESOLVED_DEPLOYMENT_SCHEMA_VERSION: 1;
|
|
3
|
+
export declare const RESOLVER_PACKAGE: "@xemahq/contracts";
|
|
3
4
|
export declare const ResolvedDeploymentSchema: z.ZodObject<{
|
|
4
5
|
schemaVersion: z.ZodLiteral<1>;
|
|
5
6
|
deployment: z.ZodString;
|
|
@@ -24,14 +25,12 @@ export declare const ResolvedDeploymentSchema: z.ZodObject<{
|
|
|
24
25
|
}, z.core.$strict>>;
|
|
25
26
|
}, z.core.$strict>>;
|
|
26
27
|
provenance: z.ZodObject<{
|
|
27
|
-
|
|
28
|
-
|
|
28
|
+
topologyInputHash: z.ZodString;
|
|
29
|
+
chartSetDigest: z.ZodString;
|
|
30
|
+
resolver: z.ZodObject<{
|
|
31
|
+
package: z.ZodLiteral<"@xemahq/contracts">;
|
|
29
32
|
version: z.ZodString;
|
|
30
33
|
}, z.core.$strict>;
|
|
31
|
-
source: z.ZodObject<{
|
|
32
|
-
repository: z.ZodString;
|
|
33
|
-
commit: z.ZodString;
|
|
34
|
-
}, z.core.$strict>;
|
|
35
34
|
}, z.core.$strict>;
|
|
36
35
|
}, z.core.$strict>;
|
|
37
36
|
export type ResolvedDeployment = z.infer<typeof ResolvedDeploymentSchema>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resolved-deployment.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/resolved-deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"resolved-deployment.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/resolved-deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAwDxB,eAAO,MAAM,kCAAkC,EAAG,CAAU,CAAC;AAG7D,eAAO,MAAM,gBAAgB,EAAG,mBAA4B,CAAC;AAoC7D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiFjC,CAAC;AAEL,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
|
|
@@ -1,11 +1,12 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.ResolvedDeploymentSchema = exports.RESOLVED_DEPLOYMENT_SCHEMA_VERSION = void 0;
|
|
3
|
+
exports.ResolvedDeploymentSchema = exports.RESOLVER_PACKAGE = exports.RESOLVED_DEPLOYMENT_SCHEMA_VERSION = void 0;
|
|
4
4
|
const zod_1 = require("zod");
|
|
5
5
|
const deployment_id_1 = require("./deployment-id");
|
|
6
6
|
const trust_domain_1 = require("./trust-domain");
|
|
7
7
|
const trust_partition_1 = require("./trust-partition");
|
|
8
8
|
exports.RESOLVED_DEPLOYMENT_SCHEMA_VERSION = 1;
|
|
9
|
+
exports.RESOLVER_PACKAGE = '@xemahq/contracts';
|
|
9
10
|
const DnsLabelSchema = zod_1.z
|
|
10
11
|
.string()
|
|
11
12
|
.min(1)
|
|
@@ -47,11 +48,16 @@ exports.ResolvedDeploymentSchema = zod_1.z
|
|
|
47
48
|
serviceAccounts: zod_1.z.array(ResolvedServiceAccountSchema),
|
|
48
49
|
provenance: zod_1.z
|
|
49
50
|
.object({
|
|
50
|
-
|
|
51
|
-
|
|
51
|
+
topologyInputHash: zod_1.z
|
|
52
|
+
.string()
|
|
53
|
+
.regex(/^[0-9a-f]{64}$/, 'must be a lowercase sha256 hex digest'),
|
|
54
|
+
chartSetDigest: zod_1.z
|
|
55
|
+
.string()
|
|
56
|
+
.regex(/^sha256:[0-9a-f]{64}$/, 'must be an OCI index digest, sha256:<64 hex>'),
|
|
57
|
+
resolver: zod_1.z
|
|
52
58
|
.object({
|
|
53
|
-
|
|
54
|
-
|
|
59
|
+
package: zod_1.z.literal(exports.RESOLVER_PACKAGE),
|
|
60
|
+
version: zod_1.z.string().min(1),
|
|
55
61
|
})
|
|
56
62
|
.strict(),
|
|
57
63
|
})
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resolved-deployment.js","sourceRoot":"","sources":["../../../src/deployment/lib/resolved-deployment.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,mDAAwD;AACxD,iDAIwB;AACxB,uDAG2B;
|
|
1
|
+
{"version":3,"file":"resolved-deployment.js","sourceRoot":"","sources":["../../../src/deployment/lib/resolved-deployment.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,mDAAwD;AACxD,iDAIwB;AACxB,uDAG2B;AA6Cd,QAAA,kCAAkC,GAAG,CAAU,CAAC;AAGhD,QAAA,gBAAgB,GAAG,mBAA4B,CAAC;AAG7D,MAAM,cAAc,GAAG,OAAC;KACrB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,iCAAiC,EAAE,+BAA+B,CAAC,CAAC;AAM7E,MAAM,aAAa,GAAG,OAAC;KACpB,MAAM,EAAE;KACR,KAAK,CAAC,4CAA6B,EAAE,uCAAuC,CAAC,CAAC;AAEjF,MAAM,mBAAmB,GAAG,OAAC;KAC1B,MAAM,CAAC;IACN,EAAE,EAAE,aAAa;IACjB,YAAY,EAAE,gCAAiB;IAC/B,WAAW,EAAE,gCAAiB;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,4BAA4B,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;IAEpB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,OAAC;SACP,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC;CACV,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,0CAAkC,CAAC;IAC5D,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qCAAqB,EAAE,yBAAyB,CAAC;IAC9E,gBAAgB,EAAE,cAAc;IAChC,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,uCAAuC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC;IACtD,UAAU,EAAE,OAAC;SACV,MAAM,CAAC;QACN,iBAAiB,EAAE,OAAC;aACjB,MAAM,EAAE;aACR,KAAK,CAAC,gBAAgB,EAAE,uCAAuC,CAAC;QACnE,cAAc,EAAE,OAAC;aACd,MAAM,EAAE;aACR,KAAK,CAAC,uBAAuB,EAAE,8CAA8C,CAAC;QACjF,QAAQ,EAAE,OAAC;aACR,MAAM,CAAC;YACN,OAAO,EAAE,OAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC;YACpC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAC3B,CAAC;aACD,MAAM,EAAE;KACZ,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;gBAC7B,OAAO,EAAE,wCAAwC;aAClD,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,aAAa,CAAU,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,IACE,KAAK,CAAC,UAAU,CAAC,8CAA+B,CAAC;gBACjD,KAAK,KAAK,GAAG,8CAA+B,GAAG,KAAK,CAAC,EAAE,EAAE,EACzD,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;oBAC9B,OAAO,EAAE,IAAI,KAAK,6CAA6C,KAAK,CAAC,EAAE,eAAe;iBACvF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC,CAAC,CAAC;IAGH,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAClD,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAClF,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC;gBACxC,OAAO,EAAE,wCAAwC;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,SAAS,IAAI;QACtB,GAAG,IAAA,sCAAoB,EAAC,QAAQ,CAAC,MAAM,CAAC;QACxC,GAAG,IAAA,4CAA0B,EAC3B,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzC,cAAc,EAAE,OAAO,CAAC,IAAI;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,EACH,QAAQ,CACT;KACF,EAAE,CAAC;QACF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"composed-process-contract.d.ts","sourceRoot":"","sources":["../../../src/process-topology/lib/composed-process-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"composed-process-contract.d.ts","sourceRoot":"","sources":["../../../src/process-topology/lib/composed-process-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAsBrE,eAAO,MAAM,oBAAoB;;;;;;;EAatB,CAAC;AAYZ,eAAO,MAAM,wBAAwB,EAiBtB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAE7C,eAAO,MAAM,4BAA4B,2GAAoC,CAAC;AAG9E,eAAO,MAAM,8BAA8B,uCAG1C,CAAC;AAEF,eAAO,MAAM,4CAA4C,EAAG,CAAU,CAAC;AAUvE,eAAO,MAAM,gCAAgC;;;;;;;;;kBAWlC,CAAC;AACZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC"}
|
|
@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
3
3
|
exports.ComposedProcessMemberIndexSchema = exports.COMPOSED_PROCESS_MEMBER_INDEX_SCHEMA_VERSION = exports.ProcessMemberEnvPrefixesSchema = exports.ProcessMemberFactsListSchema = exports.ProcessMemberFactsSchema = exports.COMPOSED_PROCESS_ENV = void 0;
|
|
4
4
|
const zod_1 = require("zod");
|
|
5
5
|
const biome_1 = require("../../biome");
|
|
6
|
+
const deployment_1 = require("../../deployment");
|
|
6
7
|
exports.COMPOSED_PROCESS_ENV = Object.freeze({
|
|
7
8
|
Name: 'XEMA_PROCESS_NAME',
|
|
8
9
|
Definition: 'XEMA_PROCESS_DEFINITION',
|
|
@@ -28,6 +29,7 @@ exports.ProcessMemberFactsSchema = zod_1.z
|
|
|
28
29
|
buildSource: zod_1.z
|
|
29
30
|
.object({ repository: zod_1.z.string().min(1), commit: CommitSchema })
|
|
30
31
|
.strict(),
|
|
32
|
+
trustCeiling: deployment_1.TrustDomainSchema.optional(),
|
|
31
33
|
kernelMajor: zod_1.z.number().int().nonnegative().optional(),
|
|
32
34
|
})
|
|
33
35
|
.strict();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"composed-process-contract.js","sourceRoot":"","sources":["../../../src/process-topology/lib/composed-process-contract.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,uCAMqB;
|
|
1
|
+
{"version":3,"file":"composed-process-contract.js","sourceRoot":"","sources":["../../../src/process-topology/lib/composed-process-contract.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,uCAMqB;AACrB,iDAAqD;AAuBxC,QAAA,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAEhD,IAAI,EAAE,mBAAmB;IAEzB,UAAU,EAAE,yBAAyB;IAErC,WAAW,EAAE,2BAA2B;IAExC,WAAW,EAAE,2BAA2B;IAExC,iBAAiB,EAAE,kCAAkC;IAErD,WAAW,EAAE,4BAA4B;CACjC,CAAC,CAAC;AAEZ,MAAM,eAAe,GAAG,OAAC;KACtB,MAAM,EAAE;KACR,KAAK,CACJ,oCAAoC,EACpC,4CAA4C,CAC7C,CAAC;AAEJ,MAAM,YAAY,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;AAGnE,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACnD,aAAa,EAAE,OAAC,CAAC,UAAU,CAAC,0BAAkB,CAAC;IAC/C,SAAS,EAAE,OAAC,CAAC,UAAU,CAAC,+BAAuB,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,wBAAgB,CAAC;IAC3C,YAAY,EAAE,wCAAgC,CAAC,QAAQ,EAAE;IACzD,MAAM,EAAE,OAAC,CAAC,UAAU,CAAC,mBAAW,CAAC;IACjC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,WAAW,EAAE,OAAC;SACX,MAAM,CAAC,EAAE,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SAC/D,MAAM,EAAE;IAEX,YAAY,EAAE,8BAAiB,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,MAAM,EAAmC,CAAC;AAEhC,QAAA,4BAA4B,GAAG,OAAC,CAAC,KAAK,CAAC,gCAAwB,CAAC,CAAC;AAGjE,QAAA,8BAA8B,GAAG,OAAC,CAAC,MAAM,CACpD,eAAe,EACf,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CACtE,CAAC;AAEW,QAAA,4CAA4C,GAAG,CAAU,CAAC;AAU1D,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,oDAA4C,CAAC;IACtE,WAAW,EAAE,OAAC;SACX,MAAM,CAAC,EAAE,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SAC/D,MAAM,EAAE;IACX,OAAO,EAAE,OAAC,CAAC,MAAM,CACf,eAAe,EACf,OAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAChD;CACF,CAAC;KACD,MAAM,EAAE,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/contracts",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.74.0",
|
|
4
4
|
"description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework deps; the one runtime dependency beside zod is the OpenFGA syntax transformer the authorization-module composer runs.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|