@xemahq/kernel-contracts 0.49.3 → 0.50.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/app-definition/lib/automation.d.ts.map +1 -1
- package/dist/app-definition/lib/automation.js.map +1 -1
- package/dist/capability/lib/capability-contribution.d.ts +2 -0
- package/dist/capability/lib/capability-contribution.d.ts.map +1 -1
- package/dist/capability/lib/capability-contribution.js +2 -0
- package/dist/capability/lib/capability-contribution.js.map +1 -1
- package/dist/space/lib/space.d.ts +2 -0
- package/dist/space/lib/space.d.ts.map +1 -1
- package/dist/space/lib/space.js +12 -1
- package/dist/space/lib/space.js.map +1 -1
- package/package.json +1 -1
- package/src/app-definition/lib/automation.ts +3 -2
- package/src/capability/lib/capability-contribution.ts +25 -0
- package/src/space/lib/space.ts +38 -0
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"automation.d.ts","sourceRoot":"","sources":["../../../src/app-definition/lib/automation.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"automation.d.ts","sourceRoot":"","sources":["../../../src/app-definition/lib/automation.ts"],"names":[],"mappings":"AAeA,oBAAY,oBAAoB;IAC9B,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B,SAAS,cAAc;CACxB;AAMD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAElB,MAAM,EAAE,MAAM,CAAC;IAMf,QAAQ,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"automation.js","sourceRoot":"","sources":["../../../src/app-definition/lib/automation.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"automation.js","sourceRoot":"","sources":["../../../src/app-definition/lib/automation.ts"],"names":[],"mappings":";;;AAeA,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,uDAA+B,CAAA;IAC/B,uDAA+B,CAAA;IAC/B,+CAAuB,CAAA;AACzB,CAAC,EAJW,oBAAoB,oCAApB,oBAAoB,QAI/B"}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
import { type CapabilityRef } from './capability-ref';
|
|
3
3
|
import { type CapabilityRiskTier } from './permission-profile';
|
|
4
|
+
import { type DataClassification } from '../../space';
|
|
4
5
|
export interface CapabilityContributionManifest {
|
|
5
6
|
readonly ref: CapabilityRef;
|
|
6
7
|
readonly title: string;
|
|
@@ -13,6 +14,7 @@ export interface CapabilityContributionManifest {
|
|
|
13
14
|
readonly examples?: readonly Record<string, unknown>[];
|
|
14
15
|
readonly externalServiceRef?: string;
|
|
15
16
|
readonly defaultCredentialBindingRef?: string;
|
|
17
|
+
readonly outputClassification?: DataClassification;
|
|
16
18
|
}
|
|
17
19
|
export declare const CapabilityContributionManifestSchema: z.ZodType<CapabilityContributionManifest>;
|
|
18
20
|
//# sourceMappingURL=capability-contribution.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,aAAa,CAAC;AAsBrB,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE/C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAKtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAKnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAUvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAOrC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAoB9C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;CACpD;AAcD,eAAO,MAAM,oCAAoC,EAAE,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAiB1C,CAAC"}
|
|
@@ -4,6 +4,7 @@ exports.CapabilityContributionManifestSchema = void 0;
|
|
|
4
4
|
const zod_1 = require("zod");
|
|
5
5
|
const capability_ref_1 = require("./capability-ref");
|
|
6
6
|
const permission_profile_1 = require("./permission-profile");
|
|
7
|
+
const space_1 = require("../../space");
|
|
7
8
|
exports.CapabilityContributionManifestSchema = zod_1.z.object({
|
|
8
9
|
ref: capability_ref_1.CapabilityRefSchema,
|
|
9
10
|
title: zod_1.z.string().min(1).max(200),
|
|
@@ -19,5 +20,6 @@ exports.CapabilityContributionManifestSchema = zod_1.z.object({
|
|
|
19
20
|
.optional(),
|
|
20
21
|
externalServiceRef: zod_1.z.string().min(1).max(200).optional(),
|
|
21
22
|
defaultCredentialBindingRef: zod_1.z.string().min(1).max(200).optional(),
|
|
23
|
+
outputClassification: space_1.DataClassificationSchema.optional(),
|
|
22
24
|
});
|
|
23
25
|
//# sourceMappingURL=capability-contribution.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"capability-contribution.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,qDAA2E;AAC3E,6DAG8B;
|
|
1
|
+
{"version":3,"file":"capability-contribution.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,qDAA2E;AAC3E,6DAG8B;AAC9B,uCAGqB;AAkGR,QAAA,oCAAoC,GAC/C,OAAC,CAAC,MAAM,CAAC;IACP,GAAG,EAAE,oCAAmB;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC/C,QAAQ,EAAE,6CAAwB;IAClC,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC7B,QAAQ,EAAE,OAAC;SACR,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SACxC,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;IACb,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,2BAA2B,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClE,oBAAoB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CAC1D,CAA8C,CAAC"}
|
|
@@ -28,6 +28,8 @@ export interface SpaceRef {
|
|
|
28
28
|
}
|
|
29
29
|
export declare const SpaceKindSchema: z.ZodEnum<typeof SpaceKind>;
|
|
30
30
|
export declare const DataClassificationSchema: z.ZodEnum<typeof DataClassification>;
|
|
31
|
+
export declare const DATA_CLASSIFICATION_RANK: Readonly<Record<DataClassification, number>>;
|
|
32
|
+
export declare function dataClassificationExceeds(candidate: DataClassification, cap: DataClassification): boolean;
|
|
31
33
|
export declare const SpaceRefSchema: z.ZodObject<{
|
|
32
34
|
tier: z.ZodEnum<typeof SpaceKind>;
|
|
33
35
|
orgId: z.ZodOptional<z.ZodString>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"space.d.ts","sourceRoot":"","sources":["../../../src/space/lib/space.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,SAAS;IACnB,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAGD,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,MAAM,WAAW;IACjB,SAAS,cAAc;CACxB;AAeD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED,eAAO,MAAM,eAAe,6BAA0B,CAAC;AACvD,eAAO,MAAM,wBAAwB,sCAAmC,CAAC;
|
|
1
|
+
{"version":3,"file":"space.d.ts","sourceRoot":"","sources":["../../../src/space/lib/space.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,SAAS;IACnB,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAGD,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,MAAM,WAAW;IACjB,SAAS,cAAc;CACxB;AAeD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED,eAAO,MAAM,eAAe,6BAA0B,CAAC;AACvD,eAAO,MAAM,wBAAwB,sCAAmC,CAAC;AAkBzE,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAC7C,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAOnC,CAAC;AAOF,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,kBAAkB,EAC7B,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAET;AAyCD,eAAO,MAAM,cAAc;;;;;;;;;;iBAEa,CAAC;AAiBzC,wBAAgB,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAuCpD;AAOD,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,QAAQ,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC"}
|
package/dist/space/lib/space.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.SpaceRefSchema = exports.DataClassificationSchema = exports.SpaceKindSchema = exports.DataClassification = exports.SpaceKind = void 0;
|
|
3
|
+
exports.SpaceRefSchema = exports.DATA_CLASSIFICATION_RANK = exports.DataClassificationSchema = exports.SpaceKindSchema = exports.DataClassification = exports.SpaceKind = void 0;
|
|
4
|
+
exports.dataClassificationExceeds = dataClassificationExceeds;
|
|
4
5
|
exports.spaceRefToPath = spaceRefToPath;
|
|
5
6
|
const zod_1 = require("zod");
|
|
6
7
|
var SpaceKind;
|
|
@@ -23,6 +24,16 @@ var DataClassification;
|
|
|
23
24
|
})(DataClassification || (exports.DataClassification = DataClassification = {}));
|
|
24
25
|
exports.SpaceKindSchema = zod_1.z.nativeEnum(SpaceKind);
|
|
25
26
|
exports.DataClassificationSchema = zod_1.z.nativeEnum(DataClassification);
|
|
27
|
+
exports.DATA_CLASSIFICATION_RANK = {
|
|
28
|
+
[DataClassification.Public]: 0,
|
|
29
|
+
[DataClassification.Internal]: 1,
|
|
30
|
+
[DataClassification.Confidential]: 2,
|
|
31
|
+
[DataClassification.Secret]: 3,
|
|
32
|
+
[DataClassification.Regulated]: 4,
|
|
33
|
+
};
|
|
34
|
+
function dataClassificationExceeds(candidate, cap) {
|
|
35
|
+
return exports.DATA_CLASSIFICATION_RANK[candidate] > exports.DATA_CLASSIFICATION_RANK[cap];
|
|
36
|
+
}
|
|
26
37
|
const spaceRefBaseShape = {
|
|
27
38
|
tier: exports.SpaceKindSchema,
|
|
28
39
|
orgId: zod_1.z.string().min(1).optional(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"space.js","sourceRoot":"","sources":["../../../src/space/lib/space.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"space.js","sourceRoot":"","sources":["../../../src/space/lib/space.ts"],"names":[],"mappings":";;;AAyFA,8DAKC;AA4DD,wCAuCC;AAjMD,6BAAwB;AAWxB,IAAY,SAQX;AARD,WAAY,SAAS;IACnB,8BAAiB,CAAA;IACjB,wBAAW,CAAA;IACX,gCAAmB,CAAA;IACnB,wBAAW,CAAA;IACX,gCAAmB,CAAA;IACnB,4BAAe,CAAA;IACf,0BAAa,CAAA;AACf,CAAC,EARW,SAAS,yBAAT,SAAS,QAQpB;AAGD,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,2CAAqB,CAAA;IACrB,mDAA6B,CAAA;IAC7B,uCAAiB,CAAA;IACjB,6CAAuB,CAAA;AACzB,CAAC,EANW,kBAAkB,kCAAlB,kBAAkB,QAM7B;AA2BY,QAAA,eAAe,GAAG,OAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAC1C,QAAA,wBAAwB,GAAG,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAkB5D,QAAA,wBAAwB,GAEjC;IACF,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9B,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChC,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;IACpC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9B,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;CAClC,CAAC;AAOF,SAAgB,yBAAyB,CACvC,SAA6B,EAC7B,GAAuB;IAEvB,OAAO,gCAAwB,CAAC,SAAS,CAAC,GAAG,gCAAwB,CAAC,GAAG,CAAC,CAAC;AAC7E,CAAC;AAUD,MAAM,iBAAiB,GAAG;IACxB,IAAI,EAAE,uBAAe;IACrB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CAC3C,CAAC;AAIX,SAAS,wBAAwB,CAC/B,KAAwB,EACxB,GAAoB;IAEpB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAA8B,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,aAAa,KAAK,CAAC,IAAI,aAAa,GAAG,EAAE;gBAClD,IAAI,EAAE,CAAC,GAAG,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAEY,QAAA,cAAc,GAAG,OAAC;KAC5B,MAAM,CAAC,iBAAiB,CAAC;KACzB,WAAW,CAAC,wBAAwB,CAAC,CAAC;AAEzC,MAAM,iBAAiB,GAAuD;IAC5E,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE;IACtB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC;IAC1B,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;IAC3C,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC;IAChD,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC;IAClC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC;IAC9B,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC;CAC7B,CAAC;AAOF,SAAgB,cAAc,CAAC,GAAa;IAC1C,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,SAAS,CAAC,MAAM;YACnB,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS,CAAC,KAAK;YAClB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,WAAW,GAAG,CAAC,OAAO,EAAE,CAAC;QAClC,KAAK,SAAS,CAAC,GAAG;YAChB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,SAAS,GAAG,CAAC,KAAK,EAAE,CAAC;QAC9B,KAAK,SAAS,CAAC,OAAO;YACpB,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,SAAS,GAAG,CAAC,KAAK,aAAa,GAAG,CAAC,SAAS,EAAE,CAAC;QACxD,KAAK,SAAS,CAAC,GAAG;YAChB,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;YACJ,CAAC;YACD,OAAO,SAAS,GAAG,CAAC,KAAK,aAAa,GAAG,CAAC,SAAS,SAAS,GAAG,CAAC,KAAK,EAAE,CAAC;QAC1E,KAAK,SAAS,CAAC,OAAO;YACpB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,aAAa,GAAG,CAAC,SAAS,EAAE,CAAC;QACtC,KAAK,SAAS,CAAC,IAAI;YACjB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;IAClC,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/kernel-contracts",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.50.0",
|
|
4
4
|
"description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|
|
@@ -9,8 +9,9 @@
|
|
|
9
9
|
*
|
|
10
10
|
* - `recordCreated` / `recordUpdated` fire transactionally-adjacent to a record
|
|
11
11
|
* write, against the written record.
|
|
12
|
-
* - `scheduled` fires on a cluster-singleton
|
|
13
|
-
* action against every record of the bound entity on
|
|
12
|
+
* - `scheduled` fires on a cluster-singleton schedule owned by the workflow
|
|
13
|
+
* runtime, and runs its action against every record of the bound entity on
|
|
14
|
+
* each tick.
|
|
14
15
|
*/
|
|
15
16
|
export enum AppAutomationTrigger {
|
|
16
17
|
RecordCreated = 'recordCreated',
|
|
@@ -5,6 +5,10 @@ import {
|
|
|
5
5
|
CapabilityRiskTierSchema,
|
|
6
6
|
type CapabilityRiskTier,
|
|
7
7
|
} from './permission-profile';
|
|
8
|
+
import {
|
|
9
|
+
DataClassificationSchema,
|
|
10
|
+
type DataClassification,
|
|
11
|
+
} from '../../space';
|
|
8
12
|
|
|
9
13
|
/**
|
|
10
14
|
* Manifest shape carried by every `ContributionKind.Capability` envelope.
|
|
@@ -68,6 +72,26 @@ export interface CapabilityContributionManifest {
|
|
|
68
72
|
* broker), NEVER a secret. Only meaningful alongside `externalServiceRef`.
|
|
69
73
|
*/
|
|
70
74
|
readonly defaultCredentialBindingRef?: string;
|
|
75
|
+
/**
|
|
76
|
+
* OPTIONAL declared classification of the data this capability RETURNS.
|
|
77
|
+
*
|
|
78
|
+
* It is the static value the capability-router's
|
|
79
|
+
* `restrict-output-classification` policy obligation compares against: if a
|
|
80
|
+
* capability DECLARES an output classification that is strictly more
|
|
81
|
+
* restrictive than the invocation context's cap, the invocation is REFUSED —
|
|
82
|
+
* a comparison of two declared values, with no need to inspect response
|
|
83
|
+
* bytes.
|
|
84
|
+
*
|
|
85
|
+
* Optional BY DESIGN — this is the load-bearing safety rule, not a silent
|
|
86
|
+
* default. An UNDECLARED classification means the capability makes NO claim to
|
|
87
|
+
* return restricted data, so it "does not exceed" any cap and PASSES every
|
|
88
|
+
* clamp. Only a capability that EXPLICITLY declares a classification above the
|
|
89
|
+
* cap fails closed. This keeps re-enabling the obligation additive: a
|
|
90
|
+
* capability that declares nothing (every capability today) is never newly
|
|
91
|
+
* refused. Do NOT change the absent case to fail closed — that would reproduce
|
|
92
|
+
* the mass-denial that removing the obligation fixed.
|
|
93
|
+
*/
|
|
94
|
+
readonly outputClassification?: DataClassification;
|
|
71
95
|
}
|
|
72
96
|
|
|
73
97
|
/**
|
|
@@ -98,4 +122,5 @@ export const CapabilityContributionManifestSchema: z.ZodType<CapabilityContribut
|
|
|
98
122
|
.optional(),
|
|
99
123
|
externalServiceRef: z.string().min(1).max(200).optional(),
|
|
100
124
|
defaultCredentialBindingRef: z.string().min(1).max(200).optional(),
|
|
125
|
+
outputClassification: DataClassificationSchema.optional(),
|
|
101
126
|
}) as z.ZodType<CapabilityContributionManifest>;
|
package/src/space/lib/space.ts
CHANGED
|
@@ -56,6 +56,44 @@ export interface SpaceRef {
|
|
|
56
56
|
export const SpaceKindSchema = z.nativeEnum(SpaceKind);
|
|
57
57
|
export const DataClassificationSchema = z.nativeEnum(DataClassification);
|
|
58
58
|
|
|
59
|
+
/**
|
|
60
|
+
* Total order over {@link DataClassification} — least → most restrictive.
|
|
61
|
+
*
|
|
62
|
+
* Public(0) < Internal(1) < Confidential(2) < Secret(3) < Regulated(4)
|
|
63
|
+
*
|
|
64
|
+
* This is the SINGLE authoritative ordering of the closed set (consumed by the
|
|
65
|
+
* capability-router's `restrict-output-classification` obligation clamp, and by
|
|
66
|
+
* any future declared-vs-cap comparison). Every enum member has a rank so the
|
|
67
|
+
* comparison is total and deterministic — never an ad-hoc string compare.
|
|
68
|
+
*
|
|
69
|
+
* `Regulated` ranks HIGHEST (most restrictive) on purpose: data under a
|
|
70
|
+
* regulatory regime is at least as sensitive as `Secret`, and putting it at the
|
|
71
|
+
* top makes the cap comparison fail CLOSED — a capability declaring `regulated`
|
|
72
|
+
* output is refused unless the cap is also `regulated`, never accidentally
|
|
73
|
+
* treated as below `secret`.
|
|
74
|
+
*/
|
|
75
|
+
export const DATA_CLASSIFICATION_RANK: Readonly<
|
|
76
|
+
Record<DataClassification, number>
|
|
77
|
+
> = {
|
|
78
|
+
[DataClassification.Public]: 0,
|
|
79
|
+
[DataClassification.Internal]: 1,
|
|
80
|
+
[DataClassification.Confidential]: 2,
|
|
81
|
+
[DataClassification.Secret]: 3,
|
|
82
|
+
[DataClassification.Regulated]: 4,
|
|
83
|
+
};
|
|
84
|
+
|
|
85
|
+
/**
|
|
86
|
+
* `true` iff `candidate` is STRICTLY more restrictive than `cap` in the
|
|
87
|
+
* {@link DATA_CLASSIFICATION_RANK} order — i.e. `candidate` "exceeds the cap".
|
|
88
|
+
* Equal or lower ranks return `false` (the cap is satisfied).
|
|
89
|
+
*/
|
|
90
|
+
export function dataClassificationExceeds(
|
|
91
|
+
candidate: DataClassification,
|
|
92
|
+
cap: DataClassification,
|
|
93
|
+
): boolean {
|
|
94
|
+
return DATA_CLASSIFICATION_RANK[candidate] > DATA_CLASSIFICATION_RANK[cap];
|
|
95
|
+
}
|
|
96
|
+
|
|
59
97
|
type SegmentKey =
|
|
60
98
|
| 'orgId'
|
|
61
99
|
| 'projectId'
|