@yourrealm/sdk 0.0.0-alpha.1378.ce03c8dc

package/src/security.ts

@@ -0,0 +1,594 @@
+// Home-side security primitives: the loose outer-shape parser for a stored
+// grants blob (`grantsSchema`), the strict write-time filter (`sanitizeGrants`),
+// and the gates that check a resolved app's elevated uses against its grants.
+// `HOST_DIRECTORY_BLOCKLIST` / `isValidHostDirectoryPath` are re-exported from
+// schema/host.ts, which owns them to avoid an import cycle.
+
+import { z } from "zod";
+import type { Network } from "./identifiers.ts";
+import type { HomeApp } from "./resolve.ts";
+import type { Grant, Grants } from "./grants.ts";
+import {
+  collectUses,
+  homeHooks,
+  dataMatches,
+  hostHooks,
+  isHomeGrant,
+  isHostGrant,
+} from "./grants.ts";
+import { PERMISSION_META, permissionAllowsAppKind } from "./permissions.ts";
+import type { AppKind, PermissionKind, WorkerCapability } from "./permissions.ts";
+import type { SerializablePermission } from "./sandbox.ts";
+
+export {
+  HOST_DIRECTORY_BLOCKLIST,
+  isValidHostDirectoryPath,
+  normalizeHostPath,
+  pathsOverlap,
+} from "./schema/host.ts";
+
+/**
+ * Loose outer-shape parser for the JSON-stored grants blob. Per-kind data
+ * validation runs in sanitizeGrants — keeping the schema parse loose lets
+ * us land readable error messages for per-kind issues there instead of
+ * burying them inside Zod's superRefine machinery.
+ */
+const rawGrantSchema = z.object({
+  kind: z.string(),
+  data: z.unknown().optional(),
+}) as z.ZodType<Grant>;
+
+export const grantsSchema: z.ZodType<Grants> = z.record(z.string(), rawGrantSchema);
+
+/**
+ * Per-grant rejection/prune entry. `path` is the grants-blob key (the
+ * permission descriptor path), `kind` is the kind the admin sent (helps
+ * the UI show which control failed), `reason` is a human-readable
+ * explanation suitable for surfacing to the operator.
+ */
+export interface GrantIssue {
+  path: string;
+  kind: string;
+  reason: string;
+}
+
+/**
+ * Result of {@link sanitizeGrants}. Two distinct buckets:
+ *
+ * - `rejected` — admin sent grants whose data the per-kind grantSchema
+ *   refused (an out-of-range port, an unknown kind, etc.) or
+ *   whose kind isn't recognized. These represent user error and the API
+ *   must surface them as a 400 instead of silently dropping.
+ * - `pruned` — grants whose declaration is missing (orphan path) or whose
+ *   kind doesn't match the declaration at that path. These represent
+ *   source drift (the realm.ts changed and removed/renamed a permission),
+ *   not admin input bugs, so the API logs them and proceeds.
+ */
+export interface SanitizeResult {
+  sanitized: Grants;
+  rejected: GrantIssue[];
+  pruned: GrantIssue[];
+}
+
+/**
+ * Validate one admin-supplied grant's data shape against the per-kind
+ * grantSchema. Returns the (possibly narrowed) grant on success, a
+ * reason string on rejection. The caller decides whether the rejection
+ * is a hard error (bad admin input) or a soft prune (source drift) —
+ * this function only checks the per-kind data shape.
+ */
+function validateGrantData(
+  grant: Grant,
+): { ok: true; grant: Grant } | { ok: false; reason: string } {
+  if (isHostGrant(grant)) {
+    const hooks = hostHooks(grant.kind);
+    if (!hooks?.grantSchema) {
+      return { ok: false, reason: `unknown host permission kind: ${grant.kind}` };
+    }
+    const r = hooks.grantSchema.safeParse(grant.data);
+    if (!r.success) {
+      const reason = r.error.issues.map((i) => i.message).join("; ");
+      return { ok: false, reason };
+    }
+    return { ok: true, grant: { kind: grant.kind, data: r.data } };
+  }
+  // home.* carries data like host (the granted scopes). Validate against the
+  // per-kind grantSchema — an unknown scope lands in the `rejected` bucket.
+  if (isHomeGrant(grant)) {
+    const hooks = homeHooks(grant.kind);
+    if (!hooks?.grantSchema) {
+      return { ok: false, reason: `unknown home permission kind: ${grant.kind}` };
+    }
+    const r = hooks.grantSchema.safeParse(grant.data);
+    if (!r.success) {
+      const reason = r.error.issues.map((i) => i.message).join("; ");
+      return { ok: false, reason };
+    }
+    return { ok: true, grant: { kind: grant.kind, data: r.data } };
+  }
+  // peers.* and remote.* are presence-only — the grant is a flag, no
+  // data field. The descriptor carries any necessary info (fetchUrl URL)
+  // and the runtime resolver pulls real values from world state / fetch.
+  if (grant.kind.startsWith("peers.") || grant.kind.startsWith("remote.")) {
+    return { ok: true, grant: { kind: grant.kind } };
+  }
+  return { ok: false, reason: `unknown permission kind: ${grant.kind}` };
+}
+
+/**
+ * Walk an admin-supplied grants blob against the source's declared
+ * permissions. Splits each entry into three buckets — kept (passes both
+ * declaration and per-kind schema checks), rejected (admin-input error),
+ * or pruned (source drift). Source drives what's installed; grants are
+ * narrowing choices, not expansions.
+ */
+export function sanitizeGrants(
+  permsFlat: Record<string, SerializablePermission>,
+  grants: Grants | undefined,
+): SanitizeResult {
+  if (!grants) return { sanitized: {}, rejected: [], pruned: [] };
+  const sanitized: Grants = {};
+  const rejected: GrantIssue[] = [];
+  const pruned: GrantIssue[] = [];
+  for (const [path, grant] of Object.entries(grants)) {
+    const perm = permsFlat[path];
+    if (!perm) {
+      pruned.push({ path, kind: grant.kind, reason: "no declared permission at this path" });
+      continue;
+    }
+    if (grant.kind !== perm.kind) {
+      pruned.push({
+        path,
+        kind: grant.kind,
+        reason: `kind ${grant.kind} does not match declared ${perm.kind}`,
+      });
+      continue;
+    }
+    const result = validateGrantData(grant);
+    if (!result.ok) {
+      rejected.push({ path, kind: grant.kind, reason: result.reason });
+      continue;
+    }
+    sanitized[path] = result.grant;
+  }
+  return { sanitized, rejected, pruned };
+}
+
+// ============================================================================
+// Violations
+// ============================================================================
+
+export interface GrantViolation {
+  kind: "grant";
+  permissionKind: string;
+  /**
+   * Compose service the use originated from, omitted for app-level uses
+   * (e.g. `state.egress`, which is declared once for the whole app, not
+   * per service).
+   */
+  serviceName?: string;
+  use: unknown;
+  description: string;
+}
+
+export interface EvalErrorViolation {
+  kind: "eval";
+  message: string;
+}
+
+/**
+ * Raised when a *pinned* worker (`deployed: <worker id>`, a single app)
+ * doesn't advertise one of the app's required host permission kinds.
+ * A system app, which stores no placement (`deployed: null`), doesn't
+ * produce this violation: install proceeds dormant and the per-worker
+ * recompute filter handles the gap as workers come and go.
+ */
+export interface WorkerCapabilityViolation {
+  kind: "worker-capability";
+  /** The worker's slug: what an operator reading the message calls the box. */
+  workerId: string;
+  missing: WorkerCapability[];
+  description: string;
+}
+
+/**
+ * Raised when something about the app contradicts its declared kind.
+ * Three producers, all reported the same way so `logViolations` needs no
+ * new branch:
+ *
+ *   - Home's deploy-target check: a single app requires a worker id, the box
+ *     it runs on. A system app has nothing to check — it stores no
+ *     placement, which Home derives from the source rather than accepting
+ *     from the client.
+ *   - `checkSystemAppRoutes`: routes, header brokering or an anonymous
+ *     gate on a system app.
+ *   - `checkPermissionAppKinds`: a permission whose `appKinds` scope
+ *     excludes this app's kind.
+ */
+export interface AppKindViolation {
+  kind: "app-kind";
+  appKind: "single" | "system";
+  description: string;
+}
+
+/**
+ * Raised when a `router.publicDomain` sits under the Realm `baseDomain`.
+ * That namespace is Home's: every routed service already gets an
+ * authenticated subdomain there, and the `.{baseDomain}`-scoped Home session
+ * cookie reaches anything under it - so an ungated public route in that space
+ * would hand the app a live Home session (account-takeover). Public domains
+ * must live outside the Realm domain.
+ */
+export interface RoutingViolation {
+  kind: "routing";
+  serviceName: string;
+  description: string;
+}
+
+export type Violation =
+  | GrantViolation
+  | EvalErrorViolation
+  | WorkerCapabilityViolation
+  | AppKindViolation
+  | RoutingViolation;
+
+interface CheckAppGrantsOptions {
+  /**
+   * Networks the consumer is allowed to join (e.g. `management-net` from
+   * a `host.management` grant, or peer networks from granted peer
+   * permissions). A `joinNetworks` entry not in this set produces a
+   * `network.join` violation.
+   */
+  allowedNetworks?: Set<Network>;
+  /**
+   * Absolute host paths exempted from the absolute-mount gate: paths a
+   * resolved permission handed the app (a Silo volume, a broker socket
+   * dir, peer backup mounts) — the grant already authorized the mount.
+   */
+  allowedAbsoluteHostPaths?: Set<string>;
+  /**
+   * Subset of `allowedAbsoluteHostPaths` the grant only covers read-only,
+   * mapped to the permission kind that granted it (so the violation names the
+   * real permission, not the mount gate it was exempted from).
+   *
+   * Two sources. The broker socket dirs (`host.logs`, `host.stats`,
+   * `host.spawn`'s socket, `home.apiAccess`'s socket) resolve to
+   * `readOnly: true` mounts because connecting to the socket needs no write
+   * access to the directory holding it. And a `host.silo` member that declared
+   * `volume: "read"` gets the shared directory read-only.
+   *
+   * Either way an app that mounts one writable gets a violation rather than a
+   * silently-corrected mount: rejecting keeps the source honest about what
+   * runs.
+   */
+  readOnlyHostPaths?: Map<string, string>;
+  /**
+   * Silo volumes this app may mount, keyed hostPath + NUL + gid by
+   * `siloMountKey`. A `host.silo` use carries both halves of "same bytes" -
+   * which directory, and which group owns it - and both have to match a Silo
+   * the operator bound this app to. So a hand-written `gid`, a Silo path
+   * without the join, or a gid belonging to a *different* Silo all fail here.
+   */
+  allowedSiloMounts?: Set<string>;
+}
+
+/**
+ * Key for `allowedSiloMounts`. NUL-separated: a NUL can't appear in a
+ * host path, so the gid half can never be mistaken for part of one.
+ */
+export function siloMountKey(hostPath: string, gid: number): string {
+  return `${hostPath}\u0000${gid}`;
+}
+
+/**
+ * Walk every service in a resolved app state and return one violation per
+ * elevated thing the app does without a matching grant.
+ *
+ * Path-aware: a use is only authorized when there's a *declared*
+ * permission whose path P satisfies (a) `permsFlat[P].kind === use.kind`
+ * AND (b) `grants[P]?.data` matches `use.data`. Hardcoded uses (no
+ * declaring permission of that kind anywhere in `permsFlat`) are flagged
+ * unconditionally — there is no path through which to grant them.
+ * Orphan-keyed grants (a grant at a path with no declaration) cannot
+ * authorize anything. The descriptor contract drives the gate, not bare
+ * kind+value matching across an unkeyed grants array.
+ */
+export function checkAppGrants(
+  state: HomeApp,
+  grants: Grants,
+  permsFlat: Record<string, SerializablePermission>,
+  options?: CheckAppGrantsOptions,
+): GrantViolation[] {
+  const violations: GrantViolation[] = [];
+  // Index declared permissions by kind so the inner loop is a hash hit
+  // instead of an O(n) scan over permsFlat per use.
+  const declarationsByKind = new Map<string, Array<[string, SerializablePermission]>>();
+  for (const [path, perm] of Object.entries(permsFlat)) {
+    const list = declarationsByKind.get(perm.kind) ?? [];
+    list.push([path, perm]);
+    declarationsByKind.set(perm.kind, list);
+  }
+
+  for (const [serviceName, svc] of Object.entries(state.services)) {
+    // A worker-supplied mount whose grant only covers read access. Checked
+    // ahead of the use loop because the path is exempt from the
+    // absolute-mount gate below — without this, mounting it writable would
+    // pass silently.
+    for (const v of svc.volumes ?? []) {
+      const grantedBy = options?.readOnlyHostPaths?.get(v.hostPath as string);
+      if (grantedBy === undefined) continue;
+      if (v.readOnly === true) continue;
+      violations.push({
+        kind: "grant",
+        permissionKind: grantedBy,
+        serviceName,
+        use: v.hostPath,
+        description: "write to a directory the grant only covers read-only",
+      });
+    }
+    // The absolute-mount gate. No permission grants a raw absolute path, so
+    // any bind mount outside the app's own `./` data dir must have come from
+    // a resolved permission's exemption (a Silo volume, a broker socket dir,
+    // a peer backup mount). Anything else is a hardcoded host mount — the
+    // types don't allow one, but a packed app can hand the VM whatever it
+    // wants, so the gate is here, not in the compiler. gid-carrying mounts
+    // are judged as `host.silo` uses below instead: the (hostPath, gid) pair
+    // has to match a bound Silo.
+    for (const v of svc.volumes ?? []) {
+      const hostPath = v.hostPath as string;
+      if (hostPath.startsWith("./")) continue;
+      if (v.gid !== undefined) continue;
+      if (options?.allowedAbsoluteHostPaths?.has(hostPath)) continue;
+      violations.push({
+        kind: "grant",
+        permissionKind: "host.mount",
+        serviceName,
+        use: hostPath,
+        description: "mount an absolute host path",
+      });
+    }
+    for (const use of collectUses(svc)) {
+      // A Silo mount's grant data is the operator's chosen Silo id, so it can
+      // never `dataMatches` the use (which is the resolved directory + group).
+      // Home resolved both from the Silo record, so the pair itself is the
+      // check: same bytes, same group.
+      if (use.kind === "host.silo") {
+        const { hostPath, gid } = use.data as { hostPath: string; gid: number };
+        if (options?.allowedSiloMounts?.has(siloMountKey(hostPath, gid))) continue;
+        violations.push({
+          kind: "grant",
+          permissionKind: use.kind,
+          serviceName,
+          use: use.data,
+          description: PERMISSION_META["host.silo"].phrase,
+        });
+        continue;
+      }
+      // Public domains match by set containment, not `dataMatches`. That
+      // comparator is JSON-string equality, so it would turn a reordered
+      // `hosts` array or a differently-keyed record into a spurious drop —
+      // and a router legitimately serves a subset of what was granted (a
+      // second service on the same grant, an app that routes only its
+      // canonical host). What must never pass is a host outside the set.
+      if (use.kind === "home.publicDomain") {
+        const { hosts, domainMode } = use.data as { hosts: string[]; domainMode: string };
+        const declarations = declarationsByKind.get(use.kind) ?? [];
+        const matched = declarations.some(([path]) => {
+          const grant = grants[path];
+          if (grant == null || !isHomeGrant(grant) || grant.kind !== use.kind) return false;
+          const data = grant.data as { hosts?: string[]; domainMode?: string };
+          // `domainMode` is checked, not just carried. It rides inside the
+          // value so the author can't wire the hosts and forget it — but a
+          // spread (`{ ...config.domain, domainMode: "all" }`) typechecks and
+          // would otherwise override the operator's redirect choice silently,
+          // which is the exact failure the one-field shape exists to prevent.
+          if (data.domainMode !== domainMode) return false;
+          const granted = new Set(data.hosts ?? []);
+          return hosts.every((h) => granted.has(h));
+        });
+        if (!matched) {
+          violations.push({
+            kind: "grant",
+            permissionKind: use.kind,
+            serviceName,
+            use: use.data,
+            description: PERMISSION_META["home.publicDomain"].phrase,
+          });
+        }
+        continue;
+      }
+      const declarations = declarationsByKind.get(use.kind) ?? [];
+      const matched = declarations.some(([path]) => {
+        const grant = grants[path];
+        return (
+          grant != null &&
+          isHostGrant(grant) &&
+          grant.kind === use.kind &&
+          dataMatches(grant.data, use.data)
+        );
+      });
+      if (!matched) {
+        violations.push({
+          kind: "grant",
+          permissionKind: use.kind,
+          serviceName,
+          use: use.data,
+          description: PERMISSION_META[use.kind as PermissionKind]?.phrase ?? use.kind,
+        });
+      }
+    }
+    for (const net of svc.joinNetworks ?? []) {
+      if (!options?.allowedNetworks?.has(net as Network)) {
+        violations.push({
+          kind: "grant",
+          permissionKind: "network.join",
+          serviceName,
+          use: [net],
+          description: "join network",
+        });
+      }
+    }
+  }
+  // App-level egress gate. `state.egress` lives next to `services` (the
+  // realm.ts author writes `egress: config.egress` from a `r.host.egress()`
+  // permission). Without this check an app could hardcode `egress: true`
+  // and the renderer would drop `internal: true` from the network — full
+  // outbound access with no consent flow. Require a declared `host.egress`
+  // at some path with a matching grant entry, mirroring how every per-
+  // service use is gated.
+  if (state.egress === true) {
+    const declarations = declarationsByKind.get("host.egress") ?? [];
+    const matched = declarations.some(([path]) => {
+      const grant = grants[path];
+      return grant != null && isHostGrant(grant) && grant.kind === "host.egress";
+    });
+    if (!matched) {
+      violations.push({
+        kind: "grant",
+        permissionKind: "host.egress",
+        use: true,
+        description: PERMISSION_META["host.egress"]?.phrase ?? "host.egress",
+      });
+    }
+  }
+  return violations;
+}
+
+/**
+ * System apps have no routes: no `router` on any service and no
+ * `verifyAnonymousRequest` (anonymous gates admit callers to an app's
+ * routes). Genuine network exposure goes through `host.port`.
+ * `getTrustedHeaders` is banned alongside them for a different
+ * reason - see its violation below.
+ *
+ * The `createSystemApp` types make all three unrepresentable at authoring
+ * time; this is the authoritative check over the *resolved* state, which
+ * catches what the types can't — a `Service` class instance smuggling a
+ * router (flattened at resolve time, bypassing `SystemServiceDefinition`)
+ * and raw `trustedHeaders` / `hasAnonymousGate` keys returned straight
+ * from `getDesiredState` (both are declared keys of `homeAppSchema`, so a
+ * packed/JS bundle can set them without the factory). Runs in
+ * `createSystemApp`'s evaluate (throws) and again in Home's graph
+ * verification (drops the app). Emits `app-kind` violations so
+ * `logViolations` needs no new branch.
+ */
+export function checkSystemAppRoutes(state: HomeApp): AppKindViolation[] {
+  const violations: AppKindViolation[] = [];
+  for (const [serviceName, svc] of Object.entries(state.services)) {
+    if (svc.router != null) {
+      violations.push({
+        kind: "app-kind",
+        appKind: "system",
+        description: `service "${serviceName}" declares a router — routes are not allowed on a system app`,
+      });
+    }
+  }
+  if (state.trustedHeaders != null) {
+    violations.push({
+      kind: "app-kind",
+      appKind: "system",
+      // Not a routing argument: brokered identity also reaches a container
+      // through a page or widget loader, and a system app has those. It is a
+      // consent argument - a system app is seeded by the platform, with no
+      // operator install click to grant the disclosure.
+      description:
+        "getTrustedHeaders is not supported on a system app — a system app is " +
+        "seeded by the platform, so no operator ever consented to it learning " +
+        "who is signed in",
+    });
+  }
+  if (state.hasAnonymousGate === true) {
+    violations.push({
+      kind: "app-kind",
+      appKind: "system",
+      description:
+        "verifyAnonymousRequest is not supported on a system app — anonymous " +
+        "gates admit callers to an app's routes, and a system app has none",
+    });
+  }
+  return violations;
+}
+
+/**
+ * Reject permissions the app's kind may not declare.
+ *
+ * Each permission carries an `appKinds` scope at its declaration site
+ * (`PermissionMeta`), so the rule travels with the kind rather than living
+ * in a table here. Two directions: a single app reaching for a fleet-wide
+ * aggregation (`peers.routedApps` and friends), and a system app reaching
+ * for something that only means one box (`host.silo`) or that would
+ * multiply across the fleet (`home.apiAccess`).
+ *
+ * Reads the declared `permissionsFlat`, not the resolved state, because
+ * the restriction is on what the source *asks for*. A permission behind an
+ * optional section still counts: the operator can turn it on later, and
+ * whether the app may ask at all shouldn't depend on today's config. That
+ * is the opposite call from `partitionHostKinds`, which is about what the
+ * app needs to run right now.
+ *
+ * Runs at author time in the factories (throws) and again in Home's graph
+ * verification (drops the app), the same pair as `checkSystemAppRoutes`.
+ */
+export function checkPermissionAppKinds(
+  appKind: AppKind,
+  permissionsFlat: Record<string, SerializablePermission>,
+): AppKindViolation[] {
+  const violations: AppKindViolation[] = [];
+  for (const [path, perm] of Object.entries(permissionsFlat)) {
+    if (permissionAllowsAppKind(perm.kind, appKind)) continue;
+    const phrase = PERMISSION_META[perm.kind as PermissionKind]?.phrase;
+    const allowed = appKind === "single" ? "system" : "single";
+    const factory = allowed === "system" ? "createSystemApp" : "createApp";
+    violations.push({
+      kind: "app-kind",
+      appKind,
+      description:
+        `"${path}" declares ${perm.kind}${phrase ? ` (${phrase})` : ""}, which only a ` +
+        `${allowed} app may declare — move the app to ${factory}, or drop the permission`,
+    });
+  }
+  return violations;
+}
+
+/**
+ * Is this hostname the Realm domain, or inside it?
+ *
+ * The one implementation of the reservation test, shared by the routing check
+ * below and by Home's `domain_claim` writer - which sees hostnames the routing
+ * check never does, because it reads the grant rather than the resolved state.
+ *
+ * `host` must already be normalized (the public-domain schema lowercases on the
+ * way in). `baseDomain` comes straight off `REALM_BASE_DOMAIN`, which nothing
+ * normalizes, so it is lowercased here: a mixed-case env value would otherwise
+ * turn the whole check into a no-op.
+ */
+export function isUnderBaseDomain(host: string, baseDomain: string): boolean {
+  const base = baseDomain.toLowerCase();
+  return host === base || host.endsWith(`.${base}`);
+}
+
+/**
+ * Reject any `router.publicDomain` that falls under the Realm `baseDomain`.
+ * The structured authenticated subdomain `{appId}-{service}.{workerId}.
+ * {baseDomain}` already covers that space, gated by Home ForwardAuth, and the
+ * `.{baseDomain}`-scoped session cookie reaches every host under it - so an
+ * ungated public route there would leak a live Home session to the app. A
+ * public domain must therefore live outside the Realm domain. No-op when the
+ * install is unconfigured (`baseDomain` null).
+ */
+export function checkPublicDomains(state: HomeApp, baseDomain: string | null): RoutingViolation[] {
+  if (!baseDomain) return [];
+  const violations: RoutingViolation[] = [];
+  for (const [serviceName, svc] of Object.entries(state.services)) {
+    for (const host of svc.router?.publicDomain?.hosts ?? []) {
+      if (isUnderBaseDomain(host, baseDomain)) {
+        violations.push({
+          kind: "routing",
+          serviceName,
+          description: `router.publicDomain "${host}" is under the Realm domain "${baseDomain}", which is reserved for authenticated subdomains. Use a domain outside "${baseDomain}" for public access — the authenticated subdomain is provisioned automatically.`,
+        });
+      }
+    }
+  }
+  return violations;
+}

package/src/serialize.ts

@@ -0,0 +1,21 @@
+import { apply, type Resolved } from "./apply.ts";
+import { containsRef, type Deferred } from "./ref.ts";
+
+/**
+ * Serialize a tree of primitives + `Ref<string>` to a string, the shared
+ * engine behind `toJson` / `toYaml` / `toIni` / `toXml`.
+ *
+ * No refs → serialize eagerly and return a plain `string`. Refs present →
+ * defer via `apply()`: the Home resolves every ref, then re-runs
+ * `serialize` with the resolved (ref-free) tree and splices the result.
+ * Resolving *before* serializing is what lets format-specific escaping
+ * (JSON/YAML quoting) see the real value — a concat-spliced ref can't be
+ * escaped because its value isn't known until deploy time.
+ */
+export function serializeRefs<T>(
+  value: T,
+  serialize: (resolved: Resolved<T>) => string,
+): string | Deferred<string> {
+  if (!containsRef(value)) return serialize(value as Resolved<T>);
+  return apply(value, serialize);
+}