跳到內容
Graft

Operations

本頁內容尚未翻譯。

Defined in: internal/policy.ts:545

Properties

Section titled “Properties”

approve

Section titled “approve”
readonly approve: (record: {
  at: number;
  overrideRevocations: boolean;
  statement: {
     assignment: {
        artifact: {
           digest: string;
           package: string;
        };
        contractEntry?: string;
        entry: string;
        grants: readonly (
           | {
           _tag: "Http";
           credential?: string;
           id: string;
           origin: string;
         }
           | {
           _tag: "Files";
           directory: string;
           id: string;
        })[];
        tier: "own" | "trusted" | "untrusted";
     };
     policyVersion: string;
     projections: readonly {
        operation: string;
        projection: string;
        service: string;
        value: Json;
        view: string;
     }[];
  };
  who: string;
}) => Effect<void, Unapproved>;

Defined in: internal/policy.ts:563

Parameters

Section titled “Parameters”
Parameter Type Description
record { at: number; overrideRevocations: boolean; statement: { assignment: { artifact: { digest: string; package: string; }; contractEntry?: string; entry: string; grants: readonly ( | { _tag: "Http"; credential?: string; id: string; origin: string; } | { _tag: "Files"; directory: string; id: string; })[]; tier: "own" | "trusted" | "untrusted"; }; policyVersion: string; projections: readonly { operation: string; projection: string; service: string; value: Json; view: string; }[]; }; who: string; } -
record.at? number -
record.overrideRevocations? boolean Explicitly audited exceptions retain the underlying revocation record.
record.statement? { assignment: { artifact: { digest: string; package: string; }; contractEntry?: string; entry: string; grants: readonly ( | { _tag: "Http"; credential?: string; id: string; origin: string; } | { _tag: "Files"; directory: string; id: string; })[]; tier: "own" | "trusted" | "untrusted"; }; policyVersion: string; projections: readonly { operation: string; projection: string; service: string; value: Json; view: string; }[]; } -
record.statement.assignment? { artifact: { digest: string; package: string; }; contractEntry?: string; entry: string; grants: readonly ( | { _tag: "Http"; credential?: string; id: string; origin: string; } | { _tag: "Files"; directory: string; id: string; })[]; tier: "own" | "trusted" | "untrusted"; } -
record.statement.assignment.artifact? { digest: string; package: string; } -
record.statement.assignment.artifact.digest? string -
record.statement.assignment.artifact.package? string -
record.statement.assignment.contractEntry? string Contract module evaluated only inside the sandbox, relative to the captured directory.
record.statement.assignment.entry? string -
record.statement.assignment.grants? readonly ( | { _tag: "Http"; credential?: string; id: string; origin: string; } | { _tag: "Files"; directory: string; id: string; })[] -
record.statement.assignment.tier? "own" | "trusted" | "untrusted" -
record.statement.policyVersion? string -
record.statement.projections? readonly { operation: string; projection: string; service: string; value: Json; view: string; }[] -
record.who? string -

Returns

Section titled “Returns”

Effect<void, Unapproved>

bind

Section titled “bind”
readonly bind: (entry: string, candidate: string, identity: {
  digest: string;
  package: string;
}, services: readonly string[]) => Effect<
  | {
  artifact: {
     digest: string;
     package: string;
  };
  contractEntry?: string;
  entry: string;
  grants: readonly (
     | {
     _tag: "Http";
     credential?: string;
     id: string;
     origin: string;
   }
     | {
     _tag: "Files";
     directory: string;
     id: string;
  })[];
  tier: "own" | "trusted" | "untrusted";
}
  | undefined,
  | Unapproved
| PolicyError, Scope>;

Defined in: internal/policy.ts:546

Parameters

Section titled “Parameters”
Parameter Type
entry string
candidate string
identity { digest: string; package: string; }
identity.digest? string
identity.package? string
services readonly string[]

Returns

Section titled “Returns”

Effect< | { artifact: { digest: string; package: string; }; contractEntry?: string; entry: string; grants: readonly ( | { _tag: "Http"; credential?: string; id: string; origin: string; } | { _tag: "Files"; directory: string; id: string; })[]; tier: "own" | "trusted" | "untrusted"; } | undefined, | Unapproved | PolicyError, Scope>

bindings

Section titled “bindings”
readonly bindings: Effect<number>;

Defined in: internal/policy.ts:574

Number of live attempt leases, including allocations that have not started.

onRevoke

Section titled “onRevoke”
readonly onRevoke: (entry: string, candidate: string, terminate: Effect<void, PolicyError>) => Effect<void, PolicyError, Scope>;

Defined in: internal/policy.ts:567

Parameters

Section titled “Parameters”
Parameter Type
entry string
candidate string
terminate Effect<void, PolicyError>

Returns

Section titled “Returns”

Effect<void, PolicyError, Scope>

review

Section titled “review”
readonly review: (request: {
  expected: {
     assignment: {
        artifact: {
           digest: string;
           package: string;
        };
        contractEntry?: string;
        entry: string;
        grants: readonly (
           | {
           _tag: "Http";
           credential?: string;
           id: string;
           origin: string;
         }
           | {
           _tag: "Files";
           directory: string;
           id: string;
        })[];
        tier: "own" | "trusted" | "untrusted";
     };
     policyVersion: string;
     projections: readonly {
        operation: string;
        projection: string;
        service: string;
        value: Json;
        view: string;
     }[];
  };
  overrideRevocations?: boolean;
  who: string;
}) => Effect<{
  at: number;
  overrideRevocations: boolean;
  statement: {
     assignment: {
        artifact: {
           digest: string;
           package: string;
        };
        contractEntry?: string;
        entry: string;
        grants: readonly (
           | {
           _tag: "Http";
           credential?: string;
           id: string;
           origin: string;
         }
           | {
           _tag: "Files";
           directory: string;
           id: string;
        })[];
        tier: "own" | "trusted" | "untrusted";
     };
     policyVersion: string;
     projections: readonly {
        operation: string;
        projection: string;
        service: string;
        value: Json;
        view: string;
     }[];
  };
  who: string;
}, Unapproved>;

Defined in: internal/policy.ts:560

Parameters

Section titled “Parameters”
Parameter Type Description
request { expected: { assignment: { artifact: { digest: string; package: string; }; contractEntry?: string; entry: string; grants: readonly ( | { _tag: "Http"; credential?: string; id: string; origin: string; } | { _tag: "Files"; directory: string; id: string; })[]; tier: "own" | "trusted" | "untrusted"; }; policyVersion: string; projections: readonly { operation: string; projection: string; service: string; value: Json; view: string; }[]; }; overrideRevocations?: boolean; who: string; } -
request.expected? { assignment: { artifact: { digest: string; package: string; }; contractEntry?: string; entry: string; grants: readonly ( | { _tag: "Http"; credential?: string; id: string; origin: string; } | { _tag: "Files"; directory: string; id: string; })[]; tier: "own" | "trusted" | "untrusted"; }; policyVersion: string; projections: readonly { operation: string; projection: string; service: string; value: Json; view: string; }[]; } -
request.expected.assignment? { artifact: { digest: string; package: string; }; contractEntry?: string; entry: string; grants: readonly ( | { _tag: "Http"; credential?: string; id: string; origin: string; } | { _tag: "Files"; directory: string; id: string; })[]; tier: "own" | "trusted" | "untrusted"; } -
request.expected.assignment.artifact? { digest: string; package: string; } -
request.expected.assignment.artifact.digest? string -
request.expected.assignment.artifact.package? string -
request.expected.assignment.contractEntry? string Contract module evaluated only inside the sandbox, relative to the captured directory.
request.expected.assignment.entry? string -
request.expected.assignment.grants? readonly ( | { _tag: "Http"; credential?: string; id: string; origin: string; } | { _tag: "Files"; directory: string; id: string; })[] -
request.expected.assignment.tier? "own" | "trusted" | "untrusted" -
request.expected.policyVersion? string -
request.expected.projections? readonly { operation: string; projection: string; service: string; value: Json; view: string; }[] -
request.overrideRevocations? boolean -
request.who? string -

Returns

Section titled “Returns”

Effect<{ at: number; overrideRevocations: boolean; statement: { assignment: { artifact: { digest: string; package: string; }; contractEntry?: string; entry: string; grants: readonly ( | { _tag: "Http"; credential?: string; id: string; origin: string; } | { _tag: "Files"; directory: string; id: string; })[]; tier: "own" | "trusted" | "untrusted"; }; policyVersion: string; projections: readonly { operation: string; projection: string; service: string; value: Json; view: string; }[]; }; who: string; }, Unapproved>

revoke

Section titled “revoke”
readonly revoke: (references: readonly string[]) => Effect<void, PolicyError>;

Defined in: internal/policy.ts:564

Parameters

Section titled “Parameters”
Parameter Type
references readonly string[]

Returns

Section titled “Returns”

Effect<void, PolicyError>

statement

Section titled “statement”
readonly statement: (entry: string, identity: {
  digest: string;
  package: string;
}) => Effect<{
  assignment: {
     artifact: {
        digest: string;
        package: string;
     };
     contractEntry?: string;
     entry: string;
     grants: readonly (
        | {
        _tag: "Http";
        credential?: string;
        id: string;
        origin: string;
      }
        | {
        _tag: "Files";
        directory: string;
        id: string;
     })[];
     tier: "own" | "trusted" | "untrusted";
  };
  policyVersion: string;
  projections: readonly {
     operation: string;
     projection: string;
     service: string;
     value: Json;
     view: string;
  }[];
}, Unapproved>;

Defined in: internal/policy.ts:556

Parameters

Section titled “Parameters”
Parameter Type
entry string
identity { digest: string; package: string; }
identity.digest? string
identity.package? string

Returns

Section titled “Returns”

Effect<{ assignment: { artifact: { digest: string; package: string; }; contractEntry?: string; entry: string; grants: readonly ( | { _tag: "Http"; credential?: string; id: string; origin: string; } | { _tag: "Files"; directory: string; id: string; })[]; tier: "own" | "trusted" | "untrusted"; }; policyVersion: string; projections: readonly { operation: string; projection: string; service: string; value: Json; view: string; }[]; }, Unapproved>

statements

Section titled “statements”
readonly statements: Effect<readonly {
  assignment: {
     artifact: {
        digest: string;
        package: string;
     };
     contractEntry?: string;
     entry: string;
     grants: readonly (
        | {
        _tag: "Http";
        credential?: string;
        id: string;
        origin: string;
      }
        | {
        _tag: "Files";
        directory: string;
        id: string;
     })[];
     tier: "own" | "trusted" | "untrusted";
  };
  policyVersion: string;
  projections: readonly {
     operation: string;
     projection: string;
     service: string;
     value: Json;
     view: string;
  }[];
}[]>;

Defined in: internal/policy.ts:572