@weave-kit/engine 0.5.0 → 0.7.0

package/dist/core/object/workflow-migrations.js

@@ -0,0 +1,125 @@
+import { DEFAULT_LOCALE } from '../i18n/index.js';
+import { WORKFLOW_FORMAT_VERSION } from '../types/workflow.js';
+import { SchemaError } from '../types/errors.js';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function asArray(value) {
+    return Array.isArray(value) ? value.filter(isRecord) : [];
+}
+function rolesOf(value) {
+    return Array.isArray(value) ? value.filter((r) => typeof r === 'string' && r.length > 0) : [];
+}
+/**
+ * Best-effort linearization of a v1 state machine (`states[]` + `transitions[]`)
+ * into a v2 single-line `nodes[]`. The implicit start node replaces the old
+ * `initial` state. Roles are gathered from the transitions touching each state;
+ * a state with no derivable roles falls back to `['*']` (fail-closed at runtime
+ * until the author edits it). There are no v1 users in the wild, so this path is
+ * exercised only by tests / deliberate upgrades.
+ */
+function linearizeV1(raw) {
+    const initial = typeof raw.initial === 'string' ? raw.initial : undefined;
+    const states = asArray(raw.states);
+    const transitions = asArray(raw.transitions);
+    const allRoles = [...new Set(transitions.flatMap((t) => rolesOf(t.roles)))];
+    const rolesFor = (name) => {
+        const into = transitions.find((t) => t.to === name && rolesOf(t.roles).length > 0);
+        if (into !== undefined)
+            return rolesOf(into.roles);
+        const out = transitions.find((t) => t.from === name && rolesOf(t.roles).length > 0);
+        if (out !== undefined)
+            return rolesOf(out.roles);
+        return allRoles.length > 0 ? allRoles : ['*'];
+    };
+    const order = states
+        .map((s) => s.name)
+        .filter((n) => typeof n === 'string' && n !== initial);
+    const position = new Map(order.map((n, idx) => [n, idx]));
+    return order.map((name) => {
+        const state = states.find((s) => s.name === name);
+        const labels = isRecord(state?.labels) ? state.labels : undefined;
+        const reject = transitions.find((t) => t.from === name && typeof t.action === 'string' && t.action.includes('reject'));
+        const onReject = reject !== undefined &&
+            typeof reject.to === 'string' &&
+            reject.to !== initial &&
+            position.has(reject.to) &&
+            position.get(reject.to) < position.get(name)
+            ? reject.to
+            : undefined;
+        const timeout = isRecord(state?.onTimeout) && typeof state.onTimeout.after === 'string'
+            ? {
+                after: state.onTimeout.after,
+                action: typeof state.onTimeout.action === 'string' && state.onTimeout.action.includes('reject')
+                    ? 'reject'
+                    : 'approve',
+            }
+            : undefined;
+        return {
+            id: name,
+            ...(labels === undefined ? {} : { name: labels }),
+            assign: { roles: rolesFor(name) },
+            ...(onReject === undefined ? {} : { onReject }),
+            ...(timeout === undefined ? {} : { onTimeout: timeout }),
+        };
+    });
+}
+/**
+ * On-disk `workflow.json` format migrations: `from`-version → a transform
+ * producing version+1. Mirror of `core/object/migrations.ts` for the sibling
+ * workflow file; append a step here whenever {@link WORKFLOW_FORMAT_VERSION} is
+ * bumped. Steps must be pure (no files/database).
+ */
+const WORKFLOW_MIGRATIONS = {
+    // v0 (unversioned) → v1: make the format version explicit.
+    0: (raw) => ({ ...raw, schemaVersion: 1 }),
+    // v1 (states/transitions) → v2 (single-line nodes chain).
+    1: (raw) => ({
+        schemaVersion: 2,
+        ...(raw.version === undefined ? {} : { version: raw.version }),
+        nodes: linearizeV1(raw),
+    }),
+};
+/**
+ * The declared format version of a raw `workflow.json`. When `schemaVersion` is
+ * absent the shape decides: a `nodes[]` chain is the current format (v2), while
+ * a state machine (`states`/`transitions`) or anything else is legacy 0. This
+ * keeps a v2 file that omits `schemaVersion` from being misread as v1 (which
+ * would linearize its absent states into an empty chain).
+ */
+export function workflowFormatVersionOf(raw, locale = DEFAULT_LOCALE) {
+    const value = raw.schemaVersion;
+    if (value === undefined) {
+        return Array.isArray(raw.nodes) ? WORKFLOW_FORMAT_VERSION : 0;
+    }
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) {
+        throw new SchemaError('schema.version.unsupported', { version: String(value), supported: WORKFLOW_FORMAT_VERSION }, locale);
+    }
+    if (value > WORKFLOW_FORMAT_VERSION) {
+        throw new SchemaError('schema.version.unsupported', { version: value, supported: WORKFLOW_FORMAT_VERSION }, locale);
+    }
+    return value;
+}
+/**
+ * Bring a raw `workflow.json` up to the current on-disk format (pure). Used by
+ * the loader (read-time normalization of older files) and `weave workflow:upgrade`.
+ */
+export function migrateWorkflowObject(raw, locale = DEFAULT_LOCALE) {
+    let version = workflowFormatVersionOf(raw, locale);
+    const from = version;
+    let current = raw;
+    while (version < WORKFLOW_FORMAT_VERSION) {
+        const step = WORKFLOW_MIGRATIONS[version];
+        if (step === undefined) {
+            throw new SchemaError('schema.version.unsupported', { version, supported: WORKFLOW_FORMAT_VERSION }, locale);
+        }
+        current = step(current);
+        version += 1;
+    }
+    return { workflow: current, from, migrated: current !== raw };
+}
+/** true when `value` is a plain workflow object (guards JSON.parse output) */
+export function isWorkflowObject(value) {
+    return isRecord(value);
+}
+//# sourceMappingURL=workflow-migrations.js.map

package/dist/core/object/workflow-migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-migrations.js","sourceRoot":"","sources":["../../../src/core/object/workflow-migrations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAIjD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,GAAgB;IACnC,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAY,EAAE;QAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAE1D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACtF,CAAC;QACF,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS;YACpB,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;YAC7B,MAAM,CAAC,EAAE,KAAK,OAAO;YACrB,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAY,GAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAY;YAClE,CAAC,CAAC,MAAM,CAAC,EAAE;YACX,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,QAAQ;YACrF,CAAC,CAAC;gBACE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK;gBAC5B,MAAM,EAAE,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC7F,CAAC,CAAE,QAAkB;oBACrB,CAAC,CAAE,SAAmB;aACzB;YACH,CAAC,CAAC,SAAS,CAAC;QACd,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACjD,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;YACjC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,mBAAmB,GAAsD;IAC7E,2DAA2D;IAC3D,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC1C,0DAA0D;IAC1D,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACX,aAAa,EAAE,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9D,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;KACxB,CAAC;CACH,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAgB,EAAE,SAAiB,cAAc;IACvF,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,WAAW,CACnB,4BAA4B,EAC5B,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,EAC9D,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,GAAG,uBAAuB,EAAE,CAAC;QACpC,MAAM,IAAI,WAAW,CACnB,4BAA4B,EAC5B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,EACtD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAgB,EAChB,SAAiB,cAAc;IAE/B,IAAI,OAAO,GAAG,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC;IACrB,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,OAAO,OAAO,GAAG,uBAAuB,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CACnB,4BAA4B,EAC5B,EAAE,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,EAC/C,MAAM,CACP,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,KAAK,GAAG,EAAE,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC"}

package/dist/core/provider/event/index.d.ts

@@ -1,3 +1,3 @@
-export { EVENT_TYPES, type AuditEventPayload, type EngineEvent, type EventBus, type EventPayload, type EventPublisher, type EventType, type PublishInput, type RecordAction, type RecordChangePayload, type ReplayResult, type SchemaChangedPayload, } from './types.js';
+export { EVENT_TYPES, type AuditEventPayload, type EngineEvent, type EventBus, type EventPayload, type EventPublisher, type EventType, type PublishInput, type RecordAction, type RecordChangePayload, type RecordTransitionedPayload, type ReplayResult, type SchemaChangedPayload, } from './types.js';
 export type { InboundEvent, IngressConfig, IngressContext, IngressHandler, IngressRequest, IngressVerifier, } from './ingress.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provider/event/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/event/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,cAAc,EACd,cAAc,EACd,eAAe,GAChB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/event/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,cAAc,EACd,cAAc,EACd,eAAe,GAChB,MAAM,cAAc,CAAC"}

package/dist/core/provider/event/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/provider/event/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,GAYZ,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/provider/event/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,GAaZ,MAAM,YAAY,CAAC"}

package/dist/core/provider/event/types.d.ts

@@ -1,6 +1,6 @@
 import type { AuditEvent } from '../../audit/index.js';
 /**
- * Engine live event contract (M12) — pure interfaces, zero dependencies.
+ * Engine live event contract — pure interfaces, zero dependencies.
  * Implementations live in `infrastructure/event`; the SSE adapter in
  * `adapters/events`; data-access only depends on the narrow publisher that the
  * assembly layer injects (keeps "disabled = not imported = zero overhead").
@@ -10,6 +10,7 @@ export declare const EVENT_TYPES: {
     readonly RECORD_CREATED: "record.created";
     readonly RECORD_UPDATED: "record.updated";
     readonly RECORD_DELETED: "record.deleted";
+    readonly RECORD_TRANSITIONED: "record.transitioned";
     readonly AUDIT_EVENT: "audit.event";
     readonly SCHEMA_CHANGED: "schema.changed";
     readonly SCHEMA_DRIFT: "schema.drift";
@@ -28,6 +29,18 @@ export interface RecordChangePayload {
     object: string;
     id: string;
 }
+/** workflow transition payload — the state change and the action that fired it */
+export interface RecordTransitionedPayload {
+    object: string;
+    id: string;
+    from: string;
+    to: string;
+    action: string;
+    /** author-managed definition revision active at transition time */
+    workflowVersion?: number;
+    /** semantic hash of the definition active at transition time */
+    workflowHash?: string;
+}
 /** audit payload — the full AuditEvent, filtered per-subscriber before delivery */
 export interface AuditEventPayload {
     event: AuditEvent;
@@ -55,7 +68,7 @@ export interface LifecyclePayload {
     kind: LifecycleKind;
 }
 /** type-specific payload */
-export type EventPayload = RecordChangePayload | AuditEventPayload | SchemaChangedPayload | SchemaDriftPayload | LifecyclePayload;
+export type EventPayload = RecordChangePayload | RecordTransitionedPayload | AuditEventPayload | SchemaChangedPayload | SchemaDriftPayload | LifecyclePayload;
 /** one engine event with a monotonically increasing sequence (replay anchor) */
 export interface EngineEvent {
     seq: number;
@@ -76,6 +89,8 @@ export type ReplayResult = 'ok' | 'gap';
  */
 export interface EventPublisher {
     publishRecordChange(action: RecordAction, object: string, id: string): void;
+    /** compact workflow-transition event (from/to/action + definition identity); emitted alongside the record update */
+    publishRecordTransitioned(object: string, id: string, from: string, to: string, action: string, workflowVersion?: number, workflowHash?: string): void;
     publishAudit(event: AuditEvent): void;
     publishSchemaChanged(): void;
     /** notify connected subscribers that a schema reload was rejected (drift) */

package/dist/core/provider/event/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/event/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD;;;;;GAKG;AAEH,qEAAqE;AACrE,eAAO,MAAM,WAAW;;;;;;;;CAQd,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAErE,gFAAgF;AAChF,eAAO,MAAM,eAAe;;CAElB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEnF,0CAA0C;AAC1C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7D,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,4BAA4B;AAC5B,MAAM,MAAM,YAAY,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;AAElI,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,4GAA4G;AAC5G,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,KAAK,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5E,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACtC,oBAAoB,IAAI,IAAI,CAAC;IAC7B,6EAA6E;IAC7E,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtD,gFAAgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;CAC7C;AAED,2FAA2F;AAC3F,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC9D,4FAA4F;IAC5F,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,YAAY,CAAC;IAC/E,yDAAyD;IACzD,OAAO,IAAI,MAAM,CAAC;IAClB,KAAK,IAAI,IAAI,CAAC;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/event/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD;;;;;GAKG;AAEH,qEAAqE;AACrE,eAAO,MAAM,WAAW;;;;;;;;;CASd,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAErE,gFAAgF;AAChF,eAAO,MAAM,eAAe;;CAElB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEnF,0CAA0C;AAC1C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7D,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,kFAAkF;AAClF,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,4BAA4B;AAC5B,MAAM,MAAM,YAAY,GACpB,mBAAmB,GACnB,yBAAyB,GACzB,iBAAiB,GACjB,oBAAoB,GACpB,kBAAkB,GAClB,gBAAgB,CAAC;AAErB,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,4GAA4G;AAC5G,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,KAAK,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5E,oHAAoH;IACpH,yBAAyB,CACvB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,eAAe,CAAC,EAAE,MAAM,EACxB,YAAY,CAAC,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACtC,oBAAoB,IAAI,IAAI,CAAC;IAC7B,6EAA6E;IAC7E,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtD,gFAAgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;CAC7C;AAED,2FAA2F;AAC3F,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC9D,4FAA4F;IAC5F,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,YAAY,CAAC;IAC/E,yDAAyD;IACzD,OAAO,IAAI,MAAM,CAAC;IAClB,KAAK,IAAI,IAAI,CAAC;CACf"}

package/dist/core/provider/event/types.js

@@ -1,5 +1,5 @@
 /**
- * Engine live event contract (M12) — pure interfaces, zero dependencies.
+ * Engine live event contract — pure interfaces, zero dependencies.
  * Implementations live in `infrastructure/event`; the SSE adapter in
  * `adapters/events`; data-access only depends on the narrow publisher that the
  * assembly layer injects (keeps "disabled = not imported = zero overhead").
@@ -9,6 +9,7 @@ export const EVENT_TYPES = {
     RECORD_CREATED: 'record.created',
     RECORD_UPDATED: 'record.updated',
     RECORD_DELETED: 'record.deleted',
+    RECORD_TRANSITIONED: 'record.transitioned',
     AUDIT_EVENT: 'audit.event',
     SCHEMA_CHANGED: 'schema.changed',
     SCHEMA_DRIFT: 'schema.drift',

package/dist/core/provider/event/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/provider/event/types.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;IAC1B,cAAc,EAAE,gBAAgB;IAChC,YAAY,EAAE,cAAc;IAC5B,kBAAkB,EAAE,oBAAoB;CAChC,CAAC;AAGX,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;CACZ,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/provider/event/types.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,mBAAmB,EAAE,qBAAqB;IAC1C,WAAW,EAAE,aAAa;IAC1B,cAAc,EAAE,gBAAgB;IAChC,YAAY,EAAE,cAAc;IAC5B,kBAAkB,EAAE,oBAAoB;CAChC,CAAC;AAGX,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;CACZ,CAAC"}

package/dist/core/provider/identity/directory.d.ts

@@ -0,0 +1,90 @@
+import type { IdentitySubject } from './types.js';
+/** contract version for `IdentityStore`/`IdentityDirectory` implementers */
+export declare const IDENTITY_STORE_API = 1;
+/** a stored user row (contract view; ids are internal uuids) */
+export interface IdentityUserRow {
+    id: string;
+    externalSource: string | null;
+    externalId: string | null;
+    roles: string[];
+    departmentId: string | null;
+    directorId: string | null;
+    enabled: boolean | null;
+}
+/** a stored department row (contract view; ids are internal uuids) */
+export interface IdentityDepartmentRow {
+    id: string;
+    externalSource: string | null;
+    externalId: string | null;
+    parentId: string | null;
+    managerId: string | null;
+    enabled: boolean | null;
+}
+/** upsert input for a user (the sync engine fills internal link ids) */
+export interface IdentityUserInput {
+    externalSource: string;
+    externalId: string;
+    name?: string | null;
+    email?: string | null;
+    mobile?: string | null;
+    roles?: string[];
+    departmentId?: string | null;
+    directorId?: string | null;
+    enabled?: boolean | null;
+}
+/** upsert input for a department */
+export interface IdentityDepartmentInput {
+    externalSource: string;
+    externalId: string;
+    name?: string | null;
+    code?: string | null;
+    parentId?: string | null;
+    managerId?: string | null;
+    enabled?: boolean | null;
+}
+/** greenfield user creation (an engine-owned user with no external source) */
+export interface IdentityUserCreate {
+    name?: string | null;
+    email?: string | null;
+    mobile?: string | null;
+    roles?: string[];
+    departmentId?: string | null;
+    directorId?: string | null;
+    enabled?: boolean | null;
+}
+/**
+ * Replaceable persistence for the local identity directory (default: PG over
+ * `weavekit_user`/`weavekit_department`). The engine-only `external_source` +
+ * `external_id` pair is the natural key an upsert matches on.
+ */
+export interface IdentityStore {
+    /** look a user up by internal id OR external id (`ref` is matched against both) */
+    findUser(ref: string): Promise<IdentityUserRow | null>;
+    findUserByExternal(source: string, externalId: string): Promise<IdentityUserRow | null>;
+    findDepartmentByExternal(source: string, externalId: string): Promise<IdentityDepartmentRow | null>;
+    /** external ids currently stored for a source (used to soft-disable the missing) */
+    listExternalIds(source: string): Promise<{
+        users: string[];
+        departments: string[];
+    }>;
+    upsertUser(input: IdentityUserInput): Promise<{
+        id: string;
+    }>;
+    upsertDepartment(input: IdentityDepartmentInput): Promise<{
+        id: string;
+    }>;
+    /** create an engine-owned (greenfield) user with no external source */
+    createUser(input: IdentityUserCreate): Promise<{
+        id: string;
+    }>;
+    /** list local users (admin surface) */
+    listUsers(): Promise<IdentityUserRow[]>;
+    setEnabled(kind: 'user' | 'department', id: string, enabled: boolean): Promise<void>;
+    getCursor(source: string): Promise<string | null>;
+    setCursor(source: string, cursor: string): Promise<void>;
+}
+/** resolve a reference / claims into the internal subject (null = unknown) */
+export interface IdentityDirectory {
+    resolve(ref: string, claims?: Record<string, unknown>): Promise<IdentitySubject | null>;
+}
+//# sourceMappingURL=directory.d.ts.map

package/dist/core/provider/identity/directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/directory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,sEAAsE;AACtE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED,oCAAoC;AACpC,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACvD,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACxF,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACpG,oFAAoF;IACpF,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACrF,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,uEAAuE;IACvE,UAAU,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,uCAAuC;IACvC,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClD,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CACzF"}

package/dist/core/provider/identity/directory.js

@@ -0,0 +1,3 @@
+/** contract version for `IdentityStore`/`IdentityDirectory` implementers */
+export const IDENTITY_STORE_API = 1;
+//# sourceMappingURL=directory.js.map

package/dist/core/provider/identity/directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory.js","sourceRoot":"","sources":["../../../../src/core/provider/identity/directory.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC"}

package/dist/core/provider/identity/index.d.ts

@@ -1,2 +1,6 @@
-export type { IdentityResolver } from './types.js';
+export type { IdentitySubject, VerifiedIdentity, IdentityUser, IdentityDepartment, IdentityPullResult, IdentityResolver, } from './types.js';
+export type { IdentitySource } from './source.js';
+export { IDENTITY_SOURCE_API } from './source.js';
+export type { IdentityStore, IdentityDirectory, IdentityUserRow, IdentityDepartmentRow, IdentityUserInput, IdentityDepartmentInput, IdentityUserCreate, } from './directory.js';
+export { IDENTITY_STORE_API } from './directory.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provider/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/core/provider/identity/index.js

@@ -1,2 +1,3 @@
-export {};
+export { IDENTITY_SOURCE_API } from './source.js';
+export { IDENTITY_STORE_API } from './directory.js';
 //# sourceMappingURL=index.js.map

package/dist/core/provider/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/provider/identity/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/provider/identity/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAUlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/core/provider/identity/source.d.ts

@@ -0,0 +1,22 @@
+import type { IdentityPullResult } from './types.js';
+/**
+ * Identity **provisioning** seam: a source pulls a normalized user/department
+ * snapshot that the sync engine upserts into the local directory. Sources are
+ * injected via config (no global registry) — the engine ships `pg` and
+ * `function`; enterprise implements SCIM/LDAP/HRIS against this same contract.
+ */
+export interface IdentitySource {
+    /** value stored as `weavekit_user/department.external_source` */
+    readonly name: string;
+    /** pull a snapshot (pass the previous cursor for incremental sources) */
+    pull(cursor?: string): Promise<IdentityPullResult>;
+    capabilities?: {
+        /** `pull(cursor)` returns only changes since the cursor */
+        incremental?: boolean;
+        /** the source knows deletions; the sync may soft-disable missing rows */
+        deactivates?: boolean;
+    };
+}
+/** contract version for `IdentitySource` implementers (stable seam) */
+export declare const IDENTITY_SOURCE_API = 1;
+//# sourceMappingURL=source.d.ts.map

package/dist/core/provider/identity/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnD,YAAY,CAAC,EAAE;QACb,2DAA2D;QAC3D,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,yEAAyE;QACzE,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,IAAI,CAAC"}

package/dist/core/provider/identity/source.js

@@ -0,0 +1,3 @@
+/** contract version for `IdentitySource` implementers (stable seam) */
+export const IDENTITY_SOURCE_API = 1;
+//# sourceMappingURL=source.js.map

package/dist/core/provider/identity/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../../../src/core/provider/identity/source.ts"],"names":[],"mappings":"AAqBA,uEAAuE;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC"}

package/dist/core/provider/identity/types.d.ts

@@ -1,11 +1,66 @@
-import type { RbacSubject } from '../../rbac/index.js';
 /**
- * Resolve a user reference (e.g. the MCP `X-Weavekit-On-Behalf-Of` header)
- * into the subject RBAC decisions run against. Implementations return null for
- * unknown references (callers reject) — an empty directory rejects everything.
+ * Identity contracts (provider layer, pure — no I/O, no protocol libraries).
+ *
+ * Three responsibilities are kept separate:
+ *  - **AuthN** verifies a credential and yields a {@link VerifiedIdentity}
+ *  - **Directory** resolves a reference/claims into the internal
+ *    {@link IdentitySubject} RBAC/audit/workflow consume
+ *  - **Provisioning** imports a normalized snapshot via {@link IdentitySource}
+ *    (see `source.ts`) into the local directory (`directory.ts`)
  *
- * May be async: production resolvers typically load the user (and their roles
- * / team) from the customer's own database.
+ * The engine owns the internal id space: every subject id is a `weavekit_user`
+ * uuid, regardless of which external source the person came from.
+ */
+/** the internal identity RBAC decisions run against (internal uuid id space) */
+export interface IdentitySubject {
+    id: string;
+    roles: string[];
+    /** department whose subtree the subject may read (department scope) */
+    departmentId?: string;
+}
+/** an authenticated but not-yet-resolved identity (a verifier's output) */
+export interface VerifiedIdentity {
+    /** external user reference (the credential subject / claim the verifier trusts) */
+    ref: string;
+    /** raw claims the verifier surfaced (e.g. OIDC claims) */
+    claims?: Record<string, unknown>;
+}
+/** one user as imported from an identity source (normalized, source-agnostic) */
+export interface IdentityUser {
+    externalId: string;
+    name?: string;
+    email?: string;
+    mobile?: string;
+    roles?: string[];
+    /** external id of the department this user belongs to */
+    departmentExternalId?: string;
+    /** external id of the user's direct manager (reporting line) */
+    directorExternalId?: string;
+    enabled?: boolean;
+    attributes?: Record<string, unknown>;
+}
+/** one department (org unit) as imported from an identity source */
+export interface IdentityDepartment {
+    externalId: string;
+    name?: string;
+    code?: string;
+    /** external id of the parent department (org hierarchy) */
+    parentExternalId?: string;
+    /** external id of the department head */
+    managerExternalId?: string;
+    enabled?: boolean;
+}
+/** one pull from an identity source */
+export interface IdentityPullResult {
+    users: IdentityUser[];
+    departments: IdentityDepartment[];
+    /** incremental cursor for the next pull (source-defined watermark) */
+    cursor?: string;
+}
+/**
+ * Resolve a user reference (e.g. the MCP `X-Weavekit-On-Behalf-Of` header) into
+ * the subject RBAC decisions run against. Implementations return null for
+ * unknown references (callers reject) — an empty directory rejects everything.
  */
-export type IdentityResolver = (ref: string) => RbacSubject | null | Promise<RbacSubject | null>;
+export type IdentityResolver = (ref: string) => IdentitySubject | null | Promise<IdentitySubject | null>;
 //# sourceMappingURL=types.d.ts.map

package/dist/core/provider/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provider/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yDAAyD;IACzD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC"}

package/dist/core/provider/identity/types.js

@@ -1,2 +1,15 @@
+/**
+ * Identity contracts (provider layer, pure — no I/O, no protocol libraries).
+ *
+ * Three responsibilities are kept separate:
+ *  - **AuthN** verifies a credential and yields a {@link VerifiedIdentity}
+ *  - **Directory** resolves a reference/claims into the internal
+ *    {@link IdentitySubject} RBAC/audit/workflow consume
+ *  - **Provisioning** imports a normalized snapshot via {@link IdentitySource}
+ *    (see `source.ts`) into the local directory (`directory.ts`)
+ *
+ * The engine owns the internal id space: every subject id is a `weavekit_user`
+ * uuid, regardless of which external source the person came from.
+ */
 export {};
 //# sourceMappingURL=types.js.map

package/dist/core/provider/identity/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/provider/identity/types.ts"],"names":[],"mappings":""}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/provider/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/core/proxy/types.d.ts

@@ -1,4 +1,4 @@
-import type { RbacSubject } from '../rbac/types.js';
+import type { IdentitySubject } from '../rbac/types.js';
 /**
  * Single source of truth for the engine generic proxy vocabulary. This module is
  * pure types + static validation (`isAllowedProxyPath`); it carries no network
@@ -48,7 +48,7 @@ export interface ProxyTarget {
     id: string;
     /** customer-engine base URL (used for `direct`; opaque for `tunnel`/`cloud`). */
     url: string;
-    /** how the target is reached: `direct` (url) | `tunnel` (HTTP/2 connector) | `cloud` (in-cloud app instance). Forwarder uses `url` today; transport-aware routing is P1. */
+    /** how the target is reached: `direct` (url) | `tunnel` (HTTP/2 connector) | `cloud` (in-cloud app instance). Forwarder uses `url` today; transport-aware routing is not implemented yet. */
     transport?: string;
     /** read/admin key (the application layer reads it from the connection). */
     apiKey: string;
@@ -83,9 +83,9 @@ export interface ProxyResponse {
  */
 export interface ProxyTargetResolver {
     /** Resolve a target by instance; `null` when unregistered (→ 404). Whoever can access which connection is the app's call. */
-    resolve(instance: string, subject: RbacSubject): Promise<ProxyTarget | null>;
+    resolve(instance: string, subject: IdentitySubject): Promise<ProxyTarget | null>;
     /** Optional: list targets the subject may reach (for `GET /api/proxy`). */
-    list?(subject: RbacSubject): Promise<ProxyTarget[]>;
+    list?(subject: IdentitySubject): Promise<ProxyTarget[]>;
 }
 /**
  * Pure gate: is `method`+`path` within an `allow` prefix? GET → `read`, every

package/dist/core/proxy/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/proxy/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;;;;GASG;AAEH,oDAAoD;AACpD,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE3E,yEAAyE;AACzE,eAAO,MAAM,gBAAgB;;;CAGnB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,OAAO,gBAAgB,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAEnF;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,kIAAkI;IAClI,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6HAA6H;IAC7H,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,+GAA+G;AAC/G,eAAO,MAAM,mBAAmB,EAAE,UAGjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,4KAA4K;IAC5K,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB;;2EAEuE;IACvE,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oHAAoH;IACpH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,6HAA6H;IAC7H,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7E,2EAA2E;IAC3E,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CACrD;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAY3F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/proxy/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;GASG;AAEH,oDAAoD;AACpD,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE3E,yEAAyE;AACzE,eAAO,MAAM,gBAAgB;;;CAGnB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,OAAO,gBAAgB,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAEnF;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,kIAAkI;IAClI,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6HAA6H;IAC7H,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,+GAA+G;AAC/G,eAAO,MAAM,mBAAmB,EAAE,UAGjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,6LAA6L;IAC7L,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB;;2EAEuE;IACvE,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oHAAoH;IACpH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,6HAA6H;IAC7H,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACjF,2EAA2E;IAC3E,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CACzD;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAY3F"}

package/dist/core/rbac/authorize.d.ts

@@ -1,13 +1,14 @@
 import type { ObjectDefinition } from '../types/index.js';
 import type { Locale } from '../i18n/index.js';
-export declare function canCreate(def: ObjectDefinition, roles: readonly string[]): boolean;
-export declare function canDelete(def: ObjectDefinition, roles: readonly string[]): boolean;
-export declare function canUpdate(def: ObjectDefinition, roles: readonly string[]): boolean;
-export declare function canUpdateField(def: ObjectDefinition, roles: readonly string[], field: string): boolean;
+import { type ObjectLookup } from './details.js';
+export declare function canCreate(def: ObjectDefinition, roles: readonly string[], lookup?: ObjectLookup): boolean;
+export declare function canDelete(def: ObjectDefinition, roles: readonly string[], lookup?: ObjectLookup): boolean;
+export declare function canUpdate(def: ObjectDefinition, roles: readonly string[], lookup?: ObjectLookup): boolean;
+export declare function canUpdateField(def: ObjectDefinition, roles: readonly string[], field: string, lookup?: ObjectLookup): boolean;
 /** allowed update fields; null = all fields, [] = none */
-export declare function allowedUpdateFields(def: ObjectDefinition, roles: readonly string[]): string[] | null;
-export declare function assertCanCreate(def: ObjectDefinition, roles: readonly string[], locale?: Locale): void;
-export declare function assertCanUpdate(def: ObjectDefinition, roles: readonly string[], locale?: Locale): void;
-export declare function assertCanDelete(def: ObjectDefinition, roles: readonly string[], locale?: Locale): void;
-export declare function assertCanUpdateField(def: ObjectDefinition, roles: readonly string[], field: string, locale?: Locale): void;
+export declare function allowedUpdateFields(def: ObjectDefinition, roles: readonly string[], lookup?: ObjectLookup): string[] | null;
+export declare function assertCanCreate(def: ObjectDefinition, roles: readonly string[], locale?: Locale, lookup?: ObjectLookup): void;
+export declare function assertCanUpdate(def: ObjectDefinition, roles: readonly string[], locale?: Locale, lookup?: ObjectLookup): void;
+export declare function assertCanDelete(def: ObjectDefinition, roles: readonly string[], locale?: Locale, lookup?: ObjectLookup): void;
+export declare function assertCanUpdateField(def: ObjectDefinition, roles: readonly string[], field: string, locale?: Locale, lookup?: ObjectLookup): void;
 //# sourceMappingURL=authorize.d.ts.map

package/dist/core/rbac/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAc,MAAM,kBAAkB,CAAC;AAQ3D,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAElF;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAElF;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIlF;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAItG;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAEpG;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAIN"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAc,MAAM,kBAAkB,CAAC;AAG3D,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAevE,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAEzG;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAEzG;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAIzG;AAED,wBAAgB,cAAc,CAC5B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAIT;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,YAAY,GACpB,MAAM,EAAE,GAAG,IAAI,CAEjB;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,YAAY,GACpB,IAAI,CAEN;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,YAAY,GACpB,IAAI,CAEN;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,YAAY,GACpB,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,YAAY,GACpB,IAAI,CAIN"}