@xemahq/contracts 0.1.0

package/dist/app-platform/lib/app-shell-binding.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppSurfaceConflictCode = exports.AppSurfaceDimensionsSchema = exports.AppHostBindingSchema = exports.AppHostBinding = exports.AppShellKindSchema = exports.AppShellKind = void 0;
+exports.validateAppSurfaceCombination = validateAppSurfaceCombination;
+exports.isHeadlessEmbeddedContradiction = isHeadlessEmbeddedContradiction;
+const zod_1 = require("zod");
+const audience_policy_1 = require("./audience-policy");
+var AppShellKind;
+(function (AppShellKind) {
+    AppShellKind["Hosted"] = "hosted";
+    AppShellKind["Standalone"] = "standalone";
+    AppShellKind["Embedded"] = "embedded";
+    AppShellKind["Headless"] = "headless";
+})(AppShellKind || (exports.AppShellKind = AppShellKind = {}));
+exports.AppShellKindSchema = zod_1.z.nativeEnum(AppShellKind);
+var AppHostBinding;
+(function (AppHostBinding) {
+    AppHostBinding["Xema"] = "xema";
+    AppHostBinding["CustomDomain"] = "custom-domain";
+    AppHostBinding["PathBased"] = "path-based";
+})(AppHostBinding || (exports.AppHostBinding = AppHostBinding = {}));
+exports.AppHostBindingSchema = zod_1.z.nativeEnum(AppHostBinding);
+exports.AppSurfaceDimensionsSchema = zod_1.z
+    .object({
+    shell: exports.AppShellKindSchema,
+    audience: zod_1.z.nativeEnum(audience_policy_1.AudienceKind),
+    host: exports.AppHostBindingSchema,
+})
+    .strict();
+var AppSurfaceConflictCode;
+(function (AppSurfaceConflictCode) {
+    AppSurfaceConflictCode["HeadlessWithChrome"] = "headless-with-chrome";
+    AppSurfaceConflictCode["EmbeddedIsChrome"] = "embedded-is-chrome";
+    AppSurfaceConflictCode["StandaloneNeedsOwnHost"] = "standalone-needs-own-host";
+    AppSurfaceConflictCode["EmbeddedNeedsXemaHost"] = "embedded-needs-xema-host";
+})(AppSurfaceConflictCode || (exports.AppSurfaceConflictCode = AppSurfaceConflictCode = {}));
+function validateAppSurfaceCombination(dims) {
+    const conflicts = [];
+    if (dims.shell === AppShellKind.Standalone &&
+        dims.host === AppHostBinding.PathBased) {
+        conflicts.push({
+            code: AppSurfaceConflictCode.StandaloneNeedsOwnHost,
+            message: 'A standalone app has its own full-page surface and cannot be path-based on a shared host; use xema or custom-domain.',
+        });
+    }
+    if (dims.shell === AppShellKind.Embedded &&
+        dims.host !== AppHostBinding.Xema) {
+        conflicts.push({
+            code: AppSurfaceConflictCode.EmbeddedNeedsXemaHost,
+            message: "An embedded app is served into a third-party page and relies on the Xema origin's CSP/cookies; it must be xema-hosted.",
+        });
+    }
+    return { ok: conflicts.length === 0, conflicts };
+}
+function isHeadlessEmbeddedContradiction(shell, alsoEmbedded) {
+    return shell === AppShellKind.Headless && alsoEmbedded;
+}
+//# sourceMappingURL=app-shell-binding.js.map

package/dist/app-platform/lib/app-shell-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-shell-binding.js","sourceRoot":"","sources":["../../../src/app-platform/lib/app-shell-binding.ts"],"names":[],"mappings":";;;AA8GA,sEAkCC;AASD,0EAKC;AA9JD,6BAAwB;AAExB,uDAAiD;AAyBjD,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,iCAAiB,CAAA;IACjB,yCAAyB,CAAA;IACzB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA;AACvB,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB;AAEY,QAAA,kBAAkB,GAAG,OAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAY7D,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,+BAAa,CAAA;IACb,gDAA8B,CAAA;IAC9B,0CAAwB,CAAA;AAC1B,CAAC,EAJW,cAAc,8BAAd,cAAc,QAIzB;AAEY,QAAA,oBAAoB,GAAG,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AASpD,QAAA,0BAA0B,GAAoC,OAAC;KACzE,MAAM,CAAC;IACN,KAAK,EAAE,0BAAkB;IACzB,QAAQ,EAAE,OAAC,CAAC,UAAU,CAAC,8BAAY,CAAC;IACpC,IAAI,EAAE,4BAAoB;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,qEAA2C,CAAA;IAC3C,iEAAuC,CAAA;IACvC,8EAAoD,CAAA;IACpD,4EAAkD,CAAA;AACpD,CAAC,EALW,sBAAsB,sCAAtB,sBAAsB,QAKjC;AAgCD,SAAgB,6BAA6B,CAC3C,IAA0B;IAE1B,MAAM,SAAS,GAAyB,EAAE,CAAC;IAQ3C,IACE,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,UAAU;QACtC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,SAAS,EACtC,CAAC;QACD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,sBAAsB,CAAC,sBAAsB;YACnD,OAAO,EACL,sHAAsH;SACzH,CAAC,CAAC;IACL,CAAC;IAED,IACE,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,QAAQ;QACpC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,IAAI,EACjC,CAAC;QACD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,sBAAsB,CAAC,qBAAqB;YAClD,OAAO,EACL,wHAAwH;SAC3H,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AASD,SAAgB,+BAA+B,CAC7C,KAAmB,EACnB,YAAqB;IAErB,OAAO,KAAK,KAAK,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC;AACzD,CAAC"}

package/dist/app-platform/lib/app-surface-authoring-mode.d.ts

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+export declare enum AppSurfaceAuthoringMode {
+    Declared = "declared",
+    Composed = "composed",
+    Coded = "coded"
+}
+export declare const AppSurfaceAuthoringModeSchema: z.ZodEnum<typeof AppSurfaceAuthoringMode>;
+//# sourceMappingURL=app-surface-authoring-mode.d.ts.map

package/dist/app-platform/lib/app-surface-authoring-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-surface-authoring-mode.d.ts","sourceRoot":"","sources":["../../../src/app-platform/lib/app-surface-authoring-mode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiDxB,oBAAY,uBAAuB;IACjC,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,eAAO,MAAM,6BAA6B,2CAEzC,CAAC"}

package/dist/app-platform/lib/app-surface-authoring-mode.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppSurfaceAuthoringModeSchema = exports.AppSurfaceAuthoringMode = void 0;
+const zod_1 = require("zod");
+var AppSurfaceAuthoringMode;
+(function (AppSurfaceAuthoringMode) {
+    AppSurfaceAuthoringMode["Declared"] = "declared";
+    AppSurfaceAuthoringMode["Composed"] = "composed";
+    AppSurfaceAuthoringMode["Coded"] = "coded";
+})(AppSurfaceAuthoringMode || (exports.AppSurfaceAuthoringMode = AppSurfaceAuthoringMode = {}));
+exports.AppSurfaceAuthoringModeSchema = zod_1.z.nativeEnum(AppSurfaceAuthoringMode);
+//# sourceMappingURL=app-surface-authoring-mode.js.map

package/dist/app-platform/lib/app-surface-authoring-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-surface-authoring-mode.js","sourceRoot":"","sources":["../../../src/app-platform/lib/app-surface-authoring-mode.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAiDxB,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,gDAAqB,CAAA;IACrB,gDAAqB,CAAA;IACrB,0CAAe,CAAA;AACjB,CAAC,EAJW,uBAAuB,uCAAvB,uBAAuB,QAIlC;AAEY,QAAA,6BAA6B,GAAG,OAAC,CAAC,UAAU,CACvD,uBAAuB,CACxB,CAAC"}

package/dist/app-platform/lib/app.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+import { type CapabilityRef } from '../../capability';
+import { type ExecutionEnvironmentRef } from '../../execution-environment';
+import { type XemaObjectRef } from '../../object';
+import { type BiomeInstall } from './biome-install';
+import { type AudiencePolicy } from './audience-policy';
+import { type BrandingConfig } from './branding-config';
+import { type AppLockfile } from './app-lockfile';
+import { AppSurfaceAuthoringMode } from './app-surface-authoring-mode';
+export interface CapabilityPolicyOverride {
+    capability: CapabilityRef;
+    allowedResources?: readonly string[];
+    allowedEnvironments?: readonly ExecutionEnvironmentRef[];
+    rateLimit?: number;
+}
+export declare const CapabilityPolicyOverrideSchema: z.ZodType<CapabilityPolicyOverride>;
+export interface App {
+    ref: XemaObjectRef;
+    installedBiomes: BiomeInstall[];
+    defaultZone: ExecutionEnvironmentRef;
+    audiences: AudiencePolicy[];
+    capabilityPolicy: CapabilityPolicyOverride[];
+    branding: BrandingConfig;
+    lockfile: AppLockfile;
+    surface: AppSurfaceAuthoringMode;
+    activeReleaseId?: string;
+}
+export declare const AppSchema: z.ZodType<App>;
+//# sourceMappingURL=app.d.ts.map

package/dist/app-platform/lib/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/app-platform/lib/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EACL,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AAUtC,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,aAAa,CAAC;IAC1B,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,mBAAmB,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,8BAA8B,EAQrC,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;AA+B1C,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,aAAa,CAAC;IACnB,eAAe,EAAE,YAAY,EAAE,CAAC;IAChC,WAAW,EAAE,uBAAuB,CAAC;IACrC,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;IAC7C,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,WAAW,CAAC;IACtB,OAAO,EAAE,uBAAuB,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,SAAS,EAmCH,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC"}

package/dist/app-platform/lib/app.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppSchema = exports.CapabilityPolicyOverrideSchema = void 0;
+const zod_1 = require("zod");
+const capability_1 = require("../../capability");
+const execution_environment_1 = require("../../execution-environment");
+const object_1 = require("../../object");
+const biome_install_1 = require("./biome-install");
+const audience_policy_1 = require("./audience-policy");
+const branding_config_1 = require("./branding-config");
+const app_lockfile_1 = require("./app-lockfile");
+const app_surface_authoring_mode_1 = require("./app-surface-authoring-mode");
+exports.CapabilityPolicyOverrideSchema = zod_1.z.object({
+    capability: capability_1.CapabilityRefSchema,
+    allowedResources: zod_1.z.array(zod_1.z.string().min(1)).readonly().optional(),
+    allowedEnvironments: zod_1.z
+        .array(execution_environment_1.ExecutionEnvironmentRefSchema)
+        .readonly()
+        .optional(),
+    rateLimit: zod_1.z.number().int().positive().optional(),
+});
+exports.AppSchema = zod_1.z
+    .object({
+    ref: object_1.XemaObjectRefSchema,
+    installedBiomes: zod_1.z.array(biome_install_1.BiomeInstallSchema),
+    defaultZone: execution_environment_1.ExecutionEnvironmentRefSchema,
+    audiences: zod_1.z.array(audience_policy_1.AudiencePolicySchema).min(1, {
+        message: 'App.audiences must contain at least one AudiencePolicy; an App with zero audiences is unreachable.',
+    }),
+    capabilityPolicy: zod_1.z.array(exports.CapabilityPolicyOverrideSchema),
+    branding: branding_config_1.BrandingConfigSchema,
+    lockfile: app_lockfile_1.AppLockfileSchema,
+    surface: app_surface_authoring_mode_1.AppSurfaceAuthoringModeSchema,
+    activeReleaseId: zod_1.z.string().min(1).optional(),
+})
+    .superRefine((app, ctx) => {
+    if (app.surface !== app_surface_authoring_mode_1.AppSurfaceAuthoringMode.Declared &&
+        app.installedBiomes.length === 0) {
+        ctx.addIssue({
+            code: 'too_small',
+            minimum: 1,
+            origin: 'array',
+            inclusive: true,
+            path: ['installedBiomes'],
+            message: `App.installedBiomes must contain at least one BiomeInstall for a '${app.surface}' App; ` +
+                'one with zero biomes has no capability surface. Only a `declared` App may install none.',
+        });
+    }
+});
+//# sourceMappingURL=app.js.map

package/dist/app-platform/lib/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../../src/app-platform/lib/app.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,iDAA2E;AAC3E,uEAGqC;AACrC,yCAAuE;AACvE,mDAAwE;AACxE,uDAA8E;AAC9E,uDAA8E;AAC9E,iDAAqE;AACrE,6EAGsC;AAiBzB,QAAA,8BAA8B,GAAG,OAAC,CAAC,MAAM,CAAC;IACrD,UAAU,EAAE,gCAAmB;IAC/B,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClE,mBAAmB,EAAE,OAAC;SACnB,KAAK,CAAC,qDAA6B,CAAC;SACpC,QAAQ,EAAE;SACV,QAAQ,EAAE;IACb,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAClD,CAAwC,CAAC;AA2C7B,QAAA,SAAS,GAAG,OAAC;KACvB,MAAM,CAAC;IACN,GAAG,EAAE,4BAAmB;IACxB,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,kCAAkB,CAAC;IAC5C,WAAW,EAAE,qDAA6B;IAC1C,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,sCAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE;QAC9C,OAAO,EACL,oGAAoG;KACvG,CAAC;IACF,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,sCAA8B,CAAC;IACzD,QAAQ,EAAE,sCAAoB;IAC9B,QAAQ,EAAE,gCAAiB;IAC3B,OAAO,EAAE,0DAA6B;IACtC,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAKxB,IACE,GAAG,CAAC,OAAO,KAAK,oDAAuB,CAAC,QAAQ;QAChD,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EACL,qEAAqE,GAAG,CAAC,OAAO,SAAS;gBACzF,yFAAyF;SAC5F,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAA8B,CAAC"}

package/dist/app-platform/lib/audience-policy.d.ts

@@ -0,0 +1,31 @@
+import { z } from 'zod';
+import { type ExecutionEnvironmentRef } from '../../execution-environment';
+export declare enum AudienceKind {
+    InternalOrg = "internal-org",
+    ExternalSubject = "external-subject",
+    PublicAnon = "public-anon"
+}
+export declare const AudienceKindSchema: z.ZodEnum<typeof AudienceKind>;
+export declare enum AudienceUpstreamType {
+    Oidc = "oidc",
+    MagicLink = "magic-link",
+    Anon = "anon"
+}
+export declare const AudienceUpstreamTypeSchema: z.ZodEnum<typeof AudienceUpstreamType>;
+export interface AudienceUpstream {
+    type: AudienceUpstreamType;
+    metadata?: Record<string, unknown>;
+}
+export declare const AudienceUpstreamSchema: z.ZodType<AudienceUpstream>;
+export interface AudienceRateLimit {
+    perHourPerSubject?: number;
+}
+export declare const AudienceRateLimitSchema: z.ZodType<AudienceRateLimit>;
+export interface AudiencePolicy {
+    kind: AudienceKind;
+    allowedEnvironments: readonly ExecutionEnvironmentRef[];
+    authUpstream?: AudienceUpstream;
+    rateLimit?: AudienceRateLimit;
+}
+export declare const AudiencePolicySchema: z.ZodType<AudiencePolicy>;
+//# sourceMappingURL=audience-policy.d.ts.map

package/dist/app-platform/lib/audience-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience-policy.d.ts","sourceRoot":"","sources":["../../../src/app-platform/lib/audience-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AAcrC,oBAAY,YAAY;IACtB,WAAW,iBAAiB;IAC5B,eAAe,qBAAqB;IACpC,UAAU,gBAAgB;CAC3B;AAED,eAAO,MAAM,kBAAkB,gCAA6B,CAAC;AAQ7D,oBAAY,oBAAoB;IAC9B,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,IAAI,SAAS;CACd;AAED,eAAO,MAAM,0BAA0B,wCAAqC,CAAC;AAE7E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,sBAAsB,EAG7B,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAElC,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,uBAAuB,EAE9B,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAYnC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,YAAY,CAAC;IACnB,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACxD,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,eAAO,MAAM,oBAAoB,EAW3B,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC"}

package/dist/app-platform/lib/audience-policy.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AudiencePolicySchema = exports.AudienceRateLimitSchema = exports.AudienceUpstreamSchema = exports.AudienceUpstreamTypeSchema = exports.AudienceUpstreamType = exports.AudienceKindSchema = exports.AudienceKind = void 0;
+const zod_1 = require("zod");
+const execution_environment_1 = require("../../execution-environment");
+var AudienceKind;
+(function (AudienceKind) {
+    AudienceKind["InternalOrg"] = "internal-org";
+    AudienceKind["ExternalSubject"] = "external-subject";
+    AudienceKind["PublicAnon"] = "public-anon";
+})(AudienceKind || (exports.AudienceKind = AudienceKind = {}));
+exports.AudienceKindSchema = zod_1.z.nativeEnum(AudienceKind);
+var AudienceUpstreamType;
+(function (AudienceUpstreamType) {
+    AudienceUpstreamType["Oidc"] = "oidc";
+    AudienceUpstreamType["MagicLink"] = "magic-link";
+    AudienceUpstreamType["Anon"] = "anon";
+})(AudienceUpstreamType || (exports.AudienceUpstreamType = AudienceUpstreamType = {}));
+exports.AudienceUpstreamTypeSchema = zod_1.z.nativeEnum(AudienceUpstreamType);
+exports.AudienceUpstreamSchema = zod_1.z.object({
+    type: exports.AudienceUpstreamTypeSchema,
+    metadata: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+});
+exports.AudienceRateLimitSchema = zod_1.z.object({
+    perHourPerSubject: zod_1.z.number().int().positive().optional(),
+});
+exports.AudiencePolicySchema = zod_1.z.object({
+    kind: exports.AudienceKindSchema,
+    allowedEnvironments: zod_1.z
+        .array(execution_environment_1.ExecutionEnvironmentRefSchema)
+        .min(1, {
+        message: 'AudiencePolicy.allowedEnvironments must contain at least one ExecutionEnvironmentRef; an audience with zero zones is a policy bug.',
+    })
+        .readonly(),
+    authUpstream: exports.AudienceUpstreamSchema.optional(),
+    rateLimit: exports.AudienceRateLimitSchema.optional(),
+});
+//# sourceMappingURL=audience-policy.js.map

package/dist/app-platform/lib/audience-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience-policy.js","sourceRoot":"","sources":["../../../src/app-platform/lib/audience-policy.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,uEAGqC;AAcrC,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,4CAA4B,CAAA;IAC5B,oDAAoC,CAAA;IACpC,0CAA0B,CAAA;AAC5B,CAAC,EAJW,YAAY,4BAAZ,YAAY,QAIvB;AAEY,QAAA,kBAAkB,GAAG,OAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAQ7D,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,qCAAa,CAAA;IACb,gDAAwB,CAAA;IACxB,qCAAa,CAAA;AACf,CAAC,EAJW,oBAAoB,oCAApB,oBAAoB,QAI/B;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAOhE,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,kCAA0B;IAChC,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAgC,CAAC;AAMrB,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAiC,CAAC;AAmBtB,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,0BAAkB;IACxB,mBAAmB,EAAE,OAAC;SACnB,KAAK,CAAC,qDAA6B,CAAC;SACpC,GAAG,CAAC,CAAC,EAAE;QACN,OAAO,EACL,oIAAoI;KACvI,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,8BAAsB,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,+BAAuB,CAAC,QAAQ,EAAE;CAC9C,CAA8B,CAAC"}

package/dist/app-platform/lib/biome-install.d.ts

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+import { type XemaObjectRef } from '../../object';
+export interface BiomeInstall {
+    biomeRef: XemaObjectRef;
+    versionConstraint: string;
+    configuration?: Record<string, unknown>;
+}
+export declare const BiomeInstallSchema: z.ZodType<BiomeInstall>;
+//# sourceMappingURL=biome-install.d.ts.map

package/dist/app-platform/lib/biome-install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"biome-install.d.ts","sourceRoot":"","sources":["../../../src/app-platform/lib/biome-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAcvE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,eAAO,MAAM,kBAAkB,EAOzB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC"}

package/dist/app-platform/lib/biome-install.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BiomeInstallSchema = void 0;
+const zod_1 = require("zod");
+const object_1 = require("../../object");
+exports.BiomeInstallSchema = zod_1.z.object({
+    biomeRef: object_1.XemaObjectRefSchema,
+    versionConstraint: zod_1.z.string().min(1, {
+        message: 'BiomeInstall.versionConstraint must be a non-empty semver-range string (e.g. `^1.2.0`, `1.2.0`, `latest-compatible`).',
+    }),
+    configuration: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+});
+//# sourceMappingURL=biome-install.js.map

package/dist/app-platform/lib/biome-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"biome-install.js","sourceRoot":"","sources":["../../../src/app-platform/lib/biome-install.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,yCAAuE;AAoB1D,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,4BAAmB;IAC7B,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QACnC,OAAO,EACL,uHAAuH;KAC1H,CAAC;IACF,aAAa,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAA4B,CAAC"}

package/dist/app-platform/lib/branding-config.d.ts

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+export interface BrandingConfig {
+    displayName: string;
+    logoUrl?: string;
+    primaryColor?: string;
+    cssTokens?: Record<string, string>;
+}
+export declare const BrandingConfigSchema: z.ZodType<BrandingConfig>;
+//# sourceMappingURL=branding-config.d.ts.map

package/dist/app-platform/lib/branding-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding-config.d.ts","sourceRoot":"","sources":["../../../src/app-platform/lib/branding-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqCxB,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,oBAAoB,EAkB3B,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC"}

package/dist/app-platform/lib/branding-config.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrandingConfigSchema = void 0;
+const zod_1 = require("zod");
+const PRIMARY_COLOR_REGEX = /^(?:#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})|rgba?\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\d{1,3}\s*(?:,\s*(?:0|1|0?\.\d+)\s*)?\))$/;
+exports.BrandingConfigSchema = zod_1.z.object({
+    displayName: zod_1.z.string().min(1, {
+        message: 'BrandingConfig.displayName must be a non-empty string.',
+    }),
+    logoUrl: zod_1.z
+        .string()
+        .url({
+        message: 'BrandingConfig.logoUrl must be a valid URL.',
+    })
+        .optional(),
+    primaryColor: zod_1.z
+        .string()
+        .regex(PRIMARY_COLOR_REGEX, {
+        message: 'BrandingConfig.primaryColor must be a hex (`#rgb`, `#rrggbb`, `#rrggbbaa`) or `rgb()` / `rgba()` value. Use `cssTokens` for richer theming.',
+    })
+        .optional(),
+    cssTokens: zod_1.z.record(zod_1.z.string().min(1), zod_1.z.string().min(1)).optional(),
+});
+//# sourceMappingURL=branding-config.js.map

package/dist/app-platform/lib/branding-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding-config.js","sourceRoot":"","sources":["../../../src/app-platform/lib/branding-config.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAaxB,MAAM,mBAAmB,GACvB,uIAAuI,CAAC;AA8B7H,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAC7B,OAAO,EAAE,wDAAwD;KAClE,CAAC;IACF,OAAO,EAAE,OAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC;QACH,OAAO,EAAE,6CAA6C;KACvD,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,mBAAmB,EAAE;QAC1B,OAAO,EACL,6IAA6I;KAChJ,CAAC;SACD,QAAQ,EAAE;IACb,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrE,CAA8B,CAAC"}

package/dist/app-platform/lib/delegated-session.d.ts

@@ -0,0 +1,22 @@
+import { z } from 'zod';
+import { type CapabilityRef } from '../../capability';
+import { type ExecutionEnvironmentRef } from '../../execution-environment';
+import { SubjectKind } from '../../subject';
+export interface DelegatedSessionActor {
+    sub: string;
+    subject_kind: SubjectKind;
+}
+export declare const DelegatedSessionActorSchema: z.ZodType<DelegatedSessionActor>;
+export interface DelegatedSessionClaims {
+    sub: string;
+    act: DelegatedSessionActor;
+    org: string;
+    project?: string;
+    session: string;
+    environment: ExecutionEnvironmentRef;
+    capabilities: CapabilityRef[];
+    exp: number;
+}
+export declare const DelegatedSessionClaimsSchema: z.ZodType<DelegatedSessionClaims>;
+export declare const DELEGATED_SESSION_ACTOR_KIND: SubjectKind;
+//# sourceMappingURL=delegated-session.d.ts.map

package/dist/app-platform/lib/delegated-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-session.d.ts","sourceRoot":"","sources":["../../../src/app-platform/lib/delegated-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,WAAW,EAAqB,MAAM,eAAe,CAAC;AA+C/D,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,WAAW,CAAC;CAC3B;AAED,eAAO,MAAM,2BAA2B,EAQzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAyDhD,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,qBAAqB,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,uBAAuB,CAAC;IACrC,YAAY,EAAE,aAAa,EAAE,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,4BAA4B,EAyBnC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAYxC,eAAO,MAAM,4BAA4B,EAAE,WAAmC,CAAC"}

package/dist/app-platform/lib/delegated-session.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DELEGATED_SESSION_ACTOR_KIND = exports.DelegatedSessionClaimsSchema = exports.DelegatedSessionActorSchema = void 0;
+const zod_1 = require("zod");
+const capability_1 = require("../../capability");
+const execution_environment_1 = require("../../execution-environment");
+const subject_1 = require("../../subject");
+exports.DelegatedSessionActorSchema = zod_1.z
+    .object({
+    sub: zod_1.z.string().min(1, {
+        message: 'DelegatedSessionClaims.act.sub must be the acting party’s BARE identifier (an AppClient `clientId`), never a "<kind>:<id>" composite.',
+    }),
+    subject_kind: subject_1.SubjectKindSchema,
+})
+    .strict();
+exports.DelegatedSessionClaimsSchema = zod_1.z.object({
+    sub: zod_1.z.string().min(1, {
+        message: 'DelegatedSessionClaims.sub must be a non-empty subject identifier (e.g. `external-subject:<id>` or `anon:<random>`).',
+    }),
+    act: exports.DelegatedSessionActorSchema,
+    org: zod_1.z.string().min(1, {
+        message: 'DelegatedSessionClaims.org must be a non-empty orgId.',
+    }),
+    project: zod_1.z
+        .string()
+        .min(1, {
+        message: 'DelegatedSessionClaims.project, WHEN PRESENT, must be a non-empty projectId. Omit the claim for an org-scoped session; never send `""`.',
+    })
+        .optional(),
+    session: zod_1.z.string().min(1, {
+        message: 'DelegatedSessionClaims.session must be a non-empty sessionId.',
+    }),
+    environment: execution_environment_1.ExecutionEnvironmentRefSchema,
+    capabilities: zod_1.z.array(capability_1.CapabilityRefSchema),
+    exp: zod_1.z.number().int().positive({
+        message: 'DelegatedSessionClaims.exp must be a positive Unix-epoch second count (RFC 7519 `exp`).',
+    }),
+});
+exports.DELEGATED_SESSION_ACTOR_KIND = subject_1.SubjectKind.AppClient;
+//# sourceMappingURL=delegated-session.js.map

package/dist/app-platform/lib/delegated-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-session.js","sourceRoot":"","sources":["../../../src/app-platform/lib/delegated-session.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,iDAA2E;AAC3E,uEAGqC;AACrC,2CAA+D;AAoDlD,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QACrB,OAAO,EACL,uIAAuI;KAC1I,CAAC;IACF,YAAY,EAAE,2BAAiB;CAChC,CAAC;KACD,MAAM,EAAsC,CAAC;AAoEnC,QAAA,4BAA4B,GAAG,OAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QACrB,OAAO,EACL,sHAAsH;KACzH,CAAC;IACF,GAAG,EAAE,mCAA2B;IAChC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QACrB,OAAO,EAAE,uDAAuD;KACjE,CAAC;IACF,OAAO,EAAE,OAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE;QACN,OAAO,EACL,yIAAyI;KAC5I,CAAC;SACD,QAAQ,EAAE;IACb,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QACzB,OAAO,EAAE,+DAA+D;KACzE,CAAC;IACF,WAAW,EAAE,qDAA6B;IAC1C,YAAY,EAAE,OAAC,CAAC,KAAK,CAAC,gCAAmB,CAAC;IAC1C,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC;QAC7B,OAAO,EACL,yFAAyF;KAC5F,CAAC;CACH,CAAsC,CAAC;AAY3B,QAAA,4BAA4B,GAAgB,qBAAW,CAAC,SAAS,CAAC"}

package/dist/app-platform/lib/external-subject.d.ts

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+export interface ExternalSubject {
+    externalId: string;
+    appClientId: string;
+    createdAt: string;
+    metadata?: Record<string, unknown>;
+}
+export declare const ExternalSubjectSchema: z.ZodType<ExternalSubject>;
+//# sourceMappingURL=external-subject.d.ts.map

package/dist/app-platform/lib/external-subject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-subject.d.ts","sourceRoot":"","sources":["../../../src/app-platform/lib/external-subject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,qBAAqB,EAY5B,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC"}

package/dist/app-platform/lib/external-subject.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExternalSubjectSchema = void 0;
+const zod_1 = require("zod");
+exports.ExternalSubjectSchema = zod_1.z.object({
+    externalId: zod_1.z.string().min(1, {
+        message: 'ExternalSubject.externalId must be a non-empty string.',
+    }),
+    appClientId: zod_1.z.string().min(1, {
+        message: 'ExternalSubject.appClientId must be a non-empty string.',
+    }),
+    createdAt: zod_1.z.string().datetime({
+        message: 'ExternalSubject.createdAt must be a strict ISO-8601 datetime string.',
+    }),
+    metadata: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+});
+//# sourceMappingURL=external-subject.js.map

package/dist/app-platform/lib/external-subject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-subject.js","sourceRoot":"","sources":["../../../src/app-platform/lib/external-subject.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAmBX,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAC5B,OAAO,EAAE,wDAAwD;KAClE,CAAC;IACF,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAC7B,OAAO,EAAE,yDAAyD;KACnE,CAAC;IACF,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,OAAO,EACL,sEAAsE;KACzE,CAAC;IACF,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAA+B,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,3 @@
+export * from './lib/authority';
+export * from './lib/hash-chain';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAiBA,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC"}

package/dist/audit/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/authority"), exports);
+__exportStar(require("./lib/hash-chain"), exports);
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAiBA,kDAAgC;AAChC,mDAAiC"}

package/dist/audit/lib/authority.d.ts

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+export declare enum AuditAuthorityKind {
+    CapabilityGrant = "capability_grant",
+    Share = "share",
+    OrgRole = "org_role",
+    RoleAssignment = "role_assignment",
+    TeamMembership = "team_membership",
+    Delegation = "delegation",
+    CredentialDelegation = "credential_delegation",
+    ServiceToken = "service_token",
+    JobToken = "job_token",
+    RuntimeCapabilityAuthority = "runtime_capability_authority",
+    Decision = "decision",
+    PlatformAdmin = "platform_admin",
+    System = "system"
+}
+export declare const AuditAuthorityKindSchema: z.ZodEnum<typeof AuditAuthorityKind>;
+export declare const AuditAuthoritySchema: z.ZodObject<{
+    kind: z.ZodEnum<typeof AuditAuthorityKind>;
+    id: z.ZodOptional<z.ZodString>;
+    rule: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuditAuthority = z.infer<typeof AuditAuthoritySchema>;
+//# sourceMappingURL=authority.d.ts.map

package/dist/audit/lib/authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../../src/audit/lib/authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqCxB,oBAAY,kBAAkB;IAM5B,eAAe,qBAAqB;IAKpC,KAAK,UAAU;IAMf,OAAO,aAAa;IAEpB,cAAc,oBAAoB;IAElC,cAAc,oBAAoB;IAMlC,UAAU,eAAe;IAOzB,oBAAoB,0BAA0B;IAE9C,YAAY,kBAAkB;IAK9B,QAAQ,cAAc;IAKtB,0BAA0B,iCAAiC;IAE3D,QAAQ,aAAa;IAErB,aAAa,mBAAmB;IAOhC,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,wBAAwB,sCAAmC,CAAC;AAWzE,eAAO,MAAM,oBAAoB;;;;iBAI/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/audit/lib/authority.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditAuthoritySchema = exports.AuditAuthorityKindSchema = exports.AuditAuthorityKind = void 0;
+const zod_1 = require("zod");
+var AuditAuthorityKind;
+(function (AuditAuthorityKind) {
+    AuditAuthorityKind["CapabilityGrant"] = "capability_grant";
+    AuditAuthorityKind["Share"] = "share";
+    AuditAuthorityKind["OrgRole"] = "org_role";
+    AuditAuthorityKind["RoleAssignment"] = "role_assignment";
+    AuditAuthorityKind["TeamMembership"] = "team_membership";
+    AuditAuthorityKind["Delegation"] = "delegation";
+    AuditAuthorityKind["CredentialDelegation"] = "credential_delegation";
+    AuditAuthorityKind["ServiceToken"] = "service_token";
+    AuditAuthorityKind["JobToken"] = "job_token";
+    AuditAuthorityKind["RuntimeCapabilityAuthority"] = "runtime_capability_authority";
+    AuditAuthorityKind["Decision"] = "decision";
+    AuditAuthorityKind["PlatformAdmin"] = "platform_admin";
+    AuditAuthorityKind["System"] = "system";
+})(AuditAuthorityKind || (exports.AuditAuthorityKind = AuditAuthorityKind = {}));
+exports.AuditAuthorityKindSchema = zod_1.z.nativeEnum(AuditAuthorityKind);
+exports.AuditAuthoritySchema = zod_1.z.object({
+    kind: exports.AuditAuthorityKindSchema,
+    id: zod_1.z.string().min(1).max(256).optional(),
+    rule: zod_1.z.string().min(1).max(256).optional(),
+});
+//# sourceMappingURL=authority.js.map

package/dist/audit/lib/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../../src/audit/lib/authority.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAqCxB,IAAY,kBA0DX;AA1DD,WAAY,kBAAkB;IAM5B,0DAAoC,CAAA;IAKpC,qCAAe,CAAA;IAMf,0CAAoB,CAAA;IAEpB,wDAAkC,CAAA;IAElC,wDAAkC,CAAA;IAMlC,+CAAyB,CAAA;IAOzB,oEAA8C,CAAA;IAE9C,oDAA8B,CAAA;IAK9B,4CAAsB,CAAA;IAKtB,iFAA2D,CAAA;IAE3D,2CAAqB,CAAA;IAErB,sDAAgC,CAAA;IAOhC,uCAAiB,CAAA;AACnB,CAAC,EA1DW,kBAAkB,kCAAlB,kBAAkB,QA0D7B;AAEY,QAAA,wBAAwB,GAAG,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAW5D,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,gCAAwB;IAC9B,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC"}

package/dist/audit/lib/hash-chain.d.ts

@@ -0,0 +1,30 @@
+export declare const AUDIT_CHAIN_HASH_ALGORITHM = "sha256";
+export declare const AUDIT_CHAIN_GENESIS = "xema:audit-chain:genesis:v1";
+export declare enum AuditChainVersion {
+    OrgProjectV1 = "org_project_v1",
+    SpaceRefV2 = "space_ref_v2",
+    AttributionV3 = "attribution_v3"
+}
+export declare const AUDIT_CHAIN_GENESIS_BY_VERSION: Readonly<Record<AuditChainVersion, string>>;
+export declare const AUDIT_CHAIN_FIELD_SEPARATOR = "\u001E";
+export declare const AUDIT_CHAIN_FIELDS_V1: readonly ["id", "orgId", "projectId", "occurredAt", "actorType", "actorId", "action", "summary", "resourceKind", "resourceRef", "authorityKind", "authorityId", "authorityRule", "decision", "denyCode", "capabilityRef", "eventId", "correlationId", "chainSeq"];
+export declare const AUDIT_CHAIN_FIELDS_V2: readonly ["id", "scopeRef", "occurredAt", "actorType", "actorId", "action", "summary", "resourceKind", "resourceRef", "authorityKind", "authorityId", "authorityRule", "decision", "denyCode", "capabilityRef", "eventId", "correlationId", "chainSeq"];
+export declare const AUDIT_CHAIN_FIELDS_V3: readonly ["id", "scopeRef", "occurredAt", "actorType", "actorId", "action", "summary", "resourceKind", "resourceRef", "authorityKind", "authorityId", "authorityRule", "decision", "denyCode", "capabilityRef", "eventId", "correlationId", "chainSeq", "subjectKind", "subjectRef", "actorChain", "actAs", "tokenClass", "zone"];
+export declare const AUDIT_CHAIN_FIELDS: readonly ["id", "scopeRef", "occurredAt", "actorType", "actorId", "action", "summary", "resourceKind", "resourceRef", "authorityKind", "authorityId", "authorityRule", "decision", "denyCode", "capabilityRef", "eventId", "correlationId", "chainSeq", "subjectKind", "subjectRef", "actorChain", "actAs", "tokenClass", "zone"];
+export declare const AUDIT_CHAIN_FIELDS_BY_VERSION: Readonly<Record<AuditChainVersion, readonly AuditChainField[]>>;
+export type AuditChainField = (typeof AUDIT_CHAIN_FIELDS_V1)[number] | (typeof AUDIT_CHAIN_FIELDS_V2)[number] | (typeof AUDIT_CHAIN_FIELDS_V3)[number];
+export declare function parseAuditChainVersion(value: string): AuditChainVersion;
+export type AuditChainedEntry = {
+    readonly [K in AuditChainField]?: string | null;
+};
+export declare class AuditChainVersionUnknownError extends Error {
+    readonly version: string;
+    constructor(version: string);
+}
+export declare class AuditChainFieldSeparatorError extends Error {
+    readonly field: AuditChainField;
+    constructor(field: AuditChainField);
+}
+export declare function auditEntryHashInput(prevHash: string, entry: AuditChainedEntry, version: AuditChainVersion): string;
+export declare function auditChainTimestamp(at: Date): string;
+//# sourceMappingURL=hash-chain.d.ts.map

package/dist/audit/lib/hash-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash-chain.d.ts","sourceRoot":"","sources":["../../../src/audit/lib/hash-chain.ts"],"names":[],"mappings":"AAoCA,eAAO,MAAM,0BAA0B,WAAW,CAAC;AASnD,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AAGjE,oBAAY,iBAAiB;IAC3B,YAAY,mBAAmB;IAC/B,UAAU,iBAAiB;IAK3B,aAAa,mBAAmB;CACjC;AASD,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CACnD,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAMjC,CAAC;AAGH,eAAO,MAAM,2BAA2B,WAAW,CAAC;AAWpD,eAAO,MAAM,qBAAqB,mQAoBxB,CAAC;AAEX,eAAO,MAAM,qBAAqB,yPAmBxB,CAAC;AAkDX,eAAO,MAAM,qBAAqB,mUAQxB,CAAC;AAGX,eAAO,MAAM,kBAAkB,mUAAwB,CAAC;AAWxD,eAAO,MAAM,6BAA6B,EAAE,QAAQ,CAClD,MAAM,CAAC,iBAAiB,EAAE,SAAS,eAAe,EAAE,CAAC,CAKrD,CAAC;AAEH,MAAM,MAAM,eAAe,GACvB,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,GACtC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,GACtC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAe3C,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAKvE;AAcD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;CAChD,CAAC;AASF,qBAAa,6BAA8B,SAAQ,KAAK;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM;gBAAf,OAAO,EAAE,MAAM;CAOrC;AAGD,qBAAa,6BAA8B,SAAQ,KAAK;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe;gBAAtB,KAAK,EAAE,eAAe;CAQ5C;AAaD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,iBAAiB,GACzB,MAAM,CAwBR;AASD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,IAAI,GAAG,MAAM,CAEpD"}