@xemahq/contracts 0.1.0

package/dist/canonical-object/lib/canonical-object-type-owner.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CanonicalObjectTypeRefParseError = exports.CANONICAL_OBJECT_TYPE_REF_SEGMENT = exports.CANONICAL_OBJECT_TYPE_SPACE_KINDS = exports.CANONICAL_OBJECT_TYPE_REGISTRY = void 0;
+exports.assertCanonicalObjectTypeSpaceAdmissible = assertCanonicalObjectTypeSpaceAdmissible;
+exports.canonicalObjectTypeOwnerFromSpace = canonicalObjectTypeOwnerFromSpace;
+exports.canonicalObjectTypeOwnerForBiome = canonicalObjectTypeOwnerForBiome;
+exports.formatCanonicalObjectTypeRef = formatCanonicalObjectTypeRef;
+exports.parseCanonicalObjectTypeRef = parseCanonicalObjectTypeRef;
+const space_1 = require("../../space");
+const canonical_object_type_1 = require("./canonical-object-type");
+exports.CANONICAL_OBJECT_TYPE_REGISTRY = 'canonical-object-type-registry';
+exports.CANONICAL_OBJECT_TYPE_SPACE_KINDS = (0, space_1.spaceKindSubset)(space_1.SpaceKind.System, space_1.SpaceKind.Biome, space_1.SpaceKind.Org, space_1.SpaceKind.Project);
+exports.CANONICAL_OBJECT_TYPE_REF_SEGMENT = 'canonical-object-type';
+function assertCanonicalObjectTypeSpaceAdmissible(kind) {
+    (0, space_1.assertSpaceKindAdmissible)(exports.CANONICAL_OBJECT_TYPE_REGISTRY, kind, exports.CANONICAL_OBJECT_TYPE_SPACE_KINDS);
+}
+function canonicalObjectTypeOwnerFromSpace(space) {
+    assertCanonicalObjectTypeSpaceAdmissible(space.tier);
+    const identity = { ...space };
+    delete identity.path;
+    delete identity.classification;
+    if (identity.tier === space_1.SpaceKind.System || identity.tier === space_1.SpaceKind.Biome) {
+        return space_1.OwnerSpaceRefSchema.parse({
+            fence: space_1.OwnerSpaceFence.Global,
+            orgId: null,
+            space: identity,
+        });
+    }
+    const orgId = identity.orgId;
+    if (orgId === undefined || orgId.length === 0) {
+        throw new Error(`A ${identity.tier}-owned canonical object type must carry an orgId — ` +
+            'the tenant fence is derived from the owning space, never supplied.');
+    }
+    return space_1.OwnerSpaceRefSchema.parse({
+        fence: space_1.OwnerSpaceFence.Tenant,
+        orgId,
+        space: identity,
+    });
+}
+function canonicalObjectTypeOwnerForBiome(biomeId) {
+    return canonicalObjectTypeOwnerFromSpace({
+        tier: space_1.SpaceKind.Biome,
+        biomeId,
+    });
+}
+function formatCanonicalObjectTypeRef(identity) {
+    const owner = canonicalObjectTypeOwnerFromSpace(identity.owner.space);
+    const key = canonical_object_type_1.CanonicalObjectTypeRefSchema.parse(identity.key);
+    return `${(0, space_1.formatSpaceRef)(owner.space)}/${exports.CANONICAL_OBJECT_TYPE_REF_SEGMENT}/${key}`;
+}
+class CanonicalObjectTypeRefParseError extends Error {
+    code = 'CANONICAL_OBJECT_TYPE_REF_INVALID';
+    raw;
+    constructor(message, raw) {
+        super(message);
+        this.name = 'CanonicalObjectTypeRefParseError';
+        this.raw = raw;
+    }
+}
+exports.CanonicalObjectTypeRefParseError = CanonicalObjectTypeRefParseError;
+function parseCanonicalObjectTypeRef(raw) {
+    const marker = `/${exports.CANONICAL_OBJECT_TYPE_REF_SEGMENT}/`;
+    const at = raw.lastIndexOf(marker);
+    if (at <= 0) {
+        throw new CanonicalObjectTypeRefParseError(`A canonical object type ref must be "<space-uri>${marker}<key>".`, raw);
+    }
+    const key = raw.slice(at + marker.length);
+    const parsedKey = canonical_object_type_1.CanonicalObjectTypeRefSchema.safeParse(key);
+    if (!parsedKey.success) {
+        throw new CanonicalObjectTypeRefParseError(`Canonical object type key "${key}" is not a legal key: ` +
+            parsedKey.error.issues.map((issue) => issue.message).join('; '), raw);
+    }
+    return {
+        owner: canonicalObjectTypeOwnerFromSpace((0, space_1.parseSpaceRef)(raw.slice(0, at))),
+        key: parsedKey.data,
+    };
+}
+//# sourceMappingURL=canonical-object-type-owner.js.map

package/dist/canonical-object/lib/canonical-object-type-owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-object-type-owner.js","sourceRoot":"","sources":["../../../src/canonical-object/lib/canonical-object-type-owner.ts"],"names":[],"mappings":";;;AAsGA,4FAQC;AAWD,8EA4BC;AAOD,4EAOC;AAYD,oEAMC;AAeD,kEAwBC;AAtKD,uCAWqB;AACrB,mEAGiC;AAGpB,QAAA,8BAA8B,GAAG,gCAAgC,CAAC;AAMlE,QAAA,iCAAiC,GAC5C,IAAA,uBAAe,EACb,iBAAS,CAAC,MAAM,EAChB,iBAAS,CAAC,KAAK,EACf,iBAAS,CAAC,GAAG,EACb,iBAAS,CAAC,OAAO,CAClB,CAAC;AAOS,QAAA,iCAAiC,GAAG,uBAAuB,CAAC;AAWzE,SAAgB,wCAAwC,CACtD,IAAe;IAEf,IAAA,iCAAyB,EACvB,sCAA8B,EAC9B,IAAI,EACJ,yCAAiC,CAClC,CAAC;AACJ,CAAC;AAWD,SAAgB,iCAAiC,CAC/C,KAAe;IAEf,wCAAwC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAa,EAAE,GAAG,KAAK,EAAE,CAAC;IACxC,OAAO,QAAQ,CAAC,IAAI,CAAC;IACrB,OAAO,QAAQ,CAAC,cAAc,CAAC;IAE/B,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAS,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAS,CAAC,KAAK,EAAE,CAAC;QAC5E,OAAO,2BAAmB,CAAC,KAAK,CAAC;YAC/B,KAAK,EAAE,uBAAe,CAAC,MAAM;YAC7B,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,KAAK,QAAQ,CAAC,IAAI,qDAAqD;YACrE,oEAAoE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,2BAAmB,CAAC,KAAK,CAAC;QAC/B,KAAK,EAAE,uBAAe,CAAC,MAAM;QAC7B,KAAK;QACL,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;AACL,CAAC;AAOD,SAAgB,gCAAgC,CAC9C,OAAe;IAEf,OAAO,iCAAiC,CAAC;QACvC,IAAI,EAAE,iBAAS,CAAC,KAAK;QACrB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAYD,SAAgB,4BAA4B,CAC1C,QAAqC;IAErC,MAAM,KAAK,GAAG,iCAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,oDAA4B,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,GAAG,IAAA,sBAAc,EAAC,KAAK,CAAC,KAAK,CAAC,IAAI,yCAAiC,IAAI,GAAG,EAAE,CAAC;AACtF,CAAC;AAGD,MAAa,gCAAiC,SAAQ,KAAK;IACzC,IAAI,GAAG,mCAAmC,CAAC;IAC3C,GAAG,CAAS;IAE5B,YAAmB,OAAe,EAAE,GAAW;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;CACF;AATD,4EASC;AAGD,SAAgB,2BAA2B,CACzC,GAAW;IAEX,MAAM,MAAM,GAAG,IAAI,yCAAiC,GAAG,CAAC;IACxD,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,gCAAgC,CACxC,mDAAmD,MAAM,SAAS,EAClE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,oDAA4B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,gCAAgC,CACxC,8BAA8B,GAAG,wBAAwB;YACvD,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EACjE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,iCAAiC,CAAC,IAAA,qBAAa,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzE,GAAG,EAAE,SAAS,CAAC,IAAI;KACpB,CAAC;AACJ,CAAC"}

package/dist/canonical-object/lib/canonical-object-type.d.ts

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+export type CanonicalObjectTypeRef = string;
+export declare const CanonicalObjectTypeRefSchema: z.ZodType<CanonicalObjectTypeRef>;
+export declare const CanonicalObjectTypeVersionSchema: z.ZodString;
+//# sourceMappingURL=canonical-object-type.d.ts.map

package/dist/canonical-object/lib/canonical-object-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-object-type.d.ts","sourceRoot":"","sources":["../../../src/canonical-object/lib/canonical-object-type.ts"],"names":[],"mappings":"AA8CA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE5C,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAOxE,CAAC;AAGJ,eAAO,MAAM,gCAAgC,aAE0B,CAAC"}

package/dist/canonical-object/lib/canonical-object-type.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CanonicalObjectTypeVersionSchema = exports.CanonicalObjectTypeRefSchema = void 0;
+const zod_1 = require("zod");
+const CANONICAL_OBJECT_TYPE_KEY_MAX = 100;
+exports.CanonicalObjectTypeRefSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(CANONICAL_OBJECT_TYPE_KEY_MAX)
+    .regex(/^[a-z][a-z0-9_]*$/, 'a canonical-object-type key must be lower_snake (e.g. sales_opportunity)');
+exports.CanonicalObjectTypeVersionSchema = zod_1.z
+    .string()
+    .regex(/^\d+\.\d+\.\d+$/, 'version must be semver MAJOR.MINOR.PATCH');
+//# sourceMappingURL=canonical-object-type.js.map

package/dist/canonical-object/lib/canonical-object-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-object-type.js","sourceRoot":"","sources":["../../../src/canonical-object/lib/canonical-object-type.ts"],"names":[],"mappings":";;;AA8CA,6BAAwB;AAGxB,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAU7B,QAAA,4BAA4B,GAAsC,OAAC;KAC7E,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,6BAA6B,CAAC;KAClC,KAAK,CACJ,mBAAmB,EACnB,0EAA0E,CAC3E,CAAC;AAGS,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,EAAE;KACR,KAAK,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC"}

package/dist/capability/index.d.ts

@@ -0,0 +1,22 @@
+export * from './lib/capability-ref';
+export * from './lib/capability-ref-pattern';
+export * from './lib/connector-capability-ref';
+export * from './lib/capability-domain';
+export * from './lib/authority-effect';
+export * from './lib/capability-reach';
+export * from './lib/capability-effect-class';
+export * from './lib/capability-aperture';
+export * from './lib/capability-agent-exposure';
+export * from './lib/capability-human-baseline';
+export * from './lib/capability-grant';
+export * from './lib/capability-policy';
+export * from './lib/permission-profile';
+export * from './lib/shell-command-descriptor';
+export * from './lib/meta-tool';
+export * from './lib/effective-capability-set';
+export * from './lib/required-resource-role-binding';
+export * from './lib/capability-contribution';
+export * from './lib/trusted-context-projection';
+export * from './lib/errors';
+export * from './lib/long-running-invocation';
+//# sourceMappingURL=index.d.ts.map

package/dist/capability/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,cAAc,CAAC;AAC7B,cAAc,+BAA+B,CAAC"}

package/dist/capability/index.js

@@ -0,0 +1,38 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/capability-ref"), exports);
+__exportStar(require("./lib/capability-ref-pattern"), exports);
+__exportStar(require("./lib/connector-capability-ref"), exports);
+__exportStar(require("./lib/capability-domain"), exports);
+__exportStar(require("./lib/authority-effect"), exports);
+__exportStar(require("./lib/capability-reach"), exports);
+__exportStar(require("./lib/capability-effect-class"), exports);
+__exportStar(require("./lib/capability-aperture"), exports);
+__exportStar(require("./lib/capability-agent-exposure"), exports);
+__exportStar(require("./lib/capability-human-baseline"), exports);
+__exportStar(require("./lib/capability-grant"), exports);
+__exportStar(require("./lib/capability-policy"), exports);
+__exportStar(require("./lib/permission-profile"), exports);
+__exportStar(require("./lib/shell-command-descriptor"), exports);
+__exportStar(require("./lib/meta-tool"), exports);
+__exportStar(require("./lib/effective-capability-set"), exports);
+__exportStar(require("./lib/required-resource-role-binding"), exports);
+__exportStar(require("./lib/capability-contribution"), exports);
+__exportStar(require("./lib/trusted-context-projection"), exports);
+__exportStar(require("./lib/errors"), exports);
+__exportStar(require("./lib/long-running-invocation"), exports);
+//# sourceMappingURL=index.js.map

package/dist/capability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,+DAA6C;AAC7C,iEAA+C;AAC/C,0DAAwC;AACxC,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,4DAA0C;AAC1C,kEAAgD;AAChD,kEAAgD;AAChD,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,iEAA+C;AAC/C,uEAAqD;AACrD,gEAA8C;AAC9C,mEAAiD;AACjD,+CAA6B;AAC7B,gEAA8C"}

package/dist/capability/lib/authority-effect.d.ts

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+export declare enum CapabilityAuthorityEffect {
+    None = "none",
+    Expanding = "expanding"
+}
+export declare const CapabilityAuthorityEffectSchema: z.ZodEnum<typeof CapabilityAuthorityEffect>;
+export declare function joinAuthorityEffect(...effects: readonly (CapabilityAuthorityEffect | undefined)[]): CapabilityAuthorityEffect;
+//# sourceMappingURL=authority-effect.d.ts.map

package/dist/capability/lib/authority-effect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-effect.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/authority-effect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoDxB,oBAAY,yBAAyB;IAMnC,IAAI,SAAS;IAMb,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,+BAA+B,6CAE3C,CAAC;AAUF,wBAAgB,mBAAmB,CACjC,GAAG,OAAO,EAAE,SAAS,CAAC,yBAAyB,GAAG,SAAS,CAAC,EAAE,GAC7D,yBAAyB,CAM3B"}

package/dist/capability/lib/authority-effect.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityAuthorityEffectSchema = exports.CapabilityAuthorityEffect = void 0;
+exports.joinAuthorityEffect = joinAuthorityEffect;
+const zod_1 = require("zod");
+var CapabilityAuthorityEffect;
+(function (CapabilityAuthorityEffect) {
+    CapabilityAuthorityEffect["None"] = "none";
+    CapabilityAuthorityEffect["Expanding"] = "expanding";
+})(CapabilityAuthorityEffect || (exports.CapabilityAuthorityEffect = CapabilityAuthorityEffect = {}));
+exports.CapabilityAuthorityEffectSchema = zod_1.z.nativeEnum(CapabilityAuthorityEffect);
+function joinAuthorityEffect(...effects) {
+    return effects.some((effect) => effect === CapabilityAuthorityEffect.Expanding)
+        ? CapabilityAuthorityEffect.Expanding
+        : CapabilityAuthorityEffect.None;
+}
+//# sourceMappingURL=authority-effect.js.map

package/dist/capability/lib/authority-effect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-effect.js","sourceRoot":"","sources":["../../../src/capability/lib/authority-effect.ts"],"names":[],"mappings":";;;AA+EA,kDAQC;AAvFD,6BAAwB;AAoDxB,IAAY,yBAaX;AAbD,WAAY,yBAAyB;IAMnC,0CAAa,CAAA;IAMb,oDAAuB,CAAA;AACzB,CAAC,EAbW,yBAAyB,yCAAzB,yBAAyB,QAapC;AAEY,QAAA,+BAA+B,GAAG,OAAC,CAAC,UAAU,CACzD,yBAAyB,CAC1B,CAAC;AAUF,SAAgB,mBAAmB,CACjC,GAAG,OAA2D;IAE9D,OAAO,OAAO,CAAC,IAAI,CACjB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,yBAAyB,CAAC,SAAS,CAC3D;QACC,CAAC,CAAC,yBAAyB,CAAC,SAAS;QACrC,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC;AACrC,CAAC"}

package/dist/capability/lib/capability-agent-exposure.d.ts

@@ -0,0 +1,8 @@
+export declare const CAPABILITY_AGENT_EXPOSURE_FIELD = "safeForAgents";
+export declare enum AgentExposureVerdict {
+    Admitted = "admitted",
+    Refused = "refused"
+}
+export declare function assessAgentExposure(descriptor: Readonly<Record<string, unknown>> | undefined): AgentExposureVerdict;
+export declare function capabilityRefusesAgents(descriptor: Readonly<Record<string, unknown>> | undefined): boolean;
+//# sourceMappingURL=capability-agent-exposure.d.ts.map

package/dist/capability/lib/capability-agent-exposure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-agent-exposure.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-agent-exposure.ts"],"names":[],"mappings":"AA6EA,eAAO,MAAM,+BAA+B,kBAAkB,CAAC;AAa/D,oBAAY,oBAAoB;IAE9B,QAAQ,aAAa;IAMrB,OAAO,YAAY;CACpB;AASD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACxD,oBAAoB,CAiBtB;AAUD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACxD,OAAO,CAET"}

package/dist/capability/lib/capability-agent-exposure.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentExposureVerdict = exports.CAPABILITY_AGENT_EXPOSURE_FIELD = void 0;
+exports.assessAgentExposure = assessAgentExposure;
+exports.capabilityRefusesAgents = capabilityRefusesAgents;
+exports.CAPABILITY_AGENT_EXPOSURE_FIELD = 'safeForAgents';
+var AgentExposureVerdict;
+(function (AgentExposureVerdict) {
+    AgentExposureVerdict["Admitted"] = "admitted";
+    AgentExposureVerdict["Refused"] = "refused";
+})(AgentExposureVerdict || (exports.AgentExposureVerdict = AgentExposureVerdict = {}));
+function assessAgentExposure(descriptor) {
+    if (descriptor === undefined) {
+        return AgentExposureVerdict.Admitted;
+    }
+    const declared = descriptor[exports.CAPABILITY_AGENT_EXPOSURE_FIELD];
+    if (declared === undefined || declared === null || declared === true) {
+        return AgentExposureVerdict.Admitted;
+    }
+    return AgentExposureVerdict.Refused;
+}
+function capabilityRefusesAgents(descriptor) {
+    return assessAgentExposure(descriptor) === AgentExposureVerdict.Refused;
+}
+//# sourceMappingURL=capability-agent-exposure.js.map

package/dist/capability/lib/capability-agent-exposure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-agent-exposure.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-agent-exposure.ts"],"names":[],"mappings":";;;AA4GA,kDAmBC;AAUD,0DAIC;AAhEY,QAAA,+BAA+B,GAAG,eAAe,CAAC;AAa/D,IAAY,oBASX;AATD,WAAY,oBAAoB;IAE9B,6CAAqB,CAAA;IAMrB,2CAAmB,CAAA;AACrB,CAAC,EATW,oBAAoB,oCAApB,oBAAoB,QAS/B;AASD,SAAgB,mBAAmB,CACjC,UAAyD;IAEzD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAO7B,OAAO,oBAAoB,CAAC,QAAQ,CAAC;IACvC,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,uCAA+B,CAAC,CAAC;IAC7D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACrE,OAAO,oBAAoB,CAAC,QAAQ,CAAC;IACvC,CAAC;IAGD,OAAO,oBAAoB,CAAC,OAAO,CAAC;AACtC,CAAC;AAUD,SAAgB,uBAAuB,CACrC,UAAyD;IAEzD,OAAO,mBAAmB,CAAC,UAAU,CAAC,KAAK,oBAAoB,CAAC,OAAO,CAAC;AAC1E,CAAC"}

package/dist/capability/lib/capability-aperture.d.ts

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+import { type CapabilityEffectClass } from './capability-effect-class';
+export declare enum CapabilityApertureKind {
+    Unrestricted = "unrestricted",
+    Armed = "armed",
+    Scoped = "scoped"
+}
+export interface UnrestrictedCapabilityAperture {
+    readonly kind: CapabilityApertureKind.Unrestricted;
+}
+export interface ArmedCapabilityAperture {
+    readonly kind: CapabilityApertureKind.Armed;
+    readonly refs: readonly string[];
+}
+export interface ScopedCapabilityAperture {
+    readonly kind: CapabilityApertureKind.Scoped;
+    readonly domains: Readonly<Record<string, CapabilityEffectClass>>;
+    readonly defaultEffect: CapabilityEffectClass | null;
+}
+export type CapabilityAperture = UnrestrictedCapabilityAperture | ArmedCapabilityAperture | ScopedCapabilityAperture;
+export declare const CapabilityApertureSchema: z.ZodType<CapabilityAperture>;
+export declare const UNRESTRICTED_CAPABILITY_APERTURE: CapabilityAperture;
+export declare function armedAperture(refs: readonly string[]): ArmedCapabilityAperture;
+export declare function scopedAperture(domains: Readonly<Record<string, CapabilityEffectClass>>, defaultEffect: CapabilityEffectClass | null): ScopedCapabilityAperture;
+export declare function resolveCapabilityArming(aperture: CapabilityAperture, requestedRefs: readonly string[], resolvedEffects: Readonly<Record<string, CapabilityEffectClass>>): ArmedCapabilityAperture;
+export declare function resolveCapabilityArmingFromPatterns(aperture: CapabilityAperture, patterns: readonly string[], resolvedEffects: Readonly<Record<string, CapabilityEffectClass>>): ArmedCapabilityAperture;
+export declare enum ApertureVerdict {
+    Admitted = "admitted",
+    Refused = "refused",
+    Unresolved = "unresolved"
+}
+export declare function assessAperture(aperture: CapabilityAperture, ref: string, effectClass?: CapabilityEffectClass | undefined): ApertureVerdict;
+export declare function apertureNeedsEffectClass(aperture: CapabilityAperture): boolean;
+export declare function narrowToAperture(aperture: CapabilityAperture, entries: readonly {
+    readonly ref: string;
+    readonly effectClass?: CapabilityEffectClass | undefined;
+}[]): readonly string[];
+//# sourceMappingURL=capability-aperture.d.ts.map

package/dist/capability/lib/capability-aperture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-aperture.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-aperture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AAuDnC,oBAAY,sBAAsB;IAKhC,YAAY,iBAAiB;IAM7B,KAAK,UAAU;IAWf,MAAM,WAAW;CAClB;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,YAAY,CAAC;CACpD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,KAAK,CAAC;IAE5C,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,MAAM,CAAC;IAK7C,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAUlE,QAAQ,CAAC,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACtD;AAED,MAAM,MAAM,kBAAkB,GAC1B,8BAA8B,GAC9B,uBAAuB,GACvB,wBAAwB,CAAC;AAkC7B,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAoB/D,CAAC;AASL,eAAO,MAAM,gCAAgC,EAAE,kBAG3C,CAAC;AASL,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,uBAAuB,CAOzB;AAUD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,EACxD,aAAa,EAAE,qBAAqB,GAAG,IAAI,GAC1C,wBAAwB,CAM1B;AAgBD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,kBAAkB,EAC5B,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,GAC/D,uBAAuB,CA4BzB;AAoED,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,GAC/D,uBAAuB,CAiDzB;AAaD,oBAAY,eAAe;IAEzB,QAAQ,aAAa;IAErB,OAAO,YAAY;IAKnB,UAAU,eAAe;CAC1B;AAiBD,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,GAC9C,eAAe,CAqCjB;AAUD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAET;AAgBD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,SAAS;IAChB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D,EAAE,GACF,SAAS,MAAM,EAAE,CAQnB"}

package/dist/capability/lib/capability-aperture.js

@@ -0,0 +1,188 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApertureVerdict = exports.UNRESTRICTED_CAPABILITY_APERTURE = exports.CapabilityApertureSchema = exports.CapabilityApertureKind = void 0;
+exports.armedAperture = armedAperture;
+exports.scopedAperture = scopedAperture;
+exports.resolveCapabilityArming = resolveCapabilityArming;
+exports.resolveCapabilityArmingFromPatterns = resolveCapabilityArmingFromPatterns;
+exports.assessAperture = assessAperture;
+exports.apertureNeedsEffectClass = apertureNeedsEffectClass;
+exports.narrowToAperture = narrowToAperture;
+const zod_1 = require("zod");
+const capability_effect_class_1 = require("./capability-effect-class");
+const capability_domain_1 = require("./capability-domain");
+const capability_ref_1 = require("./capability-ref");
+const capability_ref_pattern_1 = require("./capability-ref-pattern");
+var CapabilityApertureKind;
+(function (CapabilityApertureKind) {
+    CapabilityApertureKind["Unrestricted"] = "unrestricted";
+    CapabilityApertureKind["Armed"] = "armed";
+    CapabilityApertureKind["Scoped"] = "scoped";
+})(CapabilityApertureKind || (exports.CapabilityApertureKind = CapabilityApertureKind = {}));
+const CanonicalCapabilityRefSchema = capability_ref_1.CapabilityRefSchema.refine((ref) => (0, capability_ref_1.formatCapabilityRef)((0, capability_ref_1.parseCapabilityRef)(ref)) === ref, 'capability ref must use canonical major-version formatting');
+const CapabilityRefListInputSchema = zod_1.z
+    .array(CanonicalCapabilityRefSchema)
+    .readonly();
+const CanonicalCapabilityRefListSchema = zod_1.z
+    .array(CanonicalCapabilityRefSchema)
+    .readonly()
+    .superRefine((refs, context) => {
+    for (let index = 1; index < refs.length; index += 1) {
+        const previous = refs[index - 1];
+        const current = refs[index];
+        if (previous === undefined || current === undefined) {
+            continue;
+        }
+        if (current <= previous) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: [index],
+                message: current === previous
+                    ? 'capability refs must not contain duplicates'
+                    : 'capability refs must use canonical lexical order',
+            });
+        }
+    }
+});
+exports.CapabilityApertureSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(CapabilityApertureKind.Unrestricted),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(CapabilityApertureKind.Armed),
+        refs: CanonicalCapabilityRefListSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(CapabilityApertureKind.Scoped),
+        domains: zod_1.z.record(zod_1.z.string().min(1), capability_effect_class_1.CapabilityEffectClassSchema),
+        defaultEffect: capability_effect_class_1.CapabilityEffectClassSchema.nullable(),
+    })
+        .strict(),
+]);
+exports.UNRESTRICTED_CAPABILITY_APERTURE = Object.freeze({
+    kind: CapabilityApertureKind.Unrestricted,
+});
+function armedAperture(refs) {
+    const canonicalRefs = [...CapabilityRefListInputSchema.parse(refs)].sort();
+    const parsedRefs = CanonicalCapabilityRefListSchema.parse(canonicalRefs);
+    return Object.freeze({
+        kind: CapabilityApertureKind.Armed,
+        refs: Object.freeze([...parsedRefs]),
+    });
+}
+function scopedAperture(domains, defaultEffect) {
+    return Object.freeze({
+        kind: CapabilityApertureKind.Scoped,
+        domains: Object.freeze({ ...domains }),
+        defaultEffect,
+    });
+}
+const ResolvedCapabilityEffectsSchema = zod_1.z.record(CanonicalCapabilityRefSchema, capability_effect_class_1.CapabilityEffectClassSchema);
+function resolveCapabilityArming(aperture, requestedRefs, resolvedEffects) {
+    const parsedAperture = exports.CapabilityApertureSchema.parse(aperture);
+    const parsedEffects = ResolvedCapabilityEffectsSchema.parse(resolvedEffects);
+    const canonicalRequestedRefs = [
+        ...CapabilityRefListInputSchema.parse(requestedRefs),
+    ].sort();
+    const parsedRequestedRefs = CanonicalCapabilityRefListSchema.parse(canonicalRequestedRefs);
+    for (const ref of parsedRequestedRefs) {
+        const effectClass = Object.hasOwn(parsedEffects, ref)
+            ? parsedEffects[ref]
+            : undefined;
+        if (effectClass === undefined) {
+            throw new TypeError(`Requested capability "${ref}" has no resolved catalogue descriptor.`);
+        }
+        const verdict = assessAperture(parsedAperture, ref, effectClass);
+        if (verdict !== ApertureVerdict.Admitted) {
+            throw new TypeError(`CapabilityAperture ${parsedAperture.kind} refuses requested capability "${ref}".`);
+        }
+    }
+    return armedAperture(parsedRequestedRefs);
+}
+function resolveCapabilityArmingFromPatterns(aperture, patterns, resolvedEffects) {
+    const parsedAperture = exports.CapabilityApertureSchema.parse(aperture);
+    const parsedEffects = ResolvedCapabilityEffectsSchema.parse(resolvedEffects);
+    const parsedPatterns = (0, capability_ref_pattern_1.canonicalCapabilityRefPatterns)(patterns).map((pattern) => (0, capability_ref_pattern_1.parseCapabilityRefPattern)(pattern));
+    const catalogueRefs = Object.keys(parsedEffects).sort();
+    const admitted = new Set();
+    for (const pattern of parsedPatterns) {
+        const selected = (0, capability_ref_pattern_1.selectRefsByPatterns)([pattern], catalogueRefs);
+        const admittedForPattern = [];
+        for (const ref of selected) {
+            const effectClass = Object.hasOwn(parsedEffects, ref)
+                ? parsedEffects[ref]
+                : undefined;
+            if (effectClass === undefined) {
+                throw new TypeError(`Capability "${ref}" was selected from the catalogue but has no resolved effect class.`);
+            }
+            if (assessAperture(parsedAperture, ref, effectClass) ===
+                ApertureVerdict.Admitted) {
+                admittedForPattern.push(ref);
+            }
+        }
+        if (admittedForPattern.length === 0) {
+            throw new TypeError(`CapabilityRefPattern "${pattern.raw}" matched ${selected.length} capability ` +
+                `ref(s), and the ${parsedAperture.kind} aperture admitted none of them. ` +
+                'A pattern that contributes nothing is a misconfiguration, not an ' +
+                'empty selection — widen the aperture or correct the pattern.');
+        }
+        for (const ref of admittedForPattern) {
+            admitted.add(ref);
+        }
+    }
+    return armedAperture([...admitted]);
+}
+var ApertureVerdict;
+(function (ApertureVerdict) {
+    ApertureVerdict["Admitted"] = "admitted";
+    ApertureVerdict["Refused"] = "refused";
+    ApertureVerdict["Unresolved"] = "unresolved";
+})(ApertureVerdict || (exports.ApertureVerdict = ApertureVerdict = {}));
+function assessAperture(aperture, ref, effectClass) {
+    switch (aperture.kind) {
+        case CapabilityApertureKind.Unrestricted:
+            return ApertureVerdict.Admitted;
+        case CapabilityApertureKind.Armed:
+            return aperture.refs.includes(ref)
+                ? ApertureVerdict.Admitted
+                : ApertureVerdict.Refused;
+        case CapabilityApertureKind.Scoped: {
+            if (effectClass === undefined) {
+                return ApertureVerdict.Unresolved;
+            }
+            const domain = (0, capability_domain_1.capabilityDomainOf)(ref);
+            if (domain === null) {
+                return ApertureVerdict.Refused;
+            }
+            const ceiling = Object.prototype.hasOwnProperty.call(aperture.domains, domain)
+                ? aperture.domains[domain]
+                : aperture.defaultEffect;
+            if (ceiling === null || ceiling === undefined) {
+                return ApertureVerdict.Refused;
+            }
+            return (0, capability_effect_class_1.effectWithin)(effectClass, ceiling)
+                ? ApertureVerdict.Admitted
+                : ApertureVerdict.Refused;
+        }
+        default:
+            return assertUnreachableAperture(aperture);
+    }
+}
+function apertureNeedsEffectClass(aperture) {
+    return aperture.kind === CapabilityApertureKind.Scoped;
+}
+function narrowToAperture(aperture, entries) {
+    return entries
+        .filter((entry) => assessAperture(aperture, entry.ref, entry.effectClass) ===
+        ApertureVerdict.Admitted)
+        .map((entry) => entry.ref);
+}
+function assertUnreachableAperture(aperture) {
+    throw new Error(`Unhandled CapabilityApertureKind "${String(aperture.kind)}".`);
+}
+//# sourceMappingURL=capability-aperture.js.map

package/dist/capability/lib/capability-aperture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-aperture.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-aperture.ts"],"names":[],"mappings":";;;AAiMA,sCASC;AAUD,wCASC;AAgBD,0DAgCC;AAoED,kFAqDC;AAwCD,wCAyCC;AAUD,4DAIC;AAgBD,4CAcC;AAngBD,6BAAwB;AAExB,uEAImC;AACnC,2DAAyD;AACzD,qDAI0B;AAC1B,qEAIkC;AA4ClC,IAAY,sBAuBX;AAvBD,WAAY,sBAAsB;IAKhC,uDAA6B,CAAA;IAM7B,yCAAe,CAAA;IAWf,2CAAiB,CAAA;AACnB,CAAC,EAvBW,sBAAsB,sCAAtB,sBAAsB,QAuBjC;AAoCD,MAAM,4BAA4B,GAAG,oCAAmB,CAAC,MAAM,CAC7D,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,oCAAmB,EAAC,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAC7D,4DAA4D,CAC7D,CAAC;AAEF,MAAM,4BAA4B,GAAG,OAAC;KACnC,KAAK,CAAC,4BAA4B,CAAC;KACnC,QAAQ,EAAE,CAAC;AAEd,MAAM,gCAAgC,GAAG,OAAC;KACvC,KAAK,CAAC,4BAA4B,CAAC;KACnC,QAAQ,EAAE;KACV,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,KAAK,CAAC;gBACb,OAAO,EACL,OAAO,KAAK,QAAQ;oBAClB,CAAC,CAAC,6CAA6C;oBAC/C,CAAC,CAAC,kDAAkD;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEQ,QAAA,wBAAwB,GACnC,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3B,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC;KACrD,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC;QAC7C,IAAI,EAAE,gCAAgC;KACvC,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,MAAM,CAAC;QAC9C,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qDAA2B,CAAC;QACjE,aAAa,EAAE,qDAA2B,CAAC,QAAQ,EAAE;KACtD,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AASQ,QAAA,gCAAgC,GAC3C,MAAM,CAAC,MAAM,CAAC;IACZ,IAAI,EAAE,sBAAsB,CAAC,YAAY;CAC1C,CAAC,CAAC;AASL,SAAgB,aAAa,CAC3B,IAAuB;IAEvB,MAAM,aAAa,GAAG,CAAC,GAAG,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,gCAAgC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,sBAAsB,CAAC,KAAK;QAClC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAUD,SAAgB,cAAc,CAC5B,OAAwD,EACxD,aAA2C;IAE3C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,sBAAsB,CAAC,MAAM;QACnC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;QACtC,aAAa;KACd,CAAC,CAAC;AACL,CAAC;AAED,MAAM,+BAA+B,GAEjC,OAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,qDAA2B,CAAC,CAAC;AAYxE,SAAgB,uBAAuB,CACrC,QAA4B,EAC5B,aAAgC,EAChC,eAAgE;IAEhE,MAAM,cAAc,GAAG,gCAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,+BAA+B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC7E,MAAM,sBAAsB,GAAG;QAC7B,GAAG,4BAA4B,CAAC,KAAK,CAAC,aAAa,CAAC;KACrD,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,mBAAmB,GAAG,gCAAgC,CAAC,KAAK,CAChE,sBAAsB,CACvB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC;YACnD,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC;YACpB,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CACjB,yBAAyB,GAAG,yCAAyC,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QACjE,IAAI,OAAO,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,IAAI,SAAS,CACjB,sBAAsB,cAAc,CAAC,IAAI,kCAAkC,GAAG,IAAI,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAoED,SAAgB,mCAAmC,CACjD,QAA4B,EAC5B,QAA2B,EAC3B,eAAgE;IAEhE,MAAM,cAAc,GAAG,gCAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,+BAA+B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,IAAA,uDAA8B,EAAC,QAAQ,CAAC,CAAC,GAAG,CACjE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAA,kDAAyB,EAAC,OAAO,CAAC,CAChD,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;IAExD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QAErC,MAAM,QAAQ,GAAG,IAAA,6CAAoB,EAAC,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;QAChE,MAAM,kBAAkB,GAAa,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC;gBACnD,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC;gBACpB,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAM9B,MAAM,IAAI,SAAS,CACjB,eAAe,GAAG,qEAAqE,CACxF,CAAC;YACJ,CAAC;YACD,IACE,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,CAAC;gBAChD,eAAe,CAAC,QAAQ,EACxB,CAAC;gBACD,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CACjB,yBAAyB,OAAO,CAAC,GAAG,aAAa,QAAQ,CAAC,MAAM,cAAc;gBAC5E,mBAAmB,cAAc,CAAC,IAAI,mCAAmC;gBACzE,mEAAmE;gBACnE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;AACtC,CAAC;AAaD,IAAY,eAUX;AAVD,WAAY,eAAe;IAEzB,wCAAqB,CAAA;IAErB,sCAAmB,CAAA;IAKnB,4CAAyB,CAAA;AAC3B,CAAC,EAVW,eAAe,+BAAf,eAAe,QAU1B;AAiBD,SAAgB,cAAc,CAC5B,QAA4B,EAC5B,GAAW,EACX,WAA+C;IAE/C,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,sBAAsB,CAAC,YAAY;YACtC,OAAO,eAAe,CAAC,QAAQ,CAAC;QAClC,KAAK,sBAAsB,CAAC,KAAK;YAC/B,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAChC,CAAC,CAAC,eAAe,CAAC,QAAQ;gBAC1B,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC;QAC9B,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;YACnC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,eAAe,CAAC,UAAU,CAAC;YACpC,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,sCAAkB,EAAC,GAAG,CAAC,CAAC;YAMvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,eAAe,CAAC,OAAO,CAAC;YACjC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAClD,QAAQ,CAAC,OAAO,EAChB,MAAM,CACP;gBACC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC1B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC3B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC9C,OAAO,eAAe,CAAC,OAAO,CAAC;YACjC,CAAC;YACD,OAAO,IAAA,sCAAY,EAAC,WAAW,EAAE,OAAO,CAAC;gBACvC,CAAC,CAAC,eAAe,CAAC,QAAQ;gBAC1B,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC;QAC9B,CAAC;QACD;YACE,OAAO,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAUD,SAAgB,wBAAwB,CACtC,QAA4B;IAE5B,OAAO,QAAQ,CAAC,IAAI,KAAK,sBAAsB,CAAC,MAAM,CAAC;AACzD,CAAC;AAgBD,SAAgB,gBAAgB,CAC9B,QAA4B,EAC5B,OAGG;IAEH,OAAO,OAAO;SACX,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC;QACtD,eAAe,CAAC,QAAQ,CAC3B;SACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAe;IAChD,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,CACxC,QAA+B,CAAC,IAAI,CACtC,IAAI,CACN,CAAC;AACJ,CAAC"}

package/dist/capability/lib/capability-contribution.d.ts

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+import { type CapabilityRef } from './capability-ref';
+import { type CapabilityAuthorityEffect } from './authority-effect';
+import { type CapabilityReach } from './capability-reach';
+import { type CapabilityEffectClass } from './capability-effect-class';
+import { type RequiredResourceRoleBinding } from './required-resource-role-binding';
+import { CapabilityRiskTier } from './permission-profile';
+import { type DataClassification } from '../../space';
+import { type OrgRole } from '../../tenant';
+import { type TrustedContextProjection } from './trusted-context-projection';
+export interface CapabilityContributionManifest {
+    readonly ref: CapabilityRef;
+    readonly title: string;
+    readonly summary: string;
+    readonly sideEffects: string;
+    readonly inputSchema: Record<string, unknown>;
+    readonly outputSchema: Record<string, unknown>;
+    readonly riskTier: CapabilityRiskTier;
+    readonly requiresApproval: boolean;
+    readonly examples?: readonly Record<string, unknown>[] | undefined;
+    readonly externalServiceRef?: string | undefined;
+    readonly defaultCredentialBindingRef?: string | undefined;
+    readonly outputClassification?: DataClassification | undefined;
+    readonly authorityEffect?: CapabilityAuthorityEffect | undefined;
+    readonly reach?: CapabilityReach | undefined;
+    readonly effectClass?: CapabilityEffectClass | undefined;
+    readonly trustedContextProjection?: TrustedContextProjection | undefined;
+    readonly requiredBindings?: readonly RequiredResourceRoleBinding[] | undefined;
+    readonly safeForAgents?: boolean | undefined;
+    readonly defaultBaselineOrgRole?: OrgRole | undefined;
+}
+export declare const CapabilityContributionManifestSchema: z.ZodObject<{
+    ref: z.ZodType<CapabilityRef, unknown, z.core.$ZodTypeInternals<CapabilityRef, unknown>>;
+    title: z.ZodString;
+    summary: z.ZodString;
+    sideEffects: z.ZodString;
+    inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    riskTier: z.ZodEnum<typeof CapabilityRiskTier>;
+    requiresApproval: z.ZodBoolean;
+    examples: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    externalServiceRef: z.ZodOptional<z.ZodString>;
+    defaultCredentialBindingRef: z.ZodOptional<z.ZodString>;
+    outputClassification: z.ZodOptional<z.ZodEnum<typeof DataClassification>>;
+    authorityEffect: z.ZodOptional<z.ZodEnum<typeof CapabilityAuthorityEffect>>;
+    reach: z.ZodOptional<z.ZodEnum<typeof CapabilityReach>>;
+    effectClass: z.ZodOptional<z.ZodEnum<typeof CapabilityEffectClass>>;
+    trustedContextProjection: z.ZodOptional<z.ZodType<TrustedContextProjection, unknown, z.core.$ZodTypeInternals<TrustedContextProjection, unknown>>>;
+    requiredBindings: z.ZodOptional<z.ZodArray<z.ZodType<RequiredResourceRoleBinding, unknown, z.core.$ZodTypeInternals<RequiredResourceRoleBinding, unknown>>>>;
+    safeForAgents: z.ZodOptional<z.ZodBoolean>;
+    defaultBaselineOrgRole: z.ZodOptional<z.ZodEnum<typeof OrgRole>>;
+}, z.core.$strict>;
+//# sourceMappingURL=capability-contribution.d.ts.map

package/dist/capability/lib/capability-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAsBtC,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE/C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAKtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAKnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAUnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOjD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAoB1D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAgB/D,QAAQ,CAAC,eAAe,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAqBjE,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IA0B7C,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAQzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAgBzE,QAAQ,CAAC,gBAAgB,CAAC,EACtB,SAAS,2BAA2B,EAAE,GACtC,SAAS,CAAC;IAuDd,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAqB7C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACvD;AAcD,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;kBAsEO,CAAC"}