@xemahq/contracts 0.1.0

package/dist/capability/lib/effective-capability-set.js

@@ -0,0 +1,207 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EffectiveCapabilitySetSchema = exports.EffectiveCapabilityDescriptorSchema = exports.RuntimeBindingRequirementSchema = exports.EFFECTIVE_CAPABILITY_SET_MAX_CAPABILITIES = exports.EFFECTIVE_CAPABILITY_MAX_BINDING_REQUIREMENTS = exports.RuntimeBindingRequirementKind = exports.EffectiveCapabilityConsentSchema = exports.EffectiveCapabilityConsent = exports.EffectiveCapabilityVisibilitySchema = exports.EffectiveCapabilityVisibility = void 0;
+exports.computeEffectiveCapabilitySetHash = computeEffectiveCapabilitySetHash;
+exports.createEffectiveCapabilitySet = createEffectiveCapabilitySet;
+exports.parseAndVerifyEffectiveCapabilitySet = parseAndVerifyEffectiveCapabilitySet;
+const zod_1 = require("zod");
+const content_address_1 = require("../../content-address");
+const space_1 = require("../../space");
+const subject_1 = require("../../subject");
+const surface_1 = require("../../surface");
+const capability_ref_1 = require("./capability-ref");
+const permission_profile_1 = require("./permission-profile");
+var EffectiveCapabilityVisibility;
+(function (EffectiveCapabilityVisibility) {
+    EffectiveCapabilityVisibility["Visible"] = "visible";
+    EffectiveCapabilityVisibility["Hidden"] = "hidden";
+})(EffectiveCapabilityVisibility || (exports.EffectiveCapabilityVisibility = EffectiveCapabilityVisibility = {}));
+exports.EffectiveCapabilityVisibilitySchema = zod_1.z.nativeEnum(EffectiveCapabilityVisibility);
+var EffectiveCapabilityConsent;
+(function (EffectiveCapabilityConsent) {
+    EffectiveCapabilityConsent["None"] = "none";
+    EffectiveCapabilityConsent["Confirm"] = "confirm";
+    EffectiveCapabilityConsent["Elevated"] = "elevated";
+})(EffectiveCapabilityConsent || (exports.EffectiveCapabilityConsent = EffectiveCapabilityConsent = {}));
+exports.EffectiveCapabilityConsentSchema = zod_1.z.nativeEnum(EffectiveCapabilityConsent);
+var RuntimeBindingRequirementKind;
+(function (RuntimeBindingRequirementKind) {
+    RuntimeBindingRequirementKind["OrgConnection"] = "org-connection";
+    RuntimeBindingRequirementKind["CredentialBinding"] = "credential-binding";
+    RuntimeBindingRequirementKind["DatabaseBinding"] = "database-binding";
+})(RuntimeBindingRequirementKind || (exports.RuntimeBindingRequirementKind = RuntimeBindingRequirementKind = {}));
+exports.EFFECTIVE_CAPABILITY_MAX_BINDING_REQUIREMENTS = 128;
+exports.EFFECTIVE_CAPABILITY_SET_MAX_CAPABILITIES = 1_024;
+const SecretSafeOpaqueRefSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(2_048)
+    .regex(content_address_1.OPAQUE_TOKEN_PATTERN, 'reference must be opaque and contain no whitespace or control characters')
+    .refine((value) => !looksLikeSecretMaterial(value), {
+    message: 'reference appears to contain secret material; pass an opaque reference',
+});
+exports.RuntimeBindingRequirementSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(RuntimeBindingRequirementKind.OrgConnection),
+        orgConnectionRef: SecretSafeOpaqueRefSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(RuntimeBindingRequirementKind.CredentialBinding),
+        credentialBindingRef: SecretSafeOpaqueRefSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(RuntimeBindingRequirementKind.DatabaseBinding),
+        databaseBindingRef: SecretSafeOpaqueRefSchema,
+    })
+        .strict(),
+]);
+exports.EffectiveCapabilityDescriptorSchema = zod_1.z
+    .object({
+    capabilityRef: capability_ref_1.CapabilityRefSchema.refine((value) => (0, capability_ref_1.formatCapabilityRef)((0, capability_ref_1.parseCapabilityRef)(value)) === value, 'capabilityRef must use canonical major-version formatting'),
+    descriptorHash: content_address_1.Sha256HexSchema,
+    executionHandlerRef: SecretSafeOpaqueRefSchema,
+    visibility: exports.EffectiveCapabilityVisibilitySchema,
+    consent: exports.EffectiveCapabilityConsentSchema,
+    risk: permission_profile_1.CapabilityRiskTierSchema,
+    bindingRequirements: zod_1.z
+        .array(exports.RuntimeBindingRequirementSchema)
+        .max(exports.EFFECTIVE_CAPABILITY_MAX_BINDING_REQUIREMENTS)
+        .readonly(),
+})
+    .strict()
+    .superRefine((descriptor, context) => {
+    addStrictlySortedIssues(descriptor.bindingRequirements, bindingRequirementSortKey, context, ['bindingRequirements'], 'runtime binding requirements');
+});
+const EFFECTIVE_CAPABILITY_SET_CONTENT_FIELDS = {
+    schemaVersion: zod_1.z.literal(1),
+    principal: subject_1.SubjectRefSchema,
+    ownerSpace: space_1.OwnerSpaceRefSchema,
+    surface: surface_1.SurfaceKindSchema,
+    catalogGenerationHash: content_address_1.Sha256HexSchema,
+    policyGenerationHash: content_address_1.Sha256HexSchema,
+    capabilities: zod_1.z
+        .array(exports.EffectiveCapabilityDescriptorSchema)
+        .max(exports.EFFECTIVE_CAPABILITY_SET_MAX_CAPABILITIES)
+        .readonly(),
+};
+const EffectiveCapabilitySetContentSchema = zod_1.z
+    .object(EFFECTIVE_CAPABILITY_SET_CONTENT_FIELDS)
+    .strict()
+    .superRefine(refineEffectiveCapabilitySetContent);
+exports.EffectiveCapabilitySetSchema = zod_1.z
+    .object({
+    ...EFFECTIVE_CAPABILITY_SET_CONTENT_FIELDS,
+    setHash: content_address_1.Sha256HexSchema,
+})
+    .strict()
+    .superRefine(refineEffectiveCapabilitySetContent);
+async function computeEffectiveCapabilitySetHash(input) {
+    const content = EffectiveCapabilitySetContentSchema.parse(input);
+    return (0, content_address_1.canonicalContentHash)({
+        contract: 'xema-effective-capability-set-v1',
+        content,
+    });
+}
+async function createEffectiveCapabilitySet(input) {
+    const content = EffectiveCapabilitySetContentSchema.parse(input);
+    const setHash = await computeEffectiveCapabilitySetHash(content);
+    return (0, content_address_1.deepFreezeCanonicalJson)({
+        ...content,
+        setHash,
+    });
+}
+async function parseAndVerifyEffectiveCapabilitySet(input) {
+    const parsed = exports.EffectiveCapabilitySetSchema.parse(input);
+    const { setHash, ...content } = parsed;
+    const expected = await computeEffectiveCapabilitySetHash(content);
+    if (setHash !== expected) {
+        throw new TypeError(`EffectiveCapabilitySet.setHash mismatch: expected ${expected}, received ${setHash}.`);
+    }
+    return (0, content_address_1.deepFreezeCanonicalJson)(parsed);
+}
+function bindingRequirementSortKey(requirement) {
+    switch (requirement.kind) {
+        case RuntimeBindingRequirementKind.OrgConnection:
+            return `${requirement.kind}:${requirement.orgConnectionRef}`;
+        case RuntimeBindingRequirementKind.CredentialBinding:
+            return `${requirement.kind}:${requirement.credentialBindingRef}`;
+        case RuntimeBindingRequirementKind.DatabaseBinding:
+            return `${requirement.kind}:${requirement.databaseBindingRef}`;
+    }
+}
+function refineEffectiveCapabilitySetContent(set, context) {
+    const canonicalOwnerSpace = (0, space_1.parseOwnerSpaceKey)((0, space_1.formatOwnerSpaceKey)(set.ownerSpace));
+    if ((0, content_address_1.canonicalJsonStringify)(canonicalOwnerSpace) !==
+        (0, content_address_1.canonicalJsonStringify)(set.ownerSpace)) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['ownerSpace'],
+            message: 'ownerSpace must be canonical and must not carry derived or irrelevant space fields.',
+        });
+    }
+    addStrictlySortedIssues(set.capabilities, (descriptor) => descriptor.capabilityRef, context, ['capabilities'], 'capabilities');
+    if (set.principal.roles !== undefined) {
+        addStrictlySortedIssues(set.principal.roles, (role) => role, context, ['principal', 'roles'], 'principal roles');
+    }
+    addSecretMaterialIssues(set, context);
+}
+function addStrictlySortedIssues(values, keyOf, context, path, label) {
+    for (let index = 1; index < values.length; index += 1) {
+        const previous = values[index - 1];
+        const current = values[index];
+        if (previous === undefined || current === undefined) {
+            continue;
+        }
+        const previousKey = keyOf(previous);
+        const currentKey = keyOf(current);
+        if (currentKey <= previousKey) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: [...path, index],
+                message: currentKey === previousKey
+                    ? `${label} must not contain duplicates.`
+                    : `${label} must be sorted in ascending canonical order.`,
+            });
+        }
+    }
+}
+const SECRET_VALUE_PATTERNS = [
+    /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/u,
+    /^(?:Bearer|Basic)\s+\S+/iu,
+    /^(?:sk-(?:live|test|proj)-|gh[pousr]_|github_pat_|xox[baprs]-)/u,
+    /^AKIA[A-Z0-9]{16}$/u,
+    /^AIza[0-9A-Za-z_-]{35}$/u,
+    /^[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}$/u,
+    /^[a-z][a-z0-9+.-]*:\/\/[^/@:\s]+:[^/@\s]+@/iu,
+];
+function looksLikeSecretMaterial(value) {
+    return SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value));
+}
+function addSecretMaterialIssues(value, context, path = []) {
+    if (typeof value === 'string') {
+        if (looksLikeSecretMaterial(value)) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: [...path],
+                message: 'EffectiveCapabilitySet must not contain secret-shaped material.',
+            });
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => addSecretMaterialIssues(entry, context, [...path, index]));
+        return;
+    }
+    if (value === null || typeof value !== 'object') {
+        return;
+    }
+    for (const [key, entry] of Object.entries(value)) {
+        addSecretMaterialIssues(entry, context, [...path, key]);
+    }
+}
+//# sourceMappingURL=effective-capability-set.js.map

package/dist/capability/lib/effective-capability-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-capability-set.js","sourceRoot":"","sources":["../../../src/capability/lib/effective-capability-set.ts"],"names":[],"mappings":";;;AAyOA,8EAQC;AAGD,oEASC;AAGD,oFAYC;AA5QD,6BAAwB;AAExB,2DAM+B;AAC/B,uCAKqB;AACrB,2CAAkE;AAClE,2CAAoE;AACpE,qDAK0B;AAC1B,6DAG8B;AAG9B,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,kDAAiB,CAAA;AACnB,CAAC,EAHW,6BAA6B,6CAA7B,6BAA6B,QAGxC;AAEY,QAAA,mCAAmC,GAAG,OAAC,CAAC,UAAU,CAC7D,6BAA6B,CAC9B,CAAC;AAGF,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,2CAAa,CAAA;IACb,iDAAmB,CAAA;IACnB,mDAAqB,CAAA;AACvB,CAAC,EAJW,0BAA0B,0CAA1B,0BAA0B,QAIrC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAGF,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,iEAAgC,CAAA;IAChC,yEAAwC,CAAA;IACxC,qEAAoC,CAAA;AACtC,CAAC,EAJW,6BAA6B,6CAA7B,6BAA6B,QAIxC;AAqCY,QAAA,6CAA6C,GAAG,GAAG,CAAC;AAepD,QAAA,yCAAyC,GAAG,KAAK,CAAC;AAE/D,MAAM,yBAAyB,GAAG,OAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,KAAK,CAAC;KACV,KAAK,CACJ,sCAAoB,EACpB,0EAA0E,CAC3E;KACA,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE;IAClD,OAAO,EACL,wEAAwE;CAC3E,CAAC,CAAC;AAEQ,QAAA,+BAA+B,GAC1C,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3B,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,aAAa,CAAC;QAC5D,gBAAgB,EAAE,yBAAyB;KAC5C,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,iBAAiB,CAAC;QAChE,oBAAoB,EAAE,yBAAyB;KAChD,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,eAAe,CAAC;QAC9D,kBAAkB,EAAE,yBAAyB;KAC9C,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAaQ,QAAA,mCAAmC,GAC9C,OAAC;KACE,MAAM,CAAC;IACN,aAAa,EAAE,oCAAmB,CAAC,MAAM,CACvC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,oCAAmB,EAAC,IAAA,mCAAkB,EAAC,KAAK,CAAC,CAAC,KAAK,KAAK,EACnE,2DAA2D,CAC5D;IACD,cAAc,EAAE,iCAAe;IAC/B,mBAAmB,EAAE,yBAAyB;IAC9C,UAAU,EAAE,2CAAmC;IAC/C,OAAO,EAAE,wCAAgC;IACzC,IAAI,EAAE,6CAAwB;IAI9B,mBAAmB,EAAE,OAAC;SACnB,KAAK,CAAC,uCAA+B,CAAC;SACtC,GAAG,CAAC,qDAA6C,CAAC;SAClD,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE;IACnC,uBAAuB,CACrB,UAAU,CAAC,mBAAmB,EAC9B,yBAAyB,EACzB,OAAO,EACP,CAAC,qBAAqB,CAAC,EACvB,8BAA8B,CAC/B,CAAC;AACJ,CAAC,CAAC,CAAC;AAgBP,MAAM,uCAAuC,GAAG;IAC9C,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,0BAAgB;IAC3B,UAAU,EAAE,2BAAmB;IAC/B,OAAO,EAAE,2BAAiB;IAC1B,qBAAqB,EAAE,iCAAe;IACtC,oBAAoB,EAAE,iCAAe;IAMrC,YAAY,EAAE,OAAC;SACZ,KAAK,CAAC,2CAAmC,CAAC;SAC1C,GAAG,CAAC,iDAAyC,CAAC;SAC9C,QAAQ,EAAE;CACL,CAAC;AAEX,MAAM,mCAAmC,GACvC,OAAC;KACE,MAAM,CAAC,uCAAuC,CAAC;KAC/C,MAAM,EAAE;KACR,WAAW,CAAC,mCAAmC,CAAC,CAAC;AAGzC,QAAA,4BAA4B,GAAsC,OAAC;KAC7E,MAAM,CAAC;IACN,GAAG,uCAAuC;IAC1C,OAAO,EAAE,iCAAe;CACzB,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,mCAAmC,CAAC,CAAC;AAG7C,KAAK,UAAU,iCAAiC,CACrD,KAAc;IAEd,MAAM,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,IAAA,sCAAoB,EAAC;QAC1B,QAAQ,EAAE,kCAAkC;QAC5C,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAGM,KAAK,UAAU,4BAA4B,CAChD,KAAc;IAEd,MAAM,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,IAAA,yCAAuB,EAAC;QAC7B,GAAG,OAAO;QACV,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAGM,KAAK,UAAU,oCAAoC,CACxD,KAAc;IAEd,MAAM,MAAM,GAAG,oCAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CACjB,qDAAqD,QAAQ,cAAc,OAAO,GAAG,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,yCAAuB,EAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,yBAAyB,CAChC,WAAsC;IAEtC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,6BAA6B,CAAC,aAAa;YAC9C,OAAO,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC/D,KAAK,6BAA6B,CAAC,iBAAiB;YAClD,OAAO,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,oBAAoB,EAAE,CAAC;QACnE,KAAK,6BAA6B,CAAC,eAAe;YAChD,OAAO,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,kBAAkB,EAAE,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAC1C,GAAkC,EAClC,OAAwB;IAExB,MAAM,mBAAmB,GAAG,IAAA,0BAAkB,EAC5C,IAAA,2BAAmB,EAAC,GAAG,CAAC,UAAU,CAAC,CACpC,CAAC;IACF,IACE,IAAA,wCAAsB,EAAC,mBAAmB,CAAC;QAC3C,IAAA,wCAAsB,EAAC,GAAG,CAAC,UAAU,CAAC,EACtC,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,YAAY,CAAC;YACpB,OAAO,EACL,qFAAqF;SACxF,CAAC,CAAC;IACL,CAAC;IACD,uBAAuB,CACrB,GAAG,CAAC,YAAY,EAChB,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,EACxC,OAAO,EACP,CAAC,cAAc,CAAC,EAChB,cAAc,CACf,CAAC;IACF,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACtC,uBAAuB,CACrB,GAAG,CAAC,SAAS,CAAC,KAAK,EACnB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EACd,OAAO,EACP,CAAC,WAAW,EAAE,OAAO,CAAC,EACtB,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAoB,EACpB,KAA2B,EAC3B,OAAwB,EACxB,IAAkC,EAClC,KAAa;IAEb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC;gBACtB,OAAO,EACL,UAAU,KAAK,WAAW;oBACxB,CAAC,CAAC,GAAG,KAAK,+BAA+B;oBACzC,CAAC,CAAC,GAAG,KAAK,+CAA+C;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,qBAAqB,GAAG;IAC5B,2CAA2C;IAC3C,2BAA2B;IAC3B,iEAAiE;IACjE,qBAAqB;IACrB,0BAA0B;IAC1B,4DAA4D;IAC5D,8CAA8C;CACtC,CAAC;AAEX,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAc,EACd,OAAwB,EACxB,OAAqC,EAAE;IAEvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;gBACf,OAAO,EACL,iEAAiE;aACpE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAC7B,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}

package/dist/capability/lib/errors.d.ts

@@ -0,0 +1,72 @@
+import { z } from 'zod';
+export declare enum CapabilityErrorCode {
+    CapabilityRefInvalid = "CAPABILITY_REF_INVALID",
+    CapabilityUnresolved = "CAPABILITY_UNRESOLVED",
+    CapabilityDeniedByEnvironment = "CAPABILITY_DENIED_BY_ENVIRONMENT",
+    CapabilityDeniedByGrant = "CAPABILITY_DENIED_BY_GRANT",
+    CapabilityDeniedByRateLimit = "CAPABILITY_DENIED_BY_RATE_LIMIT",
+    CapabilityRequiresApproval = "CAPABILITY_REQUIRES_APPROVAL",
+    CapabilityRequiresGrant = "CAPABILITY_REQUIRES_GRANT",
+    AuthorizationUnreachable = "AUTHORIZATION_UNREACHABLE",
+    AuthorizationRequestRejected = "AUTHORIZATION_REQUEST_REJECTED",
+    AuditLogUnavailable = "AUDIT_LOG_UNAVAILABLE",
+    CapabilityInvocationMissingOrg = "CAPABILITY_INVOCATION_MISSING_ORG",
+    NoRunnerAvailable = "NO_RUNNER_AVAILABLE",
+    MissingCredentialBinding = "MISSING_CREDENTIAL_BINDING",
+    CapabilityNotArmed = "CAPABILITY_NOT_ARMED",
+    CapabilityApertureRequired = "CAPABILITY_APERTURE_REQUIRED",
+    CapabilityNotSafeForAgents = "CAPABILITY_NOT_SAFE_FOR_AGENTS",
+    CapabilityDeniedByParticipantRole = "CAPABILITY_DENIED_BY_PARTICIPANT_ROLE",
+    CapabilityReservedInputField = "CAPABILITY_RESERVED_INPUT_FIELD",
+    CapabilityTrustedContextUnavailable = "CAPABILITY_TRUSTED_CONTEXT_UNAVAILABLE"
+}
+export declare const CapabilityErrorCodeSchema: z.ZodEnum<typeof CapabilityErrorCode>;
+export interface CapabilityDenialDetail {
+    code: CapabilityErrorCode;
+    detail: string;
+}
+export declare const CapabilityDenialDetailSchema: z.ZodType<CapabilityDenialDetail>;
+export type CapabilityDenialSuggestion = {
+    kind: 'request-grant';
+    capability: string;
+    environment?: string;
+    resource?: string;
+} | {
+    kind: 'switch-environment';
+    from: string;
+    to: string;
+} | {
+    kind: 'request-approval';
+    capability: string;
+    approver?: string;
+} | {
+    kind: 'bind-resource';
+    roleKey: string;
+    ownerSpaceRef: string;
+    capability?: string;
+};
+export declare const CapabilityDenialSuggestionSchema: z.ZodType<CapabilityDenialSuggestion>;
+export declare class CapabilityError extends Error {
+    readonly code: CapabilityErrorCode;
+    readonly capability: string | undefined;
+    readonly subject: string | undefined;
+    readonly environment: string | undefined;
+    readonly auditId: string | undefined;
+    readonly details: readonly CapabilityDenialDetail[] | undefined;
+    constructor(args: {
+        code: CapabilityErrorCode;
+        message: string;
+        capability?: string;
+        subject?: string;
+        environment?: string;
+        auditId?: string;
+        details?: readonly CapabilityDenialDetail[];
+    });
+}
+export declare class CapabilityRefParseError extends CapabilityError {
+    constructor(args: {
+        message: string;
+        raw: string;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/capability/lib/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,oBAAY,mBAAmB;IAC7B,oBAAoB,2BAA2B;IAC/C,oBAAoB,0BAA0B;IAC9C,6BAA6B,qCAAqC;IAClE,uBAAuB,+BAA+B;IACtD,2BAA2B,oCAAoC;IAC/D,0BAA0B,iCAAiC;IAC3D,uBAAuB,8BAA8B;IACrD,wBAAwB,8BAA8B;IAyBtD,4BAA4B,mCAAmC;IAC/D,mBAAmB,0BAA0B;IAQ7C,8BAA8B,sCAAsC;IAOpE,iBAAiB,wBAAwB;IAWzC,wBAAwB,+BAA+B;IAYvD,kBAAkB,yBAAyB;IAY3C,0BAA0B,iCAAiC;IAgB3D,0BAA0B,mCAAmC;IAe7D,iCAAiC,0CAA0C;IAuB3E,4BAA4B,oCAAoC;IAuBhE,mCAAmC,2CAA2C;CAC/E;AAED,eAAO,MAAM,yBAAyB,uCAAoC,CAAC;AAO3E,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,4BAA4B,EAGnC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AASxC,MAAM,MAAM,0BAA0B,GAClC;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAgBD;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN,eAAO,MAAM,gCAAgC,EAuBvC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAU5C,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAgB,IAAI,EAAE,mBAAmB,CAAC;IAC1C,SAAgB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,SAAgB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,SAAgB,OAAO,EAAE,SAAS,sBAAsB,EAAE,GAAG,SAAS,CAAC;gBAE3D,IAAI,EAAE;QAChB,IAAI,EAAE,mBAAmB,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;KAC7C;CAUF;AASD,qBAAa,uBAAwB,SAAQ,eAAe;gBAC9C,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;CAQnD"}

package/dist/capability/lib/errors.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityRefParseError = exports.CapabilityError = exports.CapabilityDenialSuggestionSchema = exports.CapabilityDenialDetailSchema = exports.CapabilityErrorCodeSchema = exports.CapabilityErrorCode = void 0;
+const zod_1 = require("zod");
+var CapabilityErrorCode;
+(function (CapabilityErrorCode) {
+    CapabilityErrorCode["CapabilityRefInvalid"] = "CAPABILITY_REF_INVALID";
+    CapabilityErrorCode["CapabilityUnresolved"] = "CAPABILITY_UNRESOLVED";
+    CapabilityErrorCode["CapabilityDeniedByEnvironment"] = "CAPABILITY_DENIED_BY_ENVIRONMENT";
+    CapabilityErrorCode["CapabilityDeniedByGrant"] = "CAPABILITY_DENIED_BY_GRANT";
+    CapabilityErrorCode["CapabilityDeniedByRateLimit"] = "CAPABILITY_DENIED_BY_RATE_LIMIT";
+    CapabilityErrorCode["CapabilityRequiresApproval"] = "CAPABILITY_REQUIRES_APPROVAL";
+    CapabilityErrorCode["CapabilityRequiresGrant"] = "CAPABILITY_REQUIRES_GRANT";
+    CapabilityErrorCode["AuthorizationUnreachable"] = "AUTHORIZATION_UNREACHABLE";
+    CapabilityErrorCode["AuthorizationRequestRejected"] = "AUTHORIZATION_REQUEST_REJECTED";
+    CapabilityErrorCode["AuditLogUnavailable"] = "AUDIT_LOG_UNAVAILABLE";
+    CapabilityErrorCode["CapabilityInvocationMissingOrg"] = "CAPABILITY_INVOCATION_MISSING_ORG";
+    CapabilityErrorCode["NoRunnerAvailable"] = "NO_RUNNER_AVAILABLE";
+    CapabilityErrorCode["MissingCredentialBinding"] = "MISSING_CREDENTIAL_BINDING";
+    CapabilityErrorCode["CapabilityNotArmed"] = "CAPABILITY_NOT_ARMED";
+    CapabilityErrorCode["CapabilityApertureRequired"] = "CAPABILITY_APERTURE_REQUIRED";
+    CapabilityErrorCode["CapabilityNotSafeForAgents"] = "CAPABILITY_NOT_SAFE_FOR_AGENTS";
+    CapabilityErrorCode["CapabilityDeniedByParticipantRole"] = "CAPABILITY_DENIED_BY_PARTICIPANT_ROLE";
+    CapabilityErrorCode["CapabilityReservedInputField"] = "CAPABILITY_RESERVED_INPUT_FIELD";
+    CapabilityErrorCode["CapabilityTrustedContextUnavailable"] = "CAPABILITY_TRUSTED_CONTEXT_UNAVAILABLE";
+})(CapabilityErrorCode || (exports.CapabilityErrorCode = CapabilityErrorCode = {}));
+exports.CapabilityErrorCodeSchema = zod_1.z.nativeEnum(CapabilityErrorCode);
+exports.CapabilityDenialDetailSchema = zod_1.z.object({
+    code: exports.CapabilityErrorCodeSchema,
+    detail: zod_1.z.string().min(1),
+});
+exports.CapabilityDenialSuggestionSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({
+        kind: zod_1.z.literal('request-grant'),
+        capability: zod_1.z.string().min(1),
+        environment: zod_1.z.string().min(1).optional(),
+        resource: zod_1.z.string().min(1).optional(),
+    }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('switch-environment'),
+        from: zod_1.z.string().min(1),
+        to: zod_1.z.string().min(1),
+    }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('request-approval'),
+        capability: zod_1.z.string().min(1),
+        approver: zod_1.z.string().min(1).optional(),
+    }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('bind-resource'),
+        roleKey: zod_1.z.string().min(1),
+        ownerSpaceRef: zod_1.z.string().min(1),
+        capability: zod_1.z.string().min(1).optional(),
+    }),
+]);
+class CapabilityError extends Error {
+    code;
+    capability;
+    subject;
+    environment;
+    auditId;
+    details;
+    constructor(args) {
+        super(args.message);
+        this.name = 'CapabilityError';
+        this.code = args.code;
+        this.capability = args.capability;
+        this.subject = args.subject;
+        this.environment = args.environment;
+        this.auditId = args.auditId;
+        this.details = args.details;
+    }
+}
+exports.CapabilityError = CapabilityError;
+class CapabilityRefParseError extends CapabilityError {
+    constructor(args) {
+        super({
+            code: CapabilityErrorCode.CapabilityRefInvalid,
+            message: args.message,
+            capability: args.raw,
+        });
+        this.name = 'CapabilityRefParseError';
+    }
+}
+exports.CapabilityRefParseError = CapabilityRefParseError;
+//# sourceMappingURL=errors.js.map

package/dist/capability/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/capability/lib/errors.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAcxB,IAAY,mBAkKX;AAlKD,WAAY,mBAAmB;IAC7B,sEAA+C,CAAA;IAC/C,qEAA8C,CAAA;IAC9C,yFAAkE,CAAA;IAClE,6EAAsD,CAAA;IACtD,sFAA+D,CAAA;IAC/D,kFAA2D,CAAA;IAC3D,4EAAqD,CAAA;IACrD,6EAAsD,CAAA;IAyBtD,sFAA+D,CAAA;IAC/D,oEAA6C,CAAA;IAQ7C,2FAAoE,CAAA;IAOpE,gEAAyC,CAAA;IAWzC,8EAAuD,CAAA;IAYvD,kEAA2C,CAAA;IAY3C,kFAA2D,CAAA;IAgB3D,oFAA6D,CAAA;IAe7D,kGAA2E,CAAA;IAuB3E,uFAAgE,CAAA;IAuBhE,qGAA8E,CAAA;AAChF,CAAC,EAlKW,mBAAmB,mCAAnB,mBAAmB,QAkK9B;AAEY,QAAA,yBAAyB,GAAG,OAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAY9D,QAAA,4BAA4B,GAAG,OAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,iCAAyB;IAC/B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAsC,CAAC;AAgD3B,QAAA,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QAChC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACzC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACvC,CAAC;IACF,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACrC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACtB,CAAC;IACF,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACnC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACvC,CAAC;IACF,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;CACH,CAA0C,CAAC;AAU5C,MAAa,eAAgB,SAAQ,KAAK;IACxB,IAAI,CAAsB;IAC1B,UAAU,CAAqB;IAC/B,OAAO,CAAqB;IAC5B,WAAW,CAAqB;IAChC,OAAO,CAAqB;IAC5B,OAAO,CAAgD;IAEvE,YAAY,IAQX;QACC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;CACF;AA1BD,0CA0BC;AASD,MAAa,uBAAwB,SAAQ,eAAe;IAC1D,YAAY,IAAsC;QAChD,KAAK,CAAC;YACJ,IAAI,EAAE,mBAAmB,CAAC,oBAAoB;YAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,GAAG;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AATD,0DASC"}

package/dist/capability/lib/long-running-invocation.d.ts

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+import { type CapabilityRef } from './capability-ref';
+export declare enum LongRunningInvocationState {
+    Accepted = "accepted",
+    Running = "running",
+    Succeeded = "succeeded",
+    Failed = "failed"
+}
+export declare const LongRunningInvocationStateSchema: z.ZodEnum<typeof LongRunningInvocationState>;
+export declare const LONG_RUNNING_HANDLE_MAX_LENGTH = 512;
+export declare const LongRunningInvocationHandleSchema: z.ZodString;
+export interface LongRunningInvocationAccepted {
+    readonly state: LongRunningInvocationState.Accepted;
+    readonly handle: string;
+    readonly statusCapabilityRef: CapabilityRef;
+}
+export declare const LongRunningInvocationProgressSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+export interface LongRunningInvocationRunning {
+    readonly state: LongRunningInvocationState.Running;
+    readonly progress?: Readonly<Record<string, unknown>> | undefined;
+}
+export interface LongRunningInvocationSucceeded {
+    readonly state: LongRunningInvocationState.Succeeded;
+    readonly output: Readonly<Record<string, unknown>>;
+}
+export interface LongRunningInvocationFailure {
+    readonly code: string;
+    readonly message: string;
+}
+export interface LongRunningInvocationFailed {
+    readonly state: LongRunningInvocationState.Failed;
+    readonly error: LongRunningInvocationFailure;
+}
+export interface LongRunningStatusInput {
+    readonly handle: string;
+}
+export declare const LongRunningInvocationAcceptedSchema: z.ZodType<LongRunningInvocationAccepted>;
+export declare const LongRunningInvocationRunningSchema: z.ZodType<LongRunningInvocationRunning>;
+export declare const LongRunningInvocationSucceededSchema: z.ZodType<LongRunningInvocationSucceeded>;
+export declare const LongRunningInvocationFailureSchema: z.ZodType<LongRunningInvocationFailure>;
+export declare const LongRunningInvocationFailedSchema: z.ZodType<LongRunningInvocationFailed>;
+export declare const LongRunningStatusInputSchema: z.ZodType<LongRunningStatusInput>;
+export type LongRunningInvocationResponse = LongRunningInvocationAccepted | LongRunningInvocationSucceeded | LongRunningInvocationFailed;
+export declare const LongRunningInvocationResponseSchema: z.ZodType<LongRunningInvocationResponse>;
+export type LongRunningInvocationStatus = LongRunningInvocationRunning | LongRunningInvocationSucceeded | LongRunningInvocationFailed;
+export declare const LongRunningInvocationStatusSchema: z.ZodType<LongRunningInvocationStatus>;
+export declare function longRunningStatusInput(handle: string): LongRunningStatusInput;
+export declare class LongRunningStatusRefInadmissibleError extends Error {
+    readonly invokedRef: CapabilityRef;
+    readonly statusCapabilityRef: CapabilityRef;
+    constructor(invokedRef: CapabilityRef, statusCapabilityRef: CapabilityRef);
+}
+export declare function assertLongRunningStatusRefAdmissible(invokedRef: string, statusCapabilityRef: string): void;
+export declare const LONG_RUNNING_INVOCATION_RESPONSE_JSON_SCHEMA: Readonly<Record<string, unknown>>;
+export declare const LONG_RUNNING_STATUS_INPUT_JSON_SCHEMA: Readonly<Record<string, unknown>>;
+export declare const LONG_RUNNING_INVOCATION_STATUS_JSON_SCHEMA: Readonly<Record<string, unknown>>;
+//# sourceMappingURL=long-running-invocation.d.ts.map

package/dist/capability/lib/long-running-invocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"long-running-invocation.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/long-running-invocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AA+D1B,oBAAY,0BAA0B;IACpC,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAQF,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,eAAO,MAAM,iCAAiC,aAGR,CAAC;AAGvC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC,QAAQ,CAAC;IAEpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAKxB,QAAQ,CAAC,mBAAmB,EAAE,aAAa,CAAC;CAC7C;AASD,eAAO,MAAM,mCAAmC,wCAG/C,CAAC;AAEF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC,OAAO,CAAC;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACnE;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC,SAAS,CAAC;IAErD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AASD,MAAM,WAAW,4BAA4B;IAE3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC,MAAM,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;CAC9C;AAGD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAsCD,eAAO,MAAM,mCAAmC,EACjB,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;AACxE,eAAO,MAAM,kCAAkC,EACjB,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;AACtE,eAAO,MAAM,oCAAoC,EACjB,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;AAC1E,eAAO,MAAM,kCAAkC,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CACxE,CAAC;AAChB,eAAO,MAAM,iCAAiC,EACjB,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAEhE,CAAC;AAOZ,MAAM,MAAM,6BAA6B,GACrC,6BAA6B,GAC7B,8BAA8B,GAC9B,2BAA2B,CAAC;AAEhC,eAAO,MAAM,mCAAmC,EAGhC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;AAMzD,MAAM,MAAM,2BAA2B,GACnC,4BAA4B,GAC5B,8BAA8B,GAC9B,2BAA2B,CAAC;AAEhC,eAAO,MAAM,iCAAiC,EAI7B,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAGxD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,sBAAsB,CAE7E;AAWD,qBAAa,qCAAsC,SAAQ,KAAK;aAE5C,UAAU,EAAE,aAAa;aACzB,mBAAmB,EAAE,aAAa;gBADlC,UAAU,EAAE,aAAa,EACzB,mBAAmB,EAAE,aAAa;CASrD;AAQD,wBAAgB,oCAAoC,CAClD,UAAU,EAAE,MAAM,EAClB,mBAAmB,EAAE,MAAM,GAC1B,IAAI,CAMN;AAwBD,eAAO,MAAM,4CAA4C,mCAExD,CAAC;AAGF,eAAO,MAAM,qCAAqC,mCAEjD,CAAC;AAGF,eAAO,MAAM,0CAA0C,mCAEtD,CAAC"}

package/dist/capability/lib/long-running-invocation.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LONG_RUNNING_INVOCATION_STATUS_JSON_SCHEMA = exports.LONG_RUNNING_STATUS_INPUT_JSON_SCHEMA = exports.LONG_RUNNING_INVOCATION_RESPONSE_JSON_SCHEMA = exports.LongRunningStatusRefInadmissibleError = exports.LongRunningInvocationStatusSchema = exports.LongRunningInvocationResponseSchema = exports.LongRunningStatusInputSchema = exports.LongRunningInvocationFailedSchema = exports.LongRunningInvocationFailureSchema = exports.LongRunningInvocationSucceededSchema = exports.LongRunningInvocationRunningSchema = exports.LongRunningInvocationAcceptedSchema = exports.LongRunningInvocationProgressSchema = exports.LongRunningInvocationHandleSchema = exports.LONG_RUNNING_HANDLE_MAX_LENGTH = exports.LongRunningInvocationStateSchema = exports.LongRunningInvocationState = void 0;
+exports.longRunningStatusInput = longRunningStatusInput;
+exports.assertLongRunningStatusRefAdmissible = assertLongRunningStatusRefAdmissible;
+const zod_1 = require("zod");
+const capability_ref_1 = require("./capability-ref");
+var LongRunningInvocationState;
+(function (LongRunningInvocationState) {
+    LongRunningInvocationState["Accepted"] = "accepted";
+    LongRunningInvocationState["Running"] = "running";
+    LongRunningInvocationState["Succeeded"] = "succeeded";
+    LongRunningInvocationState["Failed"] = "failed";
+})(LongRunningInvocationState || (exports.LongRunningInvocationState = LongRunningInvocationState = {}));
+exports.LongRunningInvocationStateSchema = zod_1.z.nativeEnum(LongRunningInvocationState);
+exports.LONG_RUNNING_HANDLE_MAX_LENGTH = 512;
+exports.LongRunningInvocationHandleSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(exports.LONG_RUNNING_HANDLE_MAX_LENGTH);
+exports.LongRunningInvocationProgressSchema = zod_1.z.record(zod_1.z.string(), zod_1.z.unknown());
+const AcceptedObject = zod_1.z
+    .object({
+    state: zod_1.z.literal(LongRunningInvocationState.Accepted),
+    handle: exports.LongRunningInvocationHandleSchema,
+    statusCapabilityRef: capability_ref_1.CapabilityRefSchema,
+})
+    .strict();
+const RunningObject = zod_1.z
+    .object({
+    state: zod_1.z.literal(LongRunningInvocationState.Running),
+    progress: exports.LongRunningInvocationProgressSchema.optional(),
+})
+    .strict();
+const SucceededObject = zod_1.z
+    .object({
+    state: zod_1.z.literal(LongRunningInvocationState.Succeeded),
+    output: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+})
+    .strict();
+const FailureObject = zod_1.z
+    .object({
+    code: zod_1.z.string().min(1).max(200),
+    message: zod_1.z.string().min(1).max(4000),
+})
+    .strict();
+const FailedObject = zod_1.z
+    .object({
+    state: zod_1.z.literal(LongRunningInvocationState.Failed),
+    error: FailureObject,
+})
+    .strict();
+exports.LongRunningInvocationAcceptedSchema = AcceptedObject;
+exports.LongRunningInvocationRunningSchema = RunningObject;
+exports.LongRunningInvocationSucceededSchema = SucceededObject;
+exports.LongRunningInvocationFailureSchema = FailureObject;
+exports.LongRunningInvocationFailedSchema = FailedObject;
+exports.LongRunningStatusInputSchema = zod_1.z
+    .object({ handle: exports.LongRunningInvocationHandleSchema })
+    .strict();
+exports.LongRunningInvocationResponseSchema = zod_1.z.discriminatedUnion('state', [AcceptedObject, SucceededObject, FailedObject]);
+exports.LongRunningInvocationStatusSchema = zod_1.z.discriminatedUnion('state', [
+    RunningObject,
+    SucceededObject,
+    FailedObject,
+]);
+function longRunningStatusInput(handle) {
+    return { handle: exports.LongRunningInvocationHandleSchema.parse(handle) };
+}
+class LongRunningStatusRefInadmissibleError extends Error {
+    invokedRef;
+    statusCapabilityRef;
+    constructor(invokedRef, statusCapabilityRef) {
+        super(`Long-running capability ${invokedRef} named status capability ${statusCapabilityRef} ` +
+            'outside its own domain. A provider may only point a caller at a status ' +
+            'capability in the domain of the capability it accepted.');
+        this.invokedRef = invokedRef;
+        this.statusCapabilityRef = statusCapabilityRef;
+        this.name = 'LongRunningStatusRefInadmissibleError';
+    }
+}
+exports.LongRunningStatusRefInadmissibleError = LongRunningStatusRefInadmissibleError;
+function assertLongRunningStatusRefAdmissible(invokedRef, statusCapabilityRef) {
+    const invoked = (0, capability_ref_1.parseCapabilityRef)(invokedRef);
+    const status = (0, capability_ref_1.parseCapabilityRef)(statusCapabilityRef);
+    if (invoked.domain !== status.domain) {
+        throw new LongRunningStatusRefInadmissibleError(invoked.raw, status.raw);
+    }
+}
+function toJsonSchema(schema) {
+    return Object.freeze(zod_1.z.toJSONSchema(schema, {
+        target: 'draft-2020-12',
+        unrepresentable: 'throw',
+    }));
+}
+exports.LONG_RUNNING_INVOCATION_RESPONSE_JSON_SCHEMA = toJsonSchema(exports.LongRunningInvocationResponseSchema);
+exports.LONG_RUNNING_STATUS_INPUT_JSON_SCHEMA = toJsonSchema(exports.LongRunningStatusInputSchema);
+exports.LONG_RUNNING_INVOCATION_STATUS_JSON_SCHEMA = toJsonSchema(exports.LongRunningInvocationStatusSchema);
+//# sourceMappingURL=long-running-invocation.js.map

package/dist/capability/lib/long-running-invocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"long-running-invocation.js","sourceRoot":"","sources":["../../../src/capability/lib/long-running-invocation.ts"],"names":[],"mappings":";;;AAyOA,wDAEC;AA+BD,oFASC;AAnRD,6BAAwB;AAExB,qDAI0B;AA+D1B,IAAY,0BAKX;AALD,WAAY,0BAA0B;IACpC,mDAAqB,CAAA;IACrB,iDAAmB,CAAA;IACnB,qDAAuB,CAAA;IACvB,+CAAiB,CAAA;AACnB,CAAC,EALW,0BAA0B,0CAA1B,0BAA0B,QAKrC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAQW,QAAA,8BAA8B,GAAG,GAAG,CAAC;AAErC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,sCAA8B,CAAC,CAAC;AAqB1B,QAAA,mCAAmC,GAAG,OAAC,CAAC,MAAM,CACzD,OAAC,CAAC,MAAM,EAAE,EACV,OAAC,CAAC,OAAO,EAAE,CACZ,CAAC;AAoCF,MAAM,cAAc,GAAG,OAAC;KACrB,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,QAAQ,CAAC;IACrD,MAAM,EAAE,yCAAiC;IACzC,mBAAmB,EAAE,oCAAmB;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,aAAa,GAAG,OAAC;KACpB,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC;IACpD,QAAQ,EAAE,2CAAmC,CAAC,QAAQ,EAAE;CACzD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,eAAe,GAAG,OAAC;KACtB,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,SAAS,CAAC;IACtD,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,aAAa,GAAG,OAAC;KACpB,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,YAAY,GAAG,OAAC;KACnB,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,aAAa;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,mCAAmC,GAC9C,cAAqE,CAAC;AAC3D,QAAA,kCAAkC,GAC7C,aAAmE,CAAC;AACzD,QAAA,oCAAoC,GAC/C,eAAuE,CAAC;AAC7D,QAAA,kCAAkC,GAC7C,aAAa,CAAC;AACH,QAAA,iCAAiC,GAC5C,YAAiE,CAAC;AAEvD,QAAA,4BAA4B,GAAsC,OAAC;KAC7E,MAAM,CAAC,EAAE,MAAM,EAAE,yCAAiC,EAAE,CAAC;KACrD,MAAM,EAAE,CAAC;AAYC,QAAA,mCAAmC,GAAG,OAAC,CAAC,kBAAkB,CACrE,OAAO,EACP,CAAC,cAAc,EAAE,eAAe,EAAE,YAAY,CAAC,CACO,CAAC;AAW5C,QAAA,iCAAiC,GAAG,OAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE;IAC7E,aAAa;IACb,eAAe;IACf,YAAY;CACb,CAAsD,CAAC;AAGxD,SAAgB,sBAAsB,CAAC,MAAc;IACnD,OAAO,EAAE,MAAM,EAAE,yCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AACrE,CAAC;AAWD,MAAa,qCAAsC,SAAQ,KAAK;IAE5C;IACA;IAFlB,YACkB,UAAyB,EACzB,mBAAkC;QAElD,KAAK,CACH,2BAA2B,UAAU,4BAA4B,mBAAmB,GAAG;YACrF,yEAAyE;YACzE,yDAAyD,CAC5D,CAAC;QAPc,eAAU,GAAV,UAAU,CAAe;QACzB,wBAAmB,GAAnB,mBAAmB,CAAe;QAOlD,IAAI,CAAC,IAAI,GAAG,uCAAuC,CAAC;IACtD,CAAC;CACF;AAZD,sFAYC;AAQD,SAAgB,oCAAoC,CAClD,UAAkB,EAClB,mBAA2B;IAE3B,MAAM,OAAO,GAAG,IAAA,mCAAkB,EAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAA,mCAAkB,EAAC,mBAAmB,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,qCAAqC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAcD,SAAS,YAAY,CAAC,MAAiB;IACrC,OAAO,MAAM,CAAC,MAAM,CAClB,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE;QACrB,MAAM,EAAE,eAAe;QACvB,eAAe,EAAE,OAAO;KACzB,CAA4B,CAC9B,CAAC;AACJ,CAAC;AAGY,QAAA,4CAA4C,GAAG,YAAY,CACtE,2CAAmC,CACpC,CAAC;AAGW,QAAA,qCAAqC,GAAG,YAAY,CAC/D,oCAA4B,CAC7B,CAAC;AAGW,QAAA,0CAA0C,GAAG,YAAY,CACpE,yCAAiC,CAClC,CAAC"}