@xemahq/contracts 0.1.0

package/dist/capability/lib/meta-tool.d.ts

@@ -0,0 +1,107 @@
+import { z } from 'zod';
+import { type CapabilityRef } from './capability-ref';
+import { type EffectiveCapabilityDescriptor } from './effective-capability-set';
+export declare enum MetaToolName {
+    Search = "xema.capabilities.search",
+    Describe = "xema.capabilities.describe",
+    Invoke = "xema.capabilities.invoke",
+    Plan = "xema.capabilities.plan",
+    Preflight = "xema.capabilities.preflight",
+    Explain = "xema.capabilities.explain"
+}
+export declare const MetaToolNameSchema: z.ZodEnum<typeof MetaToolName>;
+export declare const META_TOOL_AUDIT_TOPIC = "capability.invoked.v1";
+export declare const META_TOOL_ROUTE_SUFFIX: Readonly<Record<MetaToolName, string>>;
+export interface MetaToolBiomeRef {
+    readonly id: string;
+    readonly version: string;
+}
+export declare const MetaToolBiomeRefSchema: z.ZodType<MetaToolBiomeRef>;
+export { PolicyDecisionKind, PolicyDecisionKindSchema, } from '../../policy-decision';
+export declare const META_TOOL_SEARCH_DEFAULT_LIMIT = 20;
+export declare const META_TOOL_SEARCH_MAX_LIMIT = 50;
+export declare enum CapabilityRelation {
+    ActsOn = "acts_on",
+    Consumes = "consumes"
+}
+export declare function parseCapabilityRelation(raw: string): CapabilityRelation;
+export declare enum CapabilityMutationClass {
+    Read = "read",
+    Mutating = "mutating",
+    Undetermined = "undetermined"
+}
+export declare enum CapabilitySearchAnchorSource {
+    Explicit = "explicit",
+    DerivedFromQuery = "derived-from-query",
+    None = "none"
+}
+export interface CapabilitySearchRequest {
+    readonly executionContext: Record<string, unknown>;
+    readonly query?: string | undefined;
+    readonly domain?: string | undefined;
+    readonly resourceType?: string | undefined;
+    readonly mutating?: boolean | undefined;
+    readonly limit?: number | undefined;
+    readonly cursor?: string | undefined;
+}
+export declare const CapabilitySearchRequestSchema: z.ZodType<CapabilitySearchRequest>;
+export interface CapabilitySearchEntry {
+    readonly descriptor: EffectiveCapabilityDescriptor;
+    readonly biome: MetaToolBiomeRef;
+    readonly title: string;
+    readonly summary: string;
+    readonly mutation: CapabilityMutationClass;
+    readonly relation?: CapabilityRelation | undefined;
+    readonly distance?: number | undefined;
+    readonly resourceType?: string | undefined;
+}
+export declare const CapabilitySearchEntrySchema: z.ZodType<CapabilitySearchEntry>;
+export interface CapabilitySearchAnchor {
+    readonly resourceType: string | null;
+    readonly source: CapabilitySearchAnchorSource;
+}
+export declare const CapabilitySearchAnchorSchema: z.ZodType<CapabilitySearchAnchor>;
+export interface CapabilitySearchResponse {
+    readonly capabilities: readonly CapabilitySearchEntry[];
+    readonly anchor: CapabilitySearchAnchor;
+    readonly consideredCount: number;
+    readonly nextCursor?: string | undefined;
+    readonly generation?: number | undefined;
+}
+export declare const CapabilitySearchResponseSchema: z.ZodType<CapabilitySearchResponse>;
+export declare const META_TOOL_DESCRIBE_BATCH_LIMIT = 50;
+export interface CapabilityDescribeRequest {
+    readonly refs: readonly CapabilityRef[];
+}
+export declare const CapabilityDescribeRequestSchema: z.ZodType<CapabilityDescribeRequest>;
+export interface CapabilityDescribeEntry {
+    readonly descriptor: EffectiveCapabilityDescriptor;
+    readonly biome: MetaToolBiomeRef;
+    readonly inputSchema: Record<string, unknown>;
+    readonly outputSchema: Record<string, unknown>;
+    readonly examples: readonly Record<string, unknown>[];
+    readonly sideEffects: string;
+}
+export declare const CapabilityDescribeEntrySchema: z.ZodType<CapabilityDescribeEntry>;
+export interface CapabilityDescribeResponse {
+    readonly entries: readonly CapabilityDescribeEntry[];
+}
+export declare const CapabilityDescribeResponseSchema: z.ZodType<CapabilityDescribeResponse>;
+export interface CapabilityInvokeRequest {
+    readonly ref: CapabilityRef;
+    readonly input: Record<string, unknown>;
+    readonly executionContext: Record<string, unknown>;
+}
+export declare const CapabilityInvokeRequestSchema: z.ZodType<CapabilityInvokeRequest>;
+export interface CapabilityInvokeObligation {
+    readonly kind: string;
+    readonly value?: unknown;
+}
+export declare const CapabilityInvokeObligationSchema: z.ZodType<CapabilityInvokeObligation>;
+export interface CapabilityInvokeResponse {
+    readonly output?: Record<string, unknown> | undefined;
+    readonly auditId: string;
+    readonly obligations: readonly CapabilityInvokeObligation[];
+}
+export declare const CapabilityInvokeResponseSchema: z.ZodType<CapabilityInvokeResponse>;
+//# sourceMappingURL=meta-tool.d.ts.map

package/dist/capability/lib/meta-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta-tool.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/meta-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,4BAA4B,CAAC;AAgCpC,oBAAY,YAAY;IACtB,MAAM,6BAA6B;IACnC,QAAQ,+BAA+B;IACvC,MAAM,6BAA6B;IACnC,IAAI,2BAA2B;IAC/B,SAAS,gCAAgC;IACzC,OAAO,8BAA8B;CACtC;AAED,eAAO,MAAM,kBAAkB,gCAA6B,CAAC;AAO7D,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAQ7D,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAOzE,CAAC;AASF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAG7D,CAAC;AAeH,OAAO,EACL,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAK/B,eAAO,MAAM,8BAA8B,KAAK,CAAC;AACjD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAU7C,oBAAY,kBAAkB;IAE5B,MAAM,YAAY;IAElB,QAAQ,aAAa;CACtB;AAGD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAQvE;AAYD,oBAAY,uBAAuB;IACjC,IAAI,SAAS;IACb,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAGD,oBAAY,4BAA4B;IAEtC,QAAQ,aAAa;IAErB,gBAAgB,uBAAuB;IAEvC,IAAI,SAAS;CACd;AAQD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CASzE,CAAC;AAQL,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAE3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAEnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEvC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAW9D,CAAC;AAEZ,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;CAC/C;AAED,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAIvE,CAAC;AAEL,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,YAAY,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACxD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IAKxC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAO3E,CAAC;AASL,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAEjD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;CACzC;AAED,eAAO,MAAM,+BAA+B,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAM7E,CAAC;AAEL,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAUhE,CAAC;AAEd,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACtD;AAED,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAG/E,CAAC;AAIL,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpD;AAED,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAKzE,CAAC;AAEL,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAI/E,CAAC;AAEL,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,SAAS,0BAA0B,EAAE,CAAC;CAC7D;AAED,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAK3E,CAAC"}

package/dist/capability/lib/meta-tool.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityInvokeResponseSchema = exports.CapabilityInvokeObligationSchema = exports.CapabilityInvokeRequestSchema = exports.CapabilityDescribeResponseSchema = exports.CapabilityDescribeEntrySchema = exports.CapabilityDescribeRequestSchema = exports.META_TOOL_DESCRIBE_BATCH_LIMIT = exports.CapabilitySearchResponseSchema = exports.CapabilitySearchAnchorSchema = exports.CapabilitySearchEntrySchema = exports.CapabilitySearchRequestSchema = exports.CapabilitySearchAnchorSource = exports.CapabilityMutationClass = exports.CapabilityRelation = exports.META_TOOL_SEARCH_MAX_LIMIT = exports.META_TOOL_SEARCH_DEFAULT_LIMIT = exports.PolicyDecisionKindSchema = exports.PolicyDecisionKind = exports.MetaToolBiomeRefSchema = exports.META_TOOL_ROUTE_SUFFIX = exports.META_TOOL_AUDIT_TOPIC = exports.MetaToolNameSchema = exports.MetaToolName = void 0;
+exports.parseCapabilityRelation = parseCapabilityRelation;
+const zod_1 = require("zod");
+const capability_ref_1 = require("./capability-ref");
+const effective_capability_set_1 = require("./effective-capability-set");
+var MetaToolName;
+(function (MetaToolName) {
+    MetaToolName["Search"] = "xema.capabilities.search";
+    MetaToolName["Describe"] = "xema.capabilities.describe";
+    MetaToolName["Invoke"] = "xema.capabilities.invoke";
+    MetaToolName["Plan"] = "xema.capabilities.plan";
+    MetaToolName["Preflight"] = "xema.capabilities.preflight";
+    MetaToolName["Explain"] = "xema.capabilities.explain";
+})(MetaToolName || (exports.MetaToolName = MetaToolName = {}));
+exports.MetaToolNameSchema = zod_1.z.nativeEnum(MetaToolName);
+exports.META_TOOL_AUDIT_TOPIC = 'capability.invoked.v1';
+exports.META_TOOL_ROUTE_SUFFIX = {
+    [MetaToolName.Search]: 'search',
+    [MetaToolName.Describe]: 'describe',
+    [MetaToolName.Invoke]: 'invoke',
+    [MetaToolName.Plan]: 'plan',
+    [MetaToolName.Preflight]: 'preflight',
+    [MetaToolName.Explain]: 'explain',
+};
+exports.MetaToolBiomeRefSchema = zod_1.z.object({
+    id: zod_1.z.string().min(1),
+    version: zod_1.z.string().min(1),
+});
+var policy_decision_1 = require("../../policy-decision");
+Object.defineProperty(exports, "PolicyDecisionKind", { enumerable: true, get: function () { return policy_decision_1.PolicyDecisionKind; } });
+Object.defineProperty(exports, "PolicyDecisionKindSchema", { enumerable: true, get: function () { return policy_decision_1.PolicyDecisionKindSchema; } });
+exports.META_TOOL_SEARCH_DEFAULT_LIMIT = 20;
+exports.META_TOOL_SEARCH_MAX_LIMIT = 50;
+var CapabilityRelation;
+(function (CapabilityRelation) {
+    CapabilityRelation["ActsOn"] = "acts_on";
+    CapabilityRelation["Consumes"] = "consumes";
+})(CapabilityRelation || (exports.CapabilityRelation = CapabilityRelation = {}));
+function parseCapabilityRelation(raw) {
+    const values = Object.values(CapabilityRelation);
+    if (!values.includes(raw)) {
+        throw new Error(`Unknown capability relation "${raw}". Expected one of ${values.join(', ')}.`);
+    }
+    return raw;
+}
+var CapabilityMutationClass;
+(function (CapabilityMutationClass) {
+    CapabilityMutationClass["Read"] = "read";
+    CapabilityMutationClass["Mutating"] = "mutating";
+    CapabilityMutationClass["Undetermined"] = "undetermined";
+})(CapabilityMutationClass || (exports.CapabilityMutationClass = CapabilityMutationClass = {}));
+var CapabilitySearchAnchorSource;
+(function (CapabilitySearchAnchorSource) {
+    CapabilitySearchAnchorSource["Explicit"] = "explicit";
+    CapabilitySearchAnchorSource["DerivedFromQuery"] = "derived-from-query";
+    CapabilitySearchAnchorSource["None"] = "none";
+})(CapabilitySearchAnchorSource || (exports.CapabilitySearchAnchorSource = CapabilitySearchAnchorSource = {}));
+exports.CapabilitySearchRequestSchema = zod_1.z.object({
+    executionContext: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    query: zod_1.z.string().optional(),
+    domain: zod_1.z.string().optional(),
+    resourceType: zod_1.z.string().optional(),
+    mutating: zod_1.z.boolean().optional(),
+    limit: zod_1.z.number().int().min(1).max(exports.META_TOOL_SEARCH_MAX_LIMIT).optional(),
+    cursor: zod_1.z.string().optional(),
+});
+exports.CapabilitySearchEntrySchema = zod_1.z
+    .object({
+    descriptor: effective_capability_set_1.EffectiveCapabilityDescriptorSchema,
+    biome: exports.MetaToolBiomeRefSchema,
+    title: zod_1.z.string().min(1),
+    summary: zod_1.z.string(),
+    mutation: zod_1.z.nativeEnum(CapabilityMutationClass),
+    relation: zod_1.z.nativeEnum(CapabilityRelation).optional(),
+    distance: zod_1.z.number().int().min(0).optional(),
+    resourceType: zod_1.z.string().optional(),
+})
+    .strict();
+exports.CapabilitySearchAnchorSchema = zod_1.z.object({
+    resourceType: zod_1.z.string().nullable(),
+    source: zod_1.z.nativeEnum(CapabilitySearchAnchorSource),
+});
+exports.CapabilitySearchResponseSchema = zod_1.z.object({
+    capabilities: zod_1.z.array(exports.CapabilitySearchEntrySchema).readonly(),
+    anchor: exports.CapabilitySearchAnchorSchema,
+    consideredCount: zod_1.z.number().int().min(0),
+    nextCursor: zod_1.z.string().optional(),
+    generation: zod_1.z.number().int().min(0).optional(),
+});
+exports.META_TOOL_DESCRIBE_BATCH_LIMIT = 50;
+exports.CapabilityDescribeRequestSchema = zod_1.z.object({
+    refs: zod_1.z
+        .array(capability_ref_1.CapabilityRefSchema)
+        .min(1)
+        .max(exports.META_TOOL_DESCRIBE_BATCH_LIMIT),
+});
+exports.CapabilityDescribeEntrySchema = zod_1.z
+    .object({
+    descriptor: effective_capability_set_1.EffectiveCapabilityDescriptorSchema,
+    biome: exports.MetaToolBiomeRefSchema,
+    inputSchema: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    outputSchema: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    examples: zod_1.z.array(zod_1.z.record(zod_1.z.string(), zod_1.z.unknown())).readonly(),
+    sideEffects: zod_1.z.string(),
+})
+    .strict();
+exports.CapabilityDescribeResponseSchema = zod_1.z.object({
+    entries: zod_1.z.array(exports.CapabilityDescribeEntrySchema).readonly(),
+});
+exports.CapabilityInvokeRequestSchema = zod_1.z.object({
+    ref: capability_ref_1.CapabilityRefSchema,
+    input: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    executionContext: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+});
+exports.CapabilityInvokeObligationSchema = zod_1.z.object({
+    kind: zod_1.z.string().min(1),
+    value: zod_1.z.unknown().optional(),
+});
+exports.CapabilityInvokeResponseSchema = zod_1.z.object({
+    output: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+    auditId: zod_1.z.string().min(1),
+    obligations: zod_1.z.array(exports.CapabilityInvokeObligationSchema).readonly(),
+});
+//# sourceMappingURL=meta-tool.js.map

package/dist/capability/lib/meta-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta-tool.js","sourceRoot":"","sources":["../../../src/capability/lib/meta-tool.ts"],"names":[],"mappings":";;;AAgIA,0DAQC;AAxID,6BAAwB;AAExB,qDAA2E;AAC3E,yEAGoC;AAgCpC,IAAY,YAOX;AAPD,WAAY,YAAY;IACtB,mDAAmC,CAAA;IACnC,uDAAuC,CAAA;IACvC,mDAAmC,CAAA;IACnC,+CAA+B,CAAA;IAC/B,yDAAyC,CAAA;IACzC,qDAAqC,CAAA;AACvC,CAAC,EAPW,YAAY,4BAAZ,YAAY,QAOvB;AAEY,QAAA,kBAAkB,GAAG,OAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAOhD,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAQhD,QAAA,sBAAsB,GAA2C;IAC5E,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ;IAC/B,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,UAAU;IACnC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ;IAC/B,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM;IAC3B,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,WAAW;IACrC,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,SAAS;CAClC,CAAC;AAcW,QAAA,sBAAsB,GAAgC,OAAC,CAAC,MAAM,CAAC;IAC1E,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAeH,yDAG+B;AAF7B,qHAAA,kBAAkB,OAAA;AAClB,2HAAA,wBAAwB,OAAA;AAMb,QAAA,8BAA8B,GAAG,EAAE,CAAC;AACpC,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAU7C,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAE5B,wCAAkB,CAAA;IAElB,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,kCAAlB,kBAAkB,QAK7B;AAGD,SAAgB,uBAAuB,CAAC,GAAW;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAa,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,sBAAsB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,GAAyB,CAAC;AACnC,CAAC;AAYD,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,wCAAa,CAAA;IACb,gDAAqB,CAAA;IACrB,wDAA6B,CAAA;AAC/B,CAAC,EAJW,uBAAuB,uCAAvB,uBAAuB,QAIlC;AAGD,IAAY,4BAOX;AAPD,WAAY,4BAA4B;IAEtC,qDAAqB,CAAA;IAErB,uEAAuC,CAAA;IAEvC,6CAAa,CAAA;AACf,CAAC,EAPW,4BAA4B,4CAA5B,4BAA4B,QAOvC;AAkBY,QAAA,6BAA6B,GACxC,OAAC,CAAC,MAAM,CAAC;IACP,gBAAgB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IACnD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kCAA0B,CAAC,CAAC,QAAQ,EAAE;IACzE,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAuBQ,QAAA,2BAA2B,GAAqC,OAAC;KAC3E,MAAM,CAAC;IACN,UAAU,EAAE,8DAAmC;IAC/C,KAAK,EAAE,8BAAsB;IAC7B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,OAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC;IAC/C,QAAQ,EAAE,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,4BAA4B,GACvC,OAAC,CAAC,MAAM,CAAC;IACP,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,OAAC,CAAC,UAAU,CAAC,4BAA4B,CAAC;CACnD,CAAC,CAAC;AAgBQ,QAAA,8BAA8B,GACzC,OAAC,CAAC,MAAM,CAAC;IACP,YAAY,EAAE,OAAC,CAAC,KAAK,CAAC,mCAA2B,CAAC,CAAC,QAAQ,EAAE;IAC7D,MAAM,EAAE,oCAA4B;IACpC,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AASQ,QAAA,8BAA8B,GAAG,EAAE,CAAC;AAMpC,QAAA,+BAA+B,GAC1C,OAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,OAAC;SACJ,KAAK,CAAC,oCAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,sCAA8B,CAAC;CACvC,CAAC,CAAC;AAYQ,QAAA,6BAA6B,GACxC,OAAC;KACE,MAAM,CAAC;IACN,UAAU,EAAE,8DAAmC;IAC/C,KAAK,EAAE,8BAAsB;IAC7B,WAAW,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC/C,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/D,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE;CACxB,CAAC;KACD,MAAM,EAAE,CAAC;AAMD,QAAA,gCAAgC,GAC3C,OAAC,CAAC,MAAM,CAAC;IACP,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAUQ,QAAA,6BAA6B,GACxC,OAAC,CAAC,MAAM,CAAC;IACP,GAAG,EAAE,oCAAmB;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IACxC,gBAAgB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;CACpD,CAAC,CAAC;AAOQ,QAAA,gCAAgC,GAC3C,OAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAQQ,QAAA,8BAA8B,GACzC,OAAC,CAAC,MAAM,CAAC;IACP,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,wCAAgC,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC"}

package/dist/capability/lib/permission-profile.d.ts

@@ -0,0 +1,35 @@
+import { z } from 'zod';
+import { type CapabilityRef } from './capability-ref';
+export declare enum BiomePermissionProfile {
+    ReadOnlyAssistant = "read-only-assistant",
+    SupportChatbot = "support-chatbot",
+    InternalAgent = "internal-agent",
+    WorkflowRunner = "workflow-runner",
+    ConnectorBridge = "connector-bridge",
+    PowerUserDeveloper = "power-user-developer",
+    OrgAdminTool = "org-admin-tool",
+    SandboxOnly = "sandbox-only",
+    Unrestricted = "unrestricted"
+}
+export declare const BiomePermissionProfileSchema: z.ZodEnum<typeof BiomePermissionProfile>;
+export declare enum CapabilityRiskTier {
+    Low = "low",
+    Medium = "medium",
+    High = "high",
+    Critical = "critical"
+}
+export declare const CapabilityRiskTierSchema: z.ZodEnum<typeof CapabilityRiskTier>;
+export interface PermissionHint {
+    capability: CapabilityRef;
+    reason: string;
+    suggestedResource?: string;
+    suggestedScope?: Record<string, unknown>;
+    riskTier: CapabilityRiskTier;
+}
+export declare const PermissionHintSchema: z.ZodType<PermissionHint>;
+export interface PermissionGroup {
+    name: string;
+    capabilities: readonly CapabilityRef[];
+}
+export declare const PermissionGroupSchema: z.ZodType<PermissionGroup>;
+//# sourceMappingURL=permission-profile.d.ts.map

package/dist/capability/lib/permission-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-profile.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/permission-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAe3E,oBAAY,sBAAsB;IAChC,iBAAiB,wBAAwB;IACzC,cAAc,oBAAoB;IAClC,aAAa,mBAAmB;IAChC,cAAc,oBAAoB;IAClC,eAAe,qBAAqB;IACpC,kBAAkB,yBAAyB;IAC3C,YAAY,mBAAmB;IAC/B,WAAW,iBAAiB;IAC5B,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,4BAA4B,0CAExC,CAAC;AAQF,oBAAY,kBAAkB;IAC5B,GAAG,QAAQ;IACX,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,QAAQ,aAAa;CACtB;AAED,eAAO,MAAM,wBAAwB,sCAAmC,CAAC;AAezE,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,aAAa,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,eAAO,MAAM,oBAAoB,EAM3B,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;AAQhC,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,SAAS,aAAa,EAAE,CAAC;CACxC;AAED,eAAO,MAAM,qBAAqB,EAG5B,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC"}

package/dist/capability/lib/permission-profile.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionGroupSchema = exports.PermissionHintSchema = exports.CapabilityRiskTierSchema = exports.CapabilityRiskTier = exports.BiomePermissionProfileSchema = exports.BiomePermissionProfile = void 0;
+const zod_1 = require("zod");
+const capability_ref_1 = require("./capability-ref");
+var BiomePermissionProfile;
+(function (BiomePermissionProfile) {
+    BiomePermissionProfile["ReadOnlyAssistant"] = "read-only-assistant";
+    BiomePermissionProfile["SupportChatbot"] = "support-chatbot";
+    BiomePermissionProfile["InternalAgent"] = "internal-agent";
+    BiomePermissionProfile["WorkflowRunner"] = "workflow-runner";
+    BiomePermissionProfile["ConnectorBridge"] = "connector-bridge";
+    BiomePermissionProfile["PowerUserDeveloper"] = "power-user-developer";
+    BiomePermissionProfile["OrgAdminTool"] = "org-admin-tool";
+    BiomePermissionProfile["SandboxOnly"] = "sandbox-only";
+    BiomePermissionProfile["Unrestricted"] = "unrestricted";
+})(BiomePermissionProfile || (exports.BiomePermissionProfile = BiomePermissionProfile = {}));
+exports.BiomePermissionProfileSchema = zod_1.z.nativeEnum(BiomePermissionProfile);
+var CapabilityRiskTier;
+(function (CapabilityRiskTier) {
+    CapabilityRiskTier["Low"] = "low";
+    CapabilityRiskTier["Medium"] = "medium";
+    CapabilityRiskTier["High"] = "high";
+    CapabilityRiskTier["Critical"] = "critical";
+})(CapabilityRiskTier || (exports.CapabilityRiskTier = CapabilityRiskTier = {}));
+exports.CapabilityRiskTierSchema = zod_1.z.nativeEnum(CapabilityRiskTier);
+exports.PermissionHintSchema = zod_1.z.object({
+    capability: capability_ref_1.CapabilityRefSchema,
+    reason: zod_1.z.string().min(1),
+    suggestedResource: zod_1.z.string().min(1).optional(),
+    suggestedScope: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+    riskTier: exports.CapabilityRiskTierSchema,
+});
+exports.PermissionGroupSchema = zod_1.z.object({
+    name: zod_1.z.string().min(1),
+    capabilities: zod_1.z.array(capability_ref_1.CapabilityRefSchema).readonly(),
+});
+//# sourceMappingURL=permission-profile.js.map

package/dist/capability/lib/permission-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-profile.js","sourceRoot":"","sources":["../../../src/capability/lib/permission-profile.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,qDAA2E;AAe3E,IAAY,sBAUX;AAVD,WAAY,sBAAsB;IAChC,mEAAyC,CAAA;IACzC,4DAAkC,CAAA;IAClC,0DAAgC,CAAA;IAChC,4DAAkC,CAAA;IAClC,8DAAoC,CAAA;IACpC,qEAA2C,CAAA;IAC3C,yDAA+B,CAAA;IAC/B,sDAA4B,CAAA;IAC5B,uDAA6B,CAAA;AAC/B,CAAC,EAVW,sBAAsB,sCAAtB,sBAAsB,QAUjC;AAEY,QAAA,4BAA4B,GAAG,OAAC,CAAC,UAAU,CACtD,sBAAsB,CACvB,CAAC;AAQF,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,iCAAW,CAAA;IACX,uCAAiB,CAAA;IACjB,mCAAa,CAAA;IACb,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,kCAAlB,kBAAkB,QAK7B;AAEY,QAAA,wBAAwB,GAAG,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAuB5D,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,oCAAmB;IAC/B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,cAAc,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5D,QAAQ,EAAE,gCAAwB;CACnC,CAA8B,CAAC;AAanB,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,OAAC,CAAC,KAAK,CAAC,oCAAmB,CAAC,CAAC,QAAQ,EAAE;CACtD,CAA+B,CAAC"}

package/dist/capability/lib/required-resource-role-binding.d.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+import { type ResourceRoleKey } from '../../resource-role';
+import { SpaceKind } from '../../space';
+export interface RequiredResourceRoleBinding {
+    readonly roleKey: ResourceRoleKey;
+    readonly ownerKind: SpaceKind;
+    readonly remedyCapabilityRef?: string | undefined;
+}
+export declare const REQUIRED_BINDING_OWNER_KINDS: readonly SpaceKind[];
+export declare const RequiredResourceRoleBindingSchema: z.ZodType<RequiredResourceRoleBinding>;
+export declare function formatRequiredBindingKey(requirement: RequiredResourceRoleBinding): string;
+//# sourceMappingURL=required-resource-role-binding.d.ts.map

package/dist/capability/lib/required-resource-role-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"required-resource-role-binding.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/required-resource-role-binding.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAmB,MAAM,aAAa,CAAC;AASzD,MAAM,WAAW,2BAA2B;IAE1C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAKlC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAW9B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnD;AAYD,eAAO,MAAM,4BAA4B,EAAE,SAAS,SAAS,EAK3D,CAAC;AAEH,eAAO,MAAM,iCAAiC,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAyC1B,CAAC;AAc5D,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,2BAA2B,GACvC,MAAM,CAER"}

package/dist/capability/lib/required-resource-role-binding.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequiredResourceRoleBindingSchema = exports.REQUIRED_BINDING_OWNER_KINDS = void 0;
+exports.formatRequiredBindingKey = formatRequiredBindingKey;
+const zod_1 = require("zod");
+const capability_ref_1 = require("./capability-ref");
+const resource_role_1 = require("../../resource-role");
+const space_1 = require("../../space");
+exports.REQUIRED_BINDING_OWNER_KINDS = Object.freeze([
+    space_1.SpaceKind.Org,
+    space_1.SpaceKind.Project,
+    space_1.SpaceKind.User,
+    space_1.SpaceKind.Biome,
+]);
+exports.RequiredResourceRoleBindingSchema = zod_1.z
+    .object({
+    roleKey: resource_role_1.ResourceRoleKeySchema,
+    ownerKind: space_1.SpaceKindSchema.refine((kind) => exports.REQUIRED_BINDING_OWNER_KINDS.includes(kind), {
+        message: 'ownerKind must be one of ' +
+            `${exports.REQUIRED_BINDING_OWNER_KINDS.join(', ')} — a requirement at any ` +
+            'other tier is either a deployment invariant no tenant can act on, ' +
+            'or names a runtime container that cannot outlive the binding.',
+    }),
+    remedyCapabilityRef: capability_ref_1.CapabilityRefSchema.optional(),
+})
+    .strict()
+    .superRefine((requirement, ctx) => {
+    if (requirement.roleKey.qualifier !== undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['roleKey', 'qualifier'],
+            message: 'a required binding must not carry a qualifier: the requirement is ' +
+                'that the role is bound at all, and the graph key that identifies ' +
+                'it does not carry one',
+        });
+    }
+});
+function formatRequiredBindingKey(requirement) {
+    return `${requirement.ownerKind}:${requirement.roleKey.resourceKind}.${requirement.roleKey.role}`;
+}
+//# sourceMappingURL=required-resource-role-binding.js.map

package/dist/capability/lib/required-resource-role-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"required-resource-role-binding.js","sourceRoot":"","sources":["../../../src/capability/lib/required-resource-role-binding.ts"],"names":[],"mappings":";;;AA+JA,4DAIC;AAlHD,6BAAwB;AAExB,qDAAuD;AAEvD,uDAG6B;AAC7B,uCAAyD;AAwC5C,QAAA,4BAA4B,GAAyB,MAAM,CAAC,MAAM,CAAC;IAC9E,iBAAS,CAAC,GAAG;IACb,iBAAS,CAAC,OAAO;IACjB,iBAAS,CAAC,IAAI;IACd,iBAAS,CAAC,KAAK;CAChB,CAAC,CAAC;AAEU,QAAA,iCAAiC,GAC5C,OAAC;KACE,MAAM,CAAC;IACN,OAAO,EAAE,qCAAqB;IAC9B,SAAS,EAAE,uBAAe,CAAC,MAAM,CAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,oCAA4B,CAAC,QAAQ,CAAC,IAAI,CAAC,EACrD;QACE,OAAO,EACL,2BAA2B;YAC3B,GAAG,oCAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B;YACpE,oEAAoE;YACpE,+DAA+D;KAClE,CACF;IACD,mBAAmB,EAAE,oCAAmB,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE;IAchC,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC;YAC9B,OAAO,EACL,oEAAoE;gBACpE,mEAAmE;gBACnE,uBAAuB;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAsD,CAAC;AAc5D,SAAgB,wBAAwB,CACtC,WAAwC;IAExC,OAAO,GAAG,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC,YAAY,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AACpG,CAAC"}

package/dist/capability/lib/shell-command-descriptor.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+import { type CapabilityRef } from './capability-ref';
+import { type CapabilityAuthorityEffect } from './authority-effect';
+import { type CapabilityReach } from './capability-reach';
+import { CapabilityRiskTier } from './permission-profile';
+import { type OrgRole } from '../../tenant';
+export interface JsonSchemaRefStub {
+    $ref: string;
+}
+export declare const JsonSchemaRefStubSchema: z.ZodType<JsonSchemaRefStub>;
+export interface ShellCommandDescriptor {
+    name: string;
+    summary: string;
+    syntax: string;
+    examples: string[];
+    requiredCapabilities: CapabilityRef[];
+    requiredZones?: string[];
+    relatedConcepts: string[];
+    safeForAgents: boolean;
+    riskTier: CapabilityRiskTier;
+    requiresApproval: boolean;
+    sideEffects: string;
+    reach?: CapabilityReach;
+    authorityEffect?: CapabilityAuthorityEffect;
+    defaultBaselineOrgRole?: OrgRole;
+    outputSchema?: JsonSchemaRefStub;
+}
+export declare const ShellCommandDescriptorSchema: z.ZodType<ShellCommandDescriptor>;
+//# sourceMappingURL=shell-command-descriptor.d.ts.map

package/dist/capability/lib/shell-command-descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-command-descriptor.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/shell-command-descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAQ3D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,uBAAuB,EAE9B,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AA2FnC,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oBAAoB,EAAE,aAAa,EAAE,CAAC;IAMtC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAMzB,eAAe,EAAE,MAAM,EAAE,CAAC;IAwB1B,aAAa,EAAE,OAAO,CAAC;IAYvB,QAAQ,EAAE,kBAAkB,CAAC;IAa7B,gBAAgB,EAAE,OAAO,CAAC;IAQ1B,WAAW,EAAE,MAAM,CAAC;IAYpB,KAAK,CAAC,EAAE,eAAe,CAAC;IAexB,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAsB5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAED,eAAO,MAAM,4BAA4B,EAmBnC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/capability/lib/shell-command-descriptor.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShellCommandDescriptorSchema = exports.JsonSchemaRefStubSchema = void 0;
+const zod_1 = require("zod");
+const capability_ref_1 = require("./capability-ref");
+const authority_effect_1 = require("./authority-effect");
+const capability_reach_1 = require("./capability-reach");
+const permission_profile_1 = require("./permission-profile");
+const tenant_1 = require("../../tenant");
+exports.JsonSchemaRefStubSchema = zod_1.z.object({
+    $ref: zod_1.z.string().min(1),
+});
+exports.ShellCommandDescriptorSchema = zod_1.z.object({
+    name: zod_1.z.string().min(1),
+    summary: zod_1.z.string().min(1),
+    syntax: zod_1.z.string().min(1),
+    examples: zod_1.z.array(zod_1.z.string().min(1)),
+    requiredCapabilities: zod_1.z.array(capability_ref_1.CapabilityRefSchema),
+    requiredZones: zod_1.z.array(zod_1.z.string().min(1)).optional(),
+    relatedConcepts: zod_1.z.array(zod_1.z.string().min(1)),
+    safeForAgents: zod_1.z.boolean(),
+    riskTier: permission_profile_1.CapabilityRiskTierSchema,
+    requiresApproval: zod_1.z.boolean(),
+    sideEffects: zod_1.z.string().min(1).max(1000),
+    reach: capability_reach_1.CapabilityReachSchema.optional(),
+    authorityEffect: authority_effect_1.CapabilityAuthorityEffectSchema.optional(),
+    defaultBaselineOrgRole: tenant_1.OrgRoleSchema.optional(),
+    outputSchema: exports.JsonSchemaRefStubSchema.optional(),
+});
+//# sourceMappingURL=shell-command-descriptor.js.map

package/dist/capability/lib/shell-command-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-command-descriptor.js","sourceRoot":"","sources":["../../../src/capability/lib/shell-command-descriptor.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,qDAA2E;AAC3E,yDAG4B;AAC5B,yDAG4B;AAC5B,6DAG8B;AAC9B,yCAA2D;AAY9C,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAiC,CAAC;AA0NtB,QAAA,4BAA4B,GAAG,OAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpC,oBAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,oCAAmB,CAAC;IAClD,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3C,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE;IAC1B,QAAQ,EAAE,6CAAwB;IAClC,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE;IAI7B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,KAAK,EAAE,wCAAqB,CAAC,QAAQ,EAAE;IACvC,eAAe,EAAE,kDAA+B,CAAC,QAAQ,EAAE;IAC3D,sBAAsB,EAAE,sBAAa,CAAC,QAAQ,EAAE;IAChD,YAAY,EAAE,+BAAuB,CAAC,QAAQ,EAAE;CACjD,CAAsC,CAAC"}

package/dist/capability/lib/trusted-context-projection.d.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+export declare const TRUSTED_OPERATION_CONTEXT_ENVELOPE_FIELD: "trustedOperationContext";
+export declare function declaresReservedTrustedOperationContextField(value: unknown): boolean;
+export declare enum TrustedContextProjectionProfile {
+    CriticalOperationV1 = "critical-operation-v1"
+}
+export declare const TrustedContextProjectionProfileSchema: z.ZodEnum<typeof TrustedContextProjectionProfile>;
+export declare enum TrustedContextProjectionDelivery {
+    ServerEnvelope = "server-envelope"
+}
+export declare const TrustedContextProjectionDeliverySchema: z.ZodEnum<typeof TrustedContextProjectionDelivery>;
+export interface TrustedContextProjection {
+    readonly schemaVersion: 1;
+    readonly profile: TrustedContextProjectionProfile;
+    readonly delivery: TrustedContextProjectionDelivery.ServerEnvelope;
+}
+export declare const TrustedContextProjectionSchema: z.ZodType<TrustedContextProjection>;
+//# sourceMappingURL=trusted-context-projection.d.ts.map

package/dist/capability/lib/trusted-context-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-context-projection.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/trusted-context-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,wCAAwC,EACnD,yBAAkC,CAAC;AAWrC,wBAAgB,4CAA4C,CAC1D,KAAK,EAAE,OAAO,GACb,OAAO,CAOT;AAGD,oBAAY,+BAA+B;IAoGzC,mBAAmB,0BAA0B;CAC9C;AAED,eAAO,MAAM,qCAAqC,mDAEjD,CAAC;AAGF,oBAAY,gCAAgC;IAC1C,cAAc,oBAAoB;CACnC;AAED,eAAO,MAAM,sCAAsC,oDAElD,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC,cAAc,CAAC;CACpE;AAED,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAOlE,CAAC"}

package/dist/capability/lib/trusted-context-projection.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedContextProjectionSchema = exports.TrustedContextProjectionDeliverySchema = exports.TrustedContextProjectionDelivery = exports.TrustedContextProjectionProfileSchema = exports.TrustedContextProjectionProfile = exports.TRUSTED_OPERATION_CONTEXT_ENVELOPE_FIELD = void 0;
+exports.declaresReservedTrustedOperationContextField = declaresReservedTrustedOperationContextField;
+const zod_1 = require("zod");
+exports.TRUSTED_OPERATION_CONTEXT_ENVELOPE_FIELD = 'trustedOperationContext';
+function declaresReservedTrustedOperationContextField(value) {
+    return (value !== null &&
+        typeof value === 'object' &&
+        !Array.isArray(value) &&
+        exports.TRUSTED_OPERATION_CONTEXT_ENVELOPE_FIELD in value);
+}
+var TrustedContextProjectionProfile;
+(function (TrustedContextProjectionProfile) {
+    TrustedContextProjectionProfile["CriticalOperationV1"] = "critical-operation-v1";
+})(TrustedContextProjectionProfile || (exports.TrustedContextProjectionProfile = TrustedContextProjectionProfile = {}));
+exports.TrustedContextProjectionProfileSchema = zod_1.z.nativeEnum(TrustedContextProjectionProfile);
+var TrustedContextProjectionDelivery;
+(function (TrustedContextProjectionDelivery) {
+    TrustedContextProjectionDelivery["ServerEnvelope"] = "server-envelope";
+})(TrustedContextProjectionDelivery || (exports.TrustedContextProjectionDelivery = TrustedContextProjectionDelivery = {}));
+exports.TrustedContextProjectionDeliverySchema = zod_1.z.nativeEnum(TrustedContextProjectionDelivery);
+exports.TrustedContextProjectionSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    profile: exports.TrustedContextProjectionProfileSchema,
+    delivery: zod_1.z.literal(TrustedContextProjectionDelivery.ServerEnvelope),
+})
+    .strict();
+//# sourceMappingURL=trusted-context-projection.js.map

package/dist/capability/lib/trusted-context-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-context-projection.js","sourceRoot":"","sources":["../../../src/capability/lib/trusted-context-projection.ts"],"names":[],"mappings":";;;AAmBA,oGASC;AA5BD,6BAAwB;AAOX,QAAA,wCAAwC,GACnD,yBAAkC,CAAC;AAWrC,SAAgB,4CAA4C,CAC1D,KAAc;IAEd,OAAO,CACL,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,gDAAwC,IAAI,KAAK,CAClD,CAAC;AACJ,CAAC;AAGD,IAAY,+BAqGX;AArGD,WAAY,+BAA+B;IAoGzC,gFAA6C,CAAA;AAC/C,CAAC,EArGW,+BAA+B,+CAA/B,+BAA+B,QAqG1C;AAEY,QAAA,qCAAqC,GAAG,OAAC,CAAC,UAAU,CAC/D,+BAA+B,CAChC,CAAC;AAGF,IAAY,gCAEX;AAFD,WAAY,gCAAgC;IAC1C,sEAAkC,CAAA;AACpC,CAAC,EAFW,gCAAgC,gDAAhC,gCAAgC,QAE3C;AAEY,QAAA,sCAAsC,GAAG,OAAC,CAAC,UAAU,CAChE,gCAAgC,CACjC,CAAC;AAQW,QAAA,8BAA8B,GACzC,OAAC;KACE,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,6CAAqC;IAC9C,QAAQ,EAAE,OAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC,cAAc,CAAC;CACrE,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/capability-projection/index.d.ts

@@ -0,0 +1,4 @@
+export * from './lib/capability-invocation-binding';
+export * from './lib/capability-sync-manifest';
+export * from './lib/projected-capability';
+//# sourceMappingURL=index.d.ts.map

package/dist/capability-projection/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability-projection/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC;AACpD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC"}

package/dist/capability-projection/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/capability-invocation-binding"), exports);
+__exportStar(require("./lib/capability-sync-manifest"), exports);
+__exportStar(require("./lib/projected-capability"), exports);
+//# sourceMappingURL=index.js.map

package/dist/capability-projection/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability-projection/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sEAAoD;AACpD,iEAA+C;AAC/C,6DAA2C"}