@xemahq/contracts 0.1.0

package/dist/policy/lib/obligations.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyObligationSchema = exports.EgressAllowlistObligationSchema = exports.DataResidencyObligationSchema = exports.RestrictOutputClassificationObligationSchema = exports.MaxCostUsdObligationSchema = exports.MaxDurationSecondsObligationSchema = exports.RequireHumanApprovalObligationSchema = exports.RequireRunnerKindObligationSchema = exports.RedactSecretsObligationSchema = exports.AuditObligationSchema = exports.DataResidencySchema = exports.DataResidency = exports.RunnerKindSchema = exports.RunnerKind = exports.PolicyObligationKindSchema = exports.PolicyObligationKind = void 0;
+const zod_1 = require("zod");
+const space_1 = require("../../space");
+var PolicyObligationKind;
+(function (PolicyObligationKind) {
+    PolicyObligationKind["Audit"] = "audit";
+    PolicyObligationKind["RedactSecrets"] = "redact-secrets";
+    PolicyObligationKind["RequireRunnerKind"] = "require-runner-kind";
+    PolicyObligationKind["RequireHumanApproval"] = "require-human-approval";
+    PolicyObligationKind["MaxDurationSeconds"] = "max-duration-seconds";
+    PolicyObligationKind["MaxCostUsd"] = "max-cost-usd";
+    PolicyObligationKind["RestrictOutputClassification"] = "restrict-output-classification";
+    PolicyObligationKind["DataResidency"] = "data-residency";
+    PolicyObligationKind["EgressAllowlist"] = "egress-allowlist";
+})(PolicyObligationKind || (exports.PolicyObligationKind = PolicyObligationKind = {}));
+exports.PolicyObligationKindSchema = zod_1.z.nativeEnum(PolicyObligationKind);
+var RunnerKind;
+(function (RunnerKind) {
+    RunnerKind["Local"] = "local";
+    RunnerKind["Cloud"] = "cloud";
+    RunnerKind["CustomerEdge"] = "customer-edge";
+    RunnerKind["GPU"] = "gpu";
+    RunnerKind["Sandbox"] = "sandbox";
+    RunnerKind["CI"] = "ci";
+    RunnerKind["McpExternal"] = "mcp-external";
+})(RunnerKind || (exports.RunnerKind = RunnerKind = {}));
+exports.RunnerKindSchema = zod_1.z.nativeEnum(RunnerKind);
+var DataResidency;
+(function (DataResidency) {
+    DataResidency["CustomerPrivate"] = "customer-private";
+})(DataResidency || (exports.DataResidency = DataResidency = {}));
+exports.DataResidencySchema = zod_1.z.nativeEnum(DataResidency);
+exports.AuditObligationSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(PolicyObligationKind.Audit),
+})
+    .strict();
+exports.RedactSecretsObligationSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(PolicyObligationKind.RedactSecrets),
+})
+    .strict();
+exports.RequireRunnerKindObligationSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(PolicyObligationKind.RequireRunnerKind),
+    runnerKind: exports.RunnerKindSchema,
+})
+    .strict();
+exports.RequireHumanApprovalObligationSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(PolicyObligationKind.RequireHumanApproval),
+    approverRole: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+exports.MaxDurationSecondsObligationSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(PolicyObligationKind.MaxDurationSeconds),
+    maxDurationSeconds: zod_1.z.number().int().positive(),
+})
+    .strict();
+exports.MaxCostUsdObligationSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(PolicyObligationKind.MaxCostUsd),
+    maxCostUsd: zod_1.z.number().positive(),
+})
+    .strict();
+exports.RestrictOutputClassificationObligationSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(PolicyObligationKind.RestrictOutputClassification),
+    maxClassification: space_1.DataClassificationSchema,
+})
+    .strict();
+exports.DataResidencyObligationSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(PolicyObligationKind.DataResidency),
+    residency: exports.DataResidencySchema,
+})
+    .strict();
+const EGRESS_PATTERN = zod_1.z
+    .string()
+    .min(1)
+    .refine((p) => !/[\s@#?]/.test(p), {
+    message: 'egress pattern must not contain whitespace, "@", "#" or "?" (those belong to the target URL, not the rule)',
+});
+exports.EgressAllowlistObligationSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(PolicyObligationKind.EgressAllowlist),
+    allow: zod_1.z.array(EGRESS_PATTERN).min(1).readonly(),
+    deny: zod_1.z.array(EGRESS_PATTERN).readonly().optional(),
+})
+    .strict();
+exports.PolicyObligationSchema = zod_1.z.discriminatedUnion('kind', [
+    exports.AuditObligationSchema,
+    exports.RedactSecretsObligationSchema,
+    exports.RequireRunnerKindObligationSchema,
+    exports.RequireHumanApprovalObligationSchema,
+    exports.MaxDurationSecondsObligationSchema,
+    exports.MaxCostUsdObligationSchema,
+    exports.RestrictOutputClassificationObligationSchema,
+    exports.DataResidencyObligationSchema,
+    exports.EgressAllowlistObligationSchema,
+]);
+//# sourceMappingURL=obligations.js.map

package/dist/policy/lib/obligations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obligations.js","sourceRoot":"","sources":["../../../src/policy/lib/obligations.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,uCAAuD;AAUvD,IAAY,oBAkBX;AAlBD,WAAY,oBAAoB;IAC9B,uCAAe,CAAA;IACf,wDAAgC,CAAA;IAChC,iEAAyC,CAAA;IACzC,uEAA+C,CAAA;IAC/C,mEAA2C,CAAA;IAC3C,mDAA2B,CAAA;IAC3B,uFAA+D,CAAA;IAC/D,wDAAgC,CAAA;IAShC,4DAAoC,CAAA;AACtC,CAAC,EAlBW,oBAAoB,oCAApB,oBAAoB,QAkB/B;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAY7E,IAAY,UAeX;AAfD,WAAY,UAAU;IACpB,6BAAe,CAAA;IACf,6BAAe,CAAA;IACf,4CAA8B,CAAA;IAC9B,yBAAW,CAAA;IACX,iCAAmB,CAAA;IACnB,uBAAS,CAAA;IAQT,0CAA4B,CAAA;AAC9B,CAAC,EAfW,UAAU,0BAAV,UAAU,QAerB;AAEY,QAAA,gBAAgB,GAAG,OAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAqCzD,IAAY,aAEX;AAFD,WAAY,aAAa;IACvB,qDAAoC,CAAA;AACtC,CAAC,EAFW,aAAa,6BAAb,aAAa,QAExB;AAEY,QAAA,mBAAmB,GAAG,OAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAUlD,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAGC,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,aAAa,CAAC;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,iBAAiB,CAAC;IACvD,UAAU,EAAE,wBAAgB;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,oCAAoC,GAAG,OAAC;KAClD,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,oBAAoB,CAAC;IAE1D,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;IACxD,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,UAAU,CAAC;IAChD,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAGC,QAAA,4CAA4C,GAAG,OAAC;KAC1D,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,4BAA4B,CAAC;IAClE,iBAAiB,EAAE,gCAAwB;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,aAAa,CAAC;IACnD,SAAS,EAAE,2BAAmB;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AA4BZ,MAAM,cAAc,GAAG,OAAC;KACrB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KAIN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACjC,OAAO,EACL,4GAA4G;CAC/G,CAAC,CAAC;AAEQ,QAAA,+BAA+B,GAAG,OAAC;KAC7C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,eAAe,CAAC;IAQrD,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEhD,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAYC,QAAA,sBAAsB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,6BAAqB;IACrB,qCAA6B;IAC7B,yCAAiC;IACjC,4CAAoC;IACpC,0CAAkC;IAClC,kCAA0B;IAC1B,oDAA4C;IAC5C,qCAA6B;IAC7B,uCAA+B;CAChC,CAAC,CAAC"}

package/dist/policy/lib/policy-decision-record.d.ts

@@ -0,0 +1,46 @@
+import { z } from 'zod';
+import { PolicyDecisionKind } from '../../policy-decision';
+import { SubjectKind } from '../../subject';
+interface PolicyDecisionRecordShape {
+    readonly executionContextId: string;
+    readonly requestId: string;
+    readonly traceId: string;
+    readonly outcome: Exclude<PolicyDecisionKind, PolicyDecisionKind.Allow>;
+    readonly reason: string;
+    readonly subject: {
+        readonly kind: SubjectKind;
+        readonly id: string;
+    };
+    readonly capabilityRef: string;
+    readonly resourceRef?: string;
+    readonly spaceRef: string;
+    readonly orgId: string;
+    readonly projectId?: string;
+    readonly environment: string;
+    readonly occurredAt: string;
+}
+export declare const PolicyDecisionRecordSchema: z.ZodObject<{
+    executionContextId: z.ZodString;
+    requestId: z.ZodString;
+    traceId: z.ZodString;
+    outcome: z.ZodEnum<typeof PolicyDecisionKind> & z.ZodType<PolicyDecisionKind.Deny | PolicyDecisionKind.NeedsApproval, PolicyDecisionKind, z.core.$ZodTypeInternals<PolicyDecisionKind.Deny | PolicyDecisionKind.NeedsApproval, PolicyDecisionKind>>;
+    reason: z.ZodString;
+    subject: z.ZodObject<{
+        kind: z.ZodEnum<typeof SubjectKind>;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    capabilityRef: z.ZodString;
+    resourceRef: z.ZodOptional<z.ZodString>;
+    spaceRef: z.ZodString;
+    orgId: z.ZodString;
+    projectId: z.ZodOptional<z.ZodString>;
+    environment: z.ZodString;
+    occurredAt: z.ZodString;
+}, z.core.$strict>;
+export type PolicyDecisionRecord = z.infer<typeof PolicyDecisionRecordSchema>;
+type _AssertNoStrayField<T extends never> = T;
+type _DocumentedButNotInSchema = _AssertNoStrayField<Exclude<keyof PolicyDecisionRecordShape, keyof PolicyDecisionRecord>>;
+type _InSchemaButNotDocumented = _AssertNoStrayField<Exclude<keyof PolicyDecisionRecord, keyof PolicyDecisionRecordShape>>;
+export type { _DocumentedButNotInSchema, _InSchemaButNotDocumented };
+export declare const POLICY_DECISION_RECORDED_EVENT_TYPE = "authorization.decision.evaluated";
+//# sourceMappingURL=policy-decision-record.d.ts.map

package/dist/policy/lib/policy-decision-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-decision-record.d.ts","sourceRoot":"","sources":["../../../src/policy/lib/policy-decision-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,kBAAkB,EAEnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAqB,MAAM,eAAe,CAAC;AAgD/D,UAAU,yBAAyB;IASjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAMpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAQzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAWxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAM9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAa1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAsBD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;kBAqB5B,CAAC;AAmBZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAe9E,KAAK,mBAAmB,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;AAC9C,KAAK,yBAAyB,GAAG,mBAAmB,CAClD,OAAO,CAAC,MAAM,yBAAyB,EAAE,MAAM,oBAAoB,CAAC,CACrE,CAAC;AACF,KAAK,yBAAyB,GAAG,mBAAmB,CAClD,OAAO,CAAC,MAAM,oBAAoB,EAAE,MAAM,yBAAyB,CAAC,CACrE,CAAC;AACF,YAAY,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,CAAC;AAWrE,eAAO,MAAM,mCAAmC,qCACZ,CAAC"}

package/dist/policy/lib/policy-decision-record.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POLICY_DECISION_RECORDED_EVENT_TYPE = exports.PolicyDecisionRecordSchema = void 0;
+const zod_1 = require("zod");
+const policy_decision_1 = require("../../policy-decision");
+const subject_1 = require("../../subject");
+const PolicyDecisionRecordOutcomeSchema = policy_decision_1.PolicyDecisionKindSchema.refine((kind) => kind !== policy_decision_1.PolicyDecisionKind.Allow, {
+    message: 'A PolicyDecisionRecord never carries `allow`: an allow is recorded by ' +
+        'the PEP that executed it, together with the execution hashes the PDP ' +
+        'cannot know.',
+});
+exports.PolicyDecisionRecordSchema = zod_1.z
+    .object({
+    executionContextId: zod_1.z.string().min(1),
+    requestId: zod_1.z.string().min(1),
+    traceId: zod_1.z.string().min(1),
+    outcome: PolicyDecisionRecordOutcomeSchema,
+    reason: zod_1.z.string().min(1),
+    subject: zod_1.z
+        .object({
+        kind: subject_1.SubjectKindSchema,
+        id: zod_1.z.string().min(1),
+    })
+        .strict(),
+    capabilityRef: zod_1.z.string().min(1),
+    resourceRef: zod_1.z.string().min(1).optional(),
+    spaceRef: zod_1.z.string().min(1),
+    orgId: zod_1.z.string().min(1),
+    projectId: zod_1.z.string().min(1).optional(),
+    environment: zod_1.z.string().min(1),
+    occurredAt: zod_1.z.string().min(1),
+})
+    .strict();
+exports.POLICY_DECISION_RECORDED_EVENT_TYPE = 'authorization.decision.evaluated';
+//# sourceMappingURL=policy-decision-record.js.map

package/dist/policy/lib/policy-decision-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-decision-record.js","sourceRoot":"","sources":["../../../src/policy/lib/policy-decision-record.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,2DAG+B;AAC/B,2CAA+D;AAiI/D,MAAM,iCAAiC,GAAG,0CAAwB,CAAC,MAAM,CACvE,CAAC,IAAI,EAAiE,EAAE,CACtE,IAAI,KAAK,oCAAkB,CAAC,KAAK,EACnC;IACE,OAAO,EACL,wEAAwE;QACxE,uEAAuE;QACvE,cAAc;CACjB,CACF,CAAC;AAEW,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,IAAI,EAAE,2BAAiB;QACvB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACtB,CAAC;SACD,MAAM,EAAE;IACX,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAoDC,QAAA,mCAAmC,GAC9C,kCAAkC,CAAC"}

package/dist/policy/lib/policy.d.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+import { type ExecutionContext } from '../../execution-context';
+import { type PolicyObligation } from './obligations';
+import { type RouteHint } from './route-hints';
+import { PolicyDecisionKind, PolicyDecisionKindSchema } from '../../policy-decision';
+export { PolicyDecisionKind, PolicyDecisionKindSchema };
+export declare enum CredentialPrecedenceSource {
+    Explicit = "explicit",
+    CapabilityDefault = "capability_default",
+    UserDefault = "user_default",
+    ProjectDefault = "project_default",
+    OrgDefault = "org_default",
+    PlatformDefault = "platform_default"
+}
+export declare const CredentialPrecedenceSourceSchema: z.ZodEnum<typeof CredentialPrecedenceSource>;
+export type PolicyRequest = ExecutionContext;
+export declare const PolicyRequestSchema: z.ZodType<PolicyRequest>;
+export interface PolicyDecision {
+    kind: PolicyDecisionKind;
+    reason?: string;
+    obligations?: readonly PolicyObligation[];
+    routeHints?: RouteHint;
+    credentialBindingId?: string;
+    credentialPrecedenceApplied?: CredentialPrecedenceSource;
+}
+export declare const PolicyDecisionSchema: z.ZodType<PolicyDecision>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy/lib/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/policy/lib/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAU/B,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;AAiBxD,oBAAY,0BAA0B;IACpC,QAAQ,aAAa;IACrB,iBAAiB,uBAAuB;IASxC,WAAW,iBAAiB;IAC5B,cAAc,oBAAoB;IAClC,UAAU,gBAAgB;IAK1B,eAAe,qBAAqB;CACrC;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAWF,MAAM,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE7C,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CACjC,CAAC;AAkBzB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC1C,UAAU,CAAC,EAAE,SAAS,CAAC;IAWvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAM7B,2BAA2B,CAAC,EAAE,0BAA0B,CAAC;CAC1D;AAED,eAAO,MAAM,oBAAoB,EASlB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC"}

package/dist/policy/lib/policy.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyDecisionSchema = exports.PolicyRequestSchema = exports.CredentialPrecedenceSourceSchema = exports.CredentialPrecedenceSource = exports.PolicyDecisionKindSchema = exports.PolicyDecisionKind = void 0;
+const zod_1 = require("zod");
+const execution_context_1 = require("../../execution-context");
+const obligations_1 = require("./obligations");
+const route_hints_1 = require("./route-hints");
+const policy_decision_1 = require("../../policy-decision");
+Object.defineProperty(exports, "PolicyDecisionKind", { enumerable: true, get: function () { return policy_decision_1.PolicyDecisionKind; } });
+Object.defineProperty(exports, "PolicyDecisionKindSchema", { enumerable: true, get: function () { return policy_decision_1.PolicyDecisionKindSchema; } });
+var CredentialPrecedenceSource;
+(function (CredentialPrecedenceSource) {
+    CredentialPrecedenceSource["Explicit"] = "explicit";
+    CredentialPrecedenceSource["CapabilityDefault"] = "capability_default";
+    CredentialPrecedenceSource["UserDefault"] = "user_default";
+    CredentialPrecedenceSource["ProjectDefault"] = "project_default";
+    CredentialPrecedenceSource["OrgDefault"] = "org_default";
+    CredentialPrecedenceSource["PlatformDefault"] = "platform_default";
+})(CredentialPrecedenceSource || (exports.CredentialPrecedenceSource = CredentialPrecedenceSource = {}));
+exports.CredentialPrecedenceSourceSchema = zod_1.z.nativeEnum(CredentialPrecedenceSource);
+exports.PolicyRequestSchema = execution_context_1.ExecutionContextSchema;
+exports.PolicyDecisionSchema = zod_1.z
+    .object({
+    kind: policy_decision_1.PolicyDecisionKindSchema,
+    reason: zod_1.z.string().min(1).optional(),
+    obligations: zod_1.z.array(obligations_1.PolicyObligationSchema).readonly().optional(),
+    routeHints: route_hints_1.RouteHintSchema.optional(),
+    credentialBindingId: zod_1.z.string().min(1).optional(),
+    credentialPrecedenceApplied: exports.CredentialPrecedenceSourceSchema.optional(),
+})
+    .strict();
+//# sourceMappingURL=policy.js.map

package/dist/policy/lib/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/policy/lib/policy.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,+DAGiC;AACjC,+CAA8E;AAC9E,+CAAgE;AAChE,2DAG+B;AAUtB,mGAZP,oCAAkB,OAYO;AAAE,yGAX3B,0CAAwB,OAW2B;AAiBrD,IAAY,0BAmBX;AAnBD,WAAY,0BAA0B;IACpC,mDAAqB,CAAA;IACrB,sEAAwC,CAAA;IASxC,0DAA4B,CAAA;IAC5B,gEAAkC,CAAA;IAClC,wDAA0B,CAAA;IAK1B,kEAAoC,CAAA;AACtC,CAAC,EAnBW,0BAA0B,0CAA1B,0BAA0B,QAmBrC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAaW,QAAA,mBAAmB,GAC9B,0CAAsB,CAAC;AA0CZ,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,0CAAwB;IAC9B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,oCAAsB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClE,UAAU,EAAE,6BAAe,CAAC,QAAQ,EAAE;IACtC,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,2BAA2B,EAAE,wCAAgC,CAAC,QAAQ,EAAE;CACzE,CAAC;KACD,MAAM,EAA+B,CAAC"}

package/dist/policy/lib/route-hints.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+import { RunnerKind } from './obligations';
+export interface RouteHint {
+    requiredRunnerLabels?: Record<string, string>;
+    preferredRunnerKind?: RunnerKind;
+    requiredRegion?: string;
+    requireCustomerEdge?: boolean;
+}
+export declare const RouteHintSchema: z.ZodType<RouteHint>;
+export { RunnerKind, RunnerKindSchema } from './obligations';
+//# sourceMappingURL=route-hints.d.ts.map

package/dist/policy/lib/route-hints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-hints.d.ts","sourceRoot":"","sources":["../../../src/policy/lib/route-hints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAoB,MAAM,eAAe,CAAC;AAW7D,MAAM,WAAW,SAAS;IAMxB,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAQ9C,mBAAmB,CAAC,EAAE,UAAU,CAAC;IAMjC,cAAc,CAAC,EAAE,MAAM,CAAC;IAQxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,eAAO,MAAM,eAAe,EASb,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/policy/lib/route-hints.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerKindSchema = exports.RunnerKind = exports.RouteHintSchema = void 0;
+const zod_1 = require("zod");
+const obligations_1 = require("./obligations");
+exports.RouteHintSchema = zod_1.z
+    .object({
+    requiredRunnerLabels: zod_1.z
+        .record(zod_1.z.string().min(1), zod_1.z.string().min(1))
+        .optional(),
+    preferredRunnerKind: obligations_1.RunnerKindSchema.optional(),
+    requiredRegion: zod_1.z.string().min(1).optional(),
+    requireCustomerEdge: zod_1.z.boolean().optional(),
+})
+    .strict();
+var obligations_2 = require("./obligations");
+Object.defineProperty(exports, "RunnerKind", { enumerable: true, get: function () { return obligations_2.RunnerKind; } });
+Object.defineProperty(exports, "RunnerKindSchema", { enumerable: true, get: function () { return obligations_2.RunnerKindSchema; } });
+//# sourceMappingURL=route-hints.js.map

package/dist/policy/lib/route-hints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-hints.js","sourceRoot":"","sources":["../../../src/policy/lib/route-hints.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,+CAA6D;AA0ChD,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,oBAAoB,EAAE,OAAC;SACpB,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC5C,QAAQ,EAAE;IACb,mBAAmB,EAAE,8BAAgB,CAAC,QAAQ,EAAE;IAChD,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,mBAAmB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAA0B,CAAC;AAEpC,6CAA6D;AAApD,yGAAA,UAAU,OAAA;AAAE,+GAAA,gBAAgB,OAAA"}

package/dist/policy/lib/space-classification-parameter.d.ts

@@ -0,0 +1,5 @@
+import { type DeclaredParameter, type EffectiveValue, type ParameterChainEntry } from '../../declared-parameter';
+import { DataClassification } from '../../space';
+export declare const SPACE_CLASSIFICATION_PARAMETER: DeclaredParameter<DataClassification>;
+export declare function resolveSpaceClassificationChain(chain: readonly ParameterChainEntry<DataClassification>[]): EffectiveValue<DataClassification>;
+//# sourceMappingURL=space-classification-parameter.d.ts.map

package/dist/policy/lib/space-classification-parameter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-classification-parameter.d.ts","sourceRoot":"","sources":["../../../src/policy/lib/space-classification-parameter.ts"],"names":[],"mappings":"AAuCA,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EAEzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAsB,MAAM,aAAa,CAAC;AAqBrE,eAAO,MAAM,8BAA8B,EAAE,iBAAiB,CAAC,kBAAkB,CAM7E,CAAC;AAeL,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,SAAS,mBAAmB,CAAC,kBAAkB,CAAC,EAAE,GACxD,cAAc,CAAC,kBAAkB,CAAC,CAEpC"}

package/dist/policy/lib/space-classification-parameter.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SPACE_CLASSIFICATION_PARAMETER = void 0;
+exports.resolveSpaceClassificationChain = resolveSpaceClassificationChain;
+const declared_parameter_1 = require("../../declared-parameter");
+const space_1 = require("../../space");
+exports.SPACE_CLASSIFICATION_PARAMETER = Object.freeze({
+    key: 'space.classification',
+    platformDefault: space_1.DataClassification.Public,
+    combine: (outer, inner) => (0, space_1.joinClassification)(outer, inner),
+});
+function resolveSpaceClassificationChain(chain) {
+    return (0, declared_parameter_1.resolveDeclaredParameter)(exports.SPACE_CLASSIFICATION_PARAMETER, chain);
+}
+//# sourceMappingURL=space-classification-parameter.js.map

package/dist/policy/lib/space-classification-parameter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-classification-parameter.js","sourceRoot":"","sources":["../../../src/policy/lib/space-classification-parameter.ts"],"names":[],"mappings":";;;AAuFA,0EAIC;AApDD,iEAKkC;AAClC,uCAAqE;AAqBxD,QAAA,8BAA8B,GACzC,MAAM,CAAC,MAAM,CAAC;IACZ,GAAG,EAAE,sBAAsB;IAC3B,eAAe,EAAE,0BAAkB,CAAC,MAAM;IAC1C,OAAO,EAAE,CAAC,KAAyB,EAAE,KAAyB,EAAE,EAAE,CAChE,IAAA,0BAAkB,EAAC,KAAK,EAAE,KAAK,CAAC;CACnC,CAAC,CAAC;AAeL,SAAgB,+BAA+B,CAC7C,KAAyD;IAEzD,OAAO,IAAA,6CAAwB,EAAC,sCAA8B,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC"}

package/dist/policy-decision/index.d.ts

@@ -0,0 +1,2 @@
+export * from './lib/policy-decision-kind';
+//# sourceMappingURL=index.d.ts.map

package/dist/policy-decision/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy-decision/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC"}

package/dist/policy-decision/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/policy-decision-kind"), exports);
+//# sourceMappingURL=index.js.map

package/dist/policy-decision/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy-decision/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6DAA2C"}

package/dist/policy-decision/lib/policy-decision-kind.d.ts

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+export declare enum PolicyDecisionKind {
+    Allow = "allow",
+    Deny = "deny",
+    NeedsApproval = "needs_approval"
+}
+export declare const PolicyDecisionKindSchema: z.ZodEnum<typeof PolicyDecisionKind>;
+//# sourceMappingURL=policy-decision-kind.d.ts.map

package/dist/policy-decision/lib/policy-decision-kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-decision-kind.d.ts","sourceRoot":"","sources":["../../../src/policy-decision/lib/policy-decision-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgCxB,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,IAAI,SAAS;IACb,aAAa,mBAAmB;CACjC;AAED,eAAO,MAAM,wBAAwB,sCAAmC,CAAC"}

package/dist/policy-decision/lib/policy-decision-kind.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyDecisionKindSchema = exports.PolicyDecisionKind = void 0;
+const zod_1 = require("zod");
+var PolicyDecisionKind;
+(function (PolicyDecisionKind) {
+    PolicyDecisionKind["Allow"] = "allow";
+    PolicyDecisionKind["Deny"] = "deny";
+    PolicyDecisionKind["NeedsApproval"] = "needs_approval";
+})(PolicyDecisionKind || (exports.PolicyDecisionKind = PolicyDecisionKind = {}));
+exports.PolicyDecisionKindSchema = zod_1.z.nativeEnum(PolicyDecisionKind);
+//# sourceMappingURL=policy-decision-kind.js.map

package/dist/policy-decision/lib/policy-decision-kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-decision-kind.js","sourceRoot":"","sources":["../../../src/policy-decision/lib/policy-decision-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAgCxB,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mCAAa,CAAA;IACb,sDAAgC,CAAA;AAClC,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAEY,QAAA,wBAAwB,GAAG,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC"}

package/dist/principal/index.d.ts

@@ -0,0 +1,6 @@
+export * from './lib/delegation-grant';
+export * from './lib/delegation-chain';
+export * from './lib/clamp-authority';
+export * from './lib/execution-principal';
+export * from './lib/app-invocation-identity';
+//# sourceMappingURL=index.d.ts.map

package/dist/principal/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/principal/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC"}

package/dist/principal/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/delegation-grant"), exports);
+__exportStar(require("./lib/delegation-chain"), exports);
+__exportStar(require("./lib/clamp-authority"), exports);
+__exportStar(require("./lib/execution-principal"), exports);
+__exportStar(require("./lib/app-invocation-identity"), exports);
+//# sourceMappingURL=index.js.map

package/dist/principal/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/principal/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,yDAAuC;AACvC,wDAAsC;AACtC,4DAA0C;AAC1C,gEAA8C"}

package/dist/principal/lib/app-invocation-identity.d.ts

@@ -0,0 +1,22 @@
+import { z } from 'zod';
+import { type SubjectRef } from '../../subject';
+export declare enum AppInvocationMode {
+    OnBehalfOfUser = "on-behalf-of-user",
+    AsApp = "as-app"
+}
+export declare const AppInvocationModeSchema: z.ZodEnum<typeof AppInvocationMode>;
+export interface OnBehalfOfUserIdentity {
+    mode: AppInvocationMode.OnBehalfOfUser;
+    user: SubjectRef;
+    appId: string;
+}
+export interface AsAppIdentity {
+    mode: AppInvocationMode.AsApp;
+    appId: string;
+}
+export type AppInvocationIdentity = OnBehalfOfUserIdentity | AsAppIdentity;
+export declare const OnBehalfOfUserIdentitySchema: z.ZodType<OnBehalfOfUserIdentity>;
+export declare const AsAppIdentitySchema: z.ZodType<AsAppIdentity>;
+export declare const AppInvocationIdentitySchema: z.ZodType<AppInvocationIdentity>;
+export declare function resolveInvocationActor(identity: AppInvocationIdentity): SubjectRef;
+//# sourceMappingURL=app-invocation-identity.d.ts.map

package/dist/principal/lib/app-invocation-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-invocation-identity.d.ts","sourceRoot":"","sources":["../../../src/principal/lib/app-invocation-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAmB/E,oBAAY,iBAAiB;IAE3B,cAAc,sBAAsB;IAEpC,KAAK,WAAW;CACjB;AAED,eAAO,MAAM,uBAAuB,qCAAkC,CAAC;AAMvE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,iBAAiB,CAAC,cAAc,CAAC;IAEvC,IAAI,EAAE,UAAU,CAAC;IAEjB,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC;IAE9B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,GAAG,aAAa,CAAC;AAa3E,eAAO,MAAM,4BAA4B,EAChB,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAE3D,eAAO,MAAM,mBAAmB,EAAiB,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AAE1E,eAAO,MAAM,2BAA2B,EAGlC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AASvC,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,qBAAqB,GAC9B,UAAU,CAOZ"}

package/dist/principal/lib/app-invocation-identity.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppInvocationIdentitySchema = exports.AsAppIdentitySchema = exports.OnBehalfOfUserIdentitySchema = exports.AppInvocationModeSchema = exports.AppInvocationMode = void 0;
+exports.resolveInvocationActor = resolveInvocationActor;
+const zod_1 = require("zod");
+const subject_1 = require("../../subject");
+var AppInvocationMode;
+(function (AppInvocationMode) {
+    AppInvocationMode["OnBehalfOfUser"] = "on-behalf-of-user";
+    AppInvocationMode["AsApp"] = "as-app";
+})(AppInvocationMode || (exports.AppInvocationMode = AppInvocationMode = {}));
+exports.AppInvocationModeSchema = zod_1.z.nativeEnum(AppInvocationMode);
+const onBehalfOfUserShape = zod_1.z.object({
+    mode: zod_1.z.literal(AppInvocationMode.OnBehalfOfUser),
+    user: subject_1.SubjectRefSchema,
+    appId: zod_1.z.string().min(1),
+});
+const asAppShape = zod_1.z.object({
+    mode: zod_1.z.literal(AppInvocationMode.AsApp),
+    appId: zod_1.z.string().min(1),
+});
+exports.OnBehalfOfUserIdentitySchema = onBehalfOfUserShape;
+exports.AsAppIdentitySchema = asAppShape;
+exports.AppInvocationIdentitySchema = zod_1.z.discriminatedUnion('mode', [
+    onBehalfOfUserShape,
+    asAppShape,
+]);
+function resolveInvocationActor(identity) {
+    switch (identity.mode) {
+        case AppInvocationMode.OnBehalfOfUser:
+            return identity.user;
+        case AppInvocationMode.AsApp:
+            return { kind: subject_1.SubjectKind.App, id: identity.appId };
+    }
+}
+//# sourceMappingURL=app-invocation-identity.js.map

package/dist/principal/lib/app-invocation-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-invocation-identity.js","sourceRoot":"","sources":["../../../src/principal/lib/app-invocation-identity.ts"],"names":[],"mappings":";;;AAiFA,wDASC;AA1FD,6BAAwB;AACxB,2CAA+E;AAmB/E,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAE3B,yDAAoC,CAAA;IAEpC,qCAAgB,CAAA;AAClB,CAAC,EALW,iBAAiB,iCAAjB,iBAAiB,QAK5B;AAEY,QAAA,uBAAuB,GAAG,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AA0BvE,MAAM,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC;IACjD,IAAI,EAAE,0BAAgB;IACtB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC;IACxC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEU,QAAA,4BAA4B,GACvC,mBAAwD,CAAC;AAE9C,QAAA,mBAAmB,GAAG,UAAsC,CAAC;AAE7D,QAAA,2BAA2B,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACtE,mBAAmB;IACnB,UAAU;CACX,CAAqC,CAAC;AASvC,SAAgB,sBAAsB,CACpC,QAA+B;IAE/B,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,iBAAiB,CAAC,cAAc;YACnC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,KAAK,iBAAiB,CAAC,KAAK;YAC1B,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/principal/lib/clamp-authority.d.ts

@@ -0,0 +1,4 @@
+import type { CapabilityRef } from '../../capability';
+export declare function clampAuthority(executorGrants: ReadonlySet<CapabilityRef>, actorEffective: ReadonlySet<CapabilityRef>): Set<CapabilityRef>;
+export declare function clampAuthorityChain(authoritySets: ReadonlyArray<ReadonlySet<CapabilityRef>>): Set<CapabilityRef>;
+//# sourceMappingURL=clamp-authority.d.ts.map

package/dist/principal/lib/clamp-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clamp-authority.d.ts","sourceRoot":"","sources":["../../../src/principal/lib/clamp-authority.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA4BtD,wBAAgB,cAAc,CAC5B,cAAc,EAAE,WAAW,CAAC,aAAa,CAAC,EAC1C,cAAc,EAAE,WAAW,CAAC,aAAa,CAAC,GACzC,GAAG,CAAC,aAAa,CAAC,CAapB;AASD,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,aAAa,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,GACvD,GAAG,CAAC,aAAa,CAAC,CAQpB"}

package/dist/principal/lib/clamp-authority.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clampAuthority = clampAuthority;
+exports.clampAuthorityChain = clampAuthorityChain;
+function clampAuthority(executorGrants, actorEffective) {
+    const [smaller, larger] = executorGrants.size <= actorEffective.size
+        ? [executorGrants, actorEffective]
+        : [actorEffective, executorGrants];
+    const intersection = new Set();
+    for (const ref of smaller) {
+        if (larger.has(ref)) {
+            intersection.add(ref);
+        }
+    }
+    return intersection;
+}
+function clampAuthorityChain(authoritySets) {
+    if (authoritySets.length === 0) {
+        return new Set();
+    }
+    return authoritySets.reduce((acc, next) => clampAuthority(acc, next), new Set(authoritySets[0]));
+}
+//# sourceMappingURL=clamp-authority.js.map

package/dist/principal/lib/clamp-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clamp-authority.js","sourceRoot":"","sources":["../../../src/principal/lib/clamp-authority.ts"],"names":[],"mappings":";;AA4BA,wCAgBC;AASD,kDAUC;AAnCD,SAAgB,cAAc,CAC5B,cAA0C,EAC1C,cAA0C;IAE1C,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GACrB,cAAc,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI;QACxC,CAAC,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC;QAClC,CAAC,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAEvC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AASD,SAAgB,mBAAmB,CACjC,aAAwD;IAExD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,EAAiB,CAAC;IAClC,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CACzB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EACxC,IAAI,GAAG,CAAgB,aAAa,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC"}

package/dist/principal/lib/delegation-chain.d.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+import { type SubjectRef } from '../../subject';
+import type { DelegationGrant } from './delegation-grant';
+export declare const MAX_DELEGATION_DEPTH = 3;
+export declare enum DelegationErrorCode {
+    ChainTooDeep = "DELEGATION_CHAIN_TOO_DEEP",
+    Cycle = "DELEGATION_CHAIN_CYCLE",
+    Discontinuous = "DELEGATION_CHAIN_DISCONTINUOUS",
+    NotAnchoredAtActor = "DELEGATION_CHAIN_NOT_ANCHORED_AT_ACTOR",
+    NotAnchoredAtExecutor = "DELEGATION_CHAIN_NOT_ANCHORED_AT_EXECUTOR",
+    EmptyChainMismatch = "DELEGATION_CHAIN_EMPTY_MISMATCH"
+}
+export declare const DelegationErrorCodeSchema: z.ZodEnum<typeof DelegationErrorCode>;
+export declare class DelegationChainError extends Error {
+    readonly code: DelegationErrorCode;
+    constructor(args: {
+        code: DelegationErrorCode;
+        message: string;
+    });
+}
+export declare function resolveDelegationChain(args: {
+    actor: SubjectRef;
+    executor: SubjectRef;
+    chain: readonly DelegationGrant[];
+}): readonly DelegationGrant[];
+//# sourceMappingURL=delegation-chain.d.ts.map

package/dist/principal/lib/delegation-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-chain.d.ts","sourceRoot":"","sources":["../../../src/principal/lib/delegation-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAQ1D,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAMtC,oBAAY,mBAAmB;IAE7B,YAAY,8BAA8B;IAE1C,KAAK,2BAA2B;IAEhC,aAAa,mCAAmC;IAEhD,kBAAkB,2CAA2C;IAE7D,qBAAqB,8CAA8C;IAMnE,kBAAkB,oCAAoC;CACvD;AAED,eAAO,MAAM,yBAAyB,uCAAoC,CAAC;AAM3E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;gBAEvB,IAAI,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAKjE;AAuBD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;CACnC,GAAG,SAAS,eAAe,EAAE,CAoE7B"}