@xemahq/contracts 0.31.0 → 0.33.0

package/dist/.source-stamp.json

@@ -1,5 +1,5 @@
 {
   "algorithm": "sha256/len-framed-v1",
-  "hash": "81e8bf284200988a26898a4104311c8690555c8aefa649f8cd1086afd51c2991",
-  "fileCount": 540
+  "hash": "6fb79ca784626aeb85f97dee1b35f04c44ab831528bd20aa7d63f41d172a2e11",
+  "fileCount": 572
 }

package/dist/authorization-facts/index.d.ts

@@ -0,0 +1,6 @@
+export * from './lib/fact-tuple';
+export * from './lib/facts-apply';
+export * from './lib/facts-writer-authority';
+export * from './lib/revoke-intent';
+export * from './lib/facts-snapshot';
+//# sourceMappingURL=index.d.ts.map

package/dist/authorization-facts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization-facts/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC"}

package/dist/authorization-facts/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/fact-tuple"), exports);
+__exportStar(require("./lib/facts-apply"), exports);
+__exportStar(require("./lib/facts-writer-authority"), exports);
+__exportStar(require("./lib/revoke-intent"), exports);
+__exportStar(require("./lib/facts-snapshot"), exports);
+//# sourceMappingURL=index.js.map

package/dist/authorization-facts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization-facts/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,oDAAkC;AAClC,+DAA6C;AAC7C,sDAAoC;AACpC,uDAAqC"}

package/dist/authorization-facts/lib/fact-tuple.d.ts

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+export declare const FACT_TYPE_PATTERN: RegExp;
+export declare const FACT_RELATION_PATTERN: RegExp;
+export declare const FACT_OBJECT_ID_PATTERN: RegExp;
+export declare const FactTypeSchema: z.ZodString;
+export declare const FactRelationSchema: z.ZodString;
+export declare const FactObjectRefSchema: z.ZodObject<{
+    type: z.ZodString;
+    id: z.ZodString;
+}, z.core.$strict>;
+export type FactObjectRef = z.infer<typeof FactObjectRefSchema>;
+export declare const FACT_WILDCARD_SUBJECT_ID = "*";
+export declare const FactSubjectRefSchema: z.ZodObject<{
+    type: z.ZodString;
+    id: z.ZodString;
+    relation: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type FactSubjectRef = z.infer<typeof FactSubjectRefSchema>;
+export declare const FactConditionSchema: z.ZodObject<{
+    name: z.ZodString;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type FactCondition = z.infer<typeof FactConditionSchema>;
+export declare const FactTupleSchema: z.ZodObject<{
+    relation: z.ZodString;
+    subject: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        relation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    condition: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type FactTuple = z.infer<typeof FactTupleSchema>;
+export declare function factTupleKey(object: FactObjectRef, tuple: FactTuple): string;
+//# sourceMappingURL=fact-tuple.d.ts.map

package/dist/authorization-facts/lib/fact-tuple.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fact-tuple.d.ts","sourceRoot":"","sources":["../../../src/authorization-facts/lib/fact-tuple.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,eAAO,MAAM,iBAAiB,QAAuB,CAAC;AAEtD,eAAO,MAAM,qBAAqB,QAAsB,CAAC;AAEzD,eAAO,MAAM,sBAAsB,QAA6B,CAAC;AAEjE,eAAO,MAAM,cAAc,aAAsC,CAAC;AAClE,eAAO,MAAM,kBAAkB,aAA0C,CAAC;AAG1E,eAAO,MAAM,mBAAmB;;;kBAOrB,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAGhE,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAQ5C,eAAO,MAAM,oBAAoB;;;;kBAW9B,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAGlE,eAAO,MAAM,mBAAmB;;;kBAKrB,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAGhE,eAAO,MAAM,eAAe;;;;;;;;;;;kBAMjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAGxD,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,CAM5E"}

package/dist/authorization-facts/lib/fact-tuple.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FactTupleSchema = exports.FactConditionSchema = exports.FactSubjectRefSchema = exports.FACT_WILDCARD_SUBJECT_ID = exports.FactObjectRefSchema = exports.FactRelationSchema = exports.FactTypeSchema = exports.FACT_OBJECT_ID_PATTERN = exports.FACT_RELATION_PATTERN = exports.FACT_TYPE_PATTERN = void 0;
+exports.factTupleKey = factTupleKey;
+const zod_1 = require("zod");
+const authzen_1 = require("../../authzen");
+exports.FACT_TYPE_PATTERN = /^[^:#@*\s]{1,254}$/;
+exports.FACT_RELATION_PATTERN = /^[^:#@*\s]{1,50}$/;
+exports.FACT_OBJECT_ID_PATTERN = /^[a-zA-Z0-9_|*@.+/\-~]+$/;
+exports.FactTypeSchema = zod_1.z.string().regex(exports.FACT_TYPE_PATTERN);
+exports.FactRelationSchema = zod_1.z.string().regex(exports.FACT_RELATION_PATTERN);
+exports.FactObjectRefSchema = zod_1.z
+    .object({
+    type: exports.FactTypeSchema,
+    id: zod_1.z.string().regex(exports.FACT_OBJECT_ID_PATTERN).refine((id) => id !== '*', {
+        message: 'an object id cannot be the wildcard.',
+    }),
+})
+    .strict();
+exports.FACT_WILDCARD_SUBJECT_ID = '*';
+exports.FactSubjectRefSchema = zod_1.z
+    .object({
+    type: exports.FactTypeSchema,
+    id: zod_1.z.string().regex(exports.FACT_OBJECT_ID_PATTERN),
+    relation: exports.FactRelationSchema.optional(),
+})
+    .strict()
+    .refine((subject) => !(subject.id === exports.FACT_WILDCARD_SUBJECT_ID && subject.relation !== undefined), { message: 'a wildcard subject cannot carry a relation (`user:*#x` is not a subject).' });
+exports.FactConditionSchema = zod_1.z
+    .object({
+    name: zod_1.z.string().min(1),
+    context: authzen_1.AuthzenAttributesSchema.optional(),
+})
+    .strict();
+exports.FactTupleSchema = zod_1.z
+    .object({
+    relation: exports.FactRelationSchema,
+    subject: exports.FactSubjectRefSchema,
+    condition: exports.FactConditionSchema.optional(),
+})
+    .strict();
+function factTupleKey(object, tuple) {
+    const subject = tuple.subject.relation === undefined
+        ? `${tuple.subject.type}:${tuple.subject.id}`
+        : `${tuple.subject.type}:${tuple.subject.id}#${tuple.subject.relation}`;
+    return `${object.type}:${object.id}#${tuple.relation}@${subject}`;
+}
+//# sourceMappingURL=fact-tuple.js.map

package/dist/authorization-facts/lib/fact-tuple.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fact-tuple.js","sourceRoot":"","sources":["../../../src/authorization-facts/lib/fact-tuple.ts"],"names":[],"mappings":";;;AAgFA,oCAMC;AAtFD,6BAAwB;AAExB,2CAAwD;AAe3C,QAAA,iBAAiB,GAAG,oBAAoB,CAAC;AAEzC,QAAA,qBAAqB,GAAG,mBAAmB,CAAC;AAE5C,QAAA,sBAAsB,GAAG,0BAA0B,CAAC;AAEpD,QAAA,cAAc,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAiB,CAAC,CAAC;AACrD,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6BAAqB,CAAC,CAAC;AAG7D,QAAA,mBAAmB,GAAG,OAAC;KACjC,MAAM,CAAC;IACN,IAAI,EAAE,sBAAc;IACpB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8BAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,EAAE;QACtE,OAAO,EAAE,sCAAsC;KAChD,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,wBAAwB,GAAG,GAAG,CAAC;AAQ/B,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,sBAAc;IACpB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8BAAsB,CAAC;IAC5C,QAAQ,EAAE,0BAAkB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,gCAAwB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,EAC9E,EAAE,OAAO,EAAE,2EAA2E,EAAE,CACzF,CAAC;AAIS,QAAA,mBAAmB,GAAG,OAAC;KACjC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,iCAAuB,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,QAAQ,EAAE,0BAAkB;IAC5B,OAAO,EAAE,4BAAoB;IAC7B,SAAS,EAAE,2BAAmB,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,SAAgB,YAAY,CAAC,MAAqB,EAAE,KAAgB;IAClE,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;QAClC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE;QAC7C,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5E,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC;AACpE,CAAC"}

package/dist/authorization-facts/lib/facts-apply.d.ts

@@ -0,0 +1,244 @@
+import { z } from 'zod';
+export declare const FACTS_APPLY_MAX_TUPLES = 100;
+export declare const FactsVersionSchema: z.ZodNumber;
+export declare enum FactChangeKind {
+    Delta = "delta",
+    DesiredState = "desired-state",
+    DeleteObject = "delete-object"
+}
+export declare const FactChangeKindSchema: z.ZodEnum<typeof FactChangeKind>;
+export declare const DeltaFactChangeSchema: z.ZodObject<{
+    kind: z.ZodLiteral<FactChangeKind.Delta>;
+    object: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    version: z.ZodNumber;
+    writes: z.ZodArray<z.ZodObject<{
+        relation: z.ZodString;
+        subject: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+            relation: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        condition: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    deletes: z.ZodArray<z.ZodObject<{
+        relation: z.ZodString;
+        subject: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+            relation: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        condition: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    revokeIntentId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const DesiredFactSubjectSchema: z.ZodObject<{
+    subject: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        relation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    condition: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const DesiredStateFactChangeSchema: z.ZodObject<{
+    kind: z.ZodLiteral<FactChangeKind.DesiredState>;
+    object: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    version: z.ZodNumber;
+    relations: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+        subject: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+            relation: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        condition: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    revokeIntentId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const DeleteObjectFactChangeSchema: z.ZodObject<{
+    kind: z.ZodLiteral<FactChangeKind.DeleteObject>;
+    object: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    version: z.ZodNumber;
+}, z.core.$strict>;
+export declare const FactChangeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<FactChangeKind.Delta>;
+    object: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    version: z.ZodNumber;
+    writes: z.ZodArray<z.ZodObject<{
+        relation: z.ZodString;
+        subject: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+            relation: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        condition: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    deletes: z.ZodArray<z.ZodObject<{
+        relation: z.ZodString;
+        subject: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+            relation: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        condition: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    revokeIntentId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<FactChangeKind.DesiredState>;
+    object: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    version: z.ZodNumber;
+    relations: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+        subject: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+            relation: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        condition: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    revokeIntentId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<FactChangeKind.DeleteObject>;
+    object: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    version: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+export type FactChange = z.infer<typeof FactChangeSchema>;
+export declare function namedTupleCount(change: FactChange): number;
+export declare const FactsApplyRequestSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    biomeId: z.ZodString;
+    changes: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<FactChangeKind.Delta>;
+        object: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+        }, z.core.$strict>;
+        version: z.ZodNumber;
+        writes: z.ZodArray<z.ZodObject<{
+            relation: z.ZodString;
+            subject: z.ZodObject<{
+                type: z.ZodString;
+                id: z.ZodString;
+                relation: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            condition: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+                context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        deletes: z.ZodArray<z.ZodObject<{
+            relation: z.ZodString;
+            subject: z.ZodObject<{
+                type: z.ZodString;
+                id: z.ZodString;
+                relation: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            condition: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+                context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        revokeIntentId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<FactChangeKind.DesiredState>;
+        object: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+        }, z.core.$strict>;
+        version: z.ZodNumber;
+        relations: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+            subject: z.ZodObject<{
+                type: z.ZodString;
+                id: z.ZodString;
+                relation: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            condition: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+                context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>>;
+        revokeIntentId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<FactChangeKind.DeleteObject>;
+        object: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+        }, z.core.$strict>;
+        version: z.ZodNumber;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strict>;
+export type FactsApplyRequest = z.infer<typeof FactsApplyRequestSchema>;
+export declare enum FactChangeOutcome {
+    Applied = "applied",
+    Superseded = "superseded",
+    Tombstoned = "tombstoned"
+}
+export declare const FactChangeOutcomeSchema: z.ZodEnum<typeof FactChangeOutcome>;
+export declare const FactChangeResultSchema: z.ZodObject<{
+    object: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    outcome: z.ZodEnum<typeof FactChangeOutcome>;
+    recordedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export type FactChangeResult = z.infer<typeof FactChangeResultSchema>;
+export declare const FactsApplyResponseSchema: z.ZodObject<{
+    results: z.ZodArray<z.ZodObject<{
+        object: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+        }, z.core.$strict>;
+        outcome: z.ZodEnum<typeof FactChangeOutcome>;
+        recordedVersion: z.ZodNumber;
+    }, z.core.$strict>>;
+    written: z.ZodNumber;
+    deleted: z.ZodNumber;
+}, z.core.$strict>;
+export type FactsApplyResponse = z.infer<typeof FactsApplyResponseSchema>;
+export declare enum FactsApplyRefusal {
+    WriterMismatch = "writer_mismatch",
+    TypeNotWritable = "type_not_writable",
+    RelationNotWritable = "relation_not_writable",
+    TenantMismatch = "tenant_mismatch",
+    TooManyTuples = "too_many_tuples",
+    TupleNotAdmittedByModel = "tuple_not_admitted_by_model"
+}
+export declare const FactsApplyRefusalSchema: z.ZodEnum<typeof FactsApplyRefusal>;
+//# sourceMappingURL=facts-apply.d.ts.map

package/dist/authorization-facts/lib/facts-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts-apply.d.ts","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyCxB,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAG1C,eAAO,MAAM,kBAAkB,aAA8B,CAAC;AAe9D,oBAAY,cAAc;IACxB,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,YAAY,kBAAkB;CAC/B;AAED,eAAO,MAAM,oBAAoB,kCAA+B,CAAC;AAEjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAa9B,CAAC;AAEL,eAAO,MAAM,wBAAwB;;;;;;;;;;kBAK1B,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAQ9B,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;kBAM9B,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAI3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAG1D,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAY1D;AAMD,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0ChC,CAAC;AACL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAGxE,oBAAY,iBAAiB;IAE3B,OAAO,YAAY;IAEnB,UAAU,eAAe;IAEzB,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB,qCAAkC,CAAC;AAEvE,eAAO,MAAM,sBAAsB;;;;;;;kBAOxB,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE,eAAO,MAAM,wBAAwB;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,oBAAY,iBAAiB;IAE3B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,mBAAmB,0BAA0B;IAE7C,cAAc,oBAAoB;IAElC,aAAa,oBAAoB;IAEjC,uBAAuB,gCAAgC;CACxD;AAED,eAAO,MAAM,uBAAuB,qCAAkC,CAAC"}

package/dist/authorization-facts/lib/facts-apply.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FactsApplyRefusalSchema = exports.FactsApplyRefusal = exports.FactsApplyResponseSchema = exports.FactChangeResultSchema = exports.FactChangeOutcomeSchema = exports.FactChangeOutcome = exports.FactsApplyRequestSchema = exports.FactChangeSchema = exports.DeleteObjectFactChangeSchema = exports.DesiredStateFactChangeSchema = exports.DesiredFactSubjectSchema = exports.DeltaFactChangeSchema = exports.FactChangeKindSchema = exports.FactChangeKind = exports.FactsVersionSchema = exports.FACTS_APPLY_MAX_TUPLES = void 0;
+exports.namedTupleCount = namedTupleCount;
+const zod_1 = require("zod");
+const fact_tuple_1 = require("./fact-tuple");
+exports.FACTS_APPLY_MAX_TUPLES = 100;
+exports.FactsVersionSchema = zod_1.z.number().int().positive();
+var FactChangeKind;
+(function (FactChangeKind) {
+    FactChangeKind["Delta"] = "delta";
+    FactChangeKind["DesiredState"] = "desired-state";
+    FactChangeKind["DeleteObject"] = "delete-object";
+})(FactChangeKind || (exports.FactChangeKind = FactChangeKind = {}));
+exports.FactChangeKindSchema = zod_1.z.nativeEnum(FactChangeKind);
+exports.DeltaFactChangeSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(FactChangeKind.Delta),
+    object: fact_tuple_1.FactObjectRefSchema,
+    version: exports.FactsVersionSchema,
+    writes: zod_1.z.array(fact_tuple_1.FactTupleSchema),
+    deletes: zod_1.z.array(fact_tuple_1.FactTupleSchema),
+    revokeIntentId: zod_1.z.string().min(1).optional(),
+})
+    .strict()
+    .refine((c) => c.writes.length + c.deletes.length > 0, {
+    message: 'a delta change carries at least one write or delete.',
+});
+exports.DesiredFactSubjectSchema = zod_1.z
+    .object({
+    subject: fact_tuple_1.FactSubjectRefSchema,
+    condition: fact_tuple_1.FactConditionSchema.optional(),
+})
+    .strict();
+exports.DesiredStateFactChangeSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(FactChangeKind.DesiredState),
+    object: fact_tuple_1.FactObjectRefSchema,
+    version: exports.FactsVersionSchema,
+    relations: zod_1.z.record(fact_tuple_1.FactRelationSchema, zod_1.z.array(exports.DesiredFactSubjectSchema)),
+    revokeIntentId: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+exports.DeleteObjectFactChangeSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(FactChangeKind.DeleteObject),
+    object: fact_tuple_1.FactObjectRefSchema,
+    version: exports.FactsVersionSchema,
+})
+    .strict();
+exports.FactChangeSchema = zod_1.z.discriminatedUnion('kind', [
+    exports.DeltaFactChangeSchema,
+    exports.DesiredStateFactChangeSchema,
+    exports.DeleteObjectFactChangeSchema,
+]);
+function namedTupleCount(change) {
+    switch (change.kind) {
+        case FactChangeKind.Delta:
+            return change.writes.length + change.deletes.length;
+        case FactChangeKind.DesiredState:
+            return Object.values(change.relations).reduce((sum, subjects) => sum + subjects.length, 0);
+        case FactChangeKind.DeleteObject:
+            return 0;
+    }
+}
+function objectKey(object) {
+    return `${object.type}:${object.id}`;
+}
+exports.FactsApplyRequestSchema = zod_1.z
+    .object({
+    orgId: zod_1.z.string().min(1),
+    biomeId: zod_1.z.string().min(1),
+    changes: zod_1.z.array(exports.FactChangeSchema).min(1),
+})
+    .strict()
+    .superRefine((request, ctx) => {
+    const seen = new Set();
+    request.changes.forEach((change, index) => {
+        const key = objectKey(change.object);
+        if (seen.has(key)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['changes', index, 'object'],
+                message: `object ${key} appears twice in one request; one change per object, so the order of its facts is never ambiguous.`,
+            });
+        }
+        seen.add(key);
+        if (change.kind === FactChangeKind.Delta) {
+            const writes = new Set(change.writes.map((t) => (0, fact_tuple_1.factTupleKey)(change.object, t)));
+            for (const tuple of change.deletes) {
+                if (writes.has((0, fact_tuple_1.factTupleKey)(change.object, tuple))) {
+                    ctx.addIssue({
+                        code: 'custom',
+                        path: ['changes', index],
+                        message: `tuple ${(0, fact_tuple_1.factTupleKey)(change.object, tuple)} is both written and deleted in one change.`,
+                    });
+                }
+            }
+        }
+    });
+    const named = request.changes.reduce((s, c) => s + namedTupleCount(c), 0);
+    if (named > exports.FACTS_APPLY_MAX_TUPLES) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['changes'],
+            message: `the request names ${named} tuples; the limit is ${exports.FACTS_APPLY_MAX_TUPLES} and a request is refused, never split.`,
+        });
+    }
+});
+var FactChangeOutcome;
+(function (FactChangeOutcome) {
+    FactChangeOutcome["Applied"] = "applied";
+    FactChangeOutcome["Superseded"] = "superseded";
+    FactChangeOutcome["Tombstoned"] = "tombstoned";
+})(FactChangeOutcome || (exports.FactChangeOutcome = FactChangeOutcome = {}));
+exports.FactChangeOutcomeSchema = zod_1.z.nativeEnum(FactChangeOutcome);
+exports.FactChangeResultSchema = zod_1.z
+    .object({
+    object: fact_tuple_1.FactObjectRefSchema,
+    outcome: exports.FactChangeOutcomeSchema,
+    recordedVersion: exports.FactsVersionSchema,
+})
+    .strict();
+exports.FactsApplyResponseSchema = zod_1.z
+    .object({
+    results: zod_1.z.array(exports.FactChangeResultSchema),
+    written: zod_1.z.number().int().nonnegative(),
+    deleted: zod_1.z.number().int().nonnegative(),
+})
+    .strict();
+var FactsApplyRefusal;
+(function (FactsApplyRefusal) {
+    FactsApplyRefusal["WriterMismatch"] = "writer_mismatch";
+    FactsApplyRefusal["TypeNotWritable"] = "type_not_writable";
+    FactsApplyRefusal["RelationNotWritable"] = "relation_not_writable";
+    FactsApplyRefusal["TenantMismatch"] = "tenant_mismatch";
+    FactsApplyRefusal["TooManyTuples"] = "too_many_tuples";
+    FactsApplyRefusal["TupleNotAdmittedByModel"] = "tuple_not_admitted_by_model";
+})(FactsApplyRefusal || (exports.FactsApplyRefusal = FactsApplyRefusal = {}));
+exports.FactsApplyRefusalSchema = zod_1.z.nativeEnum(FactsApplyRefusal);
+//# sourceMappingURL=facts-apply.js.map

package/dist/authorization-facts/lib/facts-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts-apply.js","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-apply.ts"],"names":[],"mappings":";;;AAmHA,0CAYC;AA/HD,6BAAwB;AAExB,6CAQsB;AA+BT,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAG7B,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAe9D,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,iCAAe,CAAA;IACf,gDAA8B,CAAA;IAC9B,gDAA8B,CAAA;AAChC,CAAC,EAJW,cAAc,8BAAd,cAAc,QAIzB;AAEY,QAAA,oBAAoB,GAAG,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAEpD,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC;IACrC,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;IAC3B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,4BAAe,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,4BAAe,CAAC;IAEjC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;IACrD,OAAO,EAAE,sDAAsD;CAChE,CAAC,CAAC;AAEQ,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,OAAO,EAAE,iCAAoB;IAC7B,SAAS,EAAE,gCAAmB,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC;IAC5C,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;IAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,+BAAkB,EAAE,OAAC,CAAC,KAAK,CAAC,gCAAwB,CAAC,CAAC;IAC1E,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC;IAC5C,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,gBAAgB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,6BAAqB;IACrB,oCAA4B;IAC5B,oCAA4B;CAC7B,CAAC,CAAC;AAIH,SAAgB,eAAe,CAAC,MAAkB;IAChD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,cAAc,CAAC,KAAK;YACvB,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACtD,KAAK,cAAc,CAAC,YAAY;YAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,GAAG,QAAQ,CAAC,MAAM,EACxC,CAAC,CACF,CAAC;QACJ,KAAK,cAAc,CAAC,YAAY;YAC9B,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAqB;IACtC,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;AACvC,CAAC;AAEY,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IAEN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAExB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC;gBAClC,OAAO,EAAE,UAAU,GAAG,qGAAqG;aAC5H,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;wBACxB,OAAO,EAAE,SAAS,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,6CAA6C;qBAClG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,GAAG,8BAAsB,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,qBAAqB,KAAK,yBAAyB,8BAAsB,yCAAyC;SAC5H,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,IAAY,iBAOX;AAPD,WAAY,iBAAiB;IAE3B,wCAAmB,CAAA;IAEnB,8CAAyB,CAAA;IAEzB,8CAAyB,CAAA;AAC3B,CAAC,EAPW,iBAAiB,iCAAjB,iBAAiB,QAO5B;AAEY,QAAA,uBAAuB,GAAG,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AAE1D,QAAA,sBAAsB,GAAG,OAAC;KACpC,MAAM,CAAC;IACN,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,+BAAuB;IAEhC,eAAe,EAAE,0BAAkB;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,8BAAsB,CAAC;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAOZ,IAAY,iBAaX;AAbD,WAAY,iBAAiB;IAE3B,uDAAkC,CAAA;IAElC,0DAAqC,CAAA;IAErC,kEAA6C,CAAA;IAE7C,uDAAkC,CAAA;IAElC,sDAAiC,CAAA;IAEjC,4EAAuD,CAAA;AACzD,CAAC,EAbW,iBAAiB,iCAAjB,iBAAiB,QAa5B;AAEY,QAAA,uBAAuB,GAAG,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/authorization-facts/lib/facts-snapshot.d.ts

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+export declare const FactsSnapshotPageRequestSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    type: z.ZodString;
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodNumber;
+}, z.core.$strict>;
+export type FactsSnapshotPageRequest = z.infer<typeof FactsSnapshotPageRequestSchema>;
+export declare const FactsSnapshotPageResponseSchema: z.ZodObject<{
+    changes: z.ZodArray<z.ZodObject<{
+        kind: z.ZodLiteral<import("./facts-apply").FactChangeKind.DesiredState>;
+        object: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+        }, z.core.$strict>;
+        version: z.ZodNumber;
+        relations: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+            subject: z.ZodObject<{
+                type: z.ZodString;
+                id: z.ZodString;
+                relation: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            condition: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+                context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>>;
+        revokeIntentId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodString;
+}, z.core.$strict>;
+export type FactsSnapshotPageResponse = z.infer<typeof FactsSnapshotPageResponseSchema>;
+export declare const FactsSnapshotObjectRequestSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    object: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const FactsSnapshotObjectResponseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    deleted: z.ZodLiteral<false>;
+    change: z.ZodObject<{
+        kind: z.ZodLiteral<import("./facts-apply").FactChangeKind.DesiredState>;
+        object: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+        }, z.core.$strict>;
+        version: z.ZodNumber;
+        relations: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+            subject: z.ZodObject<{
+                type: z.ZodString;
+                id: z.ZodString;
+                relation: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            condition: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+                context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>>;
+        revokeIntentId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    deleted: z.ZodLiteral<true>;
+    object: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    version: z.ZodNumber;
+}, z.core.$strict>], "deleted">;
+//# sourceMappingURL=facts-snapshot.d.ts.map

package/dist/authorization-facts/lib/facts-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts-snapshot.d.ts","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,eAAO,MAAM,8BAA8B;;;;;kBAQhC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;kBAMjC,CAAC;AACZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AAGF,eAAO,MAAM,gCAAgC;;;;;;kBAKlC,CAAC;AAMZ,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BAc7C,CAAC"}

package/dist/authorization-facts/lib/facts-snapshot.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FactsSnapshotObjectResponseSchema = exports.FactsSnapshotObjectRequestSchema = exports.FactsSnapshotPageResponseSchema = exports.FactsSnapshotPageRequestSchema = void 0;
+const zod_1 = require("zod");
+const fact_tuple_1 = require("./fact-tuple");
+const facts_apply_1 = require("./facts-apply");
+exports.FactsSnapshotPageRequestSchema = zod_1.z
+    .object({
+    orgId: zod_1.z.string().min(1),
+    type: fact_tuple_1.FactTypeSchema,
+    cursor: zod_1.z.string().min(1).optional(),
+    limit: zod_1.z.number().int().positive().max(500),
+})
+    .strict();
+exports.FactsSnapshotPageResponseSchema = zod_1.z
+    .object({
+    changes: zod_1.z.array(facts_apply_1.DesiredStateFactChangeSchema),
+    nextCursor: zod_1.z.string(),
+})
+    .strict();
+exports.FactsSnapshotObjectRequestSchema = zod_1.z
+    .object({
+    orgId: zod_1.z.string().min(1),
+    object: fact_tuple_1.FactObjectRefSchema,
+})
+    .strict();
+exports.FactsSnapshotObjectResponseSchema = zod_1.z.discriminatedUnion('deleted', [
+    zod_1.z
+        .object({ deleted: zod_1.z.literal(false), change: facts_apply_1.DesiredStateFactChangeSchema })
+        .strict(),
+    zod_1.z
+        .object({
+        deleted: zod_1.z.literal(true),
+        object: fact_tuple_1.FactObjectRefSchema,
+        version: zod_1.z.number().int().positive(),
+    })
+        .strict(),
+]);
+//# sourceMappingURL=facts-snapshot.js.map