@xemahq/contracts 0.31.0 → 0.33.0

package/dist/authzen/lib/authzen-search.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActionSearchResponseSchema = exports.ResourceSearchResponseSchema = exports.SubjectSearchResponseSchema = exports.ActionSearchRequestSchema = exports.ResourceSearchRequestSchema = exports.SubjectSearchRequestSchema = exports.AUTHZEN_LAST_PAGE_TOKEN = exports.AuthzenPageResponseSchema = exports.AuthzenPageRequestSchema = void 0;
+exports.searchResultsOutsideQueriedType = searchResultsOutsideQueriedType;
+exports.searchContinuationMatches = searchContinuationMatches;
+const zod_1 = require("zod");
+const authzen_entities_1 = require("./authzen-entities");
+exports.AuthzenPageRequestSchema = zod_1.z
+    .object({
+    token: zod_1.z.string().optional(),
+    limit: zod_1.z.number().int().nonnegative().optional(),
+    properties: authzen_entities_1.AuthzenAttributesSchema.optional(),
+})
+    .strict();
+exports.AuthzenPageResponseSchema = zod_1.z
+    .object({
+    next_token: zod_1.z.string(),
+    count: zod_1.z.number().int().nonnegative().optional(),
+    total: zod_1.z.number().int().nonnegative().optional(),
+})
+    .strict();
+exports.AUTHZEN_LAST_PAGE_TOKEN = '';
+exports.SubjectSearchRequestSchema = zod_1.z
+    .object({
+    subject: authzen_entities_1.AuthzenSubjectQuerySchema,
+    action: authzen_entities_1.AuthzenActionSchema,
+    resource: authzen_entities_1.AuthzenResourceSchema,
+    context: authzen_entities_1.AuthzenContextSchema.optional(),
+    page: exports.AuthzenPageRequestSchema.optional(),
+})
+    .strict();
+exports.ResourceSearchRequestSchema = zod_1.z
+    .object({
+    subject: authzen_entities_1.AuthzenSubjectSchema,
+    action: authzen_entities_1.AuthzenActionSchema,
+    resource: authzen_entities_1.AuthzenResourceQuerySchema,
+    context: authzen_entities_1.AuthzenContextSchema.optional(),
+    page: exports.AuthzenPageRequestSchema.optional(),
+})
+    .strict();
+exports.ActionSearchRequestSchema = zod_1.z
+    .object({
+    subject: authzen_entities_1.AuthzenSubjectSchema,
+    resource: authzen_entities_1.AuthzenResourceSchema,
+    context: authzen_entities_1.AuthzenContextSchema.optional(),
+    page: exports.AuthzenPageRequestSchema.optional(),
+})
+    .strict();
+function searchResponseSchema(entity) {
+    return zod_1.z
+        .object({
+        page: exports.AuthzenPageResponseSchema.optional(),
+        context: authzen_entities_1.AuthzenContextSchema.optional(),
+        results: zod_1.z.array(entity),
+    })
+        .strict();
+}
+exports.SubjectSearchResponseSchema = searchResponseSchema(authzen_entities_1.AuthzenSubjectSchema);
+exports.ResourceSearchResponseSchema = searchResponseSchema(authzen_entities_1.AuthzenResourceSchema);
+exports.ActionSearchResponseSchema = searchResponseSchema(authzen_entities_1.AuthzenActionSchema);
+function searchResultsOutsideQueriedType(results, queriedType) {
+    return results.filter((result) => result.type !== queriedType);
+}
+function searchContinuationMatches(previous, next) {
+    return stableStringify(withoutToken(previous)) ===
+        stableStringify(withoutToken(next));
+}
+function withoutToken(request) {
+    if (request.page === undefined) {
+        return request;
+    }
+    const { token: _token, ...page } = request.page;
+    return { ...request, page };
+}
+function stableStringify(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(stableStringify).join(',')}]`;
+    }
+    if (value !== null && typeof value === 'object') {
+        const entries = Object.entries(value)
+            .filter(([, v]) => v !== undefined)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+        return `{${entries
+            .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=authzen-search.js.map

package/dist/authzen/lib/authzen-search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen-search.js","sourceRoot":"","sources":["../../../src/authzen/lib/authzen-search.ts"],"names":[],"mappings":";;;AA+HA,0EAKC;AAQD,8DAMC;AAlJD,6BAAwB;AAExB,yDAQ4B;AAiBf,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,0CAAuB,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAChD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAG7B,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,OAAO,EAAE,4CAAyB;IAClC,MAAM,EAAE,sCAAmB;IAC3B,QAAQ,EAAE,wCAAqB;IAC/B,OAAO,EAAE,uCAAoB,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,OAAO,EAAE,uCAAoB;IAC7B,MAAM,EAAE,sCAAmB;IAC3B,QAAQ,EAAE,6CAA0B;IACpC,OAAO,EAAE,uCAAoB,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAUC,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,OAAO,EAAE,uCAAoB;IAC7B,QAAQ,EAAE,wCAAqB;IAC/B,OAAO,EAAE,uCAAoB,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,SAAS,oBAAoB,CAAyB,MAAS;IAC7D,OAAO,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,iCAAyB,CAAC,QAAQ,EAAE;QAC1C,OAAO,EAAE,uCAAoB,CAAC,QAAQ,EAAE;QACxC,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,MAAM,CAAC;KACzB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC;AAGY,QAAA,2BAA2B,GACtC,oBAAoB,CAAC,uCAAoB,CAAC,CAAC;AAKhC,QAAA,4BAA4B,GAAG,oBAAoB,CAC9D,wCAAqB,CACtB,CAAC;AAKW,QAAA,0BAA0B,GACrC,oBAAoB,CAAC,sCAAmB,CAAC,CAAC;AAS5C,SAAgB,+BAA+B,CAC7C,OAAiD,EACjD,WAAmB;IAEnB,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;AACjE,CAAC;AAQD,SAAgB,yBAAyB,CACvC,QAAyD,EACzD,IAAqD;IAErD,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5C,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,OAErB;IACC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAChD,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,IAAI,OAAO;aACf,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC"}

package/dist/authzen/lib/authzen-snapshot.d.ts

@@ -0,0 +1,47 @@
+import { z } from 'zod';
+export declare const XEMA_AUTHZ_SNAPSHOT_VERSION: 1;
+export declare const XemaAuthorityRevisionSchema: z.ZodObject<{
+    factsPosition: z.ZodString;
+    principalRevision: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type XemaAuthorityRevision = z.infer<typeof XemaAuthorityRevisionSchema>;
+export declare const XemaAuthzSnapshotClaimsSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    modelId: z.ZodString;
+    authorityRevision: z.ZodObject<{
+        factsPosition: z.ZodString;
+        principalRevision: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    contextDigest: z.ZodString;
+    issuedAtMs: z.ZodNumber;
+}, z.core.$strict>;
+export type XemaAuthzSnapshotClaims = z.infer<typeof XemaAuthzSnapshotClaimsSchema>;
+export declare const XEMA_AUTHZ_SNAPSHOT_TOKEN_PATTERN: RegExp;
+export declare const XemaAuthzSnapshotTokenSchema: z.ZodString;
+export interface XemaAuthzContextSnapshot {
+    readonly orgId: string;
+    readonly orgAuthorityKind: string | null;
+    readonly delegationId: string | null;
+    readonly capability: string | null;
+    readonly environment: string | null;
+}
+export declare const XemaAuthzContextSnapshotSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    orgAuthorityKind: z.ZodNullable<z.ZodString>;
+    delegationId: z.ZodNullable<z.ZodString>;
+    capability: z.ZodNullable<z.ZodString>;
+    environment: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare function digestXemaAuthzContextSnapshot(snapshot: XemaAuthzContextSnapshot): Promise<string>;
+export declare class XemaAuthzSnapshotTokenError extends Error {
+    constructor(message: string);
+}
+export declare function encodeXemaAuthzSnapshotPayload(claims: XemaAuthzSnapshotClaims): string;
+export declare function composeXemaAuthzSnapshotToken(payload: string, signature: Uint8Array): string;
+export interface XemaAuthzSnapshotTokenParts {
+    readonly payload: string;
+    readonly signature: Uint8Array;
+    readonly claims: XemaAuthzSnapshotClaims;
+}
+export declare function readXemaAuthzSnapshotTokenUnverified(token: string): XemaAuthzSnapshotTokenParts;
+//# sourceMappingURL=authzen-snapshot.d.ts.map

package/dist/authzen/lib/authzen-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen-snapshot.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/authzen-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA+BxB,eAAO,MAAM,2BAA2B,EAAG,CAAU,CAAC;AAatD,eAAO,MAAM,2BAA2B;;;kBAK7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF,eAAO,MAAM,6BAA6B;;;;;;;;;kBAW/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAGF,eAAO,MAAM,iCAAiC,QACV,CAAC;AAErC,eAAO,MAAM,4BAA4B,aAKrC,CAAC;AASL,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,eAAO,MAAM,8BAA8B;;;;;;kBAQhC,CAAC;AAGZ,wBAAsB,8BAA8B,CAClD,QAAQ,EAAE,wBAAwB,GACjC,OAAO,CAAC,MAAM,CAAC,CAGjB;AAGD,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAwBD,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,uBAAuB,GAC9B,MAAM,CAGR;AAGD,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,UAAU,GACpB,MAAM,CASR;AAED,MAAM,WAAW,2BAA2B;IAE1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAE/B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;CAC1C;AAOD,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,MAAM,GACZ,2BAA2B,CAsB7B"}

package/dist/authzen/lib/authzen-snapshot.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaAuthzSnapshotTokenError = exports.XemaAuthzContextSnapshotSchema = exports.XemaAuthzSnapshotTokenSchema = exports.XEMA_AUTHZ_SNAPSHOT_TOKEN_PATTERN = exports.XemaAuthzSnapshotClaimsSchema = exports.XemaAuthorityRevisionSchema = exports.XEMA_AUTHZ_SNAPSHOT_VERSION = void 0;
+exports.digestXemaAuthzContextSnapshot = digestXemaAuthzContextSnapshot;
+exports.encodeXemaAuthzSnapshotPayload = encodeXemaAuthzSnapshotPayload;
+exports.composeXemaAuthzSnapshotToken = composeXemaAuthzSnapshotToken;
+exports.readXemaAuthzSnapshotTokenUnverified = readXemaAuthzSnapshotTokenUnverified;
+const zod_1 = require("zod");
+const content_address_1 = require("../../content-address");
+exports.XEMA_AUTHZ_SNAPSHOT_VERSION = 1;
+exports.XemaAuthorityRevisionSchema = zod_1.z
+    .object({
+    factsPosition: zod_1.z.string().min(1),
+    principalRevision: zod_1.z.string().min(1).nullable(),
+})
+    .strict();
+exports.XemaAuthzSnapshotClaimsSchema = zod_1.z
+    .object({
+    v: zod_1.z.literal(exports.XEMA_AUTHZ_SNAPSHOT_VERSION),
+    modelId: zod_1.z.string().min(1),
+    authorityRevision: exports.XemaAuthorityRevisionSchema,
+    contextDigest: content_address_1.Sha256HexSchema,
+    issuedAtMs: zod_1.z.number().int().nonnegative(),
+})
+    .strict();
+exports.XEMA_AUTHZ_SNAPSHOT_TOKEN_PATTERN = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+exports.XemaAuthzSnapshotTokenSchema = zod_1.z
+    .string()
+    .regex(exports.XEMA_AUTHZ_SNAPSHOT_TOKEN_PATTERN, {
+    message: 'a Xema snapshot token is `<base64url payload>.<base64url signature>`.',
+});
+exports.XemaAuthzContextSnapshotSchema = zod_1.z
+    .object({
+    orgId: zod_1.z.string().min(1),
+    orgAuthorityKind: zod_1.z.string().min(1).nullable(),
+    delegationId: zod_1.z.string().min(1).nullable(),
+    capability: zod_1.z.string().min(1).nullable(),
+    environment: zod_1.z.string().min(1).nullable(),
+})
+    .strict();
+async function digestXemaAuthzContextSnapshot(snapshot) {
+    const parsed = exports.XemaAuthzContextSnapshotSchema.parse(snapshot);
+    return (0, content_address_1.canonicalContentHash)(parsed);
+}
+class XemaAuthzSnapshotTokenError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'XemaAuthzSnapshotTokenError';
+    }
+}
+exports.XemaAuthzSnapshotTokenError = XemaAuthzSnapshotTokenError;
+function toBase64Url(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function fromBase64Url(value) {
+    const padded = value.replace(/-/g, '+').replace(/_/g, '/');
+    const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4));
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+function encodeXemaAuthzSnapshotPayload(claims) {
+    const parsed = exports.XemaAuthzSnapshotClaimsSchema.parse(claims);
+    return toBase64Url(new TextEncoder().encode((0, content_address_1.canonicalJsonStringify)(parsed)));
+}
+function composeXemaAuthzSnapshotToken(payload, signature) {
+    if (signature.length === 0) {
+        throw new XemaAuthzSnapshotTokenError('composeXemaAuthzSnapshotToken: an empty signature is not a signature.');
+    }
+    return exports.XemaAuthzSnapshotTokenSchema.parse(`${payload}.${toBase64Url(signature)}`);
+}
+function readXemaAuthzSnapshotTokenUnverified(token) {
+    if (!exports.XEMA_AUTHZ_SNAPSHOT_TOKEN_PATTERN.test(token)) {
+        throw new XemaAuthzSnapshotTokenError('readXemaAuthzSnapshotTokenUnverified: the token is not `<payload>.<signature>`.');
+    }
+    const [payload, signature] = token.split('.');
+    let claims;
+    try {
+        claims = JSON.parse(new TextDecoder().decode(fromBase64Url(payload)));
+    }
+    catch {
+        throw new XemaAuthzSnapshotTokenError('readXemaAuthzSnapshotTokenUnverified: the payload is not base64url JSON.');
+    }
+    const parsed = exports.XemaAuthzSnapshotClaimsSchema.safeParse(claims);
+    if (!parsed.success) {
+        throw new XemaAuthzSnapshotTokenError(`readXemaAuthzSnapshotTokenUnverified: the claims do not parse: ${parsed.error.message}`);
+    }
+    return { payload, signature: fromBase64Url(signature), claims: parsed.data };
+}
+//# sourceMappingURL=authzen-snapshot.js.map

package/dist/authzen/lib/authzen-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen-snapshot.js","sourceRoot":"","sources":["../../../src/authzen/lib/authzen-snapshot.ts"],"names":[],"mappings":";;;AA4GA,wEAKC;AAgCD,wEAKC;AAGD,sEAYC;AAeD,oFAwBC;AA5MD,6BAAwB;AAExB,2DAI+B;AAyBlB,QAAA,2BAA2B,GAAG,CAAU,CAAC;AAazC,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,CAAC,EAAE,OAAC,CAAC,OAAO,CAAC,mCAA2B,CAAC;IAEzC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,iBAAiB,EAAE,mCAA2B;IAE9C,aAAa,EAAE,iCAAe;IAE9B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,iCAAiC,GAC5C,kCAAkC,CAAC;AAExB,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,EAAE;KACR,KAAK,CAAC,yCAAiC,EAAE;IACxC,OAAO,EACL,uEAAuE;CAC1E,CAAC,CAAC;AAmBQ,QAAA,8BAA8B,GAAG,OAAC;KAC5C,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAGL,KAAK,UAAU,8BAA8B,CAClD,QAAkC;IAElC,MAAM,MAAM,GAAG,sCAA8B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,IAAA,sCAAoB,EAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAGD,MAAa,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AALD,kEAKC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAMD,SAAgB,8BAA8B,CAC5C,MAA+B;IAE/B,MAAM,MAAM,GAAG,qCAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,wCAAsB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAGD,SAAgB,6BAA6B,CAC3C,OAAe,EACf,SAAqB;IAErB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,2BAA2B,CACnC,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,oCAA4B,CAAC,KAAK,CACvC,GAAG,OAAO,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CACvC,CAAC;AACJ,CAAC;AAeD,SAAgB,oCAAoC,CAClD,KAAa;IAEb,IAAI,CAAC,yCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,2BAA2B,CACnC,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAClE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,2BAA2B,CACnC,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,qCAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,2BAA2B,CACnC,kEAAkE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC/E,CAAC"}

package/dist/authzen/lib/xema-authzen-profile.d.ts

@@ -0,0 +1,155 @@
+import { z } from 'zod';
+import { AuditAuthorityKind } from '../../audit';
+import { SubjectKind } from '../../subject';
+export declare const XEMA_AUTHZEN_SUBJECT_KINDS: readonly [SubjectKind.User, SubjectKind.Agent, SubjectKind.Service, SubjectKind.ExternalSubject];
+export type XemaAuthzenSubjectKind = (typeof XEMA_AUTHZEN_SUBJECT_KINDS)[number];
+export declare const XemaAuthzenSubjectKindSchema: z.ZodEnum<{
+    user: SubjectKind.User;
+    agent: SubjectKind.Agent;
+    service: SubjectKind.Service;
+    "external-subject": SubjectKind.ExternalSubject;
+}>;
+export declare const XemaOrgAuthorityInstrumentSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
+    orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
+}, z.core.$strict>], "kind">;
+export type XemaOrgAuthorityInstrument = z.infer<typeof XemaOrgAuthorityInstrumentSchema>;
+export declare const XemaAuthzenSubjectPropertiesSchema: z.ZodObject<{
+    orgAuthority: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
+        orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strict>;
+export type XemaAuthzenSubjectProperties = z.infer<typeof XemaAuthzenSubjectPropertiesSchema>;
+export declare const XemaAuthzenSubjectSchema: z.ZodObject<{
+    type: z.ZodEnum<{
+        user: SubjectKind.User;
+        agent: SubjectKind.Agent;
+        service: SubjectKind.Service;
+        "external-subject": SubjectKind.ExternalSubject;
+    }>;
+    id: z.ZodString;
+    properties: z.ZodOptional<z.ZodObject<{
+        orgAuthority: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
+            orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
+        }, z.core.$strict>], "kind">>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type XemaAuthzenSubject = z.infer<typeof XemaAuthzenSubjectSchema>;
+export declare const XEMA_ORG_RESOURCE_TYPE = "org";
+export declare const XEMA_QUALIFIED_ID_SEPARATOR = "|";
+export declare const XEMA_QUALIFIED_ID_SEGMENT_PATTERN: RegExp;
+export declare const XemaQualifiedResourceIdSchema: z.ZodString;
+export declare class XemaQualifiedResourceIdError extends Error {
+    constructor(message: string);
+}
+export declare function qualifyResourceId(orgId: string, localId: string): string;
+export interface XemaQualifiedResourceId {
+    readonly orgId: string;
+    readonly localId: string;
+}
+export declare function parseQualifiedResourceId(id: string): XemaQualifiedResourceId;
+export declare function resourceBelongsToOrg(resource: {
+    readonly type: string;
+    readonly id: string;
+}, orgId: string): boolean;
+export declare const XemaAuthzenResourceSchema: z.ZodObject<{
+    type: z.ZodString;
+    id: z.ZodString;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export declare const XemaAuthzenActionSchema: z.ZodObject<{
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export declare const XemaAuthzenContextSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    capability: z.ZodOptional<z.ZodString>;
+    environment: z.ZodOptional<z.ZodString>;
+    delegation: z.ZodOptional<z.ZodType<import("../../subject").DelegatedAuthority, unknown, z.core.$ZodTypeInternals<import("../../subject").DelegatedAuthority, unknown>>>;
+    snapshot: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type XemaAuthzenContext = z.infer<typeof XemaAuthzenContextSchema>;
+export declare const XemaAccessEvaluationRequestSchema: z.ZodObject<{
+    subject: z.ZodObject<{
+        type: z.ZodEnum<{
+            user: SubjectKind.User;
+            agent: SubjectKind.Agent;
+            service: SubjectKind.Service;
+            "external-subject": SubjectKind.ExternalSubject;
+        }>;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodObject<{
+            orgAuthority: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
+                orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
+            }, z.core.$strict>], "kind">>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    action: z.ZodObject<{
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        name: z.ZodString;
+    }, z.core.$strict>;
+    resource: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    context: z.ZodObject<{
+        orgId: z.ZodString;
+        capability: z.ZodOptional<z.ZodString>;
+        environment: z.ZodOptional<z.ZodString>;
+        delegation: z.ZodOptional<z.ZodType<import("../../subject").DelegatedAuthority, unknown, z.core.$ZodTypeInternals<import("../../subject").DelegatedAuthority, unknown>>>;
+        snapshot: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type XemaAccessEvaluationRequest = z.infer<typeof XemaAccessEvaluationRequestSchema>;
+export declare enum XemaAuthzenReasonCode {
+    TenantMismatch = "tenant_mismatch",
+    RelationNotHeld = "relation_not_held",
+    CapabilityNotGranted = "capability_not_granted",
+    DelegationRequired = "delegation_required",
+    CapabilityNotDelegated = "capability_not_delegated",
+    ResourceOutsideDelegatedScope = "resource_outside_delegated_scope",
+    CeilingRefused = "ceiling_refused",
+    NamespaceWithdrawn = "namespace_withdrawn"
+}
+export declare const XemaAuthzenReasonCodeSchema: z.ZodEnum<typeof XemaAuthzenReasonCode>;
+export declare enum XemaAuthzenErrorCode {
+    ListTooLarge = "list_too_large",
+    SnapshotExpired = "snapshot_expired",
+    ContinuationMismatch = "continuation_mismatch",
+    UnknownType = "unknown_type",
+    UnknownAction = "unknown_action",
+    ProfileViolation = "profile_violation"
+}
+export declare const XemaAuthzenErrorCodeSchema: z.ZodEnum<typeof XemaAuthzenErrorCode>;
+export declare const XemaAuthzenItemErrorSchema: z.ZodObject<{
+    status: z.ZodNumber;
+    message: z.ZodString;
+    code: z.ZodEnum<typeof XemaAuthzenErrorCode>;
+}, z.core.$strict>;
+export declare const XemaAuthzenDecisionContextSchema: z.ZodObject<{
+    reason_code: z.ZodOptional<z.ZodEnum<typeof XemaAuthzenReasonCode>>;
+    error: z.ZodOptional<z.ZodObject<{
+        status: z.ZodNumber;
+        message: z.ZodString;
+        code: z.ZodEnum<typeof XemaAuthzenErrorCode>;
+    }, z.core.$strict>>;
+    snapshot: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type XemaAuthzenDecisionContext = z.infer<typeof XemaAuthzenDecisionContextSchema>;
+export declare const XemaAuthzenErrorBodySchema: z.ZodIntersection<z.ZodObject<{
+    code: z.ZodEnum<typeof XemaAuthzenErrorCode>;
+    message: z.ZodString;
+}, z.core.$strip>, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+//# sourceMappingURL=xema-authzen-profile.d.ts.map

package/dist/authzen/lib/xema-authzen-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAA4B,WAAW,EAAE,MAAM,eAAe,CAAC;AA6BtE,eAAO,MAAM,0BAA0B,kGAK5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;EAKvC,CAAC;AAcH,eAAO,MAAM,gCAAgC;;;;;4BAQ3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAQF,eAAO,MAAM,kCAAkC;;;;;;;kBAIpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAS1E,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAO5C,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAG/C,eAAO,MAAM,iCAAiC,QAAe,CAAC;AAE9D,eAAO,MAAM,6BAA6B,aAKtC,CAAC;AAGL,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYxE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,CAQ5E;AAQD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxD,KAAK,EAAE,MAAM,GACZ,OAAO,CAST;AAGD,eAAO,MAAM,yBAAyB;;;;kBAAwB,CAAC;AAM/D,eAAO,MAAM,uBAAuB;;;kBAIlC,CAAC;AAmBH,eAAO,MAAM,wBAAwB;;;;;;kBAQ1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAWF,oBAAY,qBAAqB;IAE/B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,oBAAoB,2BAA2B;IAE/C,kBAAkB,wBAAwB;IAE1C,sBAAsB,6BAA6B;IAEnD,6BAA6B,qCAAqC;IAElE,cAAc,oBAAoB;IAElC,kBAAkB,wBAAwB;CAC3C;AAED,eAAO,MAAM,2BAA2B,yCAAsC,CAAC;AAO/E,oBAAY,oBAAoB;IAE9B,YAAY,mBAAmB;IAE/B,eAAe,qBAAqB;IAEpC,oBAAoB,0BAA0B;IAE9C,WAAW,iBAAiB;IAE5B,aAAa,mBAAmB;IAEhC,gBAAgB,sBAAsB;CACvC;AAED,eAAO,MAAM,0BAA0B,wCAAqC,CAAC;AAG7E,eAAO,MAAM,0BAA0B;;;;kBAM5B,CAAC;AAOZ,eAAO,MAAM,gCAAgC;;;;;;;;iBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAOF,eAAO,MAAM,0BAA0B;;;0DAKR,CAAC"}

package/dist/authzen/lib/xema-authzen-profile.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaAuthzenErrorBodySchema = exports.XemaAuthzenDecisionContextSchema = exports.XemaAuthzenItemErrorSchema = exports.XemaAuthzenErrorCodeSchema = exports.XemaAuthzenErrorCode = exports.XemaAuthzenReasonCodeSchema = exports.XemaAuthzenReasonCode = exports.XemaAccessEvaluationRequestSchema = exports.XemaAuthzenContextSchema = exports.XemaAuthzenActionSchema = exports.XemaAuthzenResourceSchema = exports.XemaQualifiedResourceIdError = exports.XemaQualifiedResourceIdSchema = exports.XEMA_QUALIFIED_ID_SEGMENT_PATTERN = exports.XEMA_QUALIFIED_ID_SEPARATOR = exports.XEMA_ORG_RESOURCE_TYPE = exports.XemaAuthzenSubjectSchema = exports.XemaAuthzenSubjectPropertiesSchema = exports.XemaOrgAuthorityInstrumentSchema = exports.XemaAuthzenSubjectKindSchema = exports.XEMA_AUTHZEN_SUBJECT_KINDS = void 0;
+exports.qualifyResourceId = qualifyResourceId;
+exports.parseQualifiedResourceId = parseQualifiedResourceId;
+exports.resourceBelongsToOrg = resourceBelongsToOrg;
+const zod_1 = require("zod");
+const audit_1 = require("../../audit");
+const subject_1 = require("../../subject");
+const tenant_1 = require("../../tenant");
+const authzen_entities_1 = require("./authzen-entities");
+const authzen_snapshot_1 = require("./authzen-snapshot");
+exports.XEMA_AUTHZEN_SUBJECT_KINDS = Object.freeze([
+    subject_1.SubjectKind.User,
+    subject_1.SubjectKind.Agent,
+    subject_1.SubjectKind.Service,
+    subject_1.SubjectKind.ExternalSubject,
+]);
+exports.XemaAuthzenSubjectKindSchema = zod_1.z.enum([
+    subject_1.SubjectKind.User,
+    subject_1.SubjectKind.Agent,
+    subject_1.SubjectKind.Service,
+    subject_1.SubjectKind.ExternalSubject,
+]);
+exports.XemaOrgAuthorityInstrumentSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(audit_1.AuditAuthorityKind.OrgRole),
+        orgRole: tenant_1.OrgRoleSchema,
+    })
+        .strict(),
+    zod_1.z.object({ kind: zod_1.z.literal(audit_1.AuditAuthorityKind.PlatformAdmin) }).strict(),
+]);
+exports.XemaAuthzenSubjectPropertiesSchema = zod_1.z
+    .object({
+    orgAuthority: exports.XemaOrgAuthorityInstrumentSchema.optional(),
+})
+    .strict();
+exports.XemaAuthzenSubjectSchema = zod_1.z
+    .object({
+    type: exports.XemaAuthzenSubjectKindSchema,
+    id: zod_1.z.string().min(1),
+    properties: exports.XemaAuthzenSubjectPropertiesSchema.optional(),
+})
+    .strict();
+exports.XEMA_ORG_RESOURCE_TYPE = 'org';
+exports.XEMA_QUALIFIED_ID_SEPARATOR = '|';
+exports.XEMA_QUALIFIED_ID_SEGMENT_PATTERN = /^[^|:\s]+$/;
+exports.XemaQualifiedResourceIdSchema = zod_1.z
+    .string()
+    .regex(/^[^|:\s]+\|[^|:\s]+$/, {
+    message: 'a Xema resource id is org-qualified: `<orgId>|<localId>`, neither segment containing `|`, `:` or whitespace.',
+});
+class XemaQualifiedResourceIdError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'XemaQualifiedResourceIdError';
+    }
+}
+exports.XemaQualifiedResourceIdError = XemaQualifiedResourceIdError;
+function qualifyResourceId(orgId, localId) {
+    for (const [name, segment] of [
+        ['orgId', orgId],
+        ['localId', localId],
+    ]) {
+        if (!exports.XEMA_QUALIFIED_ID_SEGMENT_PATTERN.test(segment)) {
+            throw new XemaQualifiedResourceIdError(`qualifyResourceId: ${name} "${segment}" is empty or contains \`|\`, \`:\` or whitespace.`);
+        }
+    }
+    return `${orgId}${exports.XEMA_QUALIFIED_ID_SEPARATOR}${localId}`;
+}
+function parseQualifiedResourceId(id) {
+    if (!exports.XemaQualifiedResourceIdSchema.safeParse(id).success) {
+        throw new XemaQualifiedResourceIdError(`parseQualifiedResourceId: "${id}" is not \`<orgId>|<localId>\`.`);
+    }
+    const index = id.indexOf(exports.XEMA_QUALIFIED_ID_SEPARATOR);
+    return { orgId: id.slice(0, index), localId: id.slice(index + 1) };
+}
+function resourceBelongsToOrg(resource, orgId) {
+    if (resource.type === exports.XEMA_ORG_RESOURCE_TYPE) {
+        return resource.id === orgId;
+    }
+    const parsed = exports.XemaQualifiedResourceIdSchema.safeParse(resource.id);
+    if (!parsed.success) {
+        return false;
+    }
+    return parseQualifiedResourceId(resource.id).orgId === orgId;
+}
+exports.XemaAuthzenResourceSchema = authzen_entities_1.AuthzenResourceSchema;
+exports.XemaAuthzenActionSchema = authzen_entities_1.AuthzenActionSchema.extend({
+    name: zod_1.z.string().regex(/^[^:#@*\s]{1,50}$/, {
+        message: 'a Xema action name is an OpenFGA relation name.',
+    }),
+});
+exports.XemaAuthzenContextSchema = zod_1.z
+    .object({
+    orgId: zod_1.z.string().min(1),
+    capability: zod_1.z.string().min(1).optional(),
+    environment: zod_1.z.string().min(1).optional(),
+    delegation: subject_1.DelegatedAuthoritySchema.optional(),
+    snapshot: authzen_snapshot_1.XemaAuthzSnapshotTokenSchema.optional(),
+})
+    .strict();
+exports.XemaAccessEvaluationRequestSchema = zod_1.z
+    .object({
+    subject: exports.XemaAuthzenSubjectSchema,
+    action: exports.XemaAuthzenActionSchema,
+    resource: exports.XemaAuthzenResourceSchema,
+    context: exports.XemaAuthzenContextSchema,
+})
+    .strict();
+var XemaAuthzenReasonCode;
+(function (XemaAuthzenReasonCode) {
+    XemaAuthzenReasonCode["TenantMismatch"] = "tenant_mismatch";
+    XemaAuthzenReasonCode["RelationNotHeld"] = "relation_not_held";
+    XemaAuthzenReasonCode["CapabilityNotGranted"] = "capability_not_granted";
+    XemaAuthzenReasonCode["DelegationRequired"] = "delegation_required";
+    XemaAuthzenReasonCode["CapabilityNotDelegated"] = "capability_not_delegated";
+    XemaAuthzenReasonCode["ResourceOutsideDelegatedScope"] = "resource_outside_delegated_scope";
+    XemaAuthzenReasonCode["CeilingRefused"] = "ceiling_refused";
+    XemaAuthzenReasonCode["NamespaceWithdrawn"] = "namespace_withdrawn";
+})(XemaAuthzenReasonCode || (exports.XemaAuthzenReasonCode = XemaAuthzenReasonCode = {}));
+exports.XemaAuthzenReasonCodeSchema = zod_1.z.nativeEnum(XemaAuthzenReasonCode);
+var XemaAuthzenErrorCode;
+(function (XemaAuthzenErrorCode) {
+    XemaAuthzenErrorCode["ListTooLarge"] = "list_too_large";
+    XemaAuthzenErrorCode["SnapshotExpired"] = "snapshot_expired";
+    XemaAuthzenErrorCode["ContinuationMismatch"] = "continuation_mismatch";
+    XemaAuthzenErrorCode["UnknownType"] = "unknown_type";
+    XemaAuthzenErrorCode["UnknownAction"] = "unknown_action";
+    XemaAuthzenErrorCode["ProfileViolation"] = "profile_violation";
+})(XemaAuthzenErrorCode || (exports.XemaAuthzenErrorCode = XemaAuthzenErrorCode = {}));
+exports.XemaAuthzenErrorCodeSchema = zod_1.z.nativeEnum(XemaAuthzenErrorCode);
+exports.XemaAuthzenItemErrorSchema = zod_1.z
+    .object({
+    status: zod_1.z.number().int().min(400).max(599),
+    message: zod_1.z.string().min(1),
+    code: exports.XemaAuthzenErrorCodeSchema,
+})
+    .strict();
+exports.XemaAuthzenDecisionContextSchema = zod_1.z.object({
+    reason_code: exports.XemaAuthzenReasonCodeSchema.optional(),
+    error: exports.XemaAuthzenItemErrorSchema.optional(),
+    snapshot: authzen_snapshot_1.XemaAuthzSnapshotTokenSchema.optional(),
+});
+exports.XemaAuthzenErrorBodySchema = zod_1.z
+    .object({
+    code: exports.XemaAuthzenErrorCodeSchema,
+    message: zod_1.z.string().min(1),
+})
+    .and(authzen_entities_1.AuthzenAttributesSchema);
+//# sourceMappingURL=xema-authzen-profile.js.map

package/dist/authzen/lib/xema-authzen-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;AAqIA,8CAYC;AAQD,4DAQC;AAQD,oDAYC;AArLD,6BAAwB;AAExB,uCAAiD;AACjD,2CAAsE;AACtE,yCAA6C;AAE7C,yDAI4B;AAC5B,yDAAkE;AAqBrD,QAAA,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,qBAAW,CAAC,IAAI;IAChB,qBAAW,CAAC,KAAK;IACjB,qBAAW,CAAC,OAAO;IACnB,qBAAW,CAAC,eAAe;CACnB,CAAC,CAAC;AAIC,QAAA,4BAA4B,GAAG,OAAC,CAAC,IAAI,CAAC;IACjD,qBAAW,CAAC,IAAI;IAChB,qBAAW,CAAC,KAAK;IACjB,qBAAW,CAAC,OAAO;IACnB,qBAAW,CAAC,eAAe;CAC5B,CAAC,CAAC;AAcU,QAAA,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,sBAAa;KACvB,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACzE,CAAC,CAAC;AAWU,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,YAAY,EAAE,wCAAgC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,oCAA4B;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,0CAAkC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAUC,QAAA,sBAAsB,GAAG,KAAK,CAAC;AAO/B,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAGlC,QAAA,iCAAiC,GAAG,YAAY,CAAC;AAEjD,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,EAAE;IAC7B,OAAO,EACL,8GAA8G;CACjH,CAAC,CAAC;AAGL,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AALD,oEAKC;AAGD,SAAgB,iBAAiB,CAAC,KAAa,EAAE,OAAe;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,SAAS,EAAE,OAAO,CAAC;KACZ,EAAE,CAAC;QACX,IAAI,CAAC,yCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CACpC,sBAAsB,IAAI,KAAK,OAAO,oDAAoD,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,GAAG,mCAA2B,GAAG,OAAO,EAAE,CAAC;AAC5D,CAAC;AAQD,SAAgB,wBAAwB,CAAC,EAAU;IACjD,IAAI,CAAC,qCAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,4BAA4B,CACpC,8BAA8B,EAAE,iCAAiC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,mCAA2B,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAQD,SAAgB,oBAAoB,CAClC,QAAwD,EACxD,KAAa;IAEb,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAsB,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,qCAA6B,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;AAC/D,CAAC;AAGY,QAAA,yBAAyB,GAAG,wCAAqB,CAAC;AAMlD,QAAA,uBAAuB,GAAG,sCAAmB,CAAC,MAAM,CAAC;IAChE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC1C,OAAO,EAAE,iDAAiD;KAC3D,CAAC;CACH,CAAC,CAAC;AAmBU,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,kCAAwB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,gCAAwB;IACjC,MAAM,EAAE,+BAAuB;IAC/B,QAAQ,EAAE,iCAAyB;IACnC,OAAO,EAAE,gCAAwB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAcZ,IAAY,qBAiBX;AAjBD,WAAY,qBAAqB;IAE/B,2DAAkC,CAAA;IAElC,8DAAqC,CAAA;IAErC,wEAA+C,CAAA;IAE/C,mEAA0C,CAAA;IAE1C,4EAAmD,CAAA;IAEnD,2FAAkE,CAAA;IAElE,2DAAkC,CAAA;IAElC,mEAA0C,CAAA;AAC5C,CAAC,EAjBW,qBAAqB,qCAArB,qBAAqB,QAiBhC;AAEY,QAAA,2BAA2B,GAAG,OAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAO/E,IAAY,oBAaX;AAbD,WAAY,oBAAoB;IAE9B,uDAA+B,CAAA;IAE/B,4DAAoC,CAAA;IAEpC,sEAA8C,CAAA;IAE9C,oDAA4B,CAAA;IAE5B,wDAAgC,CAAA;IAEhC,8DAAsC,CAAA;AACxC,CAAC,EAbW,oBAAoB,oCAApB,oBAAoB,QAa/B;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAGhE,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,kCAA0B;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,gCAAgC,GAAG,OAAC,CAAC,MAAM,CAAC;IACvD,WAAW,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,kCAA0B,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAUU,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,kCAA0B;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,GAAG,CAAC,0CAAuB,CAAC,CAAC"}

package/dist/contribution/lib/contribution-kind.d.ts

@@ -30,6 +30,7 @@ export declare enum ContributionKind {
     Capability = "capability",
     ResourceOwnership = "resource-ownership",
     ResourceKind = "resource-kind",
+    AuthorizationModule = "authorization-module",
     ResourceDefinition = "resource-definition",
     StageMachine = "stage-machine",
     SearchType = "search-type",

package/dist/contribution/lib/contribution-kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqFxB,oBAAY,gBAAgB;IAW1B,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAuC5B,SAAS,eAAe;IAmBxB,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IA2B1B,WAAW,iBAAiB;IAQ5B,YAAY,kBAAkB;IAE9B,YAAY,kBAAkB;IAE9B,gBAAgB,uBAAuB;IAEvC,QAAQ,aAAa;IAErB,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAclC,kBAAkB,yBAAyB;IAY3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAe1B,oBAAoB,0BAA0B;IAG9C,gBAAgB,sBAAsB;IAmBtC,eAAe,qBAAqB;IAIpC,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAMxC,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IA4C1B,YAAY,kBAAkB;IAuB9B,cAAc,oBAAoB;IAmClC,UAAU,eAAe;IAezB,iBAAiB,uBAAuB;IAwCxC,YAAY,kBAAkB;IAa9B,kBAAkB,wBAAwB;IAc1C,YAAY,kBAAkB;IAkB9B,UAAU,gBAAgB;IAoB1B,kBAAkB,wBAAwB;IAmB1C,mBAAmB,0BAA0B;IA4B7C,YAAY,kBAAkB;IA0B9B,0BAA0B,kCAAkC;IAkB5D,eAAe,qBAAqB;IAsCpC,sBAAsB,4BAA4B;IAoClD,0BAA0B,sBAAsB;CACjD;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqFxB,oBAAY,gBAAgB;IAW1B,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAuC5B,SAAS,eAAe;IAmBxB,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IA2B1B,WAAW,iBAAiB;IAQ5B,YAAY,kBAAkB;IAE9B,YAAY,kBAAkB;IAE9B,gBAAgB,uBAAuB;IAEvC,QAAQ,aAAa;IAErB,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAclC,kBAAkB,yBAAyB;IAY3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAe1B,oBAAoB,0BAA0B;IAG9C,gBAAgB,sBAAsB;IAmBtC,eAAe,qBAAqB;IAIpC,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAMxC,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IA4C1B,YAAY,kBAAkB;IAuB9B,cAAc,oBAAoB;IAmClC,UAAU,eAAe;IAsBzB,iBAAiB,uBAAuB;IA8CxC,YAAY,kBAAkB;IAsB9B,mBAAmB,yBAAyB;IAa5C,kBAAkB,wBAAwB;IAc1C,YAAY,kBAAkB;IAkB9B,UAAU,gBAAgB;IAoB1B,kBAAkB,wBAAwB;IAmB1C,mBAAmB,0BAA0B;IA4B7C,YAAY,kBAAkB;IA0B9B,0BAA0B,kCAAkC;IAkB5D,eAAe,qBAAqB;IAsCpC,sBAAsB,4BAA4B;IAoClD,0BAA0B,sBAAsB;CACjD;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}

package/dist/contribution/lib/contribution-kind.js

@@ -34,6 +34,7 @@ var ContributionKind;
     ContributionKind["Capability"] = "capability";
     ContributionKind["ResourceOwnership"] = "resource-ownership";
     ContributionKind["ResourceKind"] = "resource-kind";
+    ContributionKind["AuthorizationModule"] = "authorization-module";
     ContributionKind["ResourceDefinition"] = "resource-definition";
     ContributionKind["StageMachine"] = "stage-machine";
     ContributionKind["SearchType"] = "search-type";

package/dist/contribution/lib/contribution-kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAqFxB,IAAY,gBA2lBX;AA3lBD,WAAY,gBAAgB;IAW1B,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAuC5B,4CAAwB,CAAA;IAmBxB,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IA2B1B,gDAA4B,CAAA;IAQ5B,kDAA8B,CAAA;IAE9B,kDAA8B,CAAA;IAE9B,2DAAuC,CAAA;IAEvC,yCAAqB,CAAA;IAErB,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAclC,+DAA2C,CAAA;IAY3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAe1B,kEAA8C,CAAA;IAG9C,0DAAsC,CAAA;IAmBtC,wDAAoC,CAAA;IAIpC,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAMxC,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IA4C1B,kDAA8B,CAAA;IAuB9B,sDAAkC,CAAA;IAmClC,6CAAyB,CAAA;IAezB,4DAAwC,CAAA;IAwCxC,kDAA8B,CAAA;IAa9B,8DAA0C,CAAA;IAc1C,kDAA8B,CAAA;IAkB9B,8CAA0B,CAAA;IAoB1B,8DAA0C,CAAA;IAmB1C,iEAA6C,CAAA;IA4B7C,kDAA8B,CAAA;IA0B9B,gFAA4D,CAAA;IAkB5D,wDAAoC,CAAA;IAsCpC,sEAAkD,CAAA;IAoClD,oEAAgD,CAAA;AAClD,CAAC,EA3lBW,gBAAgB,gCAAhB,gBAAgB,QA2lB3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAqFxB,IAAY,gBA8nBX;AA9nBD,WAAY,gBAAgB;IAW1B,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAuC5B,4CAAwB,CAAA;IAmBxB,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IA2B1B,gDAA4B,CAAA;IAQ5B,kDAA8B,CAAA;IAE9B,kDAA8B,CAAA;IAE9B,2DAAuC,CAAA;IAEvC,yCAAqB,CAAA;IAErB,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAclC,+DAA2C,CAAA;IAY3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAe1B,kEAA8C,CAAA;IAG9C,0DAAsC,CAAA;IAmBtC,wDAAoC,CAAA;IAIpC,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAMxC,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IA4C1B,kDAA8B,CAAA;IAuB9B,sDAAkC,CAAA;IAmClC,6CAAyB,CAAA;IAsBzB,4DAAwC,CAAA;IA8CxC,kDAA8B,CAAA;IAsB9B,gEAA4C,CAAA;IAa5C,8DAA0C,CAAA;IAc1C,kDAA8B,CAAA;IAkB9B,8CAA0B,CAAA;IAoB1B,8DAA0C,CAAA;IAmB1C,iEAA6C,CAAA;IA4B7C,kDAA8B,CAAA;IA0B9B,gFAA4D,CAAA;IAkB5D,wDAAoC,CAAA;IAsCpC,sEAAkD,CAAA;IAoClD,oEAAgD,CAAA;AAClD,CAAC,EA9nBW,gBAAgB,gCAAhB,gBAAgB,QA8nB3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}