@xemahq/contracts 0.32.0 → 0.33.0

package/dist/authorization-facts/lib/facts-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts-snapshot.js","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-snapshot.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,6CAAmE;AACnE,+CAA6D;AAchD,QAAA,8BAA8B,GAAG,OAAC;KAC5C,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,2BAAc;IAEpB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,+BAA+B,GAAG,OAAC;KAC7C,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,0CAA4B,CAAC;IAE9C,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,gCAAmB;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,iCAAiC,GAAG,OAAC,CAAC,kBAAkB,CACnE,SAAS,EACT;IACE,OAAC;SACE,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,0CAA4B,EAAE,CAAC;SAC3E,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,OAAO,EAAE,OAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,gCAAmB;QAC3B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC;SACD,MAAM,EAAE;CACZ,CACF,CAAC"}

package/dist/authorization-facts/lib/facts-writer-authority.d.ts

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+import { FactsApplyRefusal, type FactsApplyRequest } from './facts-apply';
+export declare const WritableRelationsSchema: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+export type WritableRelations = z.infer<typeof WritableRelationsSchema>;
+export interface FactsWriterAuthority {
+    readonly biomeId: string;
+    readonly writableRelations: WritableRelations;
+}
+export interface FactsFenceViolation {
+    readonly refusal: FactsApplyRefusal;
+    readonly changeIndex: number | null;
+    readonly message: string;
+}
+export declare function factsFenceViolations(request: FactsApplyRequest, authority: FactsWriterAuthority): FactsFenceViolation[];
+//# sourceMappingURL=facts-writer-authority.d.ts.map

package/dist/authorization-facts/lib/facts-writer-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts-writer-authority.d.ts","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-writer-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAEL,iBAAiB,EACjB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAC;AAevB,eAAO,MAAM,uBAAuB,mDAGnC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,WAAW,oBAAoB;IAEnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;CAC/C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAWD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,oBAAoB,GAC9B,mBAAmB,EAAE,CA6CvB"}

package/dist/authorization-facts/lib/facts-writer-authority.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WritableRelationsSchema = void 0;
+exports.factsFenceViolations = factsFenceViolations;
+const zod_1 = require("zod");
+const authzen_1 = require("../../authzen");
+const fact_tuple_1 = require("./fact-tuple");
+const facts_apply_1 = require("./facts-apply");
+exports.WritableRelationsSchema = zod_1.z.record(fact_tuple_1.FactTypeSchema, zod_1.z.array(fact_tuple_1.FactRelationSchema).min(1));
+function factsFenceViolations(request, authority) {
+    const violations = [];
+    if (request.biomeId !== authority.biomeId) {
+        violations.push({
+            refusal: facts_apply_1.FactsApplyRefusal.WriterMismatch,
+            changeIndex: null,
+            message: `the request writes as biome "${request.biomeId}" but the caller is biome "${authority.biomeId}".`,
+        });
+        return violations;
+    }
+    request.changes.forEach((change, index) => {
+        const { object } = change;
+        const writable = authority.writableRelations[object.type];
+        if (writable === undefined) {
+            violations.push({
+                refusal: facts_apply_1.FactsApplyRefusal.TypeNotWritable,
+                changeIndex: index,
+                message: `biome "${authority.biomeId}" may not write facts on type "${object.type}".`,
+            });
+            return;
+        }
+        if (!(0, authzen_1.resourceBelongsToOrg)(object, request.orgId)) {
+            violations.push({
+                refusal: facts_apply_1.FactsApplyRefusal.TenantMismatch,
+                changeIndex: index,
+                message: `object ${object.type}:${object.id} is not in org "${request.orgId}".`,
+            });
+        }
+        const relations = change.kind === facts_apply_1.FactChangeKind.Delta
+            ? [...change.writes, ...change.deletes].map((t) => t.relation)
+            : change.kind === facts_apply_1.FactChangeKind.DesiredState
+                ? Object.keys(change.relations)
+                : [];
+        for (const relation of new Set(relations)) {
+            if (!writable.includes(relation)) {
+                violations.push({
+                    refusal: facts_apply_1.FactsApplyRefusal.RelationNotWritable,
+                    changeIndex: index,
+                    message: `relation "${object.type}#${relation}" is not writable by biome "${authority.biomeId}".`,
+                });
+            }
+        }
+    });
+    return violations;
+}
+//# sourceMappingURL=facts-writer-authority.js.map

package/dist/authorization-facts/lib/facts-writer-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts-writer-authority.js","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-writer-authority.ts"],"names":[],"mappings":";;;AAmDA,oDAgDC;AAnGD,6BAAwB;AAExB,2CAAqD;AAErD,6CAAkE;AAClE,+CAIuB;AAeV,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAC7C,2BAAc,EACd,OAAC,CAAC,KAAK,CAAC,+BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACnC,CAAC;AAwBF,SAAgB,oBAAoB,CAClC,OAA0B,EAC1B,SAA+B;IAE/B,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;QAC1C,UAAU,CAAC,IAAI,CAAC;YACd,OAAO,EAAE,+BAAiB,CAAC,cAAc;YACzC,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,gCAAgC,OAAO,CAAC,OAAO,8BAA8B,SAAS,CAAC,OAAO,IAAI;SAC5G,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,+BAAiB,CAAC,eAAe;gBAC1C,WAAW,EAAE,KAAK;gBAClB,OAAO,EAAE,UAAU,SAAS,CAAC,OAAO,kCAAkC,MAAM,CAAC,IAAI,IAAI;aACtF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAA,8BAAoB,EAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,+BAAiB,CAAC,cAAc;gBACzC,WAAW,EAAE,KAAK;gBAClB,OAAO,EAAE,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,mBAAmB,OAAO,CAAC,KAAK,IAAI;aAChF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GACb,MAAM,CAAC,IAAI,KAAK,4BAAc,CAAC,KAAK;YAClC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9D,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,4BAAc,CAAC,YAAY;gBAC3C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC/B,CAAC,CAAC,EAAE,CAAC;QACX,KAAK,MAAM,QAAQ,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,UAAU,CAAC,IAAI,CAAC;oBACd,OAAO,EAAE,+BAAiB,CAAC,mBAAmB;oBAC9C,WAAW,EAAE,KAAK;oBAClB,OAAO,EAAE,aAAa,MAAM,CAAC,IAAI,IAAI,QAAQ,+BAA+B,SAAS,CAAC,OAAO,IAAI;iBAClG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/authorization-facts/lib/revoke-intent.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+export declare enum RevokeIntentState {
+    Pending = "pending",
+    Applied = "applied",
+    Settled = "settled"
+}
+export declare const RevokeIntentStateSchema: z.ZodEnum<typeof RevokeIntentState>;
+export declare const REVOKE_INTENT_TRANSITIONS: Readonly<Record<RevokeIntentState, readonly RevokeIntentState[]>>;
+export declare function isLegalRevokeIntentTransition(from: RevokeIntentState, to: RevokeIntentState): boolean;
+export declare const RevokeIntentSchema: z.ZodObject<{
+    id: z.ZodString;
+    orgId: z.ZodString;
+    object: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    version: z.ZodNumber;
+    state: z.ZodEnum<typeof RevokeIntentState>;
+    createdAt: z.ZodString;
+    attempts: z.ZodNumber;
+}, z.core.$strict>;
+export type RevokeIntent = z.infer<typeof RevokeIntentSchema>;
+//# sourceMappingURL=revoke-intent.d.ts.map

package/dist/authorization-facts/lib/revoke-intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke-intent.d.ts","sourceRoot":"","sources":["../../../src/authorization-facts/lib/revoke-intent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA4BxB,oBAAY,iBAAiB;IAE3B,OAAO,YAAY;IAEnB,OAAO,YAAY;IAEnB,OAAO,YAAY;CACpB;AAED,eAAO,MAAM,uBAAuB,qCAAkC,CAAC;AAOvE,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAC9C,MAAM,CAAC,iBAAiB,EAAE,SAAS,iBAAiB,EAAE,CAAC,CAQvD,CAAC;AAEH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAET;AAED,eAAO,MAAM,kBAAkB;;;;;;;;;;;kBAUpB,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/authorization-facts/lib/revoke-intent.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RevokeIntentSchema = exports.REVOKE_INTENT_TRANSITIONS = exports.RevokeIntentStateSchema = exports.RevokeIntentState = void 0;
+exports.isLegalRevokeIntentTransition = isLegalRevokeIntentTransition;
+const zod_1 = require("zod");
+const fact_tuple_1 = require("./fact-tuple");
+const facts_apply_1 = require("./facts-apply");
+var RevokeIntentState;
+(function (RevokeIntentState) {
+    RevokeIntentState["Pending"] = "pending";
+    RevokeIntentState["Applied"] = "applied";
+    RevokeIntentState["Settled"] = "settled";
+})(RevokeIntentState || (exports.RevokeIntentState = RevokeIntentState = {}));
+exports.RevokeIntentStateSchema = zod_1.z.nativeEnum(RevokeIntentState);
+exports.REVOKE_INTENT_TRANSITIONS = Object.freeze({
+    [RevokeIntentState.Pending]: Object.freeze([
+        RevokeIntentState.Applied,
+        RevokeIntentState.Settled,
+    ]),
+    [RevokeIntentState.Applied]: Object.freeze([RevokeIntentState.Settled]),
+    [RevokeIntentState.Settled]: Object.freeze([]),
+});
+function isLegalRevokeIntentTransition(from, to) {
+    return exports.REVOKE_INTENT_TRANSITIONS[from].includes(to);
+}
+exports.RevokeIntentSchema = zod_1.z
+    .object({
+    id: zod_1.z.string().min(1),
+    orgId: zod_1.z.string().min(1),
+    object: fact_tuple_1.FactObjectRefSchema,
+    version: facts_apply_1.FactsVersionSchema,
+    state: exports.RevokeIntentStateSchema,
+    createdAt: zod_1.z.string().datetime(),
+    attempts: zod_1.z.number().int().nonnegative(),
+})
+    .strict();
+//# sourceMappingURL=revoke-intent.js.map

package/dist/authorization-facts/lib/revoke-intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke-intent.js","sourceRoot":"","sources":["../../../src/authorization-facts/lib/revoke-intent.ts"],"names":[],"mappings":";;;AAuDA,sEAKC;AA5DD,6BAAwB;AAExB,6CAAmD;AACnD,+CAAmD;AAyBnD,IAAY,iBAOX;AAPD,WAAY,iBAAiB;IAE3B,wCAAmB,CAAA;IAEnB,wCAAmB,CAAA;IAEnB,wCAAmB,CAAA;AACrB,CAAC,EAPW,iBAAiB,iCAAjB,iBAAiB,QAO5B;AAEY,QAAA,uBAAuB,GAAG,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AAO1D,QAAA,yBAAyB,GAElC,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACzC,iBAAiB,CAAC,OAAO;QACzB,iBAAiB,CAAC,OAAO;KAC1B,CAAC;IACF,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH,SAAgB,6BAA6B,CAC3C,IAAuB,EACvB,EAAqB;IAErB,OAAO,iCAAyB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACtD,CAAC;AAEY,QAAA,kBAAkB,GAAG,OAAC;KAChC,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,gCAAkB;IAC3B,KAAK,EAAE,+BAAuB;IAC9B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/authorization-module/index.d.ts

@@ -0,0 +1,6 @@
+export * from './lib/authorization-namespace';
+export * from './lib/platform-authorization-modules';
+export * from './lib/authorization-module-envelope';
+export * from './lib/authorization-module-contribution';
+export * from './lib/authorization-composition-error';
+//# sourceMappingURL=index.d.ts.map

package/dist/authorization-module/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization-module/index.ts"],"names":[],"mappings":"AAAA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC"}

package/dist/authorization-module/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/authorization-namespace"), exports);
+__exportStar(require("./lib/platform-authorization-modules"), exports);
+__exportStar(require("./lib/authorization-module-envelope"), exports);
+__exportStar(require("./lib/authorization-module-contribution"), exports);
+__exportStar(require("./lib/authorization-composition-error"), exports);
+//# sourceMappingURL=index.js.map

package/dist/authorization-module/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gEAA8C;AAC9C,uEAAqD;AACrD,sEAAoD;AACpD,0EAAwD;AACxD,wEAAsD"}

package/dist/authorization-module/lib/authorization-composition-error.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+export declare enum AuthorizationCompositionViolationCode {
+    InvalidBiomeId = "invalid_biome_id",
+    NamespaceMismatch = "namespace_mismatch",
+    NamespaceCollision = "namespace_collision",
+    PlatformGenerationRefused = "platform_generation_refused",
+    ModuleFileMismatch = "module_file_mismatch",
+    ModuleNameMismatch = "module_name_mismatch",
+    TypeOutsideNamespace = "type_outside_namespace",
+    ConditionOutsideNamespace = "condition_outside_namespace",
+    ExtendsForeignType = "extends_foreign_type",
+    ReferenceNotExported = "reference_not_exported",
+    ReferenceNotImported = "reference_not_imported",
+    ReferenceNotDependedOn = "reference_not_depended_on",
+    ResourceTypesMismatch = "resource_types_mismatch",
+    UndeclaredWildcard = "undeclared_wildcard",
+    UnconditionedWildcardNotAllowed = "unconditioned_wildcard_not_allowed",
+    DependencyNotDeclaredByBiome = "dependency_not_declared_by_biome",
+    DependencyMissing = "dependency_missing",
+    DependencyVersionTooLow = "dependency_version_too_low",
+    DependencyTierViolation = "dependency_tier_violation",
+    DependencyCycle = "dependency_cycle",
+    InterfaceNotImplemented = "interface_not_implemented",
+    ImplementsForeignType = "implements_foreign_type",
+    WritableRelationInvalid = "writable_relation_invalid",
+    SearchableInvalid = "searchable_invalid",
+    PlatformTemplateInvalid = "platform_template_invalid",
+    TransformerRefused = "transformer_refused",
+    BudgetExceeded = "budget_exceeded",
+    ModuleVersionDowngrade = "module_version_downgrade",
+    ModuleVersionReused = "module_version_reused",
+    IncompatibleChangeUndeclared = "incompatible_change_undeclared",
+    MigrationFromWrongVersion = "migration_from_wrong_version"
+}
+export declare const AuthorizationCompositionViolationCodeSchema: z.ZodEnum<typeof AuthorizationCompositionViolationCode>;
+export interface AuthorizationCompositionViolation {
+    readonly code: AuthorizationCompositionViolationCode;
+    readonly owner: string;
+    readonly message: string;
+}
+export declare class AuthorizationCompositionError extends Error {
+    readonly violations: readonly AuthorizationCompositionViolation[];
+    constructor(violations: readonly AuthorizationCompositionViolation[]);
+}
+//# sourceMappingURL=authorization-composition-error.d.ts.map

package/dist/authorization-module/lib/authorization-composition-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-composition-error.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-composition-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,oBAAY,qCAAqC;IAE/C,cAAc,qBAAqB;IACnC,iBAAiB,uBAAuB;IACxC,kBAAkB,wBAAwB;IAC1C,yBAAyB,gCAAgC;IACzD,kBAAkB,yBAAyB;IAC3C,kBAAkB,yBAAyB;IAE3C,oBAAoB,2BAA2B;IAC/C,yBAAyB,gCAAgC;IACzD,kBAAkB,yBAAyB;IAC3C,oBAAoB,2BAA2B;IAC/C,oBAAoB,2BAA2B;IAC/C,sBAAsB,8BAA8B;IACpD,qBAAqB,4BAA4B;IACjD,kBAAkB,wBAAwB;IAC1C,+BAA+B,uCAAuC;IAEtE,4BAA4B,qCAAqC;IACjE,iBAAiB,uBAAuB;IACxC,uBAAuB,+BAA+B;IACtD,uBAAuB,8BAA8B;IACrD,eAAe,qBAAqB;IAEpC,uBAAuB,8BAA8B;IACrD,qBAAqB,4BAA4B;IACjD,uBAAuB,8BAA8B;IACrD,iBAAiB,uBAAuB;IAExC,uBAAuB,8BAA8B;IAErD,kBAAkB,wBAAwB;IAE1C,cAAc,oBAAoB;IAElC,sBAAsB,6BAA6B;IACnD,mBAAmB,0BAA0B;IAC7C,4BAA4B,mCAAmC;IAC/D,yBAAyB,iCAAiC;CAC3D;AAED,eAAO,MAAM,2CAA2C,yDAEvD,CAAC;AAEF,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,qCAAqC,CAAC;IAErD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,UAAU,EAAE,SAAS,iCAAiC,EAAE,CAAC;gBAEtD,UAAU,EAAE,SAAS,iCAAiC,EAAE;CAUrE"}

package/dist/authorization-module/lib/authorization-composition-error.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationCompositionError = exports.AuthorizationCompositionViolationCodeSchema = exports.AuthorizationCompositionViolationCode = void 0;
+const zod_1 = require("zod");
+var AuthorizationCompositionViolationCode;
+(function (AuthorizationCompositionViolationCode) {
+    AuthorizationCompositionViolationCode["InvalidBiomeId"] = "invalid_biome_id";
+    AuthorizationCompositionViolationCode["NamespaceMismatch"] = "namespace_mismatch";
+    AuthorizationCompositionViolationCode["NamespaceCollision"] = "namespace_collision";
+    AuthorizationCompositionViolationCode["PlatformGenerationRefused"] = "platform_generation_refused";
+    AuthorizationCompositionViolationCode["ModuleFileMismatch"] = "module_file_mismatch";
+    AuthorizationCompositionViolationCode["ModuleNameMismatch"] = "module_name_mismatch";
+    AuthorizationCompositionViolationCode["TypeOutsideNamespace"] = "type_outside_namespace";
+    AuthorizationCompositionViolationCode["ConditionOutsideNamespace"] = "condition_outside_namespace";
+    AuthorizationCompositionViolationCode["ExtendsForeignType"] = "extends_foreign_type";
+    AuthorizationCompositionViolationCode["ReferenceNotExported"] = "reference_not_exported";
+    AuthorizationCompositionViolationCode["ReferenceNotImported"] = "reference_not_imported";
+    AuthorizationCompositionViolationCode["ReferenceNotDependedOn"] = "reference_not_depended_on";
+    AuthorizationCompositionViolationCode["ResourceTypesMismatch"] = "resource_types_mismatch";
+    AuthorizationCompositionViolationCode["UndeclaredWildcard"] = "undeclared_wildcard";
+    AuthorizationCompositionViolationCode["UnconditionedWildcardNotAllowed"] = "unconditioned_wildcard_not_allowed";
+    AuthorizationCompositionViolationCode["DependencyNotDeclaredByBiome"] = "dependency_not_declared_by_biome";
+    AuthorizationCompositionViolationCode["DependencyMissing"] = "dependency_missing";
+    AuthorizationCompositionViolationCode["DependencyVersionTooLow"] = "dependency_version_too_low";
+    AuthorizationCompositionViolationCode["DependencyTierViolation"] = "dependency_tier_violation";
+    AuthorizationCompositionViolationCode["DependencyCycle"] = "dependency_cycle";
+    AuthorizationCompositionViolationCode["InterfaceNotImplemented"] = "interface_not_implemented";
+    AuthorizationCompositionViolationCode["ImplementsForeignType"] = "implements_foreign_type";
+    AuthorizationCompositionViolationCode["WritableRelationInvalid"] = "writable_relation_invalid";
+    AuthorizationCompositionViolationCode["SearchableInvalid"] = "searchable_invalid";
+    AuthorizationCompositionViolationCode["PlatformTemplateInvalid"] = "platform_template_invalid";
+    AuthorizationCompositionViolationCode["TransformerRefused"] = "transformer_refused";
+    AuthorizationCompositionViolationCode["BudgetExceeded"] = "budget_exceeded";
+    AuthorizationCompositionViolationCode["ModuleVersionDowngrade"] = "module_version_downgrade";
+    AuthorizationCompositionViolationCode["ModuleVersionReused"] = "module_version_reused";
+    AuthorizationCompositionViolationCode["IncompatibleChangeUndeclared"] = "incompatible_change_undeclared";
+    AuthorizationCompositionViolationCode["MigrationFromWrongVersion"] = "migration_from_wrong_version";
+})(AuthorizationCompositionViolationCode || (exports.AuthorizationCompositionViolationCode = AuthorizationCompositionViolationCode = {}));
+exports.AuthorizationCompositionViolationCodeSchema = zod_1.z.nativeEnum(AuthorizationCompositionViolationCode);
+class AuthorizationCompositionError extends Error {
+    violations;
+    constructor(violations) {
+        super(`authorization model composition refused with ${violations.length} violation(s):\n` +
+            violations
+                .map((v) => `  - [${v.code}] ${v.owner}: ${v.message}`)
+                .join('\n'));
+        this.name = 'AuthorizationCompositionError';
+        this.violations = violations;
+    }
+}
+exports.AuthorizationCompositionError = AuthorizationCompositionError;
+//# sourceMappingURL=authorization-composition-error.js.map

package/dist/authorization-module/lib/authorization-composition-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-composition-error.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-composition-error.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAOxB,IAAY,qCAwCX;AAxCD,WAAY,qCAAqC;IAE/C,4EAAmC,CAAA;IACnC,iFAAwC,CAAA;IACxC,mFAA0C,CAAA;IAC1C,kGAAyD,CAAA;IACzD,oFAA2C,CAAA;IAC3C,oFAA2C,CAAA;IAE3C,wFAA+C,CAAA;IAC/C,kGAAyD,CAAA;IACzD,oFAA2C,CAAA;IAC3C,wFAA+C,CAAA;IAC/C,wFAA+C,CAAA;IAC/C,6FAAoD,CAAA;IACpD,0FAAiD,CAAA;IACjD,mFAA0C,CAAA;IAC1C,+GAAsE,CAAA;IAEtE,0GAAiE,CAAA;IACjE,iFAAwC,CAAA;IACxC,+FAAsD,CAAA;IACtD,8FAAqD,CAAA;IACrD,6EAAoC,CAAA;IAEpC,8FAAqD,CAAA;IACrD,0FAAiD,CAAA;IACjD,8FAAqD,CAAA;IACrD,iFAAwC,CAAA;IAExC,8FAAqD,CAAA;IAErD,mFAA0C,CAAA;IAE1C,2EAAkC,CAAA;IAElC,4FAAmD,CAAA;IACnD,sFAA6C,CAAA;IAC7C,wGAA+D,CAAA;IAC/D,mGAA0D,CAAA;AAC5D,CAAC,EAxCW,qCAAqC,qDAArC,qCAAqC,QAwChD;AAEY,QAAA,2CAA2C,GAAG,OAAC,CAAC,UAAU,CACrE,qCAAqC,CACtC,CAAC;AAUF,MAAa,6BAA8B,SAAQ,KAAK;IAC7C,UAAU,CAA+C;IAElE,YAAY,UAAwD;QAClE,KAAK,CACH,gDAAgD,UAAU,CAAC,MAAM,kBAAkB;YACjF,UAAU;iBACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;iBACtD,IAAI,CAAC,IAAI,CAAC,CAChB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAbD,sEAaC"}

package/dist/authorization-module/lib/authorization-module-contribution.d.ts

@@ -0,0 +1,143 @@
+import { z } from 'zod';
+export declare const AuthorizationModuleFileSchema: z.ZodObject<{
+    name: z.ZodString;
+    contents: z.ZodString;
+}, z.core.$strict>;
+export type AuthorizationModuleFile = z.infer<typeof AuthorizationModuleFileSchema>;
+export declare const AuthorizationModuleTestFileSchema: z.ZodObject<{
+    name: z.ZodString;
+    contents: z.ZodString;
+}, z.core.$strict>;
+export type AuthorizationModuleTestFile = z.infer<typeof AuthorizationModuleTestFileSchema>;
+export declare const AuthorizationModuleSourceManifestSchema: z.ZodObject<{
+    envelope: z.ZodObject<{
+        namespace: z.ZodOptional<z.ZodString>;
+        moduleVersion: z.ZodNumber;
+        platformGeneration: z.ZodString;
+        files: z.ZodArray<z.ZodString>;
+        tests: z.ZodString;
+        imports: z.ZodArray<z.ZodEnum<typeof import("./platform-authorization-modules").PlatformAuthorizationModule>>;
+        dependsOn: z.ZodArray<z.ZodObject<{
+            biome: z.ZodString;
+            minModuleVersion: z.ZodNumber;
+        }, z.core.$strict>>;
+        implements: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<typeof import("./platform-authorization-modules").XemaAuthorizationInterface>>>;
+        resourceTypes: z.ZodArray<z.ZodString>;
+        writableRelations: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+        searchable: z.ZodRecord<z.ZodString, z.ZodObject<{
+            anchor: z.ZodOptional<z.ZodString>;
+            highCardinality: z.ZodBoolean;
+        }, z.core.$strict>>;
+        publicWildcards: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+        migrations: z.ZodArray<z.ZodObject<{
+            from: z.ZodNumber;
+            steps: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<import("./authorization-module-envelope").AuthorizationMigrationStepKind.RenameType>;
+                from: z.ZodString;
+                to: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<import("./authorization-module-envelope").AuthorizationMigrationStepKind.RenameRelation>;
+                type: z.ZodString;
+                from: z.ZodString;
+                to: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<import("./authorization-module-envelope").AuthorizationMigrationStepKind.DropType>;
+                type: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<import("./authorization-module-envelope").AuthorizationMigrationStepKind.DropRelation>;
+                type: z.ZodString;
+                relation: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<import("./authorization-module-envelope").AuthorizationMigrationStepKind.NarrowRestriction>;
+                type: z.ZodString;
+                relation: z.ZodString;
+                removed: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>], "kind">>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    moduleFiles: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        contents: z.ZodString;
+    }, z.core.$strict>>;
+    testFile: z.ZodObject<{
+        name: z.ZodString;
+        contents: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type AuthorizationModuleSourceManifest = z.infer<typeof AuthorizationModuleSourceManifestSchema>;
+export declare const SignedBiomeAuthorizationFactsSchema: z.ZodObject<{
+    tier: z.ZodEnum<typeof import("../../biome").BiomeTier>;
+    declaredBiomeDependencies: z.ZodArray<z.ZodString>;
+    serviceNames: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type SignedBiomeAuthorizationFacts = z.infer<typeof SignedBiomeAuthorizationFactsSchema>;
+export declare const AuthorizationModuleContributionManifestSchema: z.ZodObject<{
+    envelope: z.ZodObject<{
+        namespace: z.ZodOptional<z.ZodString>;
+        moduleVersion: z.ZodNumber;
+        platformGeneration: z.ZodString;
+        files: z.ZodArray<z.ZodString>;
+        tests: z.ZodString;
+        imports: z.ZodArray<z.ZodEnum<typeof import("./platform-authorization-modules").PlatformAuthorizationModule>>;
+        dependsOn: z.ZodArray<z.ZodObject<{
+            biome: z.ZodString;
+            minModuleVersion: z.ZodNumber;
+        }, z.core.$strict>>;
+        implements: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<typeof import("./platform-authorization-modules").XemaAuthorizationInterface>>>;
+        resourceTypes: z.ZodArray<z.ZodString>;
+        writableRelations: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+        searchable: z.ZodRecord<z.ZodString, z.ZodObject<{
+            anchor: z.ZodOptional<z.ZodString>;
+            highCardinality: z.ZodBoolean;
+        }, z.core.$strict>>;
+        publicWildcards: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+        migrations: z.ZodArray<z.ZodObject<{
+            from: z.ZodNumber;
+            steps: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<import("./authorization-module-envelope").AuthorizationMigrationStepKind.RenameType>;
+                from: z.ZodString;
+                to: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<import("./authorization-module-envelope").AuthorizationMigrationStepKind.RenameRelation>;
+                type: z.ZodString;
+                from: z.ZodString;
+                to: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<import("./authorization-module-envelope").AuthorizationMigrationStepKind.DropType>;
+                type: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<import("./authorization-module-envelope").AuthorizationMigrationStepKind.DropRelation>;
+                type: z.ZodString;
+                relation: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<import("./authorization-module-envelope").AuthorizationMigrationStepKind.NarrowRestriction>;
+                type: z.ZodString;
+                relation: z.ZodString;
+                removed: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>], "kind">>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    moduleFiles: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        contents: z.ZodString;
+    }, z.core.$strict>>;
+    testFile: z.ZodObject<{
+        name: z.ZodString;
+        contents: z.ZodString;
+    }, z.core.$strict>;
+    signedBiome: z.ZodObject<{
+        tier: z.ZodEnum<typeof import("../../biome").BiomeTier>;
+        declaredBiomeDependencies: z.ZodArray<z.ZodString>;
+        serviceNames: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type AuthorizationModuleContributionManifest = z.infer<typeof AuthorizationModuleContributionManifestSchema>;
+export declare class AuthorizationModuleContributionError extends Error {
+    constructor(message: string);
+}
+export declare function stampAuthorizationModuleContribution(source: unknown, signedBiome: SignedBiomeAuthorizationFacts): AuthorizationModuleContributionManifest;
+export declare function resolveFactsWriterBiome(callerServiceName: string, modules: ReadonlyArray<{
+    readonly biomeId: string;
+    readonly manifest: AuthorizationModuleContributionManifest;
+}>): string | null;
+//# sourceMappingURL=authorization-module-contribution.d.ts.map

package/dist/authorization-module/lib/authorization-module-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-module-contribution.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0BxB,eAAO,MAAM,6BAA6B;;;kBAK/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;kBAKnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAGF,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2BhD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAsBF,eAAO,MAAM,mCAAmC;;;;kBAQrC,CAAC;AACZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAGF,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgBtD,CAAC;AACL,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAC3D,OAAO,6CAA6C,CACrD,CAAC;AAGF,qBAAa,oCAAqC,SAAQ,KAAK;gBACjD,OAAO,EAAE,MAAM;CAI5B;AAOD,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,6BAA6B,GACzC,uCAAuC,CAsBzC;AAQD,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,MAAM,EACzB,OAAO,EAAE,aAAa,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,uCAAuC,CAAC;CAC5D,CAAC,GACD,MAAM,GAAG,IAAI,CAUf"}

package/dist/authorization-module/lib/authorization-module-contribution.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationModuleContributionError = exports.AuthorizationModuleContributionManifestSchema = exports.SignedBiomeAuthorizationFactsSchema = exports.AuthorizationModuleSourceManifestSchema = exports.AuthorizationModuleTestFileSchema = exports.AuthorizationModuleFileSchema = void 0;
+exports.stampAuthorizationModuleContribution = stampAuthorizationModuleContribution;
+exports.resolveFactsWriterBiome = resolveFactsWriterBiome;
+const zod_1 = require("zod");
+const biome_1 = require("../../biome");
+const authorization_module_envelope_1 = require("./authorization-module-envelope");
+exports.AuthorizationModuleFileSchema = zod_1.z
+    .object({
+    name: zod_1.z.string().regex(authorization_module_envelope_1.AUTHORIZATION_MODULE_FILE_PATTERN),
+    contents: zod_1.z.string().min(1),
+})
+    .strict();
+exports.AuthorizationModuleTestFileSchema = zod_1.z
+    .object({
+    name: zod_1.z.string().regex(authorization_module_envelope_1.AUTHORIZATION_MODULE_TEST_FILE_PATTERN),
+    contents: zod_1.z.string().min(1),
+})
+    .strict();
+exports.AuthorizationModuleSourceManifestSchema = zod_1.z
+    .object({
+    envelope: authorization_module_envelope_1.AuthorizationModuleEnvelopeSchema,
+    moduleFiles: zod_1.z.array(exports.AuthorizationModuleFileSchema).min(1),
+    testFile: exports.AuthorizationModuleTestFileSchema,
+})
+    .strict()
+    .superRefine((manifest, ctx) => {
+    const declared = [...manifest.envelope.files].sort();
+    const carried = manifest.moduleFiles.map((f) => f.name).sort();
+    if (declared.length !== carried.length ||
+        declared.some((name, i) => name !== carried[i])) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['moduleFiles'],
+            message: `the carried module files [${carried.join(', ')}] must be exactly the envelope's files [${declared.join(', ')}].`,
+        });
+    }
+    if (manifest.testFile.name !== manifest.envelope.tests) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['testFile', 'name'],
+            message: `the carried test file "${manifest.testFile.name}" is not the envelope's tests "${manifest.envelope.tests}".`,
+        });
+    }
+});
+function uniqueNonEmptyStrings(what) {
+    return zod_1.z
+        .array(zod_1.z.string().min(1))
+        .refine((values) => new Set(values).size === values.length, {
+        message: `${what} must not repeat an entry.`,
+    });
+}
+exports.SignedBiomeAuthorizationFactsSchema = zod_1.z
+    .object({
+    tier: biome_1.BiomeTierSchema,
+    declaredBiomeDependencies: uniqueNonEmptyStrings('declaredBiomeDependencies'),
+    serviceNames: uniqueNonEmptyStrings('serviceNames'),
+})
+    .strict();
+exports.AuthorizationModuleContributionManifestSchema = zod_1.z
+    .object({
+    envelope: authorization_module_envelope_1.AuthorizationModuleEnvelopeSchema,
+    moduleFiles: zod_1.z.array(exports.AuthorizationModuleFileSchema).min(1),
+    testFile: exports.AuthorizationModuleTestFileSchema,
+    signedBiome: exports.SignedBiomeAuthorizationFactsSchema,
+})
+    .strict()
+    .superRefine((manifest, ctx) => {
+    const { signedBiome: _signedBiome, ...source } = manifest;
+    const result = exports.AuthorizationModuleSourceManifestSchema.safeParse(source);
+    if (!result.success) {
+        for (const issue of result.error.issues) {
+            ctx.addIssue({ code: 'custom', path: issue.path, message: issue.message });
+        }
+    }
+});
+class AuthorizationModuleContributionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AuthorizationModuleContributionError';
+    }
+}
+exports.AuthorizationModuleContributionError = AuthorizationModuleContributionError;
+function stampAuthorizationModuleContribution(source, signedBiome) {
+    if (source !== null &&
+        typeof source === 'object' &&
+        Object.prototype.hasOwnProperty.call(source, 'signedBiome')) {
+        throw new AuthorizationModuleContributionError('the contribution declares `signedBiome`; that block is stamped by the parser from the signed biome manifest and an author must never set it.');
+    }
+    const parsed = exports.AuthorizationModuleSourceManifestSchema.safeParse(source);
+    if (!parsed.success) {
+        throw new AuthorizationModuleContributionError(`the authorization-module contribution does not parse: ${parsed.error.issues
+            .map((i) => `${i.path.join('.')}: ${i.message}`)
+            .join('; ')}`);
+    }
+    return exports.AuthorizationModuleContributionManifestSchema.parse({
+        ...parsed.data,
+        signedBiome: exports.SignedBiomeAuthorizationFactsSchema.parse(signedBiome),
+    });
+}
+function resolveFactsWriterBiome(callerServiceName, modules) {
+    const owners = modules
+        .filter((m) => m.manifest.signedBiome.serviceNames.includes(callerServiceName))
+        .map((m) => m.biomeId);
+    if (owners.length > 1) {
+        throw new AuthorizationModuleContributionError(`service "${callerServiceName}" is claimed by more than one biome (${owners.sort().join(', ')}); refusing to choose.`);
+    }
+    return owners[0] ?? null;
+}
+//# sourceMappingURL=authorization-module-contribution.js.map

package/dist/authorization-module/lib/authorization-module-contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-module-contribution.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-contribution.ts"],"names":[],"mappings":";;;AAmJA,oFAyBC;AAQD,0DAgBC;AApMD,6BAAwB;AAExB,uCAA8C;AAE9C,mFAIyC;AAkB5B,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iEAAiC,CAAC;IACzD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sEAAsC,CAAC;IAC9D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,uCAAuC,GAAG,OAAC;KACrD,MAAM,CAAC;IACN,QAAQ,EAAE,iEAAiC;IAC3C,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,QAAQ,EAAE,yCAAiC;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IACE,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAClC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAC/C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAC3H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;YAC1B,OAAO,EAAE,0BAA0B,QAAQ,CAAC,QAAQ,CAAC,IAAI,kCAAkC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI;SACvH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,OAAC;SACL,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE;QAC1D,OAAO,EAAE,GAAG,IAAI,4BAA4B;KAC7C,CAAC,CAAC;AACP,CAAC;AAcY,QAAA,mCAAmC,GAAG,OAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,uBAAe;IACrB,yBAAyB,EAAE,qBAAqB,CAC9C,2BAA2B,CAC5B;IACD,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,6CAA6C,GAAG,OAAC;KAC3D,MAAM,CAAC;IACN,QAAQ,EAAE,iEAAiC;IAC3C,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,QAAQ,EAAE,yCAAiC;IAC3C,WAAW,EAAE,2CAAmC;CACjD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC1D,MAAM,MAAM,GAAG,+CAAuC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAML,MAAa,oCAAqC,SAAQ,KAAK;IAC7D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AALD,oFAKC;AAOD,SAAgB,oCAAoC,CAClD,MAAe,EACf,WAA0C;IAE1C,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,oCAAoC,CAC5C,8IAA8I,CAC/I,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,+CAAuC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,oCAAoC,CAC5C,yDAAyD,MAAM,CAAC,KAAK,CAAC,MAAM;aACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,qDAA6C,CAAC,KAAK,CAAC;QACzD,GAAG,MAAM,CAAC,IAAI;QACd,WAAW,EAAE,2CAAmC,CAAC,KAAK,CAAC,WAAW,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAQD,SAAgB,uBAAuB,CACrC,iBAAyB,EACzB,OAGE;IAEF,MAAM,MAAM,GAAG,OAAO;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oCAAoC,CAC5C,YAAY,iBAAiB,wCAAwC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC3B,CAAC"}