@xemahq/contracts 0.48.0 → 0.50.0

package/dist/.source-stamp.json

@@ -1,5 +1,5 @@
 {
   "algorithm": "sha256/len-framed-v1",
-  "hash": "b730783c8c08ada3ac04ac2fb159181ccb9fd5fa4d6c95df57cc91e41eb45e9c",
-  "fileCount": 576
+  "hash": "8254f8247303451435201e2bba7b9a89faf3f8317952dc095ce75f67894b919a",
+  "fileCount": 579
 }

package/dist/authorization-module/platform/xema_capability.fga

@@ -12,12 +12,20 @@ module xema_capability
 # `user:*` on `granted_to` is the public-grant idiom: a PLATFORM-owned
 # wildcard, written only by authorization-api's grant door.
 #
-# Every request evaluates against the org's composed policy-set model, so
-# this module is part of EVERY composition — the verb verdict and the
-# instance relation are answered by one model.
+# `org#admin` is the org's ADMINISTRATORS — owner, admin, or a platform admin
+# acting in the org. It is never a stored tuple: the PDP adds it per decision
+# as a CONTEXTUAL tuple from the verified org-authority instrument
+# (`buildOrgAuthorityContextualTuples`, `@xemahq/contracts/authzen`), so a
+# grant to `org:<o>#admin` admits exactly the subjects that instrument names
+# for THIS decision, and nobody once their authority is withdrawn.
+#
+# This module is part of EVERY composition, so a grant tuple is valid under
+# every composed model. The capability verdict must therefore evaluate against
+# the org's composed policy set WITH the contextual tuples; a check that runs
+# without them can never see an administrator grant.
 # ═══════════════════════════════════════════════════════════════════════════
 
 type capability
   relations
-    define granted_to: [user, user:*, agent, app, service, runner, external-subject, role#assignee, team#member]
-    define granted_pending_approval: [user, agent, app, service, runner, external-subject, role#assignee, team#member]
+    define granted_to: [user, user:*, agent, app, service, runner, external-subject, role#assignee, team#member, org#admin]
+    define granted_pending_approval: [user, agent, app, service, runner, external-subject, role#assignee, team#member, org#admin]

package/dist/authorization-module/platform/xema_capability.fga.yaml

@@ -2,7 +2,10 @@
 # module, run against the BASE composition. Ports the capability-grant
 # semantics authorization-api relies on: direct grants, team grants through
 # nested sub-teams, role grants through team-held assignments, the public
-# `user:*` grant, and the disjoint approval-gated relation.
+# `user:*` grant, the disjoint approval-gated relation, and grants to the
+# org's administrators (`org#admin`). `org#admin` is never stored: the PDP
+# adds it as a CONTEXTUAL tuple per decision, which these tests model as a
+# test-scoped tuple — present in the allow case, absent in the deny cases.
 name: xema_capability
 model_file: ./fga.mod
 tuples:
@@ -42,6 +45,10 @@ tuples:
   - user: runner:r1
     relation: granted_to
     object: capability:runner~3anoop.echo@1|default
+  # grant to the administrators of org o1 (org-scoped capability object)
+  - user: org:o1#admin
+    relation: granted_to
+    object: capability:o1|notification~3aannouncement.publish@1|org
 tests:
   - name: a direct grant admits only its subject
     check:
@@ -106,3 +113,30 @@ tests:
             - capability:kb~3adoc.write@1|default
             - capability:kb~3adoc.publish@1|default
             - capability:catalog~3aread@1|default
+  - name: an administrator grant admits a subject only while it holds org-admin authority in THAT org
+    tuples:
+      # the per-decision contextual tuple the verified instrument produces
+      - user: user:carol
+        relation: admin
+        object: org:o1
+    check:
+      - user: user:carol
+        object: capability:o1|notification~3aannouncement.publish@1|org
+        assertions:
+          granted_to: true
+  - name: an administrator grant denies a subject with no org-authority instrument
+    check:
+      - user: user:carol
+        object: capability:o1|notification~3aannouncement.publish@1|org
+        assertions:
+          granted_to: false
+  - name: an administrator grant denies an administrator of a DIFFERENT org
+    tuples:
+      - user: user:carol
+        relation: admin
+        object: org:o2
+    check:
+      - user: user:carol
+        object: capability:o1|notification~3aannouncement.publish@1|org
+        assertions:
+          granted_to: false

package/dist/authzen/index.d.ts

@@ -5,4 +5,5 @@ export * from './lib/authzen-metadata';
 export * from './lib/xema-authzen-profile';
 export * from './lib/authzen-snapshot';
 export * from './lib/xema-capability-resource';
+export * from './lib/org-authority-contextual-tuple';
 //# sourceMappingURL=index.d.ts.map

package/dist/authzen/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC"}

package/dist/authzen/index.js

@@ -21,4 +21,5 @@ __exportStar(require("./lib/authzen-metadata"), exports);
 __exportStar(require("./lib/xema-authzen-profile"), exports);
 __exportStar(require("./lib/authzen-snapshot"), exports);
 __exportStar(require("./lib/xema-capability-resource"), exports);
+__exportStar(require("./lib/org-authority-contextual-tuple"), exports);
 //# sourceMappingURL=index.js.map

package/dist/authzen/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,2DAAyC;AACzC,uDAAqC;AACrC,yDAAuC;AACvC,6DAA2C;AAC3C,yDAAuC;AACvC,iEAA+C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,2DAAyC;AACzC,uDAAqC;AACrC,yDAAuC;AACvC,6DAA2C;AAC3C,yDAAuC;AACvC,iEAA+C;AAC/C,uEAAqD"}

package/dist/authzen/lib/org-authority-contextual-tuple.d.ts

@@ -0,0 +1,27 @@
+import type { XemaOrgAuthorityInstrument } from './xema-authzen-profile';
+export declare const XEMA_ORG_OBJECT_TYPE = "org";
+export declare const XEMA_ORG_ADMIN_RELATION = "admin";
+export interface AuthzContextualTuple {
+    readonly user: string;
+    readonly relation: string;
+    readonly object: string;
+}
+export declare enum OrgAuthorityContextualTupleRefusal {
+    SubjectNotUser = "subject_not_user",
+    RoleBelowAdmin = "role_below_admin"
+}
+export declare class OrgAuthorityContextualTupleError extends Error {
+    readonly refusal: OrgAuthorityContextualTupleRefusal;
+    constructor(refusal: OrgAuthorityContextualTupleRefusal);
+}
+export declare function buildXemaOrgObject(orgId: string): string;
+export declare function buildOrgAdministratorsUserset(orgId: string): string;
+export declare function buildOrgAuthorityContextualTuples(input: {
+    readonly subject: {
+        readonly kind: string;
+        readonly id: string;
+    };
+    readonly orgId: string;
+    readonly instrument: XemaOrgAuthorityInstrument | undefined;
+}): readonly AuthzContextualTuple[];
+//# sourceMappingURL=org-authority-contextual-tuple.d.ts.map

package/dist/authzen/lib/org-authority-contextual-tuple.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority-contextual-tuple.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AA0BzE,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAC1C,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAG/C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,oBAAY,kCAAkC;IAE5C,cAAc,qBAAqB;IAEnC,cAAc,qBAAqB;CACpC;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,kCAAkC;gBAA3C,OAAO,EAAE,kCAAkC;CAQjE;AAGD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAQD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAOD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,0BAA0B,GAAG,SAAS,CAAC;CAC7D,GAAG,SAAS,oBAAoB,EAAE,CAuBlC"}

package/dist/authzen/lib/org-authority-contextual-tuple.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgAuthorityContextualTupleError = exports.OrgAuthorityContextualTupleRefusal = exports.XEMA_ORG_ADMIN_RELATION = exports.XEMA_ORG_OBJECT_TYPE = void 0;
+exports.buildXemaOrgObject = buildXemaOrgObject;
+exports.buildOrgAdministratorsUserset = buildOrgAdministratorsUserset;
+exports.buildOrgAuthorityContextualTuples = buildOrgAuthorityContextualTuples;
+const audit_1 = require("../../audit");
+const subject_1 = require("../../subject");
+const tenant_1 = require("../../tenant");
+const xema_capability_resource_1 = require("./xema-capability-resource");
+exports.XEMA_ORG_OBJECT_TYPE = 'org';
+exports.XEMA_ORG_ADMIN_RELATION = 'admin';
+var OrgAuthorityContextualTupleRefusal;
+(function (OrgAuthorityContextualTupleRefusal) {
+    OrgAuthorityContextualTupleRefusal["SubjectNotUser"] = "subject_not_user";
+    OrgAuthorityContextualTupleRefusal["RoleBelowAdmin"] = "role_below_admin";
+})(OrgAuthorityContextualTupleRefusal || (exports.OrgAuthorityContextualTupleRefusal = OrgAuthorityContextualTupleRefusal = {}));
+class OrgAuthorityContextualTupleError extends Error {
+    refusal;
+    constructor(refusal) {
+        super(refusal === OrgAuthorityContextualTupleRefusal.SubjectNotUser
+            ? 'an org-authority instrument is carried only by a user subject.'
+            : 'the org-authority instrument states an org role that does not hold org-admin authority.');
+        this.refusal = refusal;
+        this.name = 'OrgAuthorityContextualTupleError';
+    }
+}
+exports.OrgAuthorityContextualTupleError = OrgAuthorityContextualTupleError;
+function buildXemaOrgObject(orgId) {
+    return `${exports.XEMA_ORG_OBJECT_TYPE}:${(0, xema_capability_resource_1.encodeXemaIdSegment)(orgId)}`;
+}
+function buildOrgAdministratorsUserset(orgId) {
+    return `${buildXemaOrgObject(orgId)}#${exports.XEMA_ORG_ADMIN_RELATION}`;
+}
+function buildOrgAuthorityContextualTuples(input) {
+    const { subject, orgId, instrument } = input;
+    if (instrument === undefined)
+        return [];
+    if (subject.kind !== subject_1.SubjectKind.User) {
+        throw new OrgAuthorityContextualTupleError(OrgAuthorityContextualTupleRefusal.SubjectNotUser);
+    }
+    if (instrument.kind === audit_1.AuditAuthorityKind.OrgRole &&
+        !(0, tenant_1.orgRoleSatisfies)(instrument.orgRole, tenant_1.OrgRole.Admin)) {
+        throw new OrgAuthorityContextualTupleError(OrgAuthorityContextualTupleRefusal.RoleBelowAdmin);
+    }
+    return [
+        {
+            user: (0, subject_1.subjectRefToString)({ kind: subject_1.SubjectKind.User, id: subject.id }),
+            relation: exports.XEMA_ORG_ADMIN_RELATION,
+            object: buildXemaOrgObject(orgId),
+        },
+    ];
+}
+//# sourceMappingURL=org-authority-contextual-tuple.js.map

package/dist/authzen/lib/org-authority-contextual-tuple.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority-contextual-tuple.js","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":";;;AA6DA,gDAEC;AAQD,sEAEC;AAOD,8EA2BC;AA3GD,uCAAiD;AACjD,2CAAgE;AAChE,yCAAyD;AAEzD,yEAAiE;AA2BpD,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAC7B,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAU/C,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAE5C,yEAAmC,CAAA;IAEnC,yEAAmC,CAAA;AACrC,CAAC,EALW,kCAAkC,kDAAlC,kCAAkC,QAK7C;AAED,MAAa,gCAAiC,SAAQ,KAAK;IACpC;IAArB,YAAqB,OAA2C;QAC9D,KAAK,CACH,OAAO,KAAK,kCAAkC,CAAC,cAAc;YAC3D,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,yFAAyF,CAC9F,CAAC;QALiB,YAAO,GAAP,OAAO,CAAoC;QAM9D,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AATD,4EASC;AAGD,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,OAAO,GAAG,4BAAoB,IAAI,IAAA,8CAAmB,EAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAQD,SAAgB,6BAA6B,CAAC,KAAa;IACzD,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,+BAAuB,EAAE,CAAC;AACnE,CAAC;AAOD,SAAgB,iCAAiC,CAAC,KAIjD;IACC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,gCAAgC,CACxC,kCAAkC,CAAC,cAAc,CAClD,CAAC;IACJ,CAAC;IACD,IACE,UAAU,CAAC,IAAI,KAAK,0BAAkB,CAAC,OAAO;QAC9C,CAAC,IAAA,yBAAgB,EAAC,UAAU,CAAC,OAAO,EAAE,gBAAO,CAAC,KAAK,CAAC,EACpD,CAAC;QACD,MAAM,IAAI,gCAAgC,CACxC,kCAAkC,CAAC,cAAc,CAClD,CAAC;IACJ,CAAC;IACD,OAAO;QACL;YACE,IAAI,EAAE,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YACpE,QAAQ,EAAE,+BAAuB;YACjC,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC;SAClC;KACF,CAAC;AACJ,CAAC"}

package/dist/authzen/lib/xema-authzen-profile.d.ts

@@ -87,6 +87,7 @@ export declare const XemaAuthzenInvocationSchema: z.ZodObject<{
     aperture: z.ZodOptional<z.ZodType<import("../../capability").CapabilityAperture, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityAperture, unknown>>>;
     constraints: z.ZodOptional<z.ZodType<import("../../execution-context").ExecutionContextConstraints, unknown, z.core.$ZodTypeInternals<import("../../execution-context").ExecutionContextConstraints, unknown>>>;
     resourceClassification: z.ZodOptional<z.ZodEnum<typeof import("../../space").DataClassification>>;
+    operationInstance: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type XemaAuthzenInvocation = z.infer<typeof XemaAuthzenInvocationSchema>;
 export declare const XemaAuthzenInstanceSchema: z.ZodObject<{
@@ -111,6 +112,7 @@ export declare const XemaAuthzenContextSchema: z.ZodObject<{
         aperture: z.ZodOptional<z.ZodType<import("../../capability").CapabilityAperture, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityAperture, unknown>>>;
         constraints: z.ZodOptional<z.ZodType<import("../../execution-context").ExecutionContextConstraints, unknown, z.core.$ZodTypeInternals<import("../../execution-context").ExecutionContextConstraints, unknown>>>;
         resourceClassification: z.ZodOptional<z.ZodEnum<typeof import("../../space").DataClassification>>;
+        operationInstance: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     snapshot: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
@@ -160,6 +162,7 @@ export declare const XemaAccessEvaluationRequestSchema: z.ZodObject<{
             aperture: z.ZodOptional<z.ZodType<import("../../capability").CapabilityAperture, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityAperture, unknown>>>;
             constraints: z.ZodOptional<z.ZodType<import("../../execution-context").ExecutionContextConstraints, unknown, z.core.$ZodTypeInternals<import("../../execution-context").ExecutionContextConstraints, unknown>>>;
             resourceClassification: z.ZodOptional<z.ZodEnum<typeof import("../../space").DataClassification>>;
+            operationInstance: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         snapshot: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
@@ -172,6 +175,7 @@ export declare enum XemaAuthzenReasonCode {
     DelegationRequired = "delegation_required",
     CapabilityNotDelegated = "capability_not_delegated",
     ResourceOutsideDelegatedScope = "resource_outside_delegated_scope",
+    OperationInstanceMismatch = "operation_instance_mismatch",
     CeilingRefused = "ceiling_refused",
     NamespaceWithdrawn = "namespace_withdrawn",
     SubjectNotEvaluable = "subject_not_evaluable"

package/dist/authzen/lib/xema-authzen-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAGL,WAAW,EACZ,MAAM,eAAe,CAAC;AA6BvB,eAAO,MAAM,0BAA0B,mHAS5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;;EAAqC,CAAC;AAc/E,eAAO,MAAM,gCAAgC;;;;;4BAQ3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAQF,eAAO,MAAM,kCAAkC;;;;;;;kBAIpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAY1E,eAAO,MAAM,oCAAoC,qCAEtC,CAAC;AAGZ,eAAO,MAAM,iCAAiC;;;;;kBAKnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AASF,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAO5C,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAG/C,eAAO,MAAM,iCAAiC,QAAe,CAAC;AAE9D,eAAO,MAAM,6BAA6B,aAKtC,CAAC;AAGL,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYxE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,CAQ5E;AAiBD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxD,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAgBT;AAGD,eAAO,MAAM,yBAAyB;;;;kBAAwB,CAAC;AAM/D,eAAO,MAAM,uBAAuB;;;kBAIlC,CAAC;AA0BH,eAAO,MAAM,2BAA2B;;;;;;;;kBAU7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAahF,eAAO,MAAM,yBAAyB;;;kBAK3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AA2B5E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;kBAU1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAWF,oBAAY,qBAAqB;IAE/B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,oBAAoB,2BAA2B;IAE/C,kBAAkB,wBAAwB;IAE1C,sBAAsB,6BAA6B;IAEnD,6BAA6B,qCAAqC;IAElE,cAAc,oBAAoB;IAElC,kBAAkB,wBAAwB;IAQ1C,mBAAmB,0BAA0B;CAC9C;AAED,eAAO,MAAM,2BAA2B,yCAAsC,CAAC;AAO/E,oBAAY,oBAAoB;IAE9B,YAAY,mBAAmB;IAE/B,eAAe,qBAAqB;IAEpC,oBAAoB,0BAA0B;IAE9C,WAAW,iBAAiB;IAE5B,aAAa,mBAAmB;IAEhC,gBAAgB,sBAAsB;CACvC;AAED,eAAO,MAAM,0BAA0B,wCAAqC,CAAC;AAG7E,eAAO,MAAM,0BAA0B;;;;kBAM5B,CAAC;AAOZ,eAAO,MAAM,gCAAgC;;;;;;;;iBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAOF,eAAO,MAAM,0BAA0B;;;0DAKR,CAAC"}
+{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAGL,WAAW,EACZ,MAAM,eAAe,CAAC;AA6BvB,eAAO,MAAM,0BAA0B,mHAS5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;;EAAqC,CAAC;AAc/E,eAAO,MAAM,gCAAgC;;;;;4BAQ3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAQF,eAAO,MAAM,kCAAkC;;;;;;;kBAIpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAY1E,eAAO,MAAM,oCAAoC,qCAEtC,CAAC;AAGZ,eAAO,MAAM,iCAAiC;;;;;kBAKnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AASF,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAO5C,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAG/C,eAAO,MAAM,iCAAiC,QAAe,CAAC;AAE9D,eAAO,MAAM,6BAA6B,aAKtC,CAAC;AAGL,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYxE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,CAQ5E;AAiBD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxD,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAgBT;AAGD,eAAO,MAAM,yBAAyB;;;;kBAAwB,CAAC;AAM/D,eAAO,MAAM,uBAAuB;;;kBAIlC,CAAC;AA6BH,eAAO,MAAM,2BAA2B;;;;;;;;;kBAW7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAahF,eAAO,MAAM,yBAAyB;;;kBAK3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AA2B5E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;kBAU1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAWF,oBAAY,qBAAqB;IAE/B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,oBAAoB,2BAA2B;IAE/C,kBAAkB,wBAAwB;IAE1C,sBAAsB,6BAA6B;IAEnD,6BAA6B,qCAAqC;IAElE,yBAAyB,gCAAgC;IAEzD,cAAc,oBAAoB;IAElC,kBAAkB,wBAAwB;IAQ1C,mBAAmB,0BAA0B;CAC9C;AAED,eAAO,MAAM,2BAA2B,yCAAsC,CAAC;AAO/E,oBAAY,oBAAoB;IAE9B,YAAY,mBAAmB;IAE/B,eAAe,qBAAqB;IAEpC,oBAAoB,0BAA0B;IAE9C,WAAW,iBAAiB;IAE5B,aAAa,mBAAmB;IAEhC,gBAAgB,sBAAsB;CACvC;AAED,eAAO,MAAM,0BAA0B,wCAAqC,CAAC;AAG7E,eAAO,MAAM,0BAA0B;;;;kBAM5B,CAAC;AAOZ,eAAO,MAAM,gCAAgC;;;;;;;;iBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAOF,eAAO,MAAM,0BAA0B;;;0DAKR,CAAC"}

package/dist/authzen/lib/xema-authzen-profile.js

@@ -117,6 +117,7 @@ exports.XemaAuthzenInvocationSchema = zod_1.z
     aperture: capability_1.CapabilityApertureSchema.optional(),
     constraints: execution_context_1.ExecutionContextConstraintsSchema.optional(),
     resourceClassification: space_1.DataClassificationSchema.optional(),
+    operationInstance: zod_1.z.string().min(1).optional(),
 })
     .strict();
 exports.XemaAuthzenInstanceSchema = zod_1.z
@@ -152,6 +153,7 @@ var XemaAuthzenReasonCode;
     XemaAuthzenReasonCode["DelegationRequired"] = "delegation_required";
     XemaAuthzenReasonCode["CapabilityNotDelegated"] = "capability_not_delegated";
     XemaAuthzenReasonCode["ResourceOutsideDelegatedScope"] = "resource_outside_delegated_scope";
+    XemaAuthzenReasonCode["OperationInstanceMismatch"] = "operation_instance_mismatch";
     XemaAuthzenReasonCode["CeilingRefused"] = "ceiling_refused";
     XemaAuthzenReasonCode["NamespaceWithdrawn"] = "namespace_withdrawn";
     XemaAuthzenReasonCode["SubjectNotEvaluable"] = "subject_not_evaluable";

package/dist/authzen/lib/xema-authzen-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;AA6KA,8CAYC;AAQD,4DAQC;AAiBD,oDAmBC;AA7OD,6BAAwB;AAExB,yEAGoC;AAEpC,uCAAiD;AACjD,iDAA4D;AAC5D,+DAIiC;AACjC,uCAAuD;AACvD,2CAIuB;AACvB,yCAA6C;AAE7C,yDAI4B;AAC5B,yDAAkE;AAqBrD,QAAA,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,qBAAW,CAAC,IAAI;IAChB,qBAAW,CAAC,KAAK;IACjB,qBAAW,CAAC,OAAO;IAInB,qBAAW,CAAC,GAAG;IACf,qBAAW,CAAC,eAAe;CACnB,CAAC,CAAC;AAIC,QAAA,4BAA4B,GAAG,OAAC,CAAC,IAAI,CAAC,kCAA0B,CAAC,CAAC;AAclE,QAAA,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,sBAAa;KACvB,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACzE,CAAC,CAAC;AAWU,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,YAAY,EAAE,wCAAgC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,oCAA4B;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,0CAAkC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAaC,QAAA,oCAAoC,GAAG,MAAM,CAAC,MAAM,CAAC;IAChE,qBAAW,CAAC,YAAY;CAChB,CAAC,CAAC;AAGC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,4CAAoC,CAAC;IAClD,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAYC,QAAA,sBAAsB,GAAG,KAAK,CAAC;AAO/B,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAGlC,QAAA,iCAAiC,GAAG,YAAY,CAAC;AAEjD,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,EAAE;IAC7B,OAAO,EACL,8GAA8G;CACjH,CAAC,CAAC;AAGL,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AALD,oEAKC;AAGD,SAAgB,iBAAiB,CAAC,KAAa,EAAE,OAAe;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,SAAS,EAAE,OAAO,CAAC;KACZ,EAAE,CAAC;QACX,IAAI,CAAC,yCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CACpC,sBAAsB,IAAI,KAAK,OAAO,oDAAoD,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,GAAG,mCAA2B,GAAG,OAAO,EAAE,CAAC;AAC5D,CAAC;AAQD,SAAgB,wBAAwB,CAAC,EAAU;IACjD,IAAI,CAAC,qCAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,4BAA4B,CACpC,8BAA8B,EAAE,iCAAiC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,mCAA2B,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAiBD,SAAgB,oBAAoB,CAClC,QAAwD,EACxD,KAAoB;IAEpB,IAAI,QAAQ,CAAC,IAAI,KAAK,wDAA6B,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,oDAAyB,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAsB,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,qCAA6B,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;AAC/D,CAAC;AAGY,QAAA,yBAAyB,GAAG,wCAAqB,CAAC;AAMlD,QAAA,uBAAuB,GAAG,sCAAmB,CAAC,MAAM,CAAC;IAChE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC1C,OAAO,EAAE,iDAAiD;KAC3D,CAAC;CACH,CAAC,CAAC;AA0BU,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,gCAAY,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,+CAA2B,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,+BAAqB,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,qCAAwB,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,qDAAiC,CAAC,QAAQ,EAAE;IACzD,sBAAsB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CAC5D,CAAC;KACD,MAAM,EAAE,CAAC;AAcC,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AA4BC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,kCAAwB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,iCAAyB,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,gCAAwB;IACjC,MAAM,EAAE,+BAAuB;IAC/B,QAAQ,EAAE,iCAAyB;IACnC,OAAO,EAAE,gCAAwB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAcZ,IAAY,qBAyBX;AAzBD,WAAY,qBAAqB;IAE/B,2DAAkC,CAAA;IAElC,8DAAqC,CAAA;IAErC,wEAA+C,CAAA;IAE/C,mEAA0C,CAAA;IAE1C,4EAAmD,CAAA;IAEnD,2FAAkE,CAAA;IAElE,2DAAkC,CAAA;IAElC,mEAA0C,CAAA;IAQ1C,sEAA6C,CAAA;AAC/C,CAAC,EAzBW,qBAAqB,qCAArB,qBAAqB,QAyBhC;AAEY,QAAA,2BAA2B,GAAG,OAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAO/E,IAAY,oBAaX;AAbD,WAAY,oBAAoB;IAE9B,uDAA+B,CAAA;IAE/B,4DAAoC,CAAA;IAEpC,sEAA8C,CAAA;IAE9C,oDAA4B,CAAA;IAE5B,wDAAgC,CAAA;IAEhC,8DAAsC,CAAA;AACxC,CAAC,EAbW,oBAAoB,oCAApB,oBAAoB,QAa/B;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAGhE,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,kCAA0B;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,gCAAgC,GAAG,OAAC,CAAC,MAAM,CAAC;IACvD,WAAW,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,kCAA0B,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAUU,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,kCAA0B;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,GAAG,CAAC,0CAAuB,CAAC,CAAC"}
+{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;AA6KA,8CAYC;AAQD,4DAQC;AAiBD,oDAmBC;AA7OD,6BAAwB;AAExB,yEAGoC;AAEpC,uCAAiD;AACjD,iDAA4D;AAC5D,+DAIiC;AACjC,uCAAuD;AACvD,2CAIuB;AACvB,yCAA6C;AAE7C,yDAI4B;AAC5B,yDAAkE;AAqBrD,QAAA,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,qBAAW,CAAC,IAAI;IAChB,qBAAW,CAAC,KAAK;IACjB,qBAAW,CAAC,OAAO;IAInB,qBAAW,CAAC,GAAG;IACf,qBAAW,CAAC,eAAe;CACnB,CAAC,CAAC;AAIC,QAAA,4BAA4B,GAAG,OAAC,CAAC,IAAI,CAAC,kCAA0B,CAAC,CAAC;AAclE,QAAA,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,sBAAa;KACvB,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACzE,CAAC,CAAC;AAWU,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,YAAY,EAAE,wCAAgC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,oCAA4B;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,0CAAkC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAaC,QAAA,oCAAoC,GAAG,MAAM,CAAC,MAAM,CAAC;IAChE,qBAAW,CAAC,YAAY;CAChB,CAAC,CAAC;AAGC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,4CAAoC,CAAC;IAClD,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAYC,QAAA,sBAAsB,GAAG,KAAK,CAAC;AAO/B,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAGlC,QAAA,iCAAiC,GAAG,YAAY,CAAC;AAEjD,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,EAAE;IAC7B,OAAO,EACL,8GAA8G;CACjH,CAAC,CAAC;AAGL,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AALD,oEAKC;AAGD,SAAgB,iBAAiB,CAAC,KAAa,EAAE,OAAe;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,SAAS,EAAE,OAAO,CAAC;KACZ,EAAE,CAAC;QACX,IAAI,CAAC,yCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CACpC,sBAAsB,IAAI,KAAK,OAAO,oDAAoD,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,GAAG,mCAA2B,GAAG,OAAO,EAAE,CAAC;AAC5D,CAAC;AAQD,SAAgB,wBAAwB,CAAC,EAAU;IACjD,IAAI,CAAC,qCAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,4BAA4B,CACpC,8BAA8B,EAAE,iCAAiC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,mCAA2B,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAiBD,SAAgB,oBAAoB,CAClC,QAAwD,EACxD,KAAoB;IAEpB,IAAI,QAAQ,CAAC,IAAI,KAAK,wDAA6B,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,oDAAyB,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAsB,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,qCAA6B,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;AAC/D,CAAC;AAGY,QAAA,yBAAyB,GAAG,wCAAqB,CAAC;AAMlD,QAAA,uBAAuB,GAAG,sCAAmB,CAAC,MAAM,CAAC;IAChE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC1C,OAAO,EAAE,iDAAiD;KAC3D,CAAC;CACH,CAAC,CAAC;AA6BU,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,gCAAY,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,+CAA2B,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,+BAAqB,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,qCAAwB,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,qDAAiC,CAAC,QAAQ,EAAE;IACzD,sBAAsB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;IAC3D,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAcC,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AA4BC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,kCAAwB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,iCAAyB,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,gCAAwB;IACjC,MAAM,EAAE,+BAAuB;IAC/B,QAAQ,EAAE,iCAAyB;IACnC,OAAO,EAAE,gCAAwB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAcZ,IAAY,qBA2BX;AA3BD,WAAY,qBAAqB;IAE/B,2DAAkC,CAAA;IAElC,8DAAqC,CAAA;IAErC,wEAA+C,CAAA;IAE/C,mEAA0C,CAAA;IAE1C,4EAAmD,CAAA;IAEnD,2FAAkE,CAAA;IAElE,kFAAyD,CAAA;IAEzD,2DAAkC,CAAA;IAElC,mEAA0C,CAAA;IAQ1C,sEAA6C,CAAA;AAC/C,CAAC,EA3BW,qBAAqB,qCAArB,qBAAqB,QA2BhC;AAEY,QAAA,2BAA2B,GAAG,OAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAO/E,IAAY,oBAaX;AAbD,WAAY,oBAAoB;IAE9B,uDAA+B,CAAA;IAE/B,4DAAoC,CAAA;IAEpC,sEAA8C,CAAA;IAE9C,oDAA4B,CAAA;IAE5B,wDAAgC,CAAA;IAEhC,8DAAsC,CAAA;AACxC,CAAC,EAbW,oBAAoB,oCAApB,oBAAoB,QAa/B;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAGhE,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,kCAA0B;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,gCAAgC,GAAG,OAAC,CAAC,MAAM,CAAC;IACvD,WAAW,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,kCAA0B,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAUU,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,kCAA0B;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,GAAG,CAAC,0CAAuB,CAAC,CAAC"}

package/dist/capability/lib/capability-contribution.d.ts

@@ -6,7 +6,6 @@ import { type CapabilityEffectClass } from './capability-effect-class';
 import { type RequiredResourceRoleBinding } from './required-resource-role-binding';
 import { CapabilityRiskTier } from './permission-profile';
 import { type DataClassification } from '../../space';
-import { type OrgRole } from '../../tenant';
 import { type HumanBaseline } from './capability-human-baseline';
 import { type TrustedContextProjection } from './trusted-context-projection';
 export interface CapabilityContributionManifest {
@@ -28,7 +27,6 @@ export interface CapabilityContributionManifest {
     readonly trustedContextProjection?: TrustedContextProjection | undefined;
     readonly requiredBindings?: readonly RequiredResourceRoleBinding[] | undefined;
     readonly safeForAgents?: boolean | undefined;
-    readonly defaultBaselineOrgRole?: OrgRole | undefined;
     readonly humanBaseline?: HumanBaseline | undefined;
 }
 export declare const CapabilityContributionManifestSchema: z.ZodObject<{
@@ -50,7 +48,6 @@ export declare const CapabilityContributionManifestSchema: z.ZodObject<{
     trustedContextProjection: z.ZodOptional<z.ZodType<TrustedContextProjection, unknown, z.core.$ZodTypeInternals<TrustedContextProjection, unknown>>>;
     requiredBindings: z.ZodOptional<z.ZodArray<z.ZodType<RequiredResourceRoleBinding, unknown, z.core.$ZodTypeInternals<RequiredResourceRoleBinding, unknown>>>>;
     safeForAgents: z.ZodOptional<z.ZodBoolean>;
-    defaultBaselineOrgRole: z.ZodOptional<z.ZodEnum<typeof OrgRole>>;
     humanBaseline: z.ZodOptional<z.ZodType<HumanBaseline, unknown, z.core.$ZodTypeInternals<HumanBaseline, unknown>>>;
 }, z.core.$strict>;
 //# sourceMappingURL=capability-contribution.d.ts.map

package/dist/capability/lib/capability-contribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAsBtC,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE/C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAKtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAKnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAUnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOjD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAoB1D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAgB/D,QAAQ,CAAC,eAAe,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAqBjE,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IA0B7C,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAQzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAgBzE,QAAQ,CAAC,gBAAgB,CAAC,EACtB,SAAS,2BAA2B,EAAE,GACtC,SAAS,CAAC;IAuDd,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAyB7C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAYtD,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CACpD;AAcD,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;kBAwEO,CAAC"}
+{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAsBtC,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE/C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAKtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAKnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAUnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOjD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAoB1D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAgB/D,QAAQ,CAAC,eAAe,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAqBjE,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IA0B7C,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAQzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAgBzE,QAAQ,CAAC,gBAAgB,CAAC,EACtB,SAAS,2BAA2B,EAAE,GACtC,SAAS,CAAC;IAuDd,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAa7C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CACpD;AAcD,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;kBAsEO,CAAC"}

package/dist/capability/lib/capability-contribution.js

@@ -9,7 +9,6 @@ const capability_effect_class_1 = require("./capability-effect-class");
 const required_resource_role_binding_1 = require("./required-resource-role-binding");
 const permission_profile_1 = require("./permission-profile");
 const space_1 = require("../../space");
-const tenant_1 = require("../../tenant");
 const capability_human_baseline_1 = require("./capability-human-baseline");
 const trusted_context_projection_1 = require("./trusted-context-projection");
 exports.CapabilityContributionManifestSchema = zod_1.z
@@ -35,12 +34,10 @@ exports.CapabilityContributionManifestSchema = zod_1.z
         .max(20)
         .optional(),
     safeForAgents: zod_1.z.boolean().optional(),
-    defaultBaselineOrgRole: tenant_1.OrgRoleSchema.optional(),
     humanBaseline: capability_human_baseline_1.HumanBaselineSchema.optional(),
 })
     .strict()
     .superRefine((manifest, context) => {
-    (0, capability_human_baseline_1.refineSingleHumanBaselineDeclaration)(manifest, context);
     const properties = manifest.inputSchema['properties'];
     if ((0, trusted_context_projection_1.declaresReservedTrustedOperationContextField)(properties)) {
         context.addIssue({

package/dist/capability/lib/capability-contribution.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability-contribution.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,qDAA2E;AAC3E,yDAG4B;AAC5B,yDAG4B;AAC5B,uEAGmC;AACnC,qFAG0C;AAC1C,6DAG8B;AAC9B,uCAAgF;AAChF,yCAA2D;AAC3D,2EAIqC;AACrC,6EAKsC;AAuRzB,QAAA,oCAAoC,GAAG,OAAC;KAClD,MAAM,CAAC;IACN,GAAG,EAAE,oCAAmB;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC/C,QAAQ,EAAE,6CAAwB;IAClC,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC7B,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvE,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,2BAA2B,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClE,oBAAoB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,kDAA+B,CAAC,QAAQ,EAAE;IAC3D,KAAK,EAAE,wCAAqB,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,qDAA2B,CAAC,QAAQ,EAAE;IACnD,wBAAwB,EAAE,2DAA8B,CAAC,QAAQ,EAAE;IACnE,gBAAgB,EAAE,OAAC;SAChB,KAAK,CAAC,kEAAiC,CAAC;SACxC,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;IACb,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,sBAAsB,EAAE,sBAAa,CAAC,QAAQ,EAAE;IAChD,aAAa,EAAE,+CAAmB,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,IAAA,gEAAoC,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,IAAA,yEAA4C,EAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE;gBACJ,aAAa;gBACb,YAAY;gBACZ,qEAAwC;aACzC;YACD,OAAO,EACL,GAAG,qEAAwC,0BAA0B;gBACrE,gDAAgD;SACnD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,uCAAkB,CAAC,QAAQ,EAAE,CAAC;QACtD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EACL,uEAAuE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC/B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EACL,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,sEAAsE;gBACtE,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAqD,CAAC;AASzD,SAAS,wBAAwB,CAAC,MAA+B;IAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,CACL,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC3B,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,CACzC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"capability-contribution.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,qDAA2E;AAC3E,yDAG4B;AAC5B,yDAG4B;AAC5B,uEAGmC;AACnC,qFAG0C;AAC1C,6DAG8B;AAC9B,uCAAgF;AAChF,2EAGqC;AACrC,6EAKsC;AA+PzB,QAAA,oCAAoC,GAAG,OAAC;KAClD,MAAM,CAAC;IACN,GAAG,EAAE,oCAAmB;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC/C,QAAQ,EAAE,6CAAwB;IAClC,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC7B,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvE,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,2BAA2B,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClE,oBAAoB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,kDAA+B,CAAC,QAAQ,EAAE;IAC3D,KAAK,EAAE,wCAAqB,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,qDAA2B,CAAC,QAAQ,EAAE;IACnD,wBAAwB,EAAE,2DAA8B,CAAC,QAAQ,EAAE;IACnE,gBAAgB,EAAE,OAAC;SAChB,KAAK,CAAC,kEAAiC,CAAC;SACxC,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;IACb,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,+CAAmB,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,IAAA,yEAA4C,EAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE;gBACJ,aAAa;gBACb,YAAY;gBACZ,qEAAwC;aACzC;YACD,OAAO,EACL,GAAG,qEAAwC,0BAA0B;gBACrE,gDAAgD;SACnD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,uCAAkB,CAAC,QAAQ,EAAE,CAAC;QACtD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EACL,uEAAuE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC/B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EACL,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,sEAAsE;gBACtE,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAqD,CAAC;AASzD,SAAS,wBAAwB,CAAC,MAA+B;IAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,CACL,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC3B,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,CACzC,CAAC;AACJ,CAAC"}

package/dist/capability/lib/capability-human-baseline.d.ts

@@ -1,14 +1,11 @@
 import { z } from 'zod';
 import { ExecutionEnvironmentKind } from '../../execution-environment-kind';
 import { OrgRole } from '../../tenant';
-export declare const CAPABILITY_HUMAN_BASELINE_FIELD = "defaultBaselineOrgRole";
-export declare function resolveHumanBaselineFloor(descriptor: Readonly<Record<string, unknown>> | undefined): OrgRole | undefined;
-export declare function capabilityInHumanBaseline(descriptor: Readonly<Record<string, unknown>> | undefined, role: OrgRole): boolean;
-export declare function isWidestHumanBaseline(descriptor: Readonly<Record<string, unknown>> | undefined): boolean;
 export declare const CAPABILITY_HUMAN_BASELINE_DECLARATION_FIELD = "humanBaseline";
 export declare enum HumanBaselineKind {
     ExplicitOnly = "explicit-only",
-    OrgRole = "org-role"
+    OrgRole = "org-role",
+    OrgAdministrators = "org-administrators"
 }
 export interface ExplicitOnlyHumanBaseline {
     readonly kind: HumanBaselineKind.ExplicitOnly;
@@ -18,23 +15,21 @@ export interface OrgRoleHumanBaseline {
     readonly minimumOrgRole: OrgRole;
     readonly environments: readonly ExecutionEnvironmentKind[];
 }
-export type HumanBaseline = ExplicitOnlyHumanBaseline | OrgRoleHumanBaseline;
+export interface OrgAdministratorsHumanBaseline {
+    readonly kind: HumanBaselineKind.OrgAdministrators;
+    readonly environments: readonly ExecutionEnvironmentKind[];
+}
+export type GrantingHumanBaseline = OrgRoleHumanBaseline | OrgAdministratorsHumanBaseline;
+export type HumanBaseline = ExplicitOnlyHumanBaseline | GrantingHumanBaseline;
 export declare const HumanBaselineSchema: z.ZodType<HumanBaseline>;
 export declare const EXPLICIT_ONLY_HUMAN_BASELINE: ExplicitOnlyHumanBaseline;
 export declare class HumanBaselineDeclarationError extends Error {
     constructor(message: string);
 }
 export declare function orgRoleHumanBaseline(minimumOrgRole: OrgRole, environments: readonly ExecutionEnvironmentKind[]): OrgRoleHumanBaseline;
-export declare const LEGACY_HUMAN_BASELINE_ENVIRONMENTS: Readonly<Record<OrgRole, readonly ExecutionEnvironmentKind[]>>;
-export declare function refineSingleHumanBaselineDeclaration(manifest: {
-    readonly humanBaseline?: HumanBaseline | undefined;
-    readonly defaultBaselineOrgRole?: OrgRole | undefined;
-}, context: z.RefinementCtx): void;
+export declare function orgAdministratorsHumanBaseline(environments: readonly ExecutionEnvironmentKind[]): OrgAdministratorsHumanBaseline;
 export declare function normalizeHumanBaseline(descriptor: Readonly<Record<string, unknown>> | undefined): HumanBaseline | undefined;
-export interface HumanBaselineGrantPlan {
-    readonly minimumOrgRole: OrgRole;
-    readonly environments: readonly ExecutionEnvironmentKind[];
-}
+export type HumanBaselineGrantPlan = GrantingHumanBaseline;
 export declare function humanBaselineGrantPlan(baseline: HumanBaseline | undefined): HumanBaselineGrantPlan | undefined;
 export declare function satisfiesHumanBaseline(role: OrgRole, environment: ExecutionEnvironmentKind, baseline: HumanBaseline | undefined): boolean;
 //# sourceMappingURL=capability-human-baseline.d.ts.map

package/dist/capability/lib/capability-human-baseline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-human-baseline.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-human-baseline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,wBAAwB,EAEzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,OAAO,EAGR,MAAM,cAAc,CAAC;AAsFtB,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAkBxE,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACxD,OAAO,GAAG,SAAS,CAMrB;AAkBD,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACzD,IAAI,EAAE,OAAO,GACZ,OAAO,CAIT;AAcD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACxD,OAAO,CAET;AAkDD,eAAO,MAAM,2CAA2C,kBAAkB,CAAC;AAG3E,oBAAY,iBAAiB;IAE3B,YAAY,kBAAkB;IAE9B,OAAO,aAAa;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,YAAY,CAAC;CAC/C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC;IAEzC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAMjC,QAAQ,CAAC,YAAY,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAC5D;AAED,MAAM,MAAM,aAAa,GAAG,yBAAyB,GAAG,oBAAoB,CAAC;AAqD7E,eAAO,MAAM,mBAAmB,EAGf,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AAG1C,eAAO,MAAM,4BAA4B,EAAE,yBACc,CAAC;AAO1D,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,EAAE,MAAM;CAI5B;AAOD,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,OAAO,EACvB,YAAY,EAAE,SAAS,wBAAwB,EAAE,GAChD,oBAAoB,CAgBtB;AAYD,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CACvD,MAAM,CAAC,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC,CAWpD,CAAC;AAOH,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE;IACR,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACvD,EACD,OAAO,EAAE,CAAC,CAAC,aAAa,GACvB,IAAI,CAYN;AAkBD,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACxD,aAAa,GAAG,SAAS,CA6B3B;AAGD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAC5D;AAOD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,aAAa,GAAG,SAAS,GAClC,sBAAsB,GAAG,SAAS,CAWpC;AAWD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,OAAO,EACb,WAAW,EAAE,wBAAwB,EACrC,QAAQ,EAAE,aAAa,GAAG,SAAS,GAClC,OAAO,CAOT"}
+{"version":3,"file":"capability-human-baseline.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-human-baseline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,wBAAwB,EAEzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAmC,MAAM,cAAc,CAAC;AA+HxE,eAAO,MAAM,2CAA2C,kBAAkB,CAAC;AAG3E,oBAAY,iBAAiB;IAE3B,YAAY,kBAAkB;IAE9B,OAAO,aAAa;IAEpB,iBAAiB,uBAAuB;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,YAAY,CAAC;CAC/C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC;IAEzC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAMjC,QAAQ,CAAC,YAAY,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAC5D;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;IAKnD,QAAQ,CAAC,YAAY,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAC5D;AAGD,MAAM,MAAM,qBAAqB,GAC7B,oBAAoB,GACpB,8BAA8B,CAAC;AAEnC,MAAM,MAAM,aAAa,GAAG,yBAAyB,GAAG,qBAAqB,CAAC;AAsE9E,eAAO,MAAM,mBAAmB,EAIf,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AAG1C,eAAO,MAAM,4BAA4B,EAAE,yBACc,CAAC;AAO1D,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,EAAE,MAAM;CAI5B;AAOD,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,OAAO,EACvB,YAAY,EAAE,SAAS,wBAAwB,EAAE,GAChD,oBAAoB,CAgBtB;AAMD,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,SAAS,wBAAwB,EAAE,GAChD,8BAA8B,CAehC;AAWD,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACxD,aAAa,GAAG,SAAS,CAa3B;AAQD,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAO3D,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,aAAa,GAAG,SAAS,GAClC,sBAAsB,GAAG,SAAS,CASpC;AAqBD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,OAAO,EACb,WAAW,EAAE,wBAAwB,EACrC,QAAQ,EAAE,aAAa,GAAG,SAAS,GAClC,OAAO,CAQT"}

package/dist/capability/lib/capability-human-baseline.js

@@ -1,38 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LEGACY_HUMAN_BASELINE_ENVIRONMENTS = exports.HumanBaselineDeclarationError = exports.EXPLICIT_ONLY_HUMAN_BASELINE = exports.HumanBaselineSchema = exports.HumanBaselineKind = exports.CAPABILITY_HUMAN_BASELINE_DECLARATION_FIELD = exports.CAPABILITY_HUMAN_BASELINE_FIELD = void 0;
-exports.resolveHumanBaselineFloor = resolveHumanBaselineFloor;
-exports.capabilityInHumanBaseline = capabilityInHumanBaseline;
-exports.isWidestHumanBaseline = isWidestHumanBaseline;
+exports.HumanBaselineDeclarationError = exports.EXPLICIT_ONLY_HUMAN_BASELINE = exports.HumanBaselineSchema = exports.HumanBaselineKind = exports.CAPABILITY_HUMAN_BASELINE_DECLARATION_FIELD = void 0;
 exports.orgRoleHumanBaseline = orgRoleHumanBaseline;
-exports.refineSingleHumanBaselineDeclaration = refineSingleHumanBaselineDeclaration;
+exports.orgAdministratorsHumanBaseline = orgAdministratorsHumanBaseline;
 exports.normalizeHumanBaseline = normalizeHumanBaseline;
 exports.humanBaselineGrantPlan = humanBaselineGrantPlan;
 exports.satisfiesHumanBaseline = satisfiesHumanBaseline;
 const zod_1 = require("zod");
 const execution_environment_kind_1 = require("../../execution-environment-kind");
 const tenant_1 = require("../../tenant");
-exports.CAPABILITY_HUMAN_BASELINE_FIELD = 'defaultBaselineOrgRole';
-function resolveHumanBaselineFloor(descriptor) {
-    if (descriptor === undefined)
-        return undefined;
-    const parsed = tenant_1.OrgRoleSchema.safeParse(descriptor[exports.CAPABILITY_HUMAN_BASELINE_FIELD]);
-    return parsed.success ? parsed.data : undefined;
-}
-function capabilityInHumanBaseline(descriptor, role) {
-    const floor = resolveHumanBaselineFloor(descriptor);
-    if (floor === undefined)
-        return false;
-    return (0, tenant_1.orgRoleSatisfies)(role, floor);
-}
-function isWidestHumanBaseline(descriptor) {
-    return capabilityInHumanBaseline(descriptor, tenant_1.LOWEST_ORG_ROLE);
-}
 exports.CAPABILITY_HUMAN_BASELINE_DECLARATION_FIELD = 'humanBaseline';
 var HumanBaselineKind;
 (function (HumanBaselineKind) {
     HumanBaselineKind["ExplicitOnly"] = "explicit-only";
     HumanBaselineKind["OrgRole"] = "org-role";
+    HumanBaselineKind["OrgAdministrators"] = "org-administrators";
 })(HumanBaselineKind || (exports.HumanBaselineKind = HumanBaselineKind = {}));
 function compareEnvironment(a, b) {
     if (a === b)
@@ -42,14 +24,7 @@ function compareEnvironment(a, b) {
 const ExplicitOnlyHumanBaselineSchema = zod_1.z
     .object({ kind: zod_1.z.literal(HumanBaselineKind.ExplicitOnly) })
     .strict();
-const OrgRoleHumanBaselineSchema = zod_1.z
-    .object({
-    kind: zod_1.z.literal(HumanBaselineKind.OrgRole),
-    minimumOrgRole: tenant_1.OrgRoleSchema,
-    environments: zod_1.z.array(execution_environment_kind_1.ExecutionEnvironmentKindSchema).min(1),
-})
-    .strict()
-    .superRefine((baseline, context) => {
+function refineCanonicalEnvironments(baseline, context) {
     const seen = new Set();
     for (const [index, environment] of baseline.environments.entries()) {
         if (seen.has(environment)) {
@@ -72,10 +47,26 @@ const OrgRoleHumanBaselineSchema = zod_1.z
                 `(expected [${canonical.join(', ')}]).`,
         });
     }
-});
+}
+const OrgRoleHumanBaselineSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(HumanBaselineKind.OrgRole),
+    minimumOrgRole: tenant_1.OrgRoleSchema,
+    environments: zod_1.z.array(execution_environment_kind_1.ExecutionEnvironmentKindSchema).min(1),
+})
+    .strict()
+    .superRefine(refineCanonicalEnvironments);
+const OrgAdministratorsHumanBaselineSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(HumanBaselineKind.OrgAdministrators),
+    environments: zod_1.z.array(execution_environment_kind_1.ExecutionEnvironmentKindSchema).min(1),
+})
+    .strict()
+    .superRefine(refineCanonicalEnvironments);
 exports.HumanBaselineSchema = zod_1.z.discriminatedUnion('kind', [
     ExplicitOnlyHumanBaselineSchema,
     OrgRoleHumanBaselineSchema,
+    OrgAdministratorsHumanBaselineSchema,
 ]);
 exports.EXPLICIT_ONLY_HUMAN_BASELINE = Object.freeze({ kind: HumanBaselineKind.ExplicitOnly });
 class HumanBaselineDeclarationError extends Error {
@@ -100,54 +91,33 @@ function orgRoleHumanBaseline(minimumOrgRole, environments) {
         environments: Object.freeze(candidate.environments),
     });
 }
-exports.LEGACY_HUMAN_BASELINE_ENVIRONMENTS = Object.freeze({
-    [tenant_1.OrgRole.Member]: Object.freeze([execution_environment_kind_1.ExecutionEnvironmentKind.Session]),
-    [tenant_1.OrgRole.Admin]: Object.freeze([
-        execution_environment_kind_1.ExecutionEnvironmentKind.Org,
-        execution_environment_kind_1.ExecutionEnvironmentKind.Session,
-    ]),
-    [tenant_1.OrgRole.Owner]: Object.freeze([
-        execution_environment_kind_1.ExecutionEnvironmentKind.Org,
-        execution_environment_kind_1.ExecutionEnvironmentKind.Session,
-    ]),
-});
-function refineSingleHumanBaselineDeclaration(manifest, context) {
-    if (manifest.humanBaseline !== undefined &&
-        manifest.defaultBaselineOrgRole !== undefined) {
-        context.addIssue({
-            code: 'custom',
-            path: [exports.CAPABILITY_HUMAN_BASELINE_DECLARATION_FIELD],
-            message: 'Declare either humanBaseline or the deprecated defaultBaselineOrgRole, never both.',
-        });
+function orgAdministratorsHumanBaseline(environments) {
+    const candidate = {
+        kind: HumanBaselineKind.OrgAdministrators,
+        environments: [...environments].sort(compareEnvironment),
+    };
+    const parsed = exports.HumanBaselineSchema.safeParse(candidate);
+    if (!parsed.success) {
+        throw new HumanBaselineDeclarationError(parsed.error.issues.map((issue) => issue.message).join('; '));
     }
+    return Object.freeze({
+        ...candidate,
+        environments: Object.freeze(candidate.environments),
+    });
 }
 function normalizeHumanBaseline(descriptor) {
     if (descriptor === undefined)
         return undefined;
     const structured = descriptor[exports.CAPABILITY_HUMAN_BASELINE_DECLARATION_FIELD];
-    const legacyRaw = descriptor[exports.CAPABILITY_HUMAN_BASELINE_FIELD];
-    const hasStructured = structured !== undefined && structured !== null;
-    const hasLegacy = legacyRaw !== undefined && legacyRaw !== null;
-    if (hasStructured && hasLegacy) {
-        throw new HumanBaselineDeclarationError('Declare either humanBaseline or the deprecated defaultBaselineOrgRole, never both.');
-    }
-    if (hasStructured) {
-        const parsed = exports.HumanBaselineSchema.safeParse(structured);
-        if (!parsed.success) {
-            throw new HumanBaselineDeclarationError(`Malformed humanBaseline: ${parsed.error.issues
-                .map((issue) => issue.message)
-                .join('; ')}`);
-        }
-        return parsed.data;
-    }
-    const legacy = resolveHumanBaselineFloor(descriptor);
-    if (legacy === undefined)
+    if (structured === undefined || structured === null)
         return undefined;
-    return {
-        kind: HumanBaselineKind.OrgRole,
-        minimumOrgRole: legacy,
-        environments: exports.LEGACY_HUMAN_BASELINE_ENVIRONMENTS[legacy],
-    };
+    const parsed = exports.HumanBaselineSchema.safeParse(structured);
+    if (!parsed.success) {
+        throw new HumanBaselineDeclarationError(`Malformed humanBaseline: ${parsed.error.issues
+            .map((issue) => issue.message)
+            .join('; ')}`);
+    }
+    return parsed.data;
 }
 function humanBaselineGrantPlan(baseline) {
     if (baseline === undefined)
@@ -156,17 +126,18 @@ function humanBaselineGrantPlan(baseline) {
         case HumanBaselineKind.ExplicitOnly:
             return undefined;
         case HumanBaselineKind.OrgRole:
-            return {
-                minimumOrgRole: baseline.minimumOrgRole,
-                environments: baseline.environments,
-            };
+        case HumanBaselineKind.OrgAdministrators:
+            return baseline;
     }
 }
+const ORG_ADMINISTRATOR_ROLE_FLOOR = tenant_1.OrgRole.Admin;
 function satisfiesHumanBaseline(role, environment, baseline) {
     const plan = humanBaselineGrantPlan(baseline);
     if (plan === undefined)
         return false;
-    return ((0, tenant_1.orgRoleSatisfies)(role, plan.minimumOrgRole) &&
-        plan.environments.includes(environment));
+    const floor = plan.kind === HumanBaselineKind.OrgRole
+        ? plan.minimumOrgRole
+        : ORG_ADMINISTRATOR_ROLE_FLOOR;
+    return (0, tenant_1.orgRoleSatisfies)(role, floor) && plan.environments.includes(environment);
 }
 //# sourceMappingURL=capability-human-baseline.js.map