@xemahq/contracts 0.56.0 → 0.58.0

package/dist/.source-stamp.json

@@ -1,5 +1,5 @@
 {
   "algorithm": "sha256/len-framed-v1",
-  "hash": "b34f86d55ff25752a126822de3fb54d1e61227ec75dfa6767218279b1f1f60e9",
-  "fileCount": 585
+  "hash": "3825c5091ec45cceda276093cd61ad128f14e315f67c1f404c219d24b3872cae",
+  "fileCount": 587
 }

package/dist/authorization-module/lib/platform-authorization-modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;AAQZ,eAAO,MAAM,4BAA4B,2BAA2C,CAAC;AAGrF,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAU7C,oBAAY,0BAA0B;IACpC,MAAM,gBAAgB;CACvB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,+BAA+B,oDAIjC,CAAC;AAGZ,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC,CAGrD,CAAC;AAYH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CACnD,MAAM,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAehF,CAAC;AAGH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAsBD,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAwC3E,CAAC;AAGL,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAQ7C"}
+{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;AAQZ,eAAO,MAAM,4BAA4B,2BAA2C,CAAC;AAGrF,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAU7C,oBAAY,0BAA0B;IACpC,MAAM,gBAAgB;CACvB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,+BAA+B,oDAIjC,CAAC;AAGZ,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC,CAGrD,CAAC;AAYH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CACnD,MAAM,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAehF,CAAC;AAGH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAsBD,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAqD3E,CAAC;AAGL,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAQ7C"}

package/dist/authorization-module/lib/platform-authorization-modules.js

@@ -61,6 +61,10 @@ exports.PLATFORM_FACT_WRITERS = Object.freeze({
         biome: 'agent-runtime',
         relations: Object.freeze(['parent', 'owner']),
     }),
+    xema_integration: Object.freeze({
+        biome: 'connector-platform',
+        relations: Object.freeze(['parent', 'active', 'holder', 'bound_scope', 'configurer']),
+    }),
     xema_portal: Object.freeze({
         biome: 'app-platform',
         relations: Object.freeze(['parent', 'owner', 'manager', 'editor', 'viewer', 'org_viewer']),
@@ -68,7 +72,7 @@ exports.PLATFORM_FACT_WRITERS = Object.freeze({
     ...Object.fromEntries([
         ['xema_document', 'knowledge-base'],
         ['xema_mailbox', 'mailops'],
-        ['xema_connector-migration', 'connector-platform'],
+        ['xema_connector-migration', 'connector-sync'],
         ['xema_store-listing', 'xema-store'],
         ['xema_biome-lifecycle-approval', 'biome-host'],
         ['xema_memory', 'memory'],

package/dist/authorization-module/lib/platform-authorization-modules.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;AAsMA,kEAUC;AAhND,6BAAwB;AAuBxB,IAAY,2BAIX;AAJD,WAAY,2BAA2B;IACrC,iDAAkB,CAAA;IAClB,6DAA8B,CAAA;IAC9B,uDAAwB,CAAA;AAC1B,CAAC,EAJW,2BAA2B,2CAA3B,2BAA2B,QAItC;AAEY,QAAA,iCAAiC,GAAG,OAAC,CAAC,UAAU,CAC3D,2BAA2B,CAC5B,CAAC;AAQW,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAShD,QAAA,kBAAkB,GAAG,WAAW,CAAC;AAGjC,QAAA,yBAAyB,GACpC,MAAM,CAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;AAG1C,QAAA,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1D,SAAS;IACT,eAAe;IACf,cAAc;CACN,CAAC,CAAC;AAQC,QAAA,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAU,CAAC,CAAC;AAGxE,QAAA,oBAAoB,GAAG,QAAQ,CAAC;AAU7C,IAAY,0BAEX;AAFD,WAAY,0BAA0B;IACpC,oDAAsB,CAAA;AACxB,CAAC,EAFW,0BAA0B,0CAA1B,0BAA0B,QAErC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAEW,QAAA,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,WAAW;IACX,YAAY;IACZ,YAAY;CACJ,CAAC,CAAC;AAGC,QAAA,sCAAsC,GAE/C,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,uCAA+B;CACrE,CAAC,CAAC;AAYU,QAAA,8BAA8B,GAEvC,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;KAClC,CAAC;IACF,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC;AA4BU,QAAA,qBAAqB,GAChC,MAAM,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;KAC3E,CAAC;IACF,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;KACvE,CAAC;IACF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;KAC9C,CAAC;IAGF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;KAC3F,CAAC;IACF,GAAG,MAAM,CAAC,WAAW,CAEjB;QACE,CAAC,eAAe,EAAE,gBAAgB,CAAC;QACnC,CAAC,cAAc,EAAE,SAAS,CAAC;QAC3B,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;QAClD,CAAC,oBAAoB,EAAE,YAAY,CAAC;QACpC,CAAC,+BAA+B,EAAE,YAAY,CAAC;QAC/C,CAAC,aAAa,EAAE,QAAQ,CAAC;QACzB,CAAC,uBAAuB,EAAE,eAAe,CAAC;QAC1C,CAAC,mBAAmB,EAAE,eAAe,CAAC;KAEzC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACvB,IAAI;QACJ,MAAM,CAAC,MAAM,CAAC;YACZ,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACjF,CAAC;KACH,CAAC,CACH;CACF,CAAC,CAAC;AAGL,SAAgB,2BAA2B,CACzC,OAAe;IAEf,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,6BAAqB,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CACrD,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;AAmNA,kEAUC;AA7ND,6BAAwB;AAuBxB,IAAY,2BAIX;AAJD,WAAY,2BAA2B;IACrC,iDAAkB,CAAA;IAClB,6DAA8B,CAAA;IAC9B,uDAAwB,CAAA;AAC1B,CAAC,EAJW,2BAA2B,2CAA3B,2BAA2B,QAItC;AAEY,QAAA,iCAAiC,GAAG,OAAC,CAAC,UAAU,CAC3D,2BAA2B,CAC5B,CAAC;AAQW,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAShD,QAAA,kBAAkB,GAAG,WAAW,CAAC;AAGjC,QAAA,yBAAyB,GACpC,MAAM,CAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;AAG1C,QAAA,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1D,SAAS;IACT,eAAe;IACf,cAAc;CACN,CAAC,CAAC;AAQC,QAAA,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAU,CAAC,CAAC;AAGxE,QAAA,oBAAoB,GAAG,QAAQ,CAAC;AAU7C,IAAY,0BAEX;AAFD,WAAY,0BAA0B;IACpC,oDAAsB,CAAA;AACxB,CAAC,EAFW,0BAA0B,0CAA1B,0BAA0B,QAErC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAEW,QAAA,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,WAAW;IACX,YAAY;IACZ,YAAY;CACJ,CAAC,CAAC;AAGC,QAAA,sCAAsC,GAE/C,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,uCAA+B;CACrE,CAAC,CAAC;AAYU,QAAA,8BAA8B,GAEvC,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;KAClC,CAAC;IACF,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC;AA4BU,QAAA,qBAAqB,GAChC,MAAM,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;KAC3E,CAAC;IACF,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;KACvE,CAAC;IACF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;KAC9C,CAAC;IAUF,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9B,KAAK,EAAE,oBAAoB;QAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;KACtF,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;KAC3F,CAAC;IACF,GAAG,MAAM,CAAC,WAAW,CAEjB;QACE,CAAC,eAAe,EAAE,gBAAgB,CAAC;QACnC,CAAC,cAAc,EAAE,SAAS,CAAC;QAG3B,CAAC,0BAA0B,EAAE,gBAAgB,CAAC;QAC9C,CAAC,oBAAoB,EAAE,YAAY,CAAC;QACpC,CAAC,+BAA+B,EAAE,YAAY,CAAC;QAC/C,CAAC,aAAa,EAAE,QAAQ,CAAC;QACzB,CAAC,uBAAuB,EAAE,eAAe,CAAC;QAC1C,CAAC,mBAAmB,EAAE,eAAe,CAAC;KAEzC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACvB,IAAI;QACJ,MAAM,CAAC,MAAM,CAAC;YACZ,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACjF,CAAC;KACH,CAAC,CACH;CACF,CAAC,CAAC;AAGL,SAAgB,2BAA2B,CACzC,OAAe;IAEf,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,6BAAqB,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CACrD,CACF,CAAC;AACJ,CAAC"}

package/dist/authorization-module/platform/xema_core.fga

@@ -20,7 +20,21 @@ module xema_core
 # admin's authority — never the members'.
 # ═══════════════════════════════════════════════════════════════════════════
 
+# `is_self` is NEVER a stored tuple: the PDP supplies `user:<id>#is_self@user:<id>`
+# per decision for the ASKING principal (`buildSelfContextualTuples`,
+# `@xemahq/contracts/authzen`), exactly as it supplies `org#admin`. So a user
+# may delegate their OWN authority, by a modelled rule rather than by a code
+# short-circuit — which is what lets a deployment's model TIGHTEN it. (The
+# relation is `is_self` because OpenFGA reserves the relation name `self`.)
+#
+# `may_delegate_for` (on user, team and org) answers ONLY "may this caller
+# originate a durable delegation whose authority OWNER is this subject?". It
+# grants no capability, scope or holder. These are the zero-configuration
+# defaults; a biome can never extend a platform type, so nothing widens them.
 type user
+  relations
+    define is_self: [user]
+    define may_delegate_for: is_self
 type agent
 type service
 type runner
@@ -41,6 +55,7 @@ type org
     define xema_admin: admin
     define xema_write: admin
     define xema_read: admin
+    define may_delegate_for: admin
 
 # Teams nest: `member` is the transitive closure over `sub_team`, so a grant to
 # `team:<id>#member` reaches every member of every descendant team.
@@ -51,6 +66,7 @@ type team
     define admin: [user]
     define direct_member: [user, agent, service, app, external-subject]
     define member: direct_member or member from sub_team
+    define may_delegate_for: admin
 
 type role
   relations
@@ -94,3 +110,29 @@ type xema_artifact
     define can_write: owner or xema_write from parent
     define can_read: owner or can_write or xema_read from parent
     define xema_read: can_read
+
+# ── Durable delegation: integrations and the scopes bound to them ──────────
+#
+# Generic plumbing, not a business noun. An integration INSTANCE (a
+# connection's sync, a mailbox intake, a scheduled workflow) is the thing a
+# durable delegation is created FOR; its owning service writes these facts:
+#
+#   parent       — the org it belongs to;
+#   active       — `xema_integration:<o>|<id>#active@org:<o>`, present iff the
+#                  integration is ACTIVE (removed BEFORE a disable commits);
+#   holder       — the workload declared as its executor;
+#   bound_scope  — each opaque scope (`xema_scope`) it is bound to;
+#   configurer   — who may configure it, beside the org's administrators.
+#
+# A delegation is usable only while these facts hold; the PDP re-checks them
+# at every use and reads no stored verdict.
+type xema_scope
+
+type xema_integration
+  relations
+    define parent: [org]
+    define active: [org]
+    define holder: [service]
+    define bound_scope: [xema_scope]
+    define configurer: [user, team#member]
+    define configure: configurer or admin from parent

package/dist/authorization-module/platform/xema_core.fga.yaml

@@ -156,3 +156,146 @@ tests:
         object: xema_artifact:org1|a4
         assertions:
           can_read: false
+  # ── Durable delegation: may_delegate_for defaults ──────────────────────
+  # `user#is_self` is NEVER stored: the PDP supplies it per decision as a
+  # CONTEXTUAL tuple for the asking principal (`buildSelfContextualTuples`).
+  # `fga model test` has no contextual tuples, so — as for `org#admin` above —
+  # the fact is stated as a per-test fixture tuple; the model's semantics
+  # given the fact are the same.
+  - name: a user may delegate for THEMSELF given the is_self fact, and for nobody else
+    tuples:
+      - user: user:alice
+        relation: is_self
+        object: user:alice
+    check:
+      - user: user:alice
+        object: user:alice
+        assertions:
+          may_delegate_for: true
+      - user: user:alice
+        object: user:mallory
+        assertions:
+          may_delegate_for: false
+      - user: user:mallory
+        object: user:alice
+        assertions:
+          may_delegate_for: false
+  - name: without the per-decision is_self fact, not even a user's own authority is delegable
+    check:
+      - user: user:alice
+        object: user:alice
+        assertions:
+          may_delegate_for: false
+  - name: a team admin may delegate for the team; a plain member may not
+    tuples:
+      - user: org:org1
+        relation: parent
+        object: team:t1
+      - user: user:tia
+        relation: admin
+        object: team:t1
+      - user: user:tom
+        relation: direct_member
+        object: team:t1
+    check:
+      - user: user:tia
+        object: team:t1
+        assertions:
+          may_delegate_for: true
+      - user: user:tom
+        object: team:t1
+        assertions:
+          may_delegate_for: false
+      - user: user:root
+        object: team:t1
+        assertions:
+          may_delegate_for: false
+  - name: the org admin (contextual org#admin, stated as a fixture) may delegate for the org; a member may not
+    check:
+      - user: user:root
+        object: org:org1
+        assertions:
+          may_delegate_for: true
+      - user: user:dave
+        object: org:org1
+        assertions:
+          may_delegate_for: false
+      - user: user:root
+        object: org:org2
+        assertions:
+          may_delegate_for: false
+  # ── Durable delegation: integration facts ─────────────────────────────
+  - name: an integration is configured by its configurers and its org's admin, and states its active, holder and bound-scope facts
+    tuples:
+      - user: org:org1
+        relation: parent
+        object: xema_integration:org1|i1
+      - user: org:org1
+        relation: active
+        object: xema_integration:org1|i1
+      - user: service:connector-sync
+        relation: holder
+        object: xema_integration:org1|i1
+      - user: xema_scope:repo-42
+        relation: bound_scope
+        object: xema_integration:org1|i1
+      - user: user:cora
+        relation: configurer
+        object: xema_integration:org1|i1
+      - user: org:org1
+        relation: parent
+        object: team:ops
+      - user: user:tess
+        relation: direct_member
+        object: team:ops
+      - user: team:ops#member
+        relation: configurer
+        object: xema_integration:org1|i1
+      - user: org:org1
+        relation: parent
+        object: xema_integration:org1|i2
+    check:
+      - user: user:cora
+        object: xema_integration:org1|i1
+        assertions:
+          configure: true
+      - user: user:tess
+        object: xema_integration:org1|i1
+        assertions:
+          configure: true
+      - user: user:root
+        object: xema_integration:org1|i1
+        assertions:
+          configure: true
+      - user: user:dave
+        object: xema_integration:org1|i1
+        assertions:
+          configure: false
+      - user: user:cora
+        object: xema_integration:org1|i2
+        assertions:
+          configure: false
+      - user: org:org1
+        object: xema_integration:org1|i1
+        assertions:
+          active: true
+      - user: org:org1
+        object: xema_integration:org1|i2
+        assertions:
+          active: false
+      - user: service:connector-sync
+        object: xema_integration:org1|i1
+        assertions:
+          holder: true
+      - user: service:mailops
+        object: xema_integration:org1|i1
+        assertions:
+          holder: false
+      - user: xema_scope:repo-42
+        object: xema_integration:org1|i1
+        assertions:
+          bound_scope: true
+      - user: xema_scope:repo-43
+        object: xema_integration:org1|i1
+        assertions:
+          bound_scope: false

package/dist/authzen/index.d.ts

@@ -6,4 +6,5 @@ export * from './lib/xema-authzen-profile';
 export * from './lib/authzen-snapshot';
 export * from './lib/xema-capability-resource';
 export * from './lib/org-authority-contextual-tuple';
+export * from './lib/durable-delegation-model';
 //# sourceMappingURL=index.d.ts.map

package/dist/authzen/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,gCAAgC,CAAC"}

package/dist/authzen/index.js

@@ -22,4 +22,5 @@ __exportStar(require("./lib/xema-authzen-profile"), exports);
 __exportStar(require("./lib/authzen-snapshot"), exports);
 __exportStar(require("./lib/xema-capability-resource"), exports);
 __exportStar(require("./lib/org-authority-contextual-tuple"), exports);
+__exportStar(require("./lib/durable-delegation-model"), exports);
 //# sourceMappingURL=index.js.map

package/dist/authzen/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,2DAAyC;AACzC,uDAAqC;AACrC,yDAAuC;AACvC,6DAA2C;AAC3C,yDAAuC;AACvC,iEAA+C;AAC/C,uEAAqD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,2DAAyC;AACzC,uDAAqC;AACrC,yDAAuC;AACvC,6DAA2C;AAC3C,yDAAuC;AACvC,iEAA+C;AAC/C,uEAAqD;AACrD,iEAA+C"}

package/dist/authzen/lib/durable-delegation-model.d.ts

@@ -0,0 +1,24 @@
+import type { AuthzContextualTuple } from './org-authority-contextual-tuple';
+export declare const XEMA_MAY_DELEGATE_FOR_RELATION = "may_delegate_for";
+export declare const XEMA_SELF_RELATION = "is_self";
+export declare const XEMA_INTEGRATION_OBJECT_TYPE = "xema_integration";
+export declare const XEMA_SCOPE_OBJECT_TYPE = "xema_scope";
+export declare enum XemaIntegrationRelation {
+    Parent = "parent",
+    Active = "active",
+    Holder = "holder",
+    BoundScope = "bound_scope",
+    Configurer = "configurer",
+    Configure = "configure"
+}
+export declare class XemaScopeObjectError extends Error {
+    constructor(message: string);
+}
+export declare function buildXemaScopeObject(scopeRef: string): string;
+export declare function parseXemaScopeObject(object: string): string;
+export declare function buildXemaIntegrationObject(orgId: string, integrationId: string): string;
+export declare function buildSelfContextualTuples(subject: {
+    readonly kind: string;
+    readonly id: string;
+}): readonly AuthzContextualTuple[];
+//# sourceMappingURL=durable-delegation-model.d.ts.map

package/dist/authzen/lib/durable-delegation-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-delegation-model.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/durable-delegation-model.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AA4B7E,eAAO,MAAM,8BAA8B,qBAAqB,CAAC;AAOjE,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAG5C,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAG/D,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAGnD,oBAAY,uBAAuB;IAEjC,MAAM,WAAW;IAEjB,MAAM,WAAW;IAEjB,MAAM,WAAW;IAEjB,UAAU,gBAAgB;IAE1B,UAAU,eAAe;IAEzB,SAAS,cAAc;CACxB;AAGD,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAWD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAU7D;AAGD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ3D;AAQD,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,MAAM,CAER;AAQD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,GAAG,SAAS,oBAAoB,EAAE,CAIlC"}

package/dist/authzen/lib/durable-delegation-model.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaScopeObjectError = exports.XemaIntegrationRelation = exports.XEMA_SCOPE_OBJECT_TYPE = exports.XEMA_INTEGRATION_OBJECT_TYPE = exports.XEMA_SELF_RELATION = exports.XEMA_MAY_DELEGATE_FOR_RELATION = void 0;
+exports.buildXemaScopeObject = buildXemaScopeObject;
+exports.parseXemaScopeObject = parseXemaScopeObject;
+exports.buildXemaIntegrationObject = buildXemaIntegrationObject;
+exports.buildSelfContextualTuples = buildSelfContextualTuples;
+const subject_1 = require("../../subject");
+const xema_capability_resource_1 = require("./xema-capability-resource");
+const xema_authzen_profile_1 = require("./xema-authzen-profile");
+exports.XEMA_MAY_DELEGATE_FOR_RELATION = 'may_delegate_for';
+exports.XEMA_SELF_RELATION = 'is_self';
+exports.XEMA_INTEGRATION_OBJECT_TYPE = 'xema_integration';
+exports.XEMA_SCOPE_OBJECT_TYPE = 'xema_scope';
+var XemaIntegrationRelation;
+(function (XemaIntegrationRelation) {
+    XemaIntegrationRelation["Parent"] = "parent";
+    XemaIntegrationRelation["Active"] = "active";
+    XemaIntegrationRelation["Holder"] = "holder";
+    XemaIntegrationRelation["BoundScope"] = "bound_scope";
+    XemaIntegrationRelation["Configurer"] = "configurer";
+    XemaIntegrationRelation["Configure"] = "configure";
+})(XemaIntegrationRelation || (exports.XemaIntegrationRelation = XemaIntegrationRelation = {}));
+class XemaScopeObjectError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'XemaScopeObjectError';
+    }
+}
+exports.XemaScopeObjectError = XemaScopeObjectError;
+function buildXemaScopeObject(scopeRef) {
+    if (scopeRef.length === 0) {
+        throw new XemaScopeObjectError('buildXemaScopeObject: scopeRef is empty.');
+    }
+    if (/[\s#]/.test(scopeRef)) {
+        throw new XemaScopeObjectError(`buildXemaScopeObject: scopeRef "${scopeRef}" contains whitespace or \`#\`, which no OpenFGA object id may carry.`);
+    }
+    return `${exports.XEMA_SCOPE_OBJECT_TYPE}:${(0, xema_capability_resource_1.encodeXemaIdSegment)(scopeRef)}`;
+}
+function parseXemaScopeObject(object) {
+    const prefix = `${exports.XEMA_SCOPE_OBJECT_TYPE}:`;
+    if (!object.startsWith(prefix) || object.length === prefix.length) {
+        throw new XemaScopeObjectError(`parseXemaScopeObject: "${object}" is not a ${exports.XEMA_SCOPE_OBJECT_TYPE} object.`);
+    }
+    return (0, xema_capability_resource_1.decodeXemaIdSegment)(object.slice(prefix.length));
+}
+function buildXemaIntegrationObject(orgId, integrationId) {
+    return `${exports.XEMA_INTEGRATION_OBJECT_TYPE}:${(0, xema_authzen_profile_1.qualifyResourceId)(orgId, integrationId)}`;
+}
+function buildSelfContextualTuples(subject) {
+    if (subject.kind !== subject_1.SubjectKind.User || subject.id.length === 0)
+        return [];
+    const user = (0, subject_1.subjectRefToString)({ kind: subject_1.SubjectKind.User, id: subject.id });
+    return [{ user, relation: exports.XEMA_SELF_RELATION, object: user }];
+}
+//# sourceMappingURL=durable-delegation-model.js.map

package/dist/authzen/lib/durable-delegation-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-delegation-model.js","sourceRoot":"","sources":["../../../src/authzen/lib/durable-delegation-model.ts"],"names":[],"mappings":";;;AAkFA,oDAUC;AAGD,oDAQC;AAQD,gEAKC;AAQD,8DAOC;AAnID,2CAAgE;AAEhE,yEAGoC;AAEpC,iEAA2D;AA2B9C,QAAA,8BAA8B,GAAG,kBAAkB,CAAC;AAOpD,QAAA,kBAAkB,GAAG,SAAS,CAAC;AAG/B,QAAA,4BAA4B,GAAG,kBAAkB,CAAC;AAGlD,QAAA,sBAAsB,GAAG,YAAY,CAAC;AAGnD,IAAY,uBAaX;AAbD,WAAY,uBAAuB;IAEjC,4CAAiB,CAAA;IAEjB,4CAAiB,CAAA;IAEjB,4CAAiB,CAAA;IAEjB,qDAA0B,CAAA;IAE1B,oDAAyB,CAAA;IAEzB,kDAAuB,CAAA;AACzB,CAAC,EAbW,uBAAuB,uCAAvB,uBAAuB,QAalC;AAGD,MAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AALD,oDAKC;AAWD,SAAgB,oBAAoB,CAAC,QAAgB;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAAC,0CAA0C,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,mCAAmC,QAAQ,uEAAuE,CACnH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,8BAAsB,IAAI,IAAA,8CAAmB,EAAC,QAAQ,CAAC,EAAE,CAAC;AACtE,CAAC;AAGD,SAAgB,oBAAoB,CAAC,MAAc;IACjD,MAAM,MAAM,GAAG,GAAG,8BAAsB,GAAG,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAClE,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,MAAM,cAAc,8BAAsB,UAAU,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,8CAAmB,EAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAQD,SAAgB,0BAA0B,CACxC,KAAa,EACb,aAAqB;IAErB,OAAO,GAAG,oCAA4B,IAAI,IAAA,wCAAiB,EAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;AACtF,CAAC;AAQD,SAAgB,yBAAyB,CAAC,OAGzC;IACC,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,0BAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC"}

package/dist/capability/index.d.ts

@@ -7,6 +7,7 @@ export * from './lib/capability-reach';
 export * from './lib/capability-effect-class';
 export * from './lib/capability-aperture';
 export * from './lib/capability-agent-exposure';
+export * from './lib/capability-delegable';
 export * from './lib/capability-human-baseline';
 export * from './lib/capability-grant';
 export * from './lib/capability-policy';

package/dist/capability/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,cAAc,CAAC;AAC7B,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,cAAc,CAAC;AAC7B,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC"}

package/dist/capability/index.js

@@ -23,6 +23,7 @@ __exportStar(require("./lib/capability-reach"), exports);
 __exportStar(require("./lib/capability-effect-class"), exports);
 __exportStar(require("./lib/capability-aperture"), exports);
 __exportStar(require("./lib/capability-agent-exposure"), exports);
+__exportStar(require("./lib/capability-delegable"), exports);
 __exportStar(require("./lib/capability-human-baseline"), exports);
 __exportStar(require("./lib/capability-grant"), exports);
 __exportStar(require("./lib/capability-policy"), exports);

package/dist/capability/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,+DAA6C;AAC7C,iEAA+C;AAC/C,0DAAwC;AACxC,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,4DAA0C;AAC1C,kEAAgD;AAChD,kEAAgD;AAChD,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,iEAA+C;AAC/C,uEAAqD;AACrD,gEAA8C;AAC9C,mEAAiD;AACjD,+CAA6B;AAC7B,yEAAuD;AACvD,gEAA8C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,+DAA6C;AAC7C,iEAA+C;AAC/C,0DAAwC;AACxC,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,4DAA0C;AAC1C,kEAAgD;AAChD,6DAA2C;AAC3C,kEAAgD;AAChD,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,iEAA+C;AAC/C,uEAAqD;AACrD,gEAA8C;AAC9C,mEAAiD;AACjD,+CAA6B;AAC7B,yEAAuD;AACvD,gEAA8C"}

package/dist/capability/lib/capability-contribution.d.ts

@@ -28,6 +28,7 @@ export interface CapabilityContributionManifest {
     readonly requiredBindings?: readonly RequiredResourceRoleBinding[] | undefined;
     readonly safeForAgents?: boolean | undefined;
     readonly humanBaseline?: HumanBaseline | undefined;
+    readonly delegable?: true | undefined;
 }
 export declare const CapabilityContributionManifestSchema: z.ZodObject<{
     ref: z.ZodType<CapabilityRef, unknown, z.core.$ZodTypeInternals<CapabilityRef, unknown>>;
@@ -49,5 +50,6 @@ export declare const CapabilityContributionManifestSchema: z.ZodObject<{
     requiredBindings: z.ZodOptional<z.ZodArray<z.ZodType<RequiredResourceRoleBinding, unknown, z.core.$ZodTypeInternals<RequiredResourceRoleBinding, unknown>>>>;
     safeForAgents: z.ZodOptional<z.ZodBoolean>;
     humanBaseline: z.ZodOptional<z.ZodType<HumanBaseline, unknown, z.core.$ZodTypeInternals<HumanBaseline, unknown>>>;
+    delegable: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
 //# sourceMappingURL=capability-contribution.d.ts.map

package/dist/capability/lib/capability-contribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAsBtC,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE/C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAKtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAKnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAUnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOjD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAoB1D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAgB/D,QAAQ,CAAC,eAAe,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAqBjE,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IA0B7C,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAQzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAgBzE,QAAQ,CAAC,gBAAgB,CAAC,EACtB,SAAS,2BAA2B,EAAE,GACtC,SAAS,CAAC;IAuDd,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAa7C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CACpD;AAcD,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;kBAsEO,CAAC"}
+{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAsBtC,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE/C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAKtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAKnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAUnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOjD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAoB1D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAgB/D,QAAQ,CAAC,eAAe,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAqBjE,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IA0B7C,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAQzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAgBzE,QAAQ,CAAC,gBAAgB,CAAC,EACtB,SAAS,2BAA2B,EAAE,GACtC,SAAS,CAAC;IAuDd,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAa7C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAcnD,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACvC;AAcD,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;kBAuEO,CAAC"}

package/dist/capability/lib/capability-contribution.js

@@ -10,6 +10,7 @@ const required_resource_role_binding_1 = require("./required-resource-role-bindi
 const permission_profile_1 = require("./permission-profile");
 const space_1 = require("../../space");
 const capability_human_baseline_1 = require("./capability-human-baseline");
+const capability_delegable_1 = require("./capability-delegable");
 const trusted_context_projection_1 = require("./trusted-context-projection");
 exports.CapabilityContributionManifestSchema = zod_1.z
     .object({
@@ -35,6 +36,7 @@ exports.CapabilityContributionManifestSchema = zod_1.z
         .optional(),
     safeForAgents: zod_1.z.boolean().optional(),
     humanBaseline: capability_human_baseline_1.HumanBaselineSchema.optional(),
+    delegable: capability_delegable_1.CapabilityDelegableSchema.optional(),
 })
     .strict()
     .superRefine((manifest, context) => {

package/dist/capability/lib/capability-contribution.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability-contribution.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,qDAA2E;AAC3E,yDAG4B;AAC5B,yDAG4B;AAC5B,uEAGmC;AACnC,qFAG0C;AAC1C,6DAG8B;AAC9B,uCAAgF;AAChF,2EAGqC;AACrC,6EAKsC;AA+PzB,QAAA,oCAAoC,GAAG,OAAC;KAClD,MAAM,CAAC;IACN,GAAG,EAAE,oCAAmB;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC/C,QAAQ,EAAE,6CAAwB;IAClC,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC7B,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvE,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,2BAA2B,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClE,oBAAoB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,kDAA+B,CAAC,QAAQ,EAAE;IAC3D,KAAK,EAAE,wCAAqB,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,qDAA2B,CAAC,QAAQ,EAAE;IACnD,wBAAwB,EAAE,2DAA8B,CAAC,QAAQ,EAAE;IACnE,gBAAgB,EAAE,OAAC;SAChB,KAAK,CAAC,kEAAiC,CAAC;SACxC,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;IACb,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,+CAAmB,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,IAAA,yEAA4C,EAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE;gBACJ,aAAa;gBACb,YAAY;gBACZ,qEAAwC;aACzC;YACD,OAAO,EACL,GAAG,qEAAwC,0BAA0B;gBACrE,gDAAgD;SACnD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,uCAAkB,CAAC,QAAQ,EAAE,CAAC;QACtD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EACL,uEAAuE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC/B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EACL,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,sEAAsE;gBACtE,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAqD,CAAC;AASzD,SAAS,wBAAwB,CAAC,MAA+B;IAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,CACL,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC3B,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,CACzC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"capability-contribution.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,qDAA2E;AAC3E,yDAG4B;AAC5B,yDAG4B;AAC5B,uEAGmC;AACnC,qFAG0C;AAC1C,6DAG8B;AAC9B,uCAAgF;AAChF,2EAGqC;AACrC,iEAAmE;AACnE,6EAKsC;AA6QzB,QAAA,oCAAoC,GAAG,OAAC;KAClD,MAAM,CAAC;IACN,GAAG,EAAE,oCAAmB;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC/C,QAAQ,EAAE,6CAAwB;IAClC,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC7B,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvE,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,2BAA2B,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClE,oBAAoB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,kDAA+B,CAAC,QAAQ,EAAE;IAC3D,KAAK,EAAE,wCAAqB,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,qDAA2B,CAAC,QAAQ,EAAE;IACnD,wBAAwB,EAAE,2DAA8B,CAAC,QAAQ,EAAE;IACnE,gBAAgB,EAAE,OAAC;SAChB,KAAK,CAAC,kEAAiC,CAAC;SACxC,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;IACb,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,+CAAmB,CAAC,QAAQ,EAAE;IAC7C,SAAS,EAAE,gDAAyB,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,IAAA,yEAA4C,EAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE;gBACJ,aAAa;gBACb,YAAY;gBACZ,qEAAwC;aACzC;YACD,OAAO,EACL,GAAG,qEAAwC,0BAA0B;gBACrE,gDAAgD;SACnD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,uCAAkB,CAAC,QAAQ,EAAE,CAAC;QACtD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EACL,uEAAuE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC/B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EACL,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,sEAAsE;gBACtE,qEAAqE;SACxE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAqD,CAAC;AASzD,SAAS,wBAAwB,CAAC,MAA+B;IAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,CACL,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC3B,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,CACzC,CAAC;AACJ,CAAC"}

package/dist/capability/lib/capability-delegable.d.ts

@@ -0,0 +1,6 @@
+import { z } from 'zod';
+export declare const CAPABILITY_DELEGABLE_FIELD = "delegable";
+export declare const CapabilityDelegableSchema: z.ZodLiteral<true>;
+export declare function isCapabilityDelegable(descriptor: Readonly<Record<string, unknown>> | null | undefined): boolean;
+export declare function joinCapabilityDelegable(a: true | undefined, b: true | undefined): true | undefined;
+//# sourceMappingURL=capability-delegable.d.ts.map

package/dist/capability/lib/capability-delegable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-delegable.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-delegable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2BxB,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAGtD,eAAO,MAAM,yBAAyB,oBAAkB,CAAC;AAOzD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,GAC/D,OAAO,CAET;AAMD,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,IAAI,GAAG,SAAS,EACnB,CAAC,EAAE,IAAI,GAAG,SAAS,GAClB,IAAI,GAAG,SAAS,CAElB"}

package/dist/capability/lib/capability-delegable.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityDelegableSchema = exports.CAPABILITY_DELEGABLE_FIELD = void 0;
+exports.isCapabilityDelegable = isCapabilityDelegable;
+exports.joinCapabilityDelegable = joinCapabilityDelegable;
+const zod_1 = require("zod");
+exports.CAPABILITY_DELEGABLE_FIELD = 'delegable';
+exports.CapabilityDelegableSchema = zod_1.z.literal(true);
+function isCapabilityDelegable(descriptor) {
+    return descriptor?.[exports.CAPABILITY_DELEGABLE_FIELD] === true;
+}
+function joinCapabilityDelegable(a, b) {
+    return a === true || b === true ? true : undefined;
+}
+//# sourceMappingURL=capability-delegable.js.map

package/dist/capability/lib/capability-delegable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-delegable.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-delegable.ts"],"names":[],"mappings":";;;AAqCA,sDAIC;AAMD,0DAKC;AApDD,6BAAwB;AA2BX,QAAA,0BAA0B,GAAG,WAAW,CAAC;AAGzC,QAAA,yBAAyB,GAAG,OAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAOzD,SAAgB,qBAAqB,CACnC,UAAgE;IAEhE,OAAO,UAAU,EAAE,CAAC,kCAA0B,CAAC,KAAK,IAAI,CAAC;AAC3D,CAAC;AAMD,SAAgB,uBAAuB,CACrC,CAAmB,EACnB,CAAmB;IAEnB,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC"}

package/dist/capability-projection/lib/projected-capability.d.ts

@@ -31,6 +31,7 @@ export declare const ProjectedCapabilitySchema: z.ZodObject<{
     requiredBindings: z.ZodOptional<z.ZodArray<z.ZodType<import("../../capability").RequiredResourceRoleBinding, unknown, z.core.$ZodTypeInternals<import("../../capability").RequiredResourceRoleBinding, unknown>>>>;
     safeForAgents: z.ZodOptional<z.ZodBoolean>;
     humanBaseline: z.ZodOptional<z.ZodType<import("../../capability").HumanBaseline, unknown, z.core.$ZodTypeInternals<import("../../capability").HumanBaseline, unknown>>>;
+    delegable: z.ZodOptional<z.ZodLiteral<true>>;
     invocation: z.ZodType<CapabilityInvocationBinding, unknown, z.core.$ZodTypeInternals<CapabilityInvocationBinding, unknown>>;
     provenance: z.ZodType<ProjectedCapabilityProvenance, unknown, z.core.$ZodTypeInternals<ProjectedCapabilityProvenance, unknown>>;
 }, z.core.$strict>;

package/dist/capability-projection/lib/projected-capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projected-capability.d.ts","sourceRoot":"","sources":["../../../src/capability-projection/lib/projected-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,iCAAiC,CAAC;AAUzC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,mCAAmC,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAO5E,CAAC;AAoBd,MAAM,WAAW,mBAAoB,SAAQ,8BAA8B;IACzE,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;CACpD;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAIO,CAAC"}
+{"version":3,"file":"projected-capability.d.ts","sourceRoot":"","sources":["../../../src/capability-projection/lib/projected-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,iCAAiC,CAAC;AAUzC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,mCAAmC,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAO5E,CAAC;AAoBd,MAAM,WAAW,mBAAoB,SAAQ,8BAA8B;IACzE,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;CACpD;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;kBAIO,CAAC"}

package/dist/service-registry/lib/service-names.generated.d.ts

@@ -16,6 +16,7 @@ export declare const ServiceName: {
     readonly CAPABILITY_REGISTRY_API: "capability-registry-api";
     readonly CHANNEL_GATEWAY_API: "channel-gateway-api";
     readonly CONNECTOR_GATEWAY_API: "connector-gateway-api";
+    readonly CONNECTOR_SYNC_API: "connector-sync-api";
     readonly CONTAINER_REGISTRY_API: "container-registry-api";
     readonly CONTROL_PLANE_API: "control-plane-api";
     readonly CREDENTIAL_BROKER_API: "credential-broker-api";

package/dist/service-registry/lib/service-names.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-names.generated.d.ts","sourceRoot":"","sources":["../../../src/service-registry/lib/service-names.generated.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6Dd,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC"}
+{"version":3,"file":"service-names.generated.d.ts","sourceRoot":"","sources":["../../../src/service-registry/lib/service-names.generated.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8Dd,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC"}

package/dist/service-registry/lib/service-names.generated.js

@@ -19,6 +19,7 @@ exports.ServiceName = {
     CAPABILITY_REGISTRY_API: 'capability-registry-api',
     CHANNEL_GATEWAY_API: 'channel-gateway-api',
     CONNECTOR_GATEWAY_API: 'connector-gateway-api',
+    CONNECTOR_SYNC_API: 'connector-sync-api',
     CONTAINER_REGISTRY_API: 'container-registry-api',
     CONTROL_PLANE_API: 'control-plane-api',
     CREDENTIAL_BROKER_API: 'credential-broker-api',

package/dist/service-registry/lib/service-names.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-names.generated.js","sourceRoot":"","sources":["../../../src/service-registry/lib/service-names.generated.ts"],"names":[],"mappings":";;;AAca,QAAA,WAAW,GAAG;IACzB,iBAAiB,EAAE,mBAAmB;IACtC,iBAAiB,EAAE,mBAAmB;IACtC,aAAa,EAAE,eAAe;IAC9B,mBAAmB,EAAE,qBAAqB;IAC1C,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,kBAAkB;IACpC,kBAAkB,EAAE,oBAAoB;IACxC,aAAa,EAAE,eAAe;IAC9B,iBAAiB,EAAE,mBAAmB;IACtC,WAAW,EAAE,aAAa;IAC1B,kBAAkB,EAAE,oBAAoB;IACxC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,YAAY;IACxB,uBAAuB,EAAE,yBAAyB;IAClD,mBAAmB,EAAE,qBAAqB;IAC1C,qBAAqB,EAAE,uBAAuB;IAC9C,sBAAsB,EAAE,wBAAwB;IAChD,iBAAiB,EAAE,mBAAmB;IACtC,qBAAqB,EAAE,uBAAuB;IAC9C,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C,yBAAyB,EAAE,2BAA2B;IACtD,gBAAgB,EAAE,kBAAkB;IACpC,mBAAmB,EAAE,qBAAqB;IAC1C,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,kBAAkB,EAAE,oBAAoB;IACxC,WAAW,EAAE,aAAa;IAC1B,gBAAgB,EAAE,kBAAkB;IACpC,WAAW,EAAE,aAAa;IAC1B,uBAAuB,EAAE,yBAAyB;IAClD,eAAe,EAAE,iBAAiB;IAClC,UAAU,EAAE,YAAY;IACxB,mBAAmB,EAAE,qBAAqB;IAC1C,qBAAqB,EAAE,uBAAuB;IAC9C,oBAAoB,EAAE,sBAAsB;IAC5C,kBAAkB,EAAE,oBAAoB;IACxC,cAAc,EAAE,gBAAgB;IAChC,uBAAuB,EAAE,yBAAyB;IAClD,iBAAiB,EAAE,mBAAmB;IACtC,UAAU,EAAE,YAAY;IACxB,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,qBAAqB,EAAE,uBAAuB;IAC9C,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,iBAAiB,EAAE,mBAAmB;IACtC,mBAAmB,EAAE,qBAAqB;IAC1C,uBAAuB,EAAE,yBAAyB;IAClD,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,mBAAmB;IACtC,6BAA6B,EAAE,+BAA+B;IAC9D,0BAA0B,EAAE,4BAA4B;IACxD,0BAA0B,EAAE,4BAA4B;IACxD,sBAAsB,EAAE,wBAAwB;IAChD,kBAAkB,EAAE,oBAAoB;IACxC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;CACxB,CAAC"}
+{"version":3,"file":"service-names.generated.js","sourceRoot":"","sources":["../../../src/service-registry/lib/service-names.generated.ts"],"names":[],"mappings":";;;AAca,QAAA,WAAW,GAAG;IACzB,iBAAiB,EAAE,mBAAmB;IACtC,iBAAiB,EAAE,mBAAmB;IACtC,aAAa,EAAE,eAAe;IAC9B,mBAAmB,EAAE,qBAAqB;IAC1C,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,kBAAkB;IACpC,kBAAkB,EAAE,oBAAoB;IACxC,aAAa,EAAE,eAAe;IAC9B,iBAAiB,EAAE,mBAAmB;IACtC,WAAW,EAAE,aAAa;IAC1B,kBAAkB,EAAE,oBAAoB;IACxC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,YAAY;IACxB,uBAAuB,EAAE,yBAAyB;IAClD,mBAAmB,EAAE,qBAAqB;IAC1C,qBAAqB,EAAE,uBAAuB;IAC9C,kBAAkB,EAAE,oBAAoB;IACxC,sBAAsB,EAAE,wBAAwB;IAChD,iBAAiB,EAAE,mBAAmB;IACtC,qBAAqB,EAAE,uBAAuB;IAC9C,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C,yBAAyB,EAAE,2BAA2B;IACtD,gBAAgB,EAAE,kBAAkB;IACpC,mBAAmB,EAAE,qBAAqB;IAC1C,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,kBAAkB,EAAE,oBAAoB;IACxC,WAAW,EAAE,aAAa;IAC1B,gBAAgB,EAAE,kBAAkB;IACpC,WAAW,EAAE,aAAa;IAC1B,uBAAuB,EAAE,yBAAyB;IAClD,eAAe,EAAE,iBAAiB;IAClC,UAAU,EAAE,YAAY;IACxB,mBAAmB,EAAE,qBAAqB;IAC1C,qBAAqB,EAAE,uBAAuB;IAC9C,oBAAoB,EAAE,sBAAsB;IAC5C,kBAAkB,EAAE,oBAAoB;IACxC,cAAc,EAAE,gBAAgB;IAChC,uBAAuB,EAAE,yBAAyB;IAClD,iBAAiB,EAAE,mBAAmB;IACtC,UAAU,EAAE,YAAY;IACxB,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,qBAAqB,EAAE,uBAAuB;IAC9C,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,iBAAiB,EAAE,mBAAmB;IACtC,mBAAmB,EAAE,qBAAqB;IAC1C,uBAAuB,EAAE,yBAAyB;IAClD,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,mBAAmB;IACtC,6BAA6B,EAAE,+BAA+B;IAC9D,0BAA0B,EAAE,4BAA4B;IACxD,0BAA0B,EAAE,4BAA4B;IACxD,sBAAsB,EAAE,wBAAwB;IAChD,kBAAkB,EAAE,oBAAoB;IACxC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;CACxB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/contracts",
-  "version": "0.56.0",
+  "version": "0.58.0",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework deps; the one runtime dependency beside zod is the OpenFGA syntax transformer the authorization-module composer runs.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",