@xemahq/contracts 0.64.0 → 0.65.0

package/dist/.source-stamp.json

@@ -1,5 +1,5 @@
 {
   "algorithm": "sha256/len-framed-v1",
-  "hash": "8be8bea77c32a68213ab7e441dd531b49ac87ca03a7d58f53a1d48bd0dbfd7ea",
-  "fileCount": 590
+  "hash": "e024a5707a6e0907c02059556c2d9c09d7f8139a48a94948dcd94ad4d85d0da7",
+  "fileCount": 592
 }

package/dist/redis-key/index.d.ts

@@ -0,0 +1,2 @@
+export * from './lib/key-prefix';
+//# sourceMappingURL=index.d.ts.map

package/dist/redis-key/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/redis-key/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}

package/dist/redis-key/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/key-prefix"), exports);
+//# sourceMappingURL=index.js.map

package/dist/redis-key/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/redis-key/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC"}

package/dist/redis-key/lib/key-prefix.d.ts

@@ -0,0 +1,57 @@
+import { type DeploymentId } from '../../deployment';
+export declare const KEY_SEGMENT_SEPARATOR = ":";
+export declare const KEY_PREFIX_ROOT = "xema";
+export declare enum RedisKeyScope {
+    Org = "org",
+    System = "sys",
+    Service = "svc"
+}
+export declare enum KeyPrefixSegmentKind {
+    DeploymentId = "deploymentId",
+    OrgId = "orgId",
+    BiomeId = "biomeId",
+    ServiceName = "serviceName",
+    NamespaceKey = "namespaceKey"
+}
+export declare const INVALID_KEY_PREFIX_SEGMENT = "INVALID_KEY_PREFIX_SEGMENT";
+export declare class KeyPrefixSegmentError extends Error {
+    readonly segmentKind: KeyPrefixSegmentKind;
+    readonly value: string;
+    readonly code = "INVALID_KEY_PREFIX_SEGMENT";
+    constructor(segmentKind: KeyPrefixSegmentKind, value: string);
+}
+export declare function assertKeyPrefixSegment(kind: KeyPrefixSegmentKind, value: string): string;
+export declare function assertKeyPrefixDeploymentId(value: string): DeploymentId;
+export type RedisKeyPrefixIdentity = {
+    readonly deploymentId: string;
+    readonly scope: RedisKeyScope.Org;
+    readonly orgId: string;
+    readonly biomeId: string;
+    readonly namespaceKey: string;
+} | {
+    readonly deploymentId: string;
+    readonly scope: RedisKeyScope.System;
+    readonly biomeId: string;
+    readonly namespaceKey: string;
+} | {
+    readonly deploymentId: string;
+    readonly scope: RedisKeyScope.Service;
+    readonly serviceName: string;
+    readonly namespaceKey: string;
+};
+export declare function deriveKeyPrefix(identity: RedisKeyPrefixIdentity): string;
+export declare function deploymentKeyspaceRoot(deploymentId: string): string;
+export declare enum AclPatternPlane {
+    Key = "~",
+    Channel = "&"
+}
+export declare function deploymentAclPatterns(deploymentId: string): {
+    readonly keyPattern: string;
+    readonly channelPattern: string;
+};
+export declare function isWellFormedKeyPrefix(keyPrefix: string): boolean;
+export declare function assertKeyPrefixOwnedBy(keyPrefix: string, deploymentId: string, subject: string): string;
+export declare function aclKeyPatternForPrefix(keyPrefix: string, deploymentId: string): string;
+export declare function aclChannelPatternForPrefix(keyPrefix: string, deploymentId: string): string;
+export declare function keyspaceGlobForPrefix(keyPrefix: string, deploymentId: string): string;
+//# sourceMappingURL=key-prefix.d.ts.map

package/dist/redis-key/lib/key-prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-prefix.d.ts","sourceRoot":"","sources":["../../../src/redis-key/lib/key-prefix.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA+CxE,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAGzC,eAAO,MAAM,eAAe,SAAS,CAAC;AAMtC,oBAAY,aAAa;IAEvB,GAAG,QAAQ;IAEX,MAAM,QAAQ;IAEd,OAAO,QAAQ;CAChB;AAOD,oBAAY,oBAAoB;IAC9B,YAAY,iBAAiB;IAC7B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;CAC9B;AAOD,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAOvE,qBAAa,qBAAsB,SAAQ,KAAK;IAG5C,QAAQ,CAAC,WAAW,EAAE,oBAAoB;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM;IAHxB,QAAQ,CAAC,IAAI,gCAA8B;gBAEhC,WAAW,EAAE,oBAAoB,EACjC,KAAK,EAAE,MAAM;CAWzB;AAGD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKxF;AAgBD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAUvE;AAQD,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,GACD;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,GACD;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AA8BN,wBAAgB,eAAe,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,CAuBxE;AAMD,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEnE;AAMD,oBAAY,eAAe;IACzB,GAAG,MAAM;IACT,OAAO,MAAM;CACd;AASD,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,CAMA;AAkBD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEhE;AAWD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,MAAM,CAiBR;AAGD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEtF;AASD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE1F;AAQD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAErF"}

package/dist/redis-key/lib/key-prefix.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AclPatternPlane = exports.KeyPrefixSegmentError = exports.INVALID_KEY_PREFIX_SEGMENT = exports.KeyPrefixSegmentKind = exports.RedisKeyScope = exports.KEY_PREFIX_ROOT = exports.KEY_SEGMENT_SEPARATOR = void 0;
+exports.assertKeyPrefixSegment = assertKeyPrefixSegment;
+exports.assertKeyPrefixDeploymentId = assertKeyPrefixDeploymentId;
+exports.deriveKeyPrefix = deriveKeyPrefix;
+exports.deploymentKeyspaceRoot = deploymentKeyspaceRoot;
+exports.deploymentAclPatterns = deploymentAclPatterns;
+exports.isWellFormedKeyPrefix = isWellFormedKeyPrefix;
+exports.assertKeyPrefixOwnedBy = assertKeyPrefixOwnedBy;
+exports.aclKeyPatternForPrefix = aclKeyPatternForPrefix;
+exports.aclChannelPatternForPrefix = aclChannelPatternForPrefix;
+exports.keyspaceGlobForPrefix = keyspaceGlobForPrefix;
+const deployment_1 = require("../../deployment");
+exports.KEY_SEGMENT_SEPARATOR = ':';
+exports.KEY_PREFIX_ROOT = 'xema';
+var RedisKeyScope;
+(function (RedisKeyScope) {
+    RedisKeyScope["Org"] = "org";
+    RedisKeyScope["System"] = "sys";
+    RedisKeyScope["Service"] = "svc";
+})(RedisKeyScope || (exports.RedisKeyScope = RedisKeyScope = {}));
+var KeyPrefixSegmentKind;
+(function (KeyPrefixSegmentKind) {
+    KeyPrefixSegmentKind["DeploymentId"] = "deploymentId";
+    KeyPrefixSegmentKind["OrgId"] = "orgId";
+    KeyPrefixSegmentKind["BiomeId"] = "biomeId";
+    KeyPrefixSegmentKind["ServiceName"] = "serviceName";
+    KeyPrefixSegmentKind["NamespaceKey"] = "namespaceKey";
+})(KeyPrefixSegmentKind || (exports.KeyPrefixSegmentKind = KeyPrefixSegmentKind = {}));
+const PREFIX_SEGMENT_SOURCE = '[A-Za-z0-9][A-Za-z0-9_-]{0,63}';
+const PREFIX_SEGMENT_PATTERN = new RegExp(`^${PREFIX_SEGMENT_SOURCE}$`);
+exports.INVALID_KEY_PREFIX_SEGMENT = 'INVALID_KEY_PREFIX_SEGMENT';
+class KeyPrefixSegmentError extends Error {
+    segmentKind;
+    value;
+    code = exports.INVALID_KEY_PREFIX_SEGMENT;
+    constructor(segmentKind, value) {
+        super(`Key-prefix ${segmentKind} ${JSON.stringify(value)} is not a legal key-prefix segment. ` +
+            'A segment must start with a letter or digit and contain only letters, ' +
+            `digits, '_' and '-' (1-64 characters). It is spliced into a Redis ACL glob ` +
+            `pattern, so '${exports.KEY_SEGMENT_SEPARATOR}' and the glob metacharacters ` +
+            "'*', '?', '[', ']', '\\' are refused rather than escaped.");
+        this.segmentKind = segmentKind;
+        this.value = value;
+        this.name = 'KeyPrefixSegmentError';
+    }
+}
+exports.KeyPrefixSegmentError = KeyPrefixSegmentError;
+function assertKeyPrefixSegment(kind, value) {
+    if (typeof value !== 'string' || !PREFIX_SEGMENT_PATTERN.test(value)) {
+        throw new KeyPrefixSegmentError(kind, String(value));
+    }
+    return value;
+}
+const RESERVED_DEPLOYMENT_IDS = new Set(Object.values(RedisKeyScope));
+function assertKeyPrefixDeploymentId(value) {
+    const id = (0, deployment_1.parseDeploymentId)(value);
+    if (RESERVED_DEPLOYMENT_IDS.has(value)) {
+        throw new Error(`Deployment id ${JSON.stringify(value)} is a Redis key scope literal. It would make ` +
+            "this deployment's prefixes byte-identical to legacy `xema:<scope>:…` prefixes " +
+            'another deployment on the same instance may still hold credentials over.');
+    }
+    return id;
+}
+const PREFIX_SHAPE_BY_SCOPE = Object.freeze({
+    [RedisKeyScope.Org]: Object.freeze([
+        KeyPrefixSegmentKind.OrgId,
+        KeyPrefixSegmentKind.BiomeId,
+        KeyPrefixSegmentKind.NamespaceKey,
+    ]),
+    [RedisKeyScope.System]: Object.freeze([
+        KeyPrefixSegmentKind.BiomeId,
+        KeyPrefixSegmentKind.NamespaceKey,
+    ]),
+    [RedisKeyScope.Service]: Object.freeze([
+        KeyPrefixSegmentKind.ServiceName,
+        KeyPrefixSegmentKind.NamespaceKey,
+    ]),
+});
+function deriveKeyPrefix(identity) {
+    const shape = PREFIX_SHAPE_BY_SCOPE[identity.scope];
+    if (shape === undefined) {
+        throw new Error(`Redis key scope ${JSON.stringify(identity.scope)} is not a RedisKeyScope.`);
+    }
+    const fields = identity;
+    const segments = shape.map((kind) => {
+        const value = fields[kind];
+        if (typeof value !== 'string') {
+            throw new Error(`Key-prefix identity for scope '${identity.scope}' is missing segment '${kind}'. ` +
+                'Refusing to derive a prefix from a hole.');
+        }
+        return assertKeyPrefixSegment(kind, value);
+    });
+    const deployment = assertKeyPrefixDeploymentId(identity.deploymentId);
+    return ([exports.KEY_PREFIX_ROOT, deployment, identity.scope, ...segments].join(exports.KEY_SEGMENT_SEPARATOR) +
+        exports.KEY_SEGMENT_SEPARATOR);
+}
+function deploymentKeyspaceRoot(deploymentId) {
+    return `${exports.KEY_PREFIX_ROOT}${exports.KEY_SEGMENT_SEPARATOR}${assertKeyPrefixDeploymentId(deploymentId)}${exports.KEY_SEGMENT_SEPARATOR}`;
+}
+var AclPatternPlane;
+(function (AclPatternPlane) {
+    AclPatternPlane["Key"] = "~";
+    AclPatternPlane["Channel"] = "&";
+})(AclPatternPlane || (exports.AclPatternPlane = AclPatternPlane = {}));
+function deploymentAclPatterns(deploymentId) {
+    const root = deploymentKeyspaceRoot(deploymentId);
+    return {
+        keyPattern: `${AclPatternPlane.Key}${root}*`,
+        channelPattern: `${AclPatternPlane.Channel}${root}*`,
+    };
+}
+const WELL_FORMED_KEY_PREFIX = new RegExp(`^${exports.KEY_PREFIX_ROOT}${exports.KEY_SEGMENT_SEPARATOR}${PREFIX_SEGMENT_SOURCE}${exports.KEY_SEGMENT_SEPARATOR}(?:` +
+    Object.entries(PREFIX_SHAPE_BY_SCOPE)
+        .map(([scope, shape]) => [scope, ...shape.map(() => PREFIX_SEGMENT_SOURCE)].join(exports.KEY_SEGMENT_SEPARATOR))
+        .join('|') +
+    `)${exports.KEY_SEGMENT_SEPARATOR}$`);
+function isWellFormedKeyPrefix(keyPrefix) {
+    return typeof keyPrefix === 'string' && WELL_FORMED_KEY_PREFIX.test(keyPrefix);
+}
+function assertKeyPrefixOwnedBy(keyPrefix, deploymentId, subject) {
+    if (!isWellFormedKeyPrefix(keyPrefix)) {
+        throw new Error(`Key prefix ${JSON.stringify(keyPrefix)} is not a well-formed Xema key prefix. ` +
+            `Refusing to build ${subject} from it — a malformed prefix widens the set of names ` +
+            'the glob reaches, which on the ACL side is a cross-tenant grant and on the erasure ' +
+            'side is a cross-tenant DELETE.');
+    }
+    if (!keyPrefix.startsWith(deploymentKeyspaceRoot(deploymentId))) {
+        throw new Error(`Key prefix ${JSON.stringify(keyPrefix)} does not belong to deployment ` +
+            `${JSON.stringify(deploymentId)}. Refusing to build ${subject} from it — on a shared ` +
+            "Redis instance that is a cross-deployment grant or DELETE over another deployment's keys.");
+    }
+    return keyPrefix;
+}
+function aclKeyPatternForPrefix(keyPrefix, deploymentId) {
+    return `${AclPatternPlane.Key}${assertKeyPrefixOwnedBy(keyPrefix, deploymentId, 'an ACL key pattern')}*`;
+}
+function aclChannelPatternForPrefix(keyPrefix, deploymentId) {
+    return `${AclPatternPlane.Channel}${assertKeyPrefixOwnedBy(keyPrefix, deploymentId, 'an ACL channel pattern')}*`;
+}
+function keyspaceGlobForPrefix(keyPrefix, deploymentId) {
+    return `${assertKeyPrefixOwnedBy(keyPrefix, deploymentId, 'a keyspace erasure glob')}*`;
+}
+//# sourceMappingURL=key-prefix.js.map

package/dist/redis-key/lib/key-prefix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-prefix.js","sourceRoot":"","sources":["../../../src/redis-key/lib/key-prefix.ts"],"names":[],"mappings":";;;AA4GA,wDAKC;AAgBD,kEAUC;AAyDD,0CAuBC;AAMD,wDAEC;AAkBD,sDASC;AAkBD,sDAEC;AAWD,wDAqBC;AAGD,wDAEC;AASD,gEAEC;AAQD,sDAEC;AA5UD,iDAAwE;AA+C3D,QAAA,qBAAqB,GAAG,GAAG,CAAC;AAG5B,QAAA,eAAe,GAAG,MAAM,CAAC;AAMtC,IAAY,aAOX;AAPD,WAAY,aAAa;IAEvB,4BAAW,CAAA;IAEX,+BAAc,CAAA;IAEd,gCAAe,CAAA;AACjB,CAAC,EAPW,aAAa,6BAAb,aAAa,QAOxB;AAOD,IAAY,oBAMX;AAND,WAAY,oBAAoB;IAC9B,qDAA6B,CAAA;IAC7B,uCAAe,CAAA;IACf,2CAAmB,CAAA;IACnB,mDAA2B,CAAA;IAC3B,qDAA6B,CAAA;AAC/B,CAAC,EANW,oBAAoB,oCAApB,oBAAoB,QAM/B;AAGD,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAC/D,MAAM,sBAAsB,GAAG,IAAI,MAAM,CAAC,IAAI,qBAAqB,GAAG,CAAC,CAAC;AAG3D,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAOvE,MAAa,qBAAsB,SAAQ,KAAK;IAGnC;IACA;IAHF,IAAI,GAAG,kCAA0B,CAAC;IAC3C,YACW,WAAiC,EACjC,KAAa;QAEtB,KAAK,CACH,cAAc,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,sCAAsC;YACtF,wEAAwE;YACxE,6EAA6E;YAC7E,gBAAgB,6BAAqB,gCAAgC;YACrE,2DAA2D,CAC9D,CAAC;QATO,gBAAW,GAAX,WAAW,CAAsB;QACjC,UAAK,GAAL,KAAK,CAAQ;QAStB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAfD,sDAeC;AAGD,SAAgB,sBAAsB,CAAC,IAA0B,EAAE,KAAa;IAC9E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAQD,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;AAQ3F,SAAgB,2BAA2B,CAAC,KAAa;IACvD,MAAM,EAAE,GAAG,IAAA,8BAAiB,EAAC,KAAK,CAAC,CAAC;IACpC,IAAI,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,+CAA+C;YACnF,gFAAgF;YAChF,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAoCD,MAAM,qBAAqB,GACzB,MAAM,CAAC,MAAM,CAAC;IACZ,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjC,oBAAoB,CAAC,KAAK;QAC1B,oBAAoB,CAAC,OAAO;QAC5B,oBAAoB,CAAC,YAAY;KAClC,CAAC;IACF,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpC,oBAAoB,CAAC,OAAO;QAC5B,oBAAoB,CAAC,YAAY;KAClC,CAAC;IACF,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,oBAAoB,CAAC,WAAW;QAChC,oBAAoB,CAAC,YAAY;KAClC,CAAC;CACH,CAAC,CAAC;AAML,SAAgB,eAAe,CAAC,QAAgC;IAC9D,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,MAAM,GAAG,QAA0D,CAAC;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAG9B,MAAM,IAAI,KAAK,CACb,kCAAkC,QAAQ,CAAC,KAAK,yBAAyB,IAAI,KAAK;gBAChF,0CAA0C,CAC7C,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,2BAA2B,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtE,OAAO,CACL,CAAC,uBAAe,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,6BAAqB,CAAC;QACtF,6BAAqB,CACtB,CAAC;AACJ,CAAC;AAMD,SAAgB,sBAAsB,CAAC,YAAoB;IACzD,OAAO,GAAG,uBAAe,GAAG,6BAAqB,GAAG,2BAA2B,CAAC,YAAY,CAAC,GAAG,6BAAqB,EAAE,CAAC;AAC1H,CAAC;AAMD,IAAY,eAGX;AAHD,WAAY,eAAe;IACzB,4BAAS,CAAA;IACT,gCAAa,CAAA;AACf,CAAC,EAHW,eAAe,+BAAf,eAAe,QAG1B;AASD,SAAgB,qBAAqB,CAAC,YAAoB;IAIxD,MAAM,IAAI,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO;QACL,UAAU,EAAE,GAAG,eAAe,CAAC,GAAG,GAAG,IAAI,GAAG;QAC5C,cAAc,EAAE,GAAG,eAAe,CAAC,OAAO,GAAG,IAAI,GAAG;KACrD,CAAC;AACJ,CAAC;AAOD,MAAM,sBAAsB,GAAG,IAAI,MAAM,CACvC,IAAI,uBAAe,GAAG,6BAAqB,GAAG,qBAAqB,GAAG,6BAAqB,KAAK;IAC9F,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CACtB,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,6BAAqB,CAAC,CAC/E;SACA,IAAI,CAAC,GAAG,CAAC;IACZ,IAAI,6BAAqB,GAAG,CAC/B,CAAC;AAGF,SAAgB,qBAAqB,CAAC,SAAiB;IACrD,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACjF,CAAC;AAWD,SAAgB,sBAAsB,CACpC,SAAiB,EACjB,YAAoB,EACpB,OAAe;IAEf,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,yCAAyC;YAC9E,qBAAqB,OAAO,wDAAwD;YACpF,qFAAqF;YACrF,gCAAgC,CACnC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iCAAiC;YACtE,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,uBAAuB,OAAO,yBAAyB;YACtF,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAGD,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,YAAoB;IAC5E,OAAO,GAAG,eAAe,CAAC,GAAG,GAAG,sBAAsB,CAAC,SAAS,EAAE,YAAY,EAAE,oBAAoB,CAAC,GAAG,CAAC;AAC3G,CAAC;AASD,SAAgB,0BAA0B,CAAC,SAAiB,EAAE,YAAoB;IAChF,OAAO,GAAG,eAAe,CAAC,OAAO,GAAG,sBAAsB,CAAC,SAAS,EAAE,YAAY,EAAE,wBAAwB,CAAC,GAAG,CAAC;AACnH,CAAC;AAQD,SAAgB,qBAAqB,CAAC,SAAiB,EAAE,YAAoB;IAC3E,OAAO,GAAG,sBAAsB,CAAC,SAAS,EAAE,YAAY,EAAE,yBAAyB,CAAC,GAAG,CAAC;AAC1F,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/contracts",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework deps; the one runtime dependency beside zod is the OpenFGA syntax transformer the authorization-module composer runs.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",