@xemahq/contracts 0.74.0 → 0.75.0

package/dist/.source-stamp.json

@@ -1,5 +1,5 @@
 {
   "algorithm": "sha256/len-framed-v1",
-  "hash": "7c70e7a5ff9e67519c9cbe9d38461aa5ac4808ee4d22870dddcafd78f67b14b8",
-  "fileCount": 600
+  "hash": "a880d71d25af62a8bf0567a34f2cfcb5896f755565e56229ee214aa655590eae",
+  "fileCount": 602
 }

package/dist/audit/lib/authority.d.ts

@@ -11,7 +11,9 @@ export declare enum AuditAuthorityKind {
     JobToken = "job_token",
     RuntimeCapabilityAuthority = "runtime_capability_authority",
     Decision = "decision",
+    PlatformOwner = "platform_owner",
     PlatformAdmin = "platform_admin",
+    PlatformOperator = "platform_operator",
     System = "system"
 }
 export declare const AuditAuthorityKindSchema: z.ZodEnum<typeof AuditAuthorityKind>;

package/dist/audit/lib/authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../../src/audit/lib/authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqCxB,oBAAY,kBAAkB;IAM5B,eAAe,qBAAqB;IAKpC,KAAK,UAAU;IAMf,OAAO,aAAa;IAEpB,cAAc,oBAAoB;IAElC,cAAc,oBAAoB;IAMlC,UAAU,eAAe;IAOzB,oBAAoB,0BAA0B;IAE9C,YAAY,kBAAkB;IAK9B,QAAQ,cAAc;IAKtB,0BAA0B,iCAAiC;IAE3D,QAAQ,aAAa;IAErB,aAAa,mBAAmB;IAOhC,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,wBAAwB,sCAAmC,CAAC;AAWzE,eAAO,MAAM,oBAAoB;;;;iBAI/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../../src/audit/lib/authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqCxB,oBAAY,kBAAkB;IAM5B,eAAe,qBAAqB;IAKpC,KAAK,UAAU;IAMf,OAAO,aAAa;IAEpB,cAAc,oBAAoB;IAElC,cAAc,oBAAoB;IAMlC,UAAU,eAAe;IAOzB,oBAAoB,0BAA0B;IAE9C,YAAY,kBAAkB;IAK9B,QAAQ,cAAc;IAKtB,0BAA0B,iCAAiC;IAE3D,QAAQ,aAAa;IAMrB,aAAa,mBAAmB;IAEhC,aAAa,mBAAmB;IAKhC,gBAAgB,sBAAsB;IAOtC,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,wBAAwB,sCAAmC,CAAC;AAWzE,eAAO,MAAM,oBAAoB;;;;iBAI/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/audit/lib/authority.js

@@ -15,7 +15,9 @@ var AuditAuthorityKind;
     AuditAuthorityKind["JobToken"] = "job_token";
     AuditAuthorityKind["RuntimeCapabilityAuthority"] = "runtime_capability_authority";
     AuditAuthorityKind["Decision"] = "decision";
+    AuditAuthorityKind["PlatformOwner"] = "platform_owner";
     AuditAuthorityKind["PlatformAdmin"] = "platform_admin";
+    AuditAuthorityKind["PlatformOperator"] = "platform_operator";
     AuditAuthorityKind["System"] = "system";
 })(AuditAuthorityKind || (exports.AuditAuthorityKind = AuditAuthorityKind = {}));
 exports.AuditAuthorityKindSchema = zod_1.z.nativeEnum(AuditAuthorityKind);

package/dist/audit/lib/authority.js.map

@@ -1 +1 @@
-{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../../src/audit/lib/authority.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAqCxB,IAAY,kBA0DX;AA1DD,WAAY,kBAAkB;IAM5B,0DAAoC,CAAA;IAKpC,qCAAe,CAAA;IAMf,0CAAoB,CAAA;IAEpB,wDAAkC,CAAA;IAElC,wDAAkC,CAAA;IAMlC,+CAAyB,CAAA;IAOzB,oEAA8C,CAAA;IAE9C,oDAA8B,CAAA;IAK9B,4CAAsB,CAAA;IAKtB,iFAA2D,CAAA;IAE3D,2CAAqB,CAAA;IAErB,sDAAgC,CAAA;IAOhC,uCAAiB,CAAA;AACnB,CAAC,EA1DW,kBAAkB,kCAAlB,kBAAkB,QA0D7B;AAEY,QAAA,wBAAwB,GAAG,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAW5D,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,gCAAwB;IAC9B,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC"}
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../../src/audit/lib/authority.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAqCxB,IAAY,kBAqEX;AArED,WAAY,kBAAkB;IAM5B,0DAAoC,CAAA;IAKpC,qCAAe,CAAA;IAMf,0CAAoB,CAAA;IAEpB,wDAAkC,CAAA;IAElC,wDAAkC,CAAA;IAMlC,+CAAyB,CAAA;IAOzB,oEAA8C,CAAA;IAE9C,oDAA8B,CAAA;IAK9B,4CAAsB,CAAA;IAKtB,iFAA2D,CAAA;IAE3D,2CAAqB,CAAA;IAMrB,sDAAgC,CAAA;IAEhC,sDAAgC,CAAA;IAKhC,4DAAsC,CAAA;IAOtC,uCAAiB,CAAA;AACnB,CAAC,EArEW,kBAAkB,kCAAlB,kBAAkB,QAqE7B;AAEY,QAAA,wBAAwB,GAAG,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAW5D,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,gCAAwB;IAC9B,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC"}

package/dist/authzen/lib/org-authority-contextual-tuple.d.ts

@@ -32,11 +32,14 @@ export interface XemaOrgAuthorityConformanceVector {
         readonly id: string;
     };
     readonly orgId: string;
-    readonly instrument: XemaOrgAuthorityInstrument | undefined;
+    readonly platformRoles: readonly string[];
+    readonly instrument: unknown;
     readonly expect: {
         readonly tuples: readonly AuthzContextualTuple[];
     } | {
         readonly refusal: OrgAuthorityContextualTupleRefusal;
+    } | {
+        readonly instrumentRefused: true;
     };
 }
 export declare const XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS: readonly XemaOrgAuthorityConformanceVector[];

package/dist/authzen/lib/org-authority-contextual-tuple.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-authority-contextual-tuple.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAoCzE,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAC1C,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAM/C,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAE/C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,oBAAY,kCAAkC;IAE5C,cAAc,qBAAqB;IAEnC,cAAc,qBAAqB;CACpC;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,kCAAkC;gBAA3C,OAAO,EAAE,kCAAkC;CAQjE;AAGD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAQD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAQD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,0BAA0B,GAAG,SAAS,CAAC;CAC7D,GAAG,SAAS,oBAAoB,EAAE,CAsBlC;AAGD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAE5D,QAAQ,CAAC,MAAM,EACX;QAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAA;KAAE,GACpD;QAAE,QAAQ,CAAC,OAAO,EAAE,kCAAkC,CAAA;KAAE,CAAC;CAC9D;AAOD,eAAO,MAAM,sCAAsC,EAAE,SAAS,iCAAiC,EA0C3F,CAAC"}
+{"version":3,"file":"org-authority-contextual-tuple.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAoCzE,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAC1C,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAM/C,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAE/C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,oBAAY,kCAAkC;IAE5C,cAAc,qBAAqB;IAEnC,cAAc,qBAAqB;CACpC;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,kCAAkC;gBAA3C,OAAO,EAAE,kCAAkC;CAQjE;AAGD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAQD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAQD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,0BAA0B,GAAG,SAAS,CAAC;CAC7D,GAAG,SAAS,oBAAoB,EAAE,CAsBlC;AAeD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAE7B,QAAQ,CAAC,MAAM,EACX;QAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAA;KAAE,GACpD;QAAE,QAAQ,CAAC,OAAO,EAAE,kCAAkC,CAAA;KAAE,GACxD;QAAE,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAA;KAAE,CAAC;CAC1C;AAaD,eAAO,MAAM,sCAAsC,EAAE,SAAS,iCAAiC,EA0G3F,CAAC"}

package/dist/authzen/lib/org-authority-contextual-tuple.js

@@ -53,11 +53,16 @@ function buildOrgAuthorityContextualTuples(input) {
     }
     return [{ user, relation: exports.XEMA_ORG_ADMIN_RELATION, object }];
 }
+const OWNER_TUPLES = [
+    { user: 'user:u1', relation: exports.XEMA_ORG_OWNER_RELATION, object: 'org:o1' },
+    { user: 'user:u1', relation: exports.XEMA_ORG_ADMIN_RELATION, object: 'org:o1' },
+];
 exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = Object.freeze([
     {
         name: 'no instrument derives no fact',
         subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
         orgId: 'o1',
+        platformRoles: [],
         instrument: undefined,
         expect: { tuples: [] },
     },
@@ -65,6 +70,7 @@ exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = Object.freeze([
         name: 'an org admin is the org administrator only, never the owner',
         subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
         orgId: 'o1',
+        platformRoles: [],
         instrument: { kind: audit_1.AuditAuthorityKind.OrgRole, orgRole: tenant_1.OrgRole.Admin },
         expect: { tuples: [{ user: 'user:u1', relation: exports.XEMA_ORG_ADMIN_RELATION, object: 'org:o1' }] },
     },
@@ -72,18 +78,15 @@ exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = Object.freeze([
         name: 'an org owner is the org owner AND an org administrator',
         subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
         orgId: 'o1',
+        platformRoles: [],
         instrument: { kind: audit_1.AuditAuthorityKind.OrgRole, orgRole: tenant_1.OrgRole.Owner },
-        expect: {
-            tuples: [
-                { user: 'user:u1', relation: exports.XEMA_ORG_OWNER_RELATION, object: 'org:o1' },
-                { user: 'user:u1', relation: exports.XEMA_ORG_ADMIN_RELATION, object: 'org:o1' },
-            ],
-        },
+        expect: { tuples: OWNER_TUPLES },
     },
     {
         name: 'a member instrument is refused',
         subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
         orgId: 'o1',
+        platformRoles: [],
         instrument: { kind: audit_1.AuditAuthorityKind.OrgRole, orgRole: tenant_1.OrgRole.Member },
         expect: { refusal: OrgAuthorityContextualTupleRefusal.RoleBelowAdmin },
     },
@@ -91,8 +94,73 @@ exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = Object.freeze([
         name: 'an instrument on a non-user subject is refused',
         subject: { kind: subject_1.SubjectKind.Agent, id: 'a1' },
         orgId: 'o1',
+        platformRoles: [],
         instrument: { kind: audit_1.AuditAuthorityKind.OrgRole, orgRole: tenant_1.OrgRole.Admin },
         expect: { refusal: OrgAuthorityContextualTupleRefusal.SubjectNotUser },
     },
+    {
+        name: 'a platform owner with no org role derives no fact',
+        subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
+        orgId: 'o1',
+        platformRoles: ['platform_owner'],
+        instrument: undefined,
+        expect: { tuples: [] },
+    },
+    {
+        name: 'a platform owner who is also platform admin, with no org role, derives no fact',
+        subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
+        orgId: 'o1',
+        platformRoles: ['platform_owner', 'platform_admin'],
+        instrument: undefined,
+        expect: { tuples: [] },
+    },
+    {
+        name: 'a platform operator with no org role derives no fact',
+        subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
+        orgId: 'o1',
+        platformRoles: ['platform_operator'],
+        instrument: undefined,
+        expect: { tuples: [] },
+    },
+    {
+        name: 'a platform_owner instrument is refused by the schema',
+        subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
+        orgId: 'o1',
+        platformRoles: ['platform_owner'],
+        instrument: { kind: 'platform_owner' },
+        expect: { instrumentRefused: true },
+    },
+    {
+        name: 'a platform_admin instrument is refused by the schema',
+        subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
+        orgId: 'o1',
+        platformRoles: ['platform_admin'],
+        instrument: { kind: 'platform_admin' },
+        expect: { instrumentRefused: true },
+    },
+    {
+        name: 'a platform_operator instrument is refused by the schema',
+        subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
+        orgId: 'o1',
+        platformRoles: ['platform_operator'],
+        instrument: { kind: 'platform_operator' },
+        expect: { instrumentRefused: true },
+    },
+    {
+        name: 'a platform owner who is also the org owner (separate grants) is the org owner AND administrator',
+        subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
+        orgId: 'o1',
+        platformRoles: ['platform_owner'],
+        instrument: { kind: audit_1.AuditAuthorityKind.OrgRole, orgRole: tenant_1.OrgRole.Owner },
+        expect: { tuples: OWNER_TUPLES },
+    },
+    {
+        name: 'revoking platform_owner leaves the org owner facts unchanged',
+        subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
+        orgId: 'o1',
+        platformRoles: [],
+        instrument: { kind: audit_1.AuditAuthorityKind.OrgRole, orgRole: tenant_1.OrgRole.Owner },
+        expect: { tuples: OWNER_TUPLES },
+    },
 ]);
 //# sourceMappingURL=org-authority-contextual-tuple.js.map

package/dist/authzen/lib/org-authority-contextual-tuple.js.map

@@ -1 +1 @@
-{"version":3,"file":"org-authority-contextual-tuple.js","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":";;;AA4EA,gDAEC;AAQD,sEAEC;AAQD,8EA0BC;AA1HD,uCAAiD;AACjD,2CAAgE;AAChE,yCAAyD;AAEzD,yEAAiE;AAqCpD,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAC7B,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAMlC,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAS/C,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAE5C,yEAAmC,CAAA;IAEnC,yEAAmC,CAAA;AACrC,CAAC,EALW,kCAAkC,kDAAlC,kCAAkC,QAK7C;AAED,MAAa,gCAAiC,SAAQ,KAAK;IACpC;IAArB,YAAqB,OAA2C;QAC9D,KAAK,CACH,OAAO,KAAK,kCAAkC,CAAC,cAAc;YAC3D,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,yFAAyF,CAC9F,CAAC;QALiB,YAAO,GAAP,OAAO,CAAoC;QAM9D,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AATD,4EASC;AAGD,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,OAAO,GAAG,4BAAoB,IAAI,IAAA,8CAAmB,EAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAQD,SAAgB,6BAA6B,CAAC,KAAa;IACzD,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,+BAAuB,EAAE,CAAC;AACnE,CAAC;AAQD,SAAgB,iCAAiC,CAAC,KAIjD;IACC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,gCAAgC,CACxC,kCAAkC,CAAC,cAAc,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAA,yBAAgB,EAAC,UAAU,CAAC,OAAO,EAAE,gBAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,gCAAgC,CACxC,kCAAkC,CAAC,cAAc,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,OAAO,KAAK,gBAAO,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE;YACnD,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/D,CAAC;AAmBY,QAAA,sCAAsC,GACjD,MAAM,CAAC,MAAM,CAAC;IACZ;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;KACvB;IACD;QACE,IAAI,EAAE,6DAA6D;QACnE,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE;KAC/F;IACD;QACE,IAAI,EAAE,wDAAwD;QAC9D,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACxE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE;aACzE;SACF;KACF;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,MAAM,EAAE;QACzE,MAAM,EAAE,EAAE,OAAO,EAAE,kCAAkC,CAAC,cAAc,EAAE;KACvE;IACD;QACE,IAAI,EAAE,gDAAgD;QACtD,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE;QAC9C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE,EAAE,OAAO,EAAE,kCAAkC,CAAC,cAAc,EAAE;KACvE;CACF,CAAC,CAAC"}
+{"version":3,"file":"org-authority-contextual-tuple.js","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":";;;AA4EA,gDAEC;AAQD,sEAEC;AAQD,8EA0BC;AA1HD,uCAAiD;AACjD,2CAAgE;AAChE,yCAAyD;AAEzD,yEAAiE;AAqCpD,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAC7B,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAMlC,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAS/C,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAE5C,yEAAmC,CAAA;IAEnC,yEAAmC,CAAA;AACrC,CAAC,EALW,kCAAkC,kDAAlC,kCAAkC,QAK7C;AAED,MAAa,gCAAiC,SAAQ,KAAK;IACpC;IAArB,YAAqB,OAA2C;QAC9D,KAAK,CACH,OAAO,KAAK,kCAAkC,CAAC,cAAc;YAC3D,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,yFAAyF,CAC9F,CAAC;QALiB,YAAO,GAAP,OAAO,CAAoC;QAM9D,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AATD,4EASC;AAGD,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,OAAO,GAAG,4BAAoB,IAAI,IAAA,8CAAmB,EAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAQD,SAAgB,6BAA6B,CAAC,KAAa;IACzD,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,+BAAuB,EAAE,CAAC;AACnE,CAAC;AAQD,SAAgB,iCAAiC,CAAC,KAIjD;IACC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,gCAAgC,CACxC,kCAAkC,CAAC,cAAc,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAA,yBAAgB,EAAC,UAAU,CAAC,OAAO,EAAE,gBAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,gCAAgC,CACxC,kCAAkC,CAAC,cAAc,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,OAAO,KAAK,gBAAO,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE;YACnD,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/D,CAAC;AA8BD,MAAM,YAAY,GAAoC;IACpD,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACxE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE;CACzE,CAAC;AAQW,QAAA,sCAAsC,GACjD,MAAM,CAAC,MAAM,CAAC;IACZ;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;KACvB;IACD;QACE,IAAI,EAAE,6DAA6D;QACnE,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE;KAC/F;IACD;QACE,IAAI,EAAE,wDAAwD;QAC9D,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;KACjC;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,MAAM,EAAE;QACzE,MAAM,EAAE,EAAE,OAAO,EAAE,kCAAkC,CAAC,cAAc,EAAE;KACvE;IACD;QACE,IAAI,EAAE,gDAAgD;QACtD,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE;QAC9C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE,EAAE,OAAO,EAAE,kCAAkC,CAAC,cAAc,EAAE;KACvE;IACD;QACE,IAAI,EAAE,mDAAmD;QACzD,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,CAAC,gBAAgB,CAAC;QACjC,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;KACvB;IACD;QACE,IAAI,EAAE,gFAAgF;QACtF,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QACnD,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;KACvB;IACD;QACE,IAAI,EAAE,sDAAsD;QAC5D,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,CAAC,mBAAmB,CAAC;QACpC,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;KACvB;IACD;QACE,IAAI,EAAE,sDAAsD;QAC5D,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,CAAC,gBAAgB,CAAC;QACjC,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACtC,MAAM,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;KACpC;IACD;QACE,IAAI,EAAE,sDAAsD;QAC5D,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,CAAC,gBAAgB,CAAC;QACjC,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACtC,MAAM,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;KACpC;IACD;QACE,IAAI,EAAE,yDAAyD;QAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,CAAC,mBAAmB,CAAC;QACpC,UAAU,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;QACzC,MAAM,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;KACpC;IACD;QACE,IAAI,EAAE,iGAAiG;QACvG,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,CAAC,gBAAgB,CAAC;QACjC,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;KACjC;IACD;QACE,IAAI,EAAE,8DAA8D;QACpE,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;KACjC;CACF,CAAC,CAAC"}

package/dist/biome/component-vocabulary/index.d.ts

@@ -0,0 +1,2 @@
+export { BiomeNexusOperationMode } from '../lib/biome-component-vocabulary';
+//# sourceMappingURL=index.d.ts.map

package/dist/biome/component-vocabulary/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/biome/component-vocabulary/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/biome/component-vocabulary/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BiomeNexusOperationMode = void 0;
+var biome_component_vocabulary_1 = require("../lib/biome-component-vocabulary");
+Object.defineProperty(exports, "BiomeNexusOperationMode", { enumerable: true, get: function () { return biome_component_vocabulary_1.BiomeNexusOperationMode; } });
+//# sourceMappingURL=index.js.map

package/dist/biome/component-vocabulary/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/biome/component-vocabulary/index.ts"],"names":[],"mappings":";;;AAGA,gFAA4E;AAAnE,qIAAA,uBAAuB,OAAA"}

package/dist/workflow/nexus-endpoint/index.d.ts

@@ -0,0 +1,2 @@
+export { NexusOperationNameSchema, NexusServiceNameSchema, NexusServiceVersionSchema, } from '../lib/nexus-endpoint';
+//# sourceMappingURL=index.d.ts.map

package/dist/workflow/nexus-endpoint/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/workflow/nexus-endpoint/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC"}

package/dist/workflow/nexus-endpoint/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NexusServiceVersionSchema = exports.NexusServiceNameSchema = exports.NexusOperationNameSchema = void 0;
+var nexus_endpoint_1 = require("../lib/nexus-endpoint");
+Object.defineProperty(exports, "NexusOperationNameSchema", { enumerable: true, get: function () { return nexus_endpoint_1.NexusOperationNameSchema; } });
+Object.defineProperty(exports, "NexusServiceNameSchema", { enumerable: true, get: function () { return nexus_endpoint_1.NexusServiceNameSchema; } });
+Object.defineProperty(exports, "NexusServiceVersionSchema", { enumerable: true, get: function () { return nexus_endpoint_1.NexusServiceVersionSchema; } });
+//# sourceMappingURL=index.js.map

package/dist/workflow/nexus-endpoint/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/workflow/nexus-endpoint/index.ts"],"names":[],"mappings":";;;AAGA,wDAI+B;AAH7B,0HAAA,wBAAwB,OAAA;AACxB,wHAAA,sBAAsB,OAAA;AACtB,2HAAA,yBAAyB,OAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/contracts",
-  "version": "0.74.0",
+  "version": "0.75.0",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework deps; the one runtime dependency beside zod is the OpenFGA syntax transformer the authorization-module composer runs.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",