@xemahq/contracts 0.77.0 → 0.79.0

package/README.md

@@ -64,7 +64,7 @@ endpoints, or Kubernetes topology. The generated JSON Schema is exported as
 inferred from the same Zod source.
 
 The `edition-protocol` entrypoint names the edition protocol an edition tool
-speaks: `EDITION_PROTOCOL` (`{ version, contentDigest }`) and the entry
+speaks: `EDITION_PROTOCOL` (`{ version, provisional, contentDigest }`; a tool refuses to pin a `provisional` identity) and the entry
 subpaths the tool loads. `contentDigest` is the kernel contract authority
 digest over the exact bytes of every source file those entry subpaths load at
 runtime, derived from the import graph; that file list is

package/dist/.source-stamp.json

@@ -1,5 +1,5 @@
 {
   "algorithm": "sha256/len-framed-v1",
-  "hash": "4f1cce8802a153154715090e69998cbadaced83a9a8722ccf1ec9ee9dc3cc163",
-  "fileCount": 613
+  "hash": "751467371f4ca72b2d0e636d4e5d3772efd6498eb4a4501a76651c61546e46b4",
+  "fileCount": 631
 }

package/dist/authorization-facts/lib/facts-apply.d.ts

@@ -235,6 +235,7 @@ export declare enum FactsApplyRefusal {
     TypeNotWritable = "type_not_writable",
     RelationNotWritable = "relation_not_writable",
     TenantMismatch = "tenant_mismatch",
+    SubjectUnresolvable = "subject_unresolvable",
     SplitWouldWiden = "split_would_widen",
     TupleNotAdmittedByModel = "tuple_not_admitted_by_model"
 }

package/dist/authorization-facts/lib/facts-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facts-apply.d.ts","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2DxB,eAAO,MAAM,kBAAkB,aAA8B,CAAC;AAe9D,oBAAY,cAAc;IACxB,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,YAAY,kBAAkB;CAC/B;AAED,eAAO,MAAM,oBAAoB,kCAA+B,CAAC;AAEjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAa9B,CAAC;AAEL,eAAO,MAAM,wBAAwB;;;;;;;;;;kBAK1B,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAQ9B,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;kBAM9B,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAI3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkChC,CAAC;AACL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAGxE,oBAAY,iBAAiB;IAE3B,OAAO,YAAY;IAEnB,UAAU,eAAe;IAEzB,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB,qCAAkC,CAAC;AAEvE,eAAO,MAAM,sBAAsB;;;;;;;kBAOxB,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE,eAAO,MAAM,wBAAwB;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,oBAAY,iBAAiB;IAE3B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,mBAAmB,0BAA0B;IAE7C,cAAc,oBAAoB;IAOlC,eAAe,sBAAsB;IAErC,uBAAuB,gCAAgC;CACxD;AAED,eAAO,MAAM,uBAAuB,qCAAkC,CAAC"}
+{"version":3,"file":"facts-apply.d.ts","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2DxB,eAAO,MAAM,kBAAkB,aAA8B,CAAC;AAe9D,oBAAY,cAAc;IACxB,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,YAAY,kBAAkB;CAC/B;AAED,eAAO,MAAM,oBAAoB,kCAA+B,CAAC;AAEjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAa9B,CAAC;AAEL,eAAO,MAAM,wBAAwB;;;;;;;;;;kBAK1B,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAQ9B,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;kBAM9B,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAI3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkChC,CAAC;AACL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAGxE,oBAAY,iBAAiB;IAE3B,OAAO,YAAY;IAEnB,UAAU,eAAe;IAEzB,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB,qCAAkC,CAAC;AAEvE,eAAO,MAAM,sBAAsB;;;;;;;kBAOxB,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE,eAAO,MAAM,wBAAwB;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,oBAAY,iBAAiB;IAE3B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,mBAAmB,0BAA0B;IAE7C,cAAc,oBAAoB;IAMlC,mBAAmB,yBAAyB;IAO5C,eAAe,sBAAsB;IAErC,uBAAuB,gCAAgC;CACxD;AAED,eAAO,MAAM,uBAAuB,qCAAkC,CAAC"}

package/dist/authorization-facts/lib/facts-apply.js

@@ -114,6 +114,7 @@ var FactsApplyRefusal;
     FactsApplyRefusal["TypeNotWritable"] = "type_not_writable";
     FactsApplyRefusal["RelationNotWritable"] = "relation_not_writable";
     FactsApplyRefusal["TenantMismatch"] = "tenant_mismatch";
+    FactsApplyRefusal["SubjectUnresolvable"] = "subject_unresolvable";
     FactsApplyRefusal["SplitWouldWiden"] = "split_would_widen";
     FactsApplyRefusal["TupleNotAdmittedByModel"] = "tuple_not_admitted_by_model";
 })(FactsApplyRefusal || (exports.FactsApplyRefusal = FactsApplyRefusal = {}));

package/dist/authorization-facts/lib/facts-apply.js.map

@@ -1 +1 @@
-{"version":3,"file":"facts-apply.js","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-apply.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,6CAQsB;AAiDT,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAe9D,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,iCAAe,CAAA;IACf,gDAA8B,CAAA;IAC9B,gDAA8B,CAAA;AAChC,CAAC,EAJW,cAAc,8BAAd,cAAc,QAIzB;AAEY,QAAA,oBAAoB,GAAG,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAEpD,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC;IACrC,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;IAC3B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,4BAAe,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,4BAAe,CAAC;IAEjC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;IACrD,OAAO,EAAE,sDAAsD;CAChE,CAAC,CAAC;AAEQ,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,OAAO,EAAE,iCAAoB;IAC7B,SAAS,EAAE,gCAAmB,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC;IAC5C,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;IAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,+BAAkB,EAAE,OAAC,CAAC,KAAK,CAAC,gCAAwB,CAAC,CAAC;IAC1E,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC;IAC5C,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,gBAAgB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,6BAAqB;IACrB,oCAA4B;IAC5B,oCAA4B;CAC7B,CAAC,CAAC;AAGH,SAAS,SAAS,CAAC,MAAqB;IACtC,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;AACvC,CAAC;AAEY,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IAEN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAExB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC;gBAClC,OAAO,EAAE,UAAU,GAAG,qGAAqG;aAC5H,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;wBACxB,OAAO,EAAE,SAAS,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,6CAA6C;qBAClG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAIL,IAAY,iBAOX;AAPD,WAAY,iBAAiB;IAE3B,wCAAmB,CAAA;IAEnB,8CAAyB,CAAA;IAEzB,8CAAyB,CAAA;AAC3B,CAAC,EAPW,iBAAiB,iCAAjB,iBAAiB,QAO5B;AAEY,QAAA,uBAAuB,GAAG,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AAE1D,QAAA,sBAAsB,GAAG,OAAC;KACpC,MAAM,CAAC;IACN,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,+BAAuB;IAEhC,eAAe,EAAE,0BAAkB;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,8BAAsB,CAAC;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAOZ,IAAY,iBAkBX;AAlBD,WAAY,iBAAiB;IAE3B,uDAAkC,CAAA;IAElC,0DAAqC,CAAA;IAErC,kEAA6C,CAAA;IAE7C,uDAAkC,CAAA;IAOlC,0DAAqC,CAAA;IAErC,4EAAuD,CAAA;AACzD,CAAC,EAlBW,iBAAiB,iCAAjB,iBAAiB,QAkB5B;AAEY,QAAA,uBAAuB,GAAG,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"facts-apply.js","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-apply.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,6CAQsB;AAiDT,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAe9D,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,iCAAe,CAAA;IACf,gDAA8B,CAAA;IAC9B,gDAA8B,CAAA;AAChC,CAAC,EAJW,cAAc,8BAAd,cAAc,QAIzB;AAEY,QAAA,oBAAoB,GAAG,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAEpD,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC;IACrC,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;IAC3B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,4BAAe,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,4BAAe,CAAC;IAEjC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;IACrD,OAAO,EAAE,sDAAsD;CAChE,CAAC,CAAC;AAEQ,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,OAAO,EAAE,iCAAoB;IAC7B,SAAS,EAAE,gCAAmB,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC;IAC5C,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;IAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,+BAAkB,EAAE,OAAC,CAAC,KAAK,CAAC,gCAAwB,CAAC,CAAC;IAC1E,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC;IAC5C,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,gBAAgB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,6BAAqB;IACrB,oCAA4B;IAC5B,oCAA4B;CAC7B,CAAC,CAAC;AAGH,SAAS,SAAS,CAAC,MAAqB;IACtC,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;AACvC,CAAC;AAEY,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IAEN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAExB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC;gBAClC,OAAO,EAAE,UAAU,GAAG,qGAAqG;aAC5H,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;wBACxB,OAAO,EAAE,SAAS,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,6CAA6C;qBAClG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAIL,IAAY,iBAOX;AAPD,WAAY,iBAAiB;IAE3B,wCAAmB,CAAA;IAEnB,8CAAyB,CAAA;IAEzB,8CAAyB,CAAA;AAC3B,CAAC,EAPW,iBAAiB,iCAAjB,iBAAiB,QAO5B;AAEY,QAAA,uBAAuB,GAAG,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AAE1D,QAAA,sBAAsB,GAAG,OAAC;KACpC,MAAM,CAAC;IACN,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,+BAAuB;IAEhC,eAAe,EAAE,0BAAkB;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,8BAAsB,CAAC;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAOZ,IAAY,iBAwBX;AAxBD,WAAY,iBAAiB;IAE3B,uDAAkC,CAAA;IAElC,0DAAqC,CAAA;IAErC,kEAA6C,CAAA;IAE7C,uDAAkC,CAAA;IAMlC,iEAA4C,CAAA;IAO5C,0DAAqC,CAAA;IAErC,4EAAuD,CAAA;AACzD,CAAC,EAxBW,iBAAiB,iCAAjB,iBAAiB,QAwB5B;AAEY,QAAA,uBAAuB,GAAG,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/authorization-facts/lib/facts-writer-authority.d.ts

@@ -2,6 +2,17 @@ import { z } from 'zod';
 import { FactsApplyRefusal, type FactsApplyRequest } from './facts-apply';
 export declare const WritableRelationsSchema: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
 export type WritableRelations = z.infer<typeof WritableRelationsSchema>;
+export declare const ORG_QUALIFIED_SUBJECT_TYPES: readonly string[];
+export declare const ORG_RESOLVED_SUBJECT_TYPES: readonly string[];
+export type SubjectOrgResolution = {
+    readonly known: true;
+    readonly orgId: string | null;
+} | {
+    readonly known: false;
+};
+export interface SubjectOrgResolver {
+    resolveSubjectOrg(type: string, id: string): Promise<SubjectOrgResolution>;
+}
 export interface FactsWriterAuthority {
     readonly biomeId: string;
     readonly writableRelations: WritableRelations;
@@ -11,5 +22,5 @@ export interface FactsFenceViolation {
     readonly changeIndex: number | null;
     readonly message: string;
 }
-export declare function factsFenceViolations(request: FactsApplyRequest, authority: FactsWriterAuthority): FactsFenceViolation[];
+export declare function factsFenceViolations(request: FactsApplyRequest, authority: FactsWriterAuthority, resolver?: SubjectOrgResolver): Promise<FactsFenceViolation[]>;
 //# sourceMappingURL=facts-writer-authority.d.ts.map

package/dist/authorization-facts/lib/facts-writer-authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facts-writer-authority.d.ts","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-writer-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAEL,iBAAiB,EACjB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAC;AAevB,eAAO,MAAM,uBAAuB,mDAGnC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,WAAW,oBAAoB;IAEnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;CAC/C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAWD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,oBAAoB,GAC9B,mBAAmB,EAAE,CA6CvB"}
+{"version":3,"file":"facts-writer-authority.d.ts","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-writer-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAEL,iBAAiB,EACjB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAC;AAiBvB,eAAO,MAAM,uBAAuB,mDAGnC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AASxE,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAGvD,CAAC;AASH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAGtD,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAE5B;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAEvD;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAQ9B,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,oBAAoB;IAEnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;CAC/C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAgBD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,oBAAoB,EAC/B,QAAQ,CAAC,EAAE,kBAAkB,GAC5B,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAkFhC"}

package/dist/authorization-facts/lib/facts-writer-authority.js

@@ -1,13 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WritableRelationsSchema = void 0;
+exports.ORG_RESOLVED_SUBJECT_TYPES = exports.ORG_QUALIFIED_SUBJECT_TYPES = exports.WritableRelationsSchema = void 0;
 exports.factsFenceViolations = factsFenceViolations;
 const zod_1 = require("zod");
 const authzen_1 = require("../../authzen");
 const fact_tuple_1 = require("./fact-tuple");
 const facts_apply_1 = require("./facts-apply");
 exports.WritableRelationsSchema = zod_1.z.record(fact_tuple_1.FactTypeSchema, zod_1.z.array(fact_tuple_1.FactRelationSchema).min(1));
-function factsFenceViolations(request, authority) {
+exports.ORG_QUALIFIED_SUBJECT_TYPES = Object.freeze([
+    'project',
+    'membership',
+]);
+exports.ORG_RESOLVED_SUBJECT_TYPES = Object.freeze([
+    'team',
+    'role',
+]);
+async function factsFenceViolations(request, authority, resolver) {
     const violations = [];
     if (request.biomeId !== authority.biomeId) {
         violations.push({
@@ -17,7 +25,20 @@ function factsFenceViolations(request, authority) {
         });
         return violations;
     }
-    request.changes.forEach((change, index) => {
+    const resolved = new Map();
+    const resolve = (subject) => {
+        if (resolver === undefined) {
+            return null;
+        }
+        const key = `${subject.type}:${subject.id}`;
+        let resolution = resolved.get(key);
+        if (resolution === undefined) {
+            resolution = resolver.resolveSubjectOrg(subject.type, subject.id);
+            resolved.set(key, resolution);
+        }
+        return resolution;
+    };
+    for (const [index, change] of request.changes.entries()) {
         const { object } = change;
         const writable = authority.writableRelations[object.type];
         if (writable === undefined) {
@@ -26,7 +47,7 @@ function factsFenceViolations(request, authority) {
                 changeIndex: index,
                 message: `biome "${authority.biomeId}" may not write facts on type "${object.type}".`,
             });
-            return;
+            continue;
         }
         if (!(0, authzen_1.resourceBelongsToOrg)(object, request.orgId)) {
             violations.push({
@@ -35,6 +56,27 @@ function factsFenceViolations(request, authority) {
                 message: `object ${object.type}:${object.id} is not in org "${request.orgId}".`,
             });
         }
+        const writtenSubjects = change.kind === facts_apply_1.FactChangeKind.Delta
+            ? change.writes.map((t) => t.subject)
+            : change.kind === facts_apply_1.FactChangeKind.DesiredState
+                ? Object.values(change.relations).flatMap((subjects) => subjects.map((s) => s.subject))
+                : [];
+        for (const subject of writtenSubjects) {
+            if (exports.ORG_QUALIFIED_SUBJECT_TYPES.includes(subject.type) &&
+                !(0, authzen_1.resourceBelongsToOrg)(subject, request.orgId)) {
+                violations.push({
+                    refusal: facts_apply_1.FactsApplyRefusal.TenantMismatch,
+                    changeIndex: index,
+                    message: `subject ${subject.type}:${subject.id} is not in org "${request.orgId}".`,
+                });
+            }
+            if (exports.ORG_RESOLVED_SUBJECT_TYPES.includes(subject.type)) {
+                const violation = subjectOrgViolation(subject, request.orgId, await resolve(subject));
+                if (violation !== null) {
+                    violations.push({ ...violation, changeIndex: index });
+                }
+            }
+        }
         const relations = change.kind === facts_apply_1.FactChangeKind.Delta
             ? [...change.writes, ...change.deletes].map((t) => t.relation)
             : change.kind === facts_apply_1.FactChangeKind.DesiredState
@@ -49,7 +91,29 @@ function factsFenceViolations(request, authority) {
                 });
             }
         }
-    });
+    }
     return violations;
 }
+function subjectOrgViolation(subject, orgId, resolution) {
+    const ref = `${subject.type}:${subject.id}`;
+    if (resolution === null) {
+        return {
+            refusal: facts_apply_1.FactsApplyRefusal.SubjectUnresolvable,
+            message: `subject ${ref} is unresolvable: the fence has no subject-org resolver, so its org is unknown.`,
+        };
+    }
+    if (!resolution.known) {
+        return {
+            refusal: facts_apply_1.FactsApplyRefusal.SubjectUnresolvable,
+            message: `subject ${ref} is unresolvable: its owning store knows no such ${subject.type}.`,
+        };
+    }
+    if (resolution.orgId !== orgId) {
+        return {
+            refusal: facts_apply_1.FactsApplyRefusal.TenantMismatch,
+            message: `subject ${ref} is not in org "${orgId}".`,
+        };
+    }
+    return null;
+}
 //# sourceMappingURL=facts-writer-authority.js.map

package/dist/authorization-facts/lib/facts-writer-authority.js.map

@@ -1 +1 @@
-{"version":3,"file":"facts-writer-authority.js","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-writer-authority.ts"],"names":[],"mappings":";;;AAmDA,oDAgDC;AAnGD,6BAAwB;AAExB,2CAAqD;AAErD,6CAAkE;AAClE,+CAIuB;AAeV,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAC7C,2BAAc,EACd,OAAC,CAAC,KAAK,CAAC,+BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACnC,CAAC;AAwBF,SAAgB,oBAAoB,CAClC,OAA0B,EAC1B,SAA+B;IAE/B,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;QAC1C,UAAU,CAAC,IAAI,CAAC;YACd,OAAO,EAAE,+BAAiB,CAAC,cAAc;YACzC,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,gCAAgC,OAAO,CAAC,OAAO,8BAA8B,SAAS,CAAC,OAAO,IAAI;SAC5G,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,+BAAiB,CAAC,eAAe;gBAC1C,WAAW,EAAE,KAAK;gBAClB,OAAO,EAAE,UAAU,SAAS,CAAC,OAAO,kCAAkC,MAAM,CAAC,IAAI,IAAI;aACtF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAA,8BAAoB,EAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,+BAAiB,CAAC,cAAc;gBACzC,WAAW,EAAE,KAAK;gBAClB,OAAO,EAAE,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,mBAAmB,OAAO,CAAC,KAAK,IAAI;aAChF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GACb,MAAM,CAAC,IAAI,KAAK,4BAAc,CAAC,KAAK;YAClC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9D,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,4BAAc,CAAC,YAAY;gBAC3C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC/B,CAAC,CAAC,EAAE,CAAC;QACX,KAAK,MAAM,QAAQ,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,UAAU,CAAC,IAAI,CAAC;oBACd,OAAO,EAAE,+BAAiB,CAAC,mBAAmB;oBAC9C,WAAW,EAAE,KAAK;oBAClB,OAAO,EAAE,aAAa,MAAM,CAAC,IAAI,IAAI,QAAQ,+BAA+B,SAAS,CAAC,OAAO,IAAI;iBAClG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"facts-writer-authority.js","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-writer-authority.ts"],"names":[],"mappings":";;;AAmGA,oDAsFC;AAzLD,6BAAwB;AAExB,2CAAqD;AAErD,6CAAkE;AAClE,+CAIuB;AAiBV,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAC7C,2BAAc,EACd,OAAC,CAAC,KAAK,CAAC,+BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACnC,CAAC;AAUW,QAAA,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,SAAS;IACT,YAAY;CACb,CAAC,CAAC;AASU,QAAA,0BAA0B,GAAsB,MAAM,CAAC,MAAM,CAAC;IACzE,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AA6CI,KAAK,UAAU,oBAAoB,CACxC,OAA0B,EAC1B,SAA+B,EAC/B,QAA6B;IAE7B,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;QAC1C,UAAU,CAAC,IAAI,CAAC;YACd,OAAO,EAAE,+BAAiB,CAAC,cAAc;YACzC,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,gCAAgC,OAAO,CAAC,OAAO,8BAA8B,SAAS,CAAC,OAAO,IAAI;SAC5G,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyC,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,OAAuB,EAAwC,EAAE;QAChF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,UAAU,GAAG,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,+BAAiB,CAAC,eAAe;gBAC1C,WAAW,EAAE,KAAK;gBAClB,OAAO,EAAE,UAAU,SAAS,CAAC,OAAO,kCAAkC,MAAM,CAAC,IAAI,IAAI;aACtF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAA,8BAAoB,EAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,+BAAiB,CAAC,cAAc;gBACzC,WAAW,EAAE,KAAK;gBAClB,OAAO,EAAE,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,mBAAmB,OAAO,CAAC,KAAK,IAAI;aAChF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,eAAe,GACnB,MAAM,CAAC,IAAI,KAAK,4BAAc,CAAC,KAAK;YAClC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,4BAAc,CAAC,YAAY;gBAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACvF,CAAC,CAAC,EAAE,CAAC;QACX,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,IACE,mCAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;gBAClD,CAAC,IAAA,8BAAoB,EAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAC7C,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC;oBACd,OAAO,EAAE,+BAAiB,CAAC,cAAc;oBACzC,WAAW,EAAE,KAAK;oBAClB,OAAO,EAAE,WAAW,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,mBAAmB,OAAO,CAAC,KAAK,IAAI;iBACnF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,kCAA0B,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBACvB,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GACb,MAAM,CAAC,IAAI,KAAK,4BAAc,CAAC,KAAK;YAClC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9D,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,4BAAc,CAAC,YAAY;gBAC3C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC/B,CAAC,CAAC,EAAE,CAAC;QACX,KAAK,MAAM,QAAQ,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,UAAU,CAAC,IAAI,CAAC;oBACd,OAAO,EAAE,+BAAiB,CAAC,mBAAmB;oBAC9C,WAAW,EAAE,KAAK;oBAClB,OAAO,EAAE,aAAa,MAAM,CAAC,IAAI,IAAI,QAAQ,+BAA+B,SAAS,CAAC,OAAO,IAAI;iBAClG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAuB,EACvB,KAAa,EACb,UAAuC;IAEvC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;IAC5C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,+BAAiB,CAAC,mBAAmB;YAC9C,OAAO,EAAE,WAAW,GAAG,iFAAiF;SACzG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,+BAAiB,CAAC,mBAAmB;YAC9C,OAAO,EAAE,WAAW,GAAG,oDAAoD,OAAO,CAAC,IAAI,GAAG;SAC3F,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE,+BAAiB,CAAC,cAAc;YACzC,OAAO,EAAE,WAAW,GAAG,mBAAmB,KAAK,IAAI;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/authorization-module/index.d.ts

@@ -2,6 +2,8 @@ export * from './lib/authorization-namespace';
 export * from './lib/platform-authorization-modules';
 export * from './lib/authorization-interface-requirements';
 export * from './lib/authorization-module-envelope';
+export * from './lib/delegation-wildcard-ceiling';
+export * from './lib/delegation-origination';
 export * from './lib/authorization-module-contribution';
 export * from './lib/authorization-composition-error';
 //# sourceMappingURL=index.d.ts.map

package/dist/authorization-module/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization-module/index.ts"],"names":[],"mappings":"AAAA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,qCAAqC,CAAC;AACpD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization-module/index.ts"],"names":[],"mappings":"AAAA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC"}

package/dist/authorization-module/index.js

@@ -18,6 +18,8 @@ __exportStar(require("./lib/authorization-namespace"), exports);
 __exportStar(require("./lib/platform-authorization-modules"), exports);
 __exportStar(require("./lib/authorization-interface-requirements"), exports);
 __exportStar(require("./lib/authorization-module-envelope"), exports);
+__exportStar(require("./lib/delegation-wildcard-ceiling"), exports);
+__exportStar(require("./lib/delegation-origination"), exports);
 __exportStar(require("./lib/authorization-module-contribution"), exports);
 __exportStar(require("./lib/authorization-composition-error"), exports);
 //# sourceMappingURL=index.js.map

package/dist/authorization-module/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gEAA8C;AAC9C,uEAAqD;AACrD,6EAA2D;AAC3D,sEAAoD;AACpD,0EAAwD;AACxD,wEAAsD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gEAA8C;AAC9C,uEAAqD;AACrD,6EAA2D;AAC3D,sEAAoD;AACpD,oEAAkD;AAClD,+DAA6C;AAC7C,0EAAwD;AACxD,wEAAsD"}

package/dist/authorization-module/lib/authorization-composition-error.d.ts

@@ -24,6 +24,15 @@ export declare enum AuthorizationCompositionViolationCode {
     InterfaceRelationMistyped = "interface_relation_mistyped",
     InterfaceRelationNotWritable = "interface_relation_not_writable",
     ImplementsForeignType = "implements_foreign_type",
+    ParentInheritanceCycle = "parent_inheritance_cycle",
+    DelegationOriginationNotAnchor = "delegation_origination_not_anchor",
+    DelegationOriginationRedelegableNotSubset = "delegation_origination_redelegable_not_subset",
+    DelegationOriginationCapabilityUndeclared = "delegation_origination_capability_undeclared",
+    DelegationOriginationMissing = "delegation_origination_missing",
+    DelegationOriginationHolderNotService = "delegation_origination_holder_not_service",
+    DelegationOriginationStatedRedelegableFixed = "delegation_origination_stated_redelegable_fixed",
+    DelegationOriginationWildcardNotPermitted = "delegation_origination_wildcard_not_permitted",
+    DelegationOriginationWildcardNotFirstParty = "delegation_origination_wildcard_not_first_party",
     WritableRelationInvalid = "writable_relation_invalid",
     SearchableInvalid = "searchable_invalid",
     PlatformTemplateInvalid = "platform_template_invalid",
@@ -45,4 +54,7 @@ export declare class AuthorizationCompositionError extends Error {
     readonly violations: readonly AuthorizationCompositionViolation[];
     constructor(violations: readonly AuthorizationCompositionViolation[]);
 }
+export declare class AuthorizationCompositionInputError extends Error {
+    constructor(message: string);
+}
 //# sourceMappingURL=authorization-composition-error.d.ts.map

package/dist/authorization-module/lib/authorization-composition-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-composition-error.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-composition-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,oBAAY,qCAAqC;IAE/C,cAAc,qBAAqB;IACnC,iBAAiB,uBAAuB;IACxC,kBAAkB,wBAAwB;IAC1C,yBAAyB,gCAAgC;IACzD,kBAAkB,yBAAyB;IAC3C,kBAAkB,yBAAyB;IAE3C,oBAAoB,2BAA2B;IAC/C,yBAAyB,gCAAgC;IACzD,kBAAkB,yBAAyB;IAC3C,oBAAoB,2BAA2B;IAC/C,oBAAoB,2BAA2B;IAC/C,sBAAsB,8BAA8B;IACpD,qBAAqB,4BAA4B;IACjD,kBAAkB,wBAAwB;IAC1C,+BAA+B,uCAAuC;IAEtE,4BAA4B,qCAAqC;IACjE,iBAAiB,uBAAuB;IACxC,uBAAuB,+BAA+B;IACtD,uBAAuB,8BAA8B;IACrD,eAAe,qBAAqB;IAEpC,uBAAuB,8BAA8B;IAErD,yBAAyB,gCAAgC;IAEzD,4BAA4B,oCAAoC;IAChE,qBAAqB,4BAA4B;IACjD,uBAAuB,8BAA8B;IACrD,iBAAiB,uBAAuB;IAExC,uBAAuB,8BAA8B;IAErD,uBAAuB,+BAA+B;IAEtD,kBAAkB,wBAAwB;IAE1C,cAAc,oBAAoB;IAElC,sBAAsB,6BAA6B;IACnD,mBAAmB,0BAA0B;IAC7C,4BAA4B,mCAAmC;IAC/D,yBAAyB,iCAAiC;CAC3D;AAED,eAAO,MAAM,2CAA2C,yDAEvD,CAAC;AAEF,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,qCAAqC,CAAC;IAErD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,UAAU,EAAE,SAAS,iCAAiC,EAAE,CAAC;gBAEtD,UAAU,EAAE,SAAS,iCAAiC,EAAE;CAUrE"}
+{"version":3,"file":"authorization-composition-error.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-composition-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,oBAAY,qCAAqC;IAE/C,cAAc,qBAAqB;IACnC,iBAAiB,uBAAuB;IACxC,kBAAkB,wBAAwB;IAC1C,yBAAyB,gCAAgC;IACzD,kBAAkB,yBAAyB;IAC3C,kBAAkB,yBAAyB;IAE3C,oBAAoB,2BAA2B;IAC/C,yBAAyB,gCAAgC;IACzD,kBAAkB,yBAAyB;IAC3C,oBAAoB,2BAA2B;IAC/C,oBAAoB,2BAA2B;IAC/C,sBAAsB,8BAA8B;IACpD,qBAAqB,4BAA4B;IACjD,kBAAkB,wBAAwB;IAC1C,+BAA+B,uCAAuC;IAEtE,4BAA4B,qCAAqC;IACjE,iBAAiB,uBAAuB;IACxC,uBAAuB,+BAA+B;IACtD,uBAAuB,8BAA8B;IACrD,eAAe,qBAAqB;IAEpC,uBAAuB,8BAA8B;IAErD,yBAAyB,gCAAgC;IAEzD,4BAA4B,oCAAoC;IAChE,qBAAqB,4BAA4B;IAMjD,sBAAsB,6BAA6B;IAGnD,8BAA8B,sCAAsC;IAEpE,yCAAyC,kDAAkD;IAE3F,yCAAyC,iDAAiD;IAE1F,4BAA4B,mCAAmC;IAE/D,qCAAqC,8CAA8C;IAEnF,2CAA2C,oDAAoD;IAE/F,yCAAyC,kDAAkD;IAE3F,0CAA0C,oDAAoD;IAC9F,uBAAuB,8BAA8B;IACrD,iBAAiB,uBAAuB;IAExC,uBAAuB,8BAA8B;IAErD,uBAAuB,+BAA+B;IAEtD,kBAAkB,wBAAwB;IAE1C,cAAc,oBAAoB;IAElC,sBAAsB,6BAA6B;IACnD,mBAAmB,0BAA0B;IAC7C,4BAA4B,mCAAmC;IAC/D,yBAAyB,iCAAiC;CAC3D;AAED,eAAO,MAAM,2CAA2C,yDAEvD,CAAC;AAEF,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,qCAAqC,CAAC;IAErD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,UAAU,EAAE,SAAS,iCAAiC,EAAE,CAAC;gBAEtD,UAAU,EAAE,SAAS,iCAAiC,EAAE;CAUrE;AAOD,qBAAa,kCAAmC,SAAQ,KAAK;gBAC/C,OAAO,EAAE,MAAM;CAI5B"}

package/dist/authorization-module/lib/authorization-composition-error.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationCompositionError = exports.AuthorizationCompositionViolationCodeSchema = exports.AuthorizationCompositionViolationCode = void 0;
+exports.AuthorizationCompositionInputError = exports.AuthorizationCompositionError = exports.AuthorizationCompositionViolationCodeSchema = exports.AuthorizationCompositionViolationCode = void 0;
 const zod_1 = require("zod");
 var AuthorizationCompositionViolationCode;
 (function (AuthorizationCompositionViolationCode) {
@@ -28,6 +28,15 @@ var AuthorizationCompositionViolationCode;
     AuthorizationCompositionViolationCode["InterfaceRelationMistyped"] = "interface_relation_mistyped";
     AuthorizationCompositionViolationCode["InterfaceRelationNotWritable"] = "interface_relation_not_writable";
     AuthorizationCompositionViolationCode["ImplementsForeignType"] = "implements_foreign_type";
+    AuthorizationCompositionViolationCode["ParentInheritanceCycle"] = "parent_inheritance_cycle";
+    AuthorizationCompositionViolationCode["DelegationOriginationNotAnchor"] = "delegation_origination_not_anchor";
+    AuthorizationCompositionViolationCode["DelegationOriginationRedelegableNotSubset"] = "delegation_origination_redelegable_not_subset";
+    AuthorizationCompositionViolationCode["DelegationOriginationCapabilityUndeclared"] = "delegation_origination_capability_undeclared";
+    AuthorizationCompositionViolationCode["DelegationOriginationMissing"] = "delegation_origination_missing";
+    AuthorizationCompositionViolationCode["DelegationOriginationHolderNotService"] = "delegation_origination_holder_not_service";
+    AuthorizationCompositionViolationCode["DelegationOriginationStatedRedelegableFixed"] = "delegation_origination_stated_redelegable_fixed";
+    AuthorizationCompositionViolationCode["DelegationOriginationWildcardNotPermitted"] = "delegation_origination_wildcard_not_permitted";
+    AuthorizationCompositionViolationCode["DelegationOriginationWildcardNotFirstParty"] = "delegation_origination_wildcard_not_first_party";
     AuthorizationCompositionViolationCode["WritableRelationInvalid"] = "writable_relation_invalid";
     AuthorizationCompositionViolationCode["SearchableInvalid"] = "searchable_invalid";
     AuthorizationCompositionViolationCode["PlatformTemplateInvalid"] = "platform_template_invalid";
@@ -52,4 +61,11 @@ class AuthorizationCompositionError extends Error {
     }
 }
 exports.AuthorizationCompositionError = AuthorizationCompositionError;
+class AuthorizationCompositionInputError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AuthorizationCompositionInputError';
+    }
+}
+exports.AuthorizationCompositionInputError = AuthorizationCompositionInputError;
 //# sourceMappingURL=authorization-composition-error.js.map

package/dist/authorization-module/lib/authorization-composition-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-composition-error.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-composition-error.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAOxB,IAAY,qCA8CX;AA9CD,WAAY,qCAAqC;IAE/C,4EAAmC,CAAA;IACnC,iFAAwC,CAAA;IACxC,mFAA0C,CAAA;IAC1C,kGAAyD,CAAA;IACzD,oFAA2C,CAAA;IAC3C,oFAA2C,CAAA;IAE3C,wFAA+C,CAAA;IAC/C,kGAAyD,CAAA;IACzD,oFAA2C,CAAA;IAC3C,wFAA+C,CAAA;IAC/C,wFAA+C,CAAA;IAC/C,6FAAoD,CAAA;IACpD,0FAAiD,CAAA;IACjD,mFAA0C,CAAA;IAC1C,+GAAsE,CAAA;IAEtE,0GAAiE,CAAA;IACjE,iFAAwC,CAAA;IACxC,+FAAsD,CAAA;IACtD,8FAAqD,CAAA;IACrD,6EAAoC,CAAA;IAEpC,8FAAqD,CAAA;IAErD,kGAAyD,CAAA;IAEzD,yGAAgE,CAAA;IAChE,0FAAiD,CAAA;IACjD,8FAAqD,CAAA;IACrD,iFAAwC,CAAA;IAExC,8FAAqD,CAAA;IAErD,+FAAsD,CAAA;IAEtD,mFAA0C,CAAA;IAE1C,2EAAkC,CAAA;IAElC,4FAAmD,CAAA;IACnD,sFAA6C,CAAA;IAC7C,wGAA+D,CAAA;IAC/D,mGAA0D,CAAA;AAC5D,CAAC,EA9CW,qCAAqC,qDAArC,qCAAqC,QA8ChD;AAEY,QAAA,2CAA2C,GAAG,OAAC,CAAC,UAAU,CACrE,qCAAqC,CACtC,CAAC;AAUF,MAAa,6BAA8B,SAAQ,KAAK;IAC7C,UAAU,CAA+C;IAElE,YAAY,UAAwD;QAClE,KAAK,CACH,gDAAgD,UAAU,CAAC,MAAM,kBAAkB;YACjF,UAAU;iBACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;iBACtD,IAAI,CAAC,IAAI,CAAC,CAChB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAbD,sEAaC"}
+{"version":3,"file":"authorization-composition-error.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-composition-error.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAOxB,IAAY,qCAqEX;AArED,WAAY,qCAAqC;IAE/C,4EAAmC,CAAA;IACnC,iFAAwC,CAAA;IACxC,mFAA0C,CAAA;IAC1C,kGAAyD,CAAA;IACzD,oFAA2C,CAAA;IAC3C,oFAA2C,CAAA;IAE3C,wFAA+C,CAAA;IAC/C,kGAAyD,CAAA;IACzD,oFAA2C,CAAA;IAC3C,wFAA+C,CAAA;IAC/C,wFAA+C,CAAA;IAC/C,6FAAoD,CAAA;IACpD,0FAAiD,CAAA;IACjD,mFAA0C,CAAA;IAC1C,+GAAsE,CAAA;IAEtE,0GAAiE,CAAA;IACjE,iFAAwC,CAAA;IACxC,+FAAsD,CAAA;IACtD,8FAAqD,CAAA;IACrD,6EAAoC,CAAA;IAEpC,8FAAqD,CAAA;IAErD,kGAAyD,CAAA;IAEzD,yGAAgE,CAAA;IAChE,0FAAiD,CAAA;IAMjD,4FAAmD,CAAA;IAGnD,6GAAoE,CAAA;IAEpE,oIAA2F,CAAA;IAE3F,mIAA0F,CAAA;IAE1F,wGAA+D,CAAA;IAE/D,4HAAmF,CAAA;IAEnF,wIAA+F,CAAA;IAE/F,oIAA2F,CAAA;IAE3F,uIAA8F,CAAA;IAC9F,8FAAqD,CAAA;IACrD,iFAAwC,CAAA;IAExC,8FAAqD,CAAA;IAErD,+FAAsD,CAAA;IAEtD,mFAA0C,CAAA;IAE1C,2EAAkC,CAAA;IAElC,4FAAmD,CAAA;IACnD,sFAA6C,CAAA;IAC7C,wGAA+D,CAAA;IAC/D,mGAA0D,CAAA;AAC5D,CAAC,EArEW,qCAAqC,qDAArC,qCAAqC,QAqEhD;AAEY,QAAA,2CAA2C,GAAG,OAAC,CAAC,UAAU,CACrE,qCAAqC,CACtC,CAAC;AAUF,MAAa,6BAA8B,SAAQ,KAAK;IAC7C,UAAU,CAA+C;IAElE,YAAY,UAAwD;QAClE,KAAK,CACH,gDAAgD,UAAU,CAAC,MAAM,kBAAkB;YACjF,UAAU;iBACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;iBACtD,IAAI,CAAC,IAAI,CAAC,CAChB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAbD,sEAaC;AAOD,MAAa,kCAAmC,SAAQ,KAAK;IAC3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AALD,gFAKC"}

package/dist/authorization-module/lib/authorization-interface-requirements.d.ts

@@ -1,7 +1,8 @@
 export declare enum XemaInterfaceRelationKind {
     Defined = "defined",
     Assignable = "assignable",
-    Computed = "computed"
+    Computed = "computed",
+    Checkable = "checkable"
 }
 export interface XemaInterfaceUsersetTerm {
     readonly relation: string;
@@ -15,6 +16,9 @@ export type XemaInterfaceRelationRequirement = {
 } | {
     readonly kind: XemaInterfaceRelationKind.Computed;
     readonly anyOf: readonly XemaInterfaceUsersetTerm[];
+} | {
+    readonly kind: XemaInterfaceRelationKind.Checkable;
+    readonly subjects: readonly string[];
 };
 export type XemaInterfaceRequirements = Readonly<Record<string, XemaInterfaceRelationRequirement>>;
 export declare function formatXemaInterfaceUsersetTerm(term: XemaInterfaceUsersetTerm): string;

package/dist/authorization-module/lib/authorization-interface-requirements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-interface-requirements.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-interface-requirements.ts"],"names":[],"mappings":"AAeA,oBAAY,yBAAyB;IACnC,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,gCAAgC,GACxC;IAAE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,OAAO,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,UAAU,CAAC;IAEpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,QAAQ,CAAC;IAElD,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACrD,CAAC;AAGN,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAC9C,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CACjD,CAAC;AAGF,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,CAErF"}
+{"version":3,"file":"authorization-interface-requirements.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-interface-requirements.ts"],"names":[],"mappings":"AAkBA,oBAAY,yBAAyB;IACnC,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,gCAAgC,GACxC;IAAE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,OAAO,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,UAAU,CAAC;IAEpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,QAAQ,CAAC;IAElD,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACrD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC;IAEnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAGN,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAC9C,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CACjD,CAAC;AAGF,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,CAErF"}

package/dist/authorization-module/lib/authorization-interface-requirements.js

@@ -7,6 +7,7 @@ var XemaInterfaceRelationKind;
     XemaInterfaceRelationKind["Defined"] = "defined";
     XemaInterfaceRelationKind["Assignable"] = "assignable";
     XemaInterfaceRelationKind["Computed"] = "computed";
+    XemaInterfaceRelationKind["Checkable"] = "checkable";
 })(XemaInterfaceRelationKind || (exports.XemaInterfaceRelationKind = XemaInterfaceRelationKind = {}));
 function formatXemaInterfaceUsersetTerm(term) {
     return term.from === undefined ? term.relation : `${term.relation} from ${term.from}`;

package/dist/authorization-module/lib/authorization-interface-requirements.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-interface-requirements.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-interface-requirements.ts"],"names":[],"mappings":";;;AA8CA,wEAEC;AAjCD,IAAY,yBAIX;AAJD,WAAY,yBAAyB;IACnC,gDAAmB,CAAA;IACnB,sDAAyB,CAAA;IACzB,kDAAqB,CAAA;AACvB,CAAC,EAJW,yBAAyB,yCAAzB,yBAAyB,QAIpC;AA2BD,SAAgB,8BAA8B,CAAC,IAA8B;IAC3E,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC"}
+{"version":3,"file":"authorization-interface-requirements.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-interface-requirements.ts"],"names":[],"mappings":";;;AAuDA,wEAEC;AAvCD,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,gDAAmB,CAAA;IACnB,sDAAyB,CAAA;IACzB,kDAAqB,CAAA;IACrB,oDAAuB,CAAA;AACzB,CAAC,EALW,yBAAyB,yCAAzB,yBAAyB,QAKpC;AAgCD,SAAgB,8BAA8B,CAAC,IAA8B;IAC3E,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC"}

package/dist/authorization-module/lib/authorization-module-contribution.d.ts

@@ -22,6 +22,17 @@ export declare const AuthorizationModuleSourceManifestSchema: z.ZodObject<{
             minModuleVersion: z.ZodNumber;
         }, z.core.$strict>>;
         implements: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<typeof import("./platform-authorization-modules").XemaAuthorizationInterface>>>;
+        delegationOrigination: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            holderWorkload: z.ZodString;
+            capabilities: z.ZodUnion<readonly [z.ZodArray<z.ZodType<import("../../capability").CapabilityRef, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityRef, unknown>>>, z.ZodObject<{
+                stated: z.ZodLiteral<true>;
+                ceiling: z.ZodOptional<z.ZodEnum<typeof import("./delegation-wildcard-ceiling").DelegationCeiling>>;
+            }, z.core.$strict>]>;
+            redelegable: z.ZodUnion<readonly [z.ZodArray<z.ZodType<import("../../capability").CapabilityRef, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityRef, unknown>>>, z.ZodObject<{
+                stated: z.ZodLiteral<true>;
+            }, z.core.$strict>]>;
+            expiresAfter: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
         resourceTypes: z.ZodArray<z.ZodString>;
         writableRelations: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
         searchable: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -69,6 +80,7 @@ export declare const SignedBiomeAuthorizationFactsSchema: z.ZodObject<{
     tier: z.ZodEnum<typeof import("../../biome").BiomeTier>;
     declaredBiomeDependencies: z.ZodArray<z.ZodString>;
     serviceNames: z.ZodArray<z.ZodString>;
+    declaredCapabilities: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 export type SignedBiomeAuthorizationFacts = z.infer<typeof SignedBiomeAuthorizationFactsSchema>;
 export declare const AuthorizationModuleContributionManifestSchema: z.ZodObject<{
@@ -84,6 +96,17 @@ export declare const AuthorizationModuleContributionManifestSchema: z.ZodObject<
             minModuleVersion: z.ZodNumber;
         }, z.core.$strict>>;
         implements: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<typeof import("./platform-authorization-modules").XemaAuthorizationInterface>>>;
+        delegationOrigination: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            holderWorkload: z.ZodString;
+            capabilities: z.ZodUnion<readonly [z.ZodArray<z.ZodType<import("../../capability").CapabilityRef, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityRef, unknown>>>, z.ZodObject<{
+                stated: z.ZodLiteral<true>;
+                ceiling: z.ZodOptional<z.ZodEnum<typeof import("./delegation-wildcard-ceiling").DelegationCeiling>>;
+            }, z.core.$strict>]>;
+            redelegable: z.ZodUnion<readonly [z.ZodArray<z.ZodType<import("../../capability").CapabilityRef, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityRef, unknown>>>, z.ZodObject<{
+                stated: z.ZodLiteral<true>;
+            }, z.core.$strict>]>;
+            expiresAfter: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
         resourceTypes: z.ZodArray<z.ZodString>;
         writableRelations: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
         searchable: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -129,6 +152,7 @@ export declare const AuthorizationModuleContributionManifestSchema: z.ZodObject<
         tier: z.ZodEnum<typeof import("../../biome").BiomeTier>;
         declaredBiomeDependencies: z.ZodArray<z.ZodString>;
         serviceNames: z.ZodArray<z.ZodString>;
+        declaredCapabilities: z.ZodArray<z.ZodString>;
     }, z.core.$strict>;
 }, z.core.$strict>;
 export type AuthorizationModuleContributionManifest = z.infer<typeof AuthorizationModuleContributionManifestSchema>;

package/dist/authorization-module/lib/authorization-module-contribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-module-contribution.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2BxB,eAAO,MAAM,6BAA6B;;;kBAK/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;kBAKnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAGF,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2BhD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAsBF,eAAO,MAAM,mCAAmC;;;;kBAQrC,CAAC;AACZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAGF,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgBtD,CAAC;AACL,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAC3D,OAAO,6CAA6C,CACrD,CAAC;AAGF,qBAAa,oCAAqC,SAAQ,KAAK;gBACjD,OAAO,EAAE,MAAM;CAI5B;AAOD,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,6BAA6B,GACzC,uCAAuC,CAsBzC;AAGD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAYD,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACtC,MAAM,GAAG,IAAI,CAcf;AAGD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,aAAa,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,uCAAuC,CAAC;CAC5D,CAAC,GACD,gBAAgB,EAAE,CAKpB;AAQD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,uCAAuC,GAAG,SAAS,GAC5D,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAOpD"}
+{"version":3,"file":"authorization-module-contribution.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2BxB,eAAO,MAAM,6BAA6B;;;kBAK/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;kBAKnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAGF,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2BhD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAsBF,eAAO,MAAM,mCAAmC;;;;;kBAarC,CAAC;AACZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAGF,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgBtD,CAAC;AACL,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAC3D,OAAO,6CAA6C,CACrD,CAAC;AAGF,qBAAa,oCAAqC,SAAQ,KAAK;gBACjD,OAAO,EAAE,MAAM;CAI5B;AAOD,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,6BAA6B,GACzC,uCAAuC,CAsBzC;AAGD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAYD,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACtC,MAAM,GAAG,IAAI,CAcf;AAGD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,aAAa,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,uCAAuC,CAAC;CAC5D,CAAC,GACD,gBAAgB,EAAE,CAKpB;AAQD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,uCAAuC,GAAG,SAAS,GAC5D,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAOpD"}

package/dist/authorization-module/lib/authorization-module-contribution.js

@@ -59,6 +59,7 @@ exports.SignedBiomeAuthorizationFactsSchema = zod_1.z
     tier: biome_1.BiomeTierSchema,
     declaredBiomeDependencies: uniqueNonEmptyStrings('declaredBiomeDependencies'),
     serviceNames: uniqueNonEmptyStrings('serviceNames'),
+    declaredCapabilities: uniqueNonEmptyStrings('declaredCapabilities'),
 })
     .strict();
 exports.AuthorizationModuleContributionManifestSchema = zod_1.z

package/dist/authorization-module/lib/authorization-module-contribution.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-module-contribution.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-contribution.ts"],"names":[],"mappings":";;;AAoJA,oFAyBC;AAkBD,0DAiBC;AAGD,gEAUC;AAQD,wDAUC;AA/OD,6BAAwB;AAExB,uCAA8C;AAE9C,mFAIyC;AACzC,qFAA+E;AAkBlE,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iEAAiC,CAAC;IACzD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sEAAsC,CAAC;IAC9D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,uCAAuC,GAAG,OAAC;KACrD,MAAM,CAAC;IACN,QAAQ,EAAE,iEAAiC;IAC3C,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,QAAQ,EAAE,yCAAiC;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IACE,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAClC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAC/C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAC3H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;YAC1B,OAAO,EAAE,0BAA0B,QAAQ,CAAC,QAAQ,CAAC,IAAI,kCAAkC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI;SACvH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,OAAC;SACL,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE;QAC1D,OAAO,EAAE,GAAG,IAAI,4BAA4B;KAC7C,CAAC,CAAC;AACP,CAAC;AAcY,QAAA,mCAAmC,GAAG,OAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,uBAAe;IACrB,yBAAyB,EAAE,qBAAqB,CAC9C,2BAA2B,CAC5B;IACD,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,6CAA6C,GAAG,OAAC;KAC3D,MAAM,CAAC;IACN,QAAQ,EAAE,iEAAiC;IAC3C,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,QAAQ,EAAE,yCAAiC;IAC3C,WAAW,EAAE,2CAAmC;CACjD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC1D,MAAM,MAAM,GAAG,+CAAuC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAML,MAAa,oCAAqC,SAAQ,KAAK;IAC7D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AALD,oFAKC;AAOD,SAAgB,oCAAoC,CAClD,MAAe,EACf,WAA0C;IAE1C,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,oCAAoC,CAC5C,8IAA8I,CAC/I,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,+CAAuC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,oCAAoC,CAC5C,yDAAyD,MAAM,CAAC,KAAK,CAAC,MAAM;aACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,qDAA6C,CAAC,KAAK,CAAC;QACzD,GAAG,MAAM,CAAC,IAAI;QACd,WAAW,EAAE,2CAAmC,CAAC,KAAK,CAAC,WAAW,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAkBD,SAAgB,uBAAuB,CACrC,iBAAyB,EACzB,MAAuC;IAEvC,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CACR,MAAM;aACH,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;aACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACzB;KACF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oCAAoC,CAC5C,YAAY,iBAAiB,wCAAwC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC3B,CAAC;AAGD,SAAgB,0BAA0B,CACxC,OAGE;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY;KAClD,CAAC,CAAC,CAAC;AACN,CAAC;AAQD,SAAgB,sBAAsB,CACpC,OAAe,EACf,QAA6D;IAE7D,MAAM,QAAQ,GAAG,IAAA,4DAA2B,EAAC,OAAO,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"authorization-module-contribution.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-contribution.ts"],"names":[],"mappings":";;;AAyJA,oFAyBC;AAkBD,0DAiBC;AAGD,gEAUC;AAQD,wDAUC;AApPD,6BAAwB;AAExB,uCAA8C;AAE9C,mFAIyC;AACzC,qFAA+E;AAkBlE,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iEAAiC,CAAC;IACzD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sEAAsC,CAAC;IAC9D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,uCAAuC,GAAG,OAAC;KACrD,MAAM,CAAC;IACN,QAAQ,EAAE,iEAAiC;IAC3C,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,QAAQ,EAAE,yCAAiC;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IACE,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAClC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAC/C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAC3H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;YAC1B,OAAO,EAAE,0BAA0B,QAAQ,CAAC,QAAQ,CAAC,IAAI,kCAAkC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI;SACvH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,OAAC;SACL,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE;QAC1D,OAAO,EAAE,GAAG,IAAI,4BAA4B;KAC7C,CAAC,CAAC;AACP,CAAC;AAcY,QAAA,mCAAmC,GAAG,OAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,uBAAe;IACrB,yBAAyB,EAAE,qBAAqB,CAC9C,2BAA2B,CAC5B;IACD,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC;IAKnD,oBAAoB,EAAE,qBAAqB,CAAC,sBAAsB,CAAC;CACpE,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,6CAA6C,GAAG,OAAC;KAC3D,MAAM,CAAC;IACN,QAAQ,EAAE,iEAAiC;IAC3C,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,QAAQ,EAAE,yCAAiC;IAC3C,WAAW,EAAE,2CAAmC;CACjD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC1D,MAAM,MAAM,GAAG,+CAAuC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAML,MAAa,oCAAqC,SAAQ,KAAK;IAC7D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AALD,oFAKC;AAOD,SAAgB,oCAAoC,CAClD,MAAe,EACf,WAA0C;IAE1C,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,oCAAoC,CAC5C,8IAA8I,CAC/I,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,+CAAuC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,oCAAoC,CAC5C,yDAAyD,MAAM,CAAC,KAAK,CAAC,MAAM;aACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,qDAA6C,CAAC,KAAK,CAAC;QACzD,GAAG,MAAM,CAAC,IAAI;QACd,WAAW,EAAE,2CAAmC,CAAC,KAAK,CAAC,WAAW,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAkBD,SAAgB,uBAAuB,CACrC,iBAAyB,EACzB,MAAuC;IAEvC,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CACR,MAAM;aACH,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;aACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACzB;KACF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oCAAoC,CAC5C,YAAY,iBAAiB,wCAAwC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC3B,CAAC;AAGD,SAAgB,0BAA0B,CACxC,OAGE;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY;KAClD,CAAC,CAAC,CAAC;AACN,CAAC;AAQD,SAAgB,sBAAsB,CACpC,OAAe,EACf,QAA6D;IAE7D,MAAM,QAAQ,GAAG,IAAA,4DAA2B,EAAC,OAAO,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/authorization-module/lib/authorization-module-envelope.d.ts

@@ -79,6 +79,17 @@ export declare const AuthorizationModuleEnvelopeSchema: z.ZodObject<{
         minModuleVersion: z.ZodNumber;
     }, z.core.$strict>>;
     implements: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<typeof import("./platform-authorization-modules").XemaAuthorizationInterface>>>;
+    delegationOrigination: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        holderWorkload: z.ZodString;
+        capabilities: z.ZodUnion<readonly [z.ZodArray<z.ZodType<import("../../capability").CapabilityRef, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityRef, unknown>>>, z.ZodObject<{
+            stated: z.ZodLiteral<true>;
+            ceiling: z.ZodOptional<z.ZodEnum<typeof import("./delegation-wildcard-ceiling").DelegationCeiling>>;
+        }, z.core.$strict>]>;
+        redelegable: z.ZodUnion<readonly [z.ZodArray<z.ZodType<import("../../capability").CapabilityRef, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityRef, unknown>>>, z.ZodObject<{
+            stated: z.ZodLiteral<true>;
+        }, z.core.$strict>]>;
+        expiresAfter: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
     resourceTypes: z.ZodArray<z.ZodString>;
     writableRelations: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
     searchable: z.ZodRecord<z.ZodString, z.ZodObject<{

package/dist/authorization-module/lib/authorization-module-envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-module-envelope.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA+BxB,eAAO,MAAM,iCAAiC,QAAgC,CAAC;AAE/E,eAAO,MAAM,sCAAsC,QACd,CAAC;AAStC,eAAO,MAAM,mCAAmC;;;kBAKrC,CAAC;AACZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAGF,eAAO,MAAM,6BAA6B;;;kBAiBtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAOF,oBAAY,8BAA8B;IACxC,UAAU,gBAAgB;IAC1B,cAAc,oBAAoB;IAClC,QAAQ,cAAc;IACtB,YAAY,kBAAkB;IAC9B,iBAAiB,uBAAuB;CACzC;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;4BAsC3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AASF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;kBAKpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqDnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC"}
+{"version":3,"file":"authorization-module-envelope.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgCxB,eAAO,MAAM,iCAAiC,QAAgC,CAAC;AAE/E,eAAO,MAAM,sCAAsC,QACd,CAAC;AAStC,eAAO,MAAM,mCAAmC;;;kBAKrC,CAAC;AACZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAGF,eAAO,MAAM,6BAA6B;;;kBAiBtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAOF,oBAAY,8BAA8B;IACxC,UAAU,gBAAgB;IAC1B,cAAc,oBAAoB;IAClC,QAAQ,cAAc;IACtB,YAAY,kBAAkB;IAC9B,iBAAiB,uBAAuB;CACzC;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;4BAsC3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AASF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;kBAKpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4DnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC"}

package/dist/authorization-module/lib/authorization-module-envelope.js

@@ -5,6 +5,7 @@ const zod_1 = require("zod");
 const authorization_facts_1 = require("../../authorization-facts");
 const platform_generation_1 = require("../../platform-generation");
 const authorization_namespace_1 = require("./authorization-namespace");
+const delegation_origination_1 = require("./delegation-origination");
 const platform_authorization_modules_1 = require("./platform-authorization-modules");
 const TypeNameSchema = zod_1.z.string().regex(/^[^:#@*\s]{1,254}$/);
 const RelationNameSchema = zod_1.z.string().regex(/^[^:#@*\s]{1,50}$/);
@@ -94,6 +95,9 @@ exports.AuthorizationModuleEnvelopeSchema = zod_1.z
         .array(exports.AuthorizationModuleDependencySchema)
         .refine((deps) => new Set(deps.map((d) => d.biome)).size === deps.length, { message: 'dependsOn must not name a biome twice.' }),
     implements: zod_1.z.record(TypeNameSchema, uniqueArray(platform_authorization_modules_1.XemaAuthorizationInterfaceSchema, 'implements').min(1)),
+    delegationOrigination: zod_1.z
+        .record(TypeNameSchema, delegation_origination_1.DelegationOriginationSchema)
+        .optional(),
     resourceTypes: uniqueArray(TypeNameSchema, 'resourceTypes').min(1),
     writableRelations: authorization_facts_1.WritableRelationsSchema,
     searchable: zod_1.z.record(TypeNameSchema, exports.AuthorizationSearchableSchema),

package/dist/authorization-module/lib/authorization-module-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-module-envelope.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-envelope.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,mEAAoE;AACpE,mEAAqE;AAErE,uEAAuE;AACvE,qFAG0C;AAkB1C,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAC9D,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAGpD,QAAA,iCAAiC,GAAG,6BAA6B,CAAC;AAElE,QAAA,sCAAsC,GACjD,mCAAmC,CAAC;AAEtC,SAAS,WAAW,CAAyB,IAAO,EAAE,IAAY;IAChE,OAAO,OAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE;QAC9E,OAAO,EAAE,GAAG,IAAI,4BAA4B;KAC7C,CAAC,CAAC;AACL,CAAC;AAGY,QAAA,mCAAmC,GAAG,OAAC;KACjD,MAAM,CAAC;IACN,KAAK,EAAE,oDAA0B;IACjC,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IAKN,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE;IAMjC,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE;CAC7B,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE;IAC3D,OAAO,EAAE,kEAAkE;CAC5E,CAAC,CAAC;AAUL,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,4DAA0B,CAAA;IAC1B,oEAAkC,CAAA;IAClC,wDAAsB,CAAA;IACtB,gEAA8B,CAAA;IAC9B,0EAAwC,CAAA;AAC1C,CAAC,EANW,8BAA8B,8CAA9B,8BAA8B,QAMzC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC;QAC1D,IAAI,EAAE,cAAc;QACpB,EAAE,EAAE,cAAc;KACnB,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC;QAC9D,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,kBAAkB;QACxB,EAAE,EAAE,kBAAkB;KACvB,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,cAAc;KACrB,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC;QAC5D,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,kBAAkB;KAC7B,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC;QACjE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,kBAAkB;QAE5B,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3C,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAYU,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,wCAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACxD,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IAEN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAO1C,kBAAkB,EAAE,8CAAwB;IAE5C,KAAK,EAAE,WAAW,CAChB,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yCAAiC,CAAC,EACnD,OAAO,CACR,CAAC,GAAG,CAAC,CAAC,CAAC;IAER,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8CAAsC,CAAC;IAE/D,OAAO,EAAE,WAAW,CAAC,kEAAiC,EAAE,SAAS,CAAC;IAElE,SAAS,EAAE,OAAC;SACT,KAAK,CAAC,2CAAmC,CAAC;SAC1C,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAChE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CACtD;IAEH,UAAU,EAAE,OAAC,CAAC,MAAM,CAClB,cAAc,EACd,WAAW,CAAC,iEAAgC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACnE;IAED,aAAa,EAAE,WAAW,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAElE,iBAAiB,EAAE,6CAAuB;IAE1C,UAAU,EAAE,OAAC,CAAC,MAAM,CAAC,cAAc,EAAE,qCAA6B,CAAC;IAOnE,eAAe,EAAE,OAAC,CAAC,MAAM,CACvB,cAAc,EACd,WAAW,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAC1D;IAED,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,0CAAkC,CAAC;CACxD,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"authorization-module-envelope.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-envelope.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,mEAAoE;AACpE,mEAAqE;AAErE,uEAAuE;AACvE,qEAAuE;AACvE,qFAG0C;AAkB1C,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAC9D,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAGpD,QAAA,iCAAiC,GAAG,6BAA6B,CAAC;AAElE,QAAA,sCAAsC,GACjD,mCAAmC,CAAC;AAEtC,SAAS,WAAW,CAAyB,IAAO,EAAE,IAAY;IAChE,OAAO,OAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE;QAC9E,OAAO,EAAE,GAAG,IAAI,4BAA4B;KAC7C,CAAC,CAAC;AACL,CAAC;AAGY,QAAA,mCAAmC,GAAG,OAAC;KACjD,MAAM,CAAC;IACN,KAAK,EAAE,oDAA0B;IACjC,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IAKN,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE;IAMjC,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE;CAC7B,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE;IAC3D,OAAO,EAAE,kEAAkE;CAC5E,CAAC,CAAC;AAUL,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,4DAA0B,CAAA;IAC1B,oEAAkC,CAAA;IAClC,wDAAsB,CAAA;IACtB,gEAA8B,CAAA;IAC9B,0EAAwC,CAAA;AAC1C,CAAC,EANW,8BAA8B,8CAA9B,8BAA8B,QAMzC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC;QAC1D,IAAI,EAAE,cAAc;QACpB,EAAE,EAAE,cAAc;KACnB,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC;QAC9D,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,kBAAkB;QACxB,EAAE,EAAE,kBAAkB;KACvB,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,cAAc;KACrB,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC;QAC5D,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,kBAAkB;KAC7B,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC;QACjE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,kBAAkB;QAE5B,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3C,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAYU,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,wCAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACxD,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IAEN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAO1C,kBAAkB,EAAE,8CAAwB;IAE5C,KAAK,EAAE,WAAW,CAChB,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yCAAiC,CAAC,EACnD,OAAO,CACR,CAAC,GAAG,CAAC,CAAC,CAAC;IAER,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8CAAsC,CAAC;IAE/D,OAAO,EAAE,WAAW,CAAC,kEAAiC,EAAE,SAAS,CAAC;IAElE,SAAS,EAAE,OAAC;SACT,KAAK,CAAC,2CAAmC,CAAC;SAC1C,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAChE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CACtD;IAEH,UAAU,EAAE,OAAC,CAAC,MAAM,CAClB,cAAc,EACd,WAAW,CAAC,iEAAgC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACnE;IAKD,qBAAqB,EAAE,OAAC;SACrB,MAAM,CAAC,cAAc,EAAE,oDAA2B,CAAC;SACnD,QAAQ,EAAE;IAEb,aAAa,EAAE,WAAW,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAElE,iBAAiB,EAAE,6CAAuB;IAE1C,UAAU,EAAE,OAAC,CAAC,MAAM,CAAC,cAAc,EAAE,qCAA6B,CAAC;IAOnE,eAAe,EAAE,OAAC,CAAC,MAAM,CACvB,cAAc,EACd,WAAW,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAC1D;IAED,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,0CAAkC,CAAC;CACxD,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/authorization-module/lib/delegation-origination.d.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+import { DelegationCeiling } from './delegation-wildcard-ceiling';
+export declare const DELEGATION_ORIGINATION_DURATION_PATTERN: RegExp;
+declare const StatedCapabilitiesSchema: z.ZodObject<{
+    stated: z.ZodLiteral<true>;
+    ceiling: z.ZodOptional<z.ZodEnum<typeof DelegationCeiling>>;
+}, z.core.$strict>;
+export declare const DelegationOriginationSchema: z.ZodObject<{
+    holderWorkload: z.ZodString;
+    capabilities: z.ZodUnion<readonly [z.ZodArray<z.ZodType<import("../../capability").CapabilityRef, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityRef, unknown>>>, z.ZodObject<{
+        stated: z.ZodLiteral<true>;
+        ceiling: z.ZodOptional<z.ZodEnum<typeof DelegationCeiling>>;
+    }, z.core.$strict>]>;
+    redelegable: z.ZodUnion<readonly [z.ZodArray<z.ZodType<import("../../capability").CapabilityRef, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityRef, unknown>>>, z.ZodObject<{
+        stated: z.ZodLiteral<true>;
+    }, z.core.$strict>]>;
+    expiresAfter: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type DelegationOrigination = z.infer<typeof DelegationOriginationSchema>;
+export type StatedCapabilities = z.infer<typeof StatedCapabilitiesSchema>;
+export declare function hasStatedCapabilities(origination: Pick<DelegationOrigination, 'capabilities'>): origination is {
+    capabilities: StatedCapabilities;
+} & typeof origination;
+export declare function hasWildcardCeiling(origination: Pick<DelegationOrigination, 'capabilities'>): boolean;
+export {};
+//# sourceMappingURL=delegation-origination.d.ts.map

package/dist/authorization-module/lib/delegation-origination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-origination.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/delegation-origination.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAQlE,eAAO,MAAM,uCAAuC,QACiB,CAAC;AAWtE,QAAA,MAAM,wBAAwB;;;kBAKnB,CAAC;AAgCZ,eAAO,MAAM,2BAA2B;;;;;;;;;;kBAqB7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,cAAc,CAAC,GACvD,WAAW,IAAI;IAAE,YAAY,EAAE,kBAAkB,CAAA;CAAE,GAAG,OAAO,WAAW,CAE1E;AAQD,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,cAAc,CAAC,GAAG,OAAO,CAKpG"}