@xemahq/contracts 0.80.0 → 0.82.0

package/dist/caller-context/lib/org-scope-mint.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnprovenOrgScopeError = exports.OrgScopeProvenance = void 0;
+exports.orgScopeFromOwningRow = orgScopeFromOwningRow;
+exports.describeOrgScopeWitness = describeOrgScopeWitness;
+var OrgScopeProvenance;
+(function (OrgScopeProvenance) {
+    OrgScopeProvenance["OwningRow"] = "owning_row";
+})(OrgScopeProvenance || (exports.OrgScopeProvenance = OrgScopeProvenance = {}));
+class UnprovenOrgScopeError extends Error {
+    assertedOrgId;
+    source;
+    constructor(assertedOrgId, source) {
+        super(`Refusing to state org "${assertedOrgId}" in a worker context: ` +
+            `(authority=${source}). Resolve the tenant from the owning row.`);
+        this.assertedOrgId = assertedOrgId;
+        this.source = source;
+        this.name = 'UnprovenOrgScopeError';
+    }
+}
+exports.UnprovenOrgScopeError = UnprovenOrgScopeError;
+function orgScopeFromOwningRow(orgId, row) {
+    const trimmed = orgId.trim();
+    if (trimmed.length === 0) {
+        throw new UnprovenOrgScopeError('', `empty-org/${OrgScopeProvenance.OwningRow}`);
+    }
+    return {
+        orgId: trimmed,
+        provenance: OrgScopeProvenance.OwningRow,
+        evidence: `row:${row.entity}:${row.id}`,
+    };
+}
+function describeOrgScopeWitness(w) {
+    return `owning row (${w.evidence})`;
+}
+//# sourceMappingURL=org-scope-mint.js.map

package/dist/caller-context/lib/org-scope-mint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-scope-mint.js","sourceRoot":"","sources":["../../../src/caller-context/lib/org-scope-mint.ts"],"names":[],"mappings":";;;AAkEA,sDAaC;AAGD,0DAEC;AAzDD,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAM5B,8CAAwB,CAAA;AAC1B,CAAC,EAPW,kBAAkB,kCAAlB,kBAAkB,QAO7B;AAkBD,MAAa,qBAAsB,SAAQ,KAAK;IAEnC;IACA;IAFX,YACW,aAAqB,EACrB,MAAc;QAEvB,KAAK,CACH,0BAA0B,aAAa,yBAAyB;YAC9D,cAAc,MAAM,4CAA4C,CACnE,CAAC;QANO,kBAAa,GAAb,aAAa,CAAQ;QACrB,WAAM,GAAN,MAAM,CAAQ;QAMvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAXD,sDAWC;AAGD,SAAgB,qBAAqB,CACnC,KAAa,EACb,GAAqD;IAErD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAqB,CAAC,EAAE,EAAE,aAAa,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,kBAAkB,CAAC,SAAS;QACxC,QAAQ,EAAE,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE;KACrB,CAAC;AACvB,CAAC;AAGD,SAAgB,uBAAuB,CAAC,CAAkB;IACxD,OAAO,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC;AACtC,CAAC"}

package/dist/caller-context/lib/platform-sweep.d.ts

@@ -0,0 +1,64 @@
+import { PlatformSweep } from '../../deployment';
+import { type OrgAuthorityVerdict } from './org-authority';
+import type { ReceiverOperationId } from './receiver-operation';
+export { PlatformSweep };
+export declare enum PlatformSweepReach {
+    ModelGatewaySessionMint = "model:gateway-session.mint@1",
+    CredentialResolve = "credential:resolve@1",
+    CredentialWrite = "credential:write@1",
+    CredentialRevoke = "credential:revoke@1",
+    MemberNotificationPublish = "notification:member.publish@1",
+    WorkspaceStorageErase = "workspace-storage:erase@1",
+    AppErase = "app-platform:app-erase@1",
+    ResourceRoleBindingWrite = "resource-role:binding.write@1",
+    OrgDataErase = "org-data:erase@1",
+    ContributionOrgSync = "contribution:org-sync@1",
+    EmbeddingCommitmentMigrationReport = "embedding-commitment:migration.report@1",
+    LegalHoldOrgErasureFence = "legal-hold:org-erasure-fence@1",
+    WorkspaceAllocationErase = "workspace:allocation.erase@1",
+    EndedHolderCheckWrite = "agent-session:session-sweep.ended-holder-check.write@1",
+    ConnectorInstallationVerify = "connector:installation-verify@1",
+    AuditCapabilityUsageRead = "audit:capability-usage.read@1",
+    LegalHoldResolve = "legal-hold:resolve@1",
+    AuthorizationFactsSnapshot = "authorization-facts:snapshot@1"
+}
+export declare const PLATFORM_SWEEP_REACH: Readonly<Record<PlatformSweep, readonly PlatformSweepReach[]>>;
+export declare function parsePlatformSweep(name: string): PlatformSweep | undefined;
+declare const PLATFORM_SWEEP_GRANT_BRAND: unique symbol;
+export interface PlatformSweepGrant {
+    readonly [PLATFORM_SWEEP_GRANT_BRAND]: true;
+    readonly sweep: PlatformSweep;
+    readonly orgId: string;
+}
+export declare class PlatformSweepGrantError extends Error {
+    readonly sweep: PlatformSweep;
+    constructor(sweep: PlatformSweep);
+}
+export declare function platformSweepGrant(sweep: PlatformSweep, orgId: string): PlatformSweepGrant;
+export declare enum PlatformSweepRefusal {
+    NoSweep = "no_sweep",
+    UnknownSweep = "unknown_sweep",
+    UnnamedService = "unnamed_service",
+    OrgMismatch = "org_mismatch",
+    OutOfReach = "out_of_reach"
+}
+export interface AdmittedPlatformSweep {
+    readonly admitted: true;
+    readonly sweep: PlatformSweep;
+    readonly callerService: string;
+    readonly orgId: string;
+    readonly reach: ReceiverOperationId;
+}
+export interface RefusedPlatformSweep {
+    readonly admitted: false;
+    readonly refusal: PlatformSweepRefusal;
+    readonly stated?: string;
+}
+export declare function admitPlatformSweep(input: {
+    readonly platformSweep: string | undefined;
+    readonly callerService: string | undefined;
+    readonly orgAuthority: OrgAuthorityVerdict | undefined;
+    readonly requestedOrgId: string;
+    readonly reach: ReceiverOperationId;
+}): AdmittedPlatformSweep | RefusedPlatformSweep;
+//# sourceMappingURL=platform-sweep.d.ts.map

package/dist/caller-context/lib/platform-sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-sweep.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/platform-sweep.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAOhE,OAAO,EAAE,aAAa,EAAE,CAAC;AAOzB,oBAAY,kBAAkB;IAE5B,uBAAuB,iCAAiC;IAExD,iBAAiB,yBAAyB;IAM1C,eAAe,uBAAuB;IAEtC,gBAAgB,wBAAwB;IAKxC,yBAAyB,kCAAkC;IAK3D,qBAAqB,8BAA8B;IAMnD,QAAQ,6BAA6B;IAKrC,wBAAwB,kCAAkC;IAO1D,YAAY,qBAAqB;IAKjC,mBAAmB,4BAA4B;IAK/C,kCAAkC,4CAA4C;IAK9E,wBAAwB,mCAAmC;IAE3D,wBAAwB,iCAAiC;IAMzD,qBAAqB,2DAA2D;IAEhF,2BAA2B,oCAAoC;IAK/D,wBAAwB,kCAAkC;IAK1D,gBAAgB,yBAAyB;IAMzC,0BAA0B,mCAAmC;CAC9D;AAGD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CACzC,MAAM,CAAC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC,CA8CrD,CAAC;AAKF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE1E;AAID,OAAO,CAAC,MAAM,0BAA0B,EAAE,OAAO,MAAM,CAAC;AAQxD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,KAAK,EAAE,aAAa;gBAApB,KAAK,EAAE,aAAa;CAI1C;AAOD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAM1F;AAKD,oBAAY,oBAAoB;IAE9B,OAAO,aAAa;IAEpB,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,WAAW,iBAAiB;IAE5B,UAAU,iBAAiB;CAC5B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IAEvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAYD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC,GAAG,qBAAqB,GAAG,oBAAoB,CAqC/C"}

package/dist/caller-context/lib/platform-sweep.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PlatformSweepRefusal = exports.PlatformSweepGrantError = exports.PLATFORM_SWEEP_REACH = exports.PlatformSweepReach = exports.PlatformSweep = void 0;
+exports.parsePlatformSweep = parsePlatformSweep;
+exports.platformSweepGrant = platformSweepGrant;
+exports.admitPlatformSweep = admitPlatformSweep;
+const deployment_1 = require("../../deployment");
+Object.defineProperty(exports, "PlatformSweep", { enumerable: true, get: function () { return deployment_1.PlatformSweep; } });
+const org_authority_1 = require("./org-authority");
+var PlatformSweepReach;
+(function (PlatformSweepReach) {
+    PlatformSweepReach["ModelGatewaySessionMint"] = "model:gateway-session.mint@1";
+    PlatformSweepReach["CredentialResolve"] = "credential:resolve@1";
+    PlatformSweepReach["CredentialWrite"] = "credential:write@1";
+    PlatformSweepReach["CredentialRevoke"] = "credential:revoke@1";
+    PlatformSweepReach["MemberNotificationPublish"] = "notification:member.publish@1";
+    PlatformSweepReach["WorkspaceStorageErase"] = "workspace-storage:erase@1";
+    PlatformSweepReach["AppErase"] = "app-platform:app-erase@1";
+    PlatformSweepReach["ResourceRoleBindingWrite"] = "resource-role:binding.write@1";
+    PlatformSweepReach["OrgDataErase"] = "org-data:erase@1";
+    PlatformSweepReach["ContributionOrgSync"] = "contribution:org-sync@1";
+    PlatformSweepReach["EmbeddingCommitmentMigrationReport"] = "embedding-commitment:migration.report@1";
+    PlatformSweepReach["LegalHoldOrgErasureFence"] = "legal-hold:org-erasure-fence@1";
+    PlatformSweepReach["WorkspaceAllocationErase"] = "workspace:allocation.erase@1";
+    PlatformSweepReach["EndedHolderCheckWrite"] = "agent-session:session-sweep.ended-holder-check.write@1";
+    PlatformSweepReach["ConnectorInstallationVerify"] = "connector:installation-verify@1";
+    PlatformSweepReach["AuditCapabilityUsageRead"] = "audit:capability-usage.read@1";
+    PlatformSweepReach["LegalHoldResolve"] = "legal-hold:resolve@1";
+    PlatformSweepReach["AuthorizationFactsSnapshot"] = "authorization-facts:snapshot@1";
+})(PlatformSweepReach || (exports.PlatformSweepReach = PlatformSweepReach = {}));
+exports.PLATFORM_SWEEP_REACH = {
+    [deployment_1.PlatformSweep.EraseSweep]: [PlatformSweepReach.CredentialResolve, PlatformSweepReach.CredentialRevoke],
+    [deployment_1.PlatformSweep.OrgErasure]: [
+        PlatformSweepReach.OrgDataErase,
+        PlatformSweepReach.LegalHoldOrgErasureFence,
+        PlatformSweepReach.LegalHoldResolve,
+    ],
+    [deployment_1.PlatformSweep.AppErasure]: [PlatformSweepReach.AppErase],
+    [deployment_1.PlatformSweep.IndexMaintenance]: [
+        PlatformSweepReach.ModelGatewaySessionMint,
+        PlatformSweepReach.EmbeddingCommitmentMigrationReport,
+        PlatformSweepReach.AuditCapabilityUsageRead,
+        PlatformSweepReach.AuthorizationFactsSnapshot,
+    ],
+    [deployment_1.PlatformSweep.ConnectorSecretCustody]: [
+        PlatformSweepReach.CredentialResolve,
+        PlatformSweepReach.CredentialWrite,
+        PlatformSweepReach.CredentialRevoke,
+        PlatformSweepReach.ConnectorInstallationVerify,
+    ],
+    [deployment_1.PlatformSweep.CredentialRefresh]: [PlatformSweepReach.CredentialResolve, PlatformSweepReach.CredentialWrite],
+    [deployment_1.PlatformSweep.ConnectionHealthProbe]: [PlatformSweepReach.CredentialResolve],
+    [deployment_1.PlatformSweep.MemberNotification]: [PlatformSweepReach.MemberNotificationPublish],
+    [deployment_1.PlatformSweep.EndedHolderErasure]: [
+        PlatformSweepReach.WorkspaceStorageErase,
+        PlatformSweepReach.WorkspaceAllocationErase,
+        PlatformSweepReach.EndedHolderCheckWrite,
+    ],
+    [deployment_1.PlatformSweep.ScmProjectBindingMaintenance]: [PlatformSweepReach.ResourceRoleBindingWrite],
+    [deployment_1.PlatformSweep.ContributionConvergence]: [PlatformSweepReach.ContributionOrgSync],
+    [deployment_1.PlatformSweep.RetentionExpiryErasure]: [PlatformSweepReach.LegalHoldResolve],
+};
+const SWEEP_VALUES = new Set(Object.values(deployment_1.PlatformSweep));
+function parsePlatformSweep(name) {
+    return SWEEP_VALUES.has(name) ? name : undefined;
+}
+class PlatformSweepGrantError extends Error {
+    sweep;
+    constructor(sweep) {
+        super(`A platform sweep '${sweep}' names the ONE organization it runs over; none was given.`);
+        this.sweep = sweep;
+        this.name = 'PlatformSweepGrantError';
+    }
+}
+exports.PlatformSweepGrantError = PlatformSweepGrantError;
+function platformSweepGrant(sweep, orgId) {
+    const trimmed = orgId.trim();
+    if (trimmed === '') {
+        throw new PlatformSweepGrantError(sweep);
+    }
+    return { sweep, orgId: trimmed };
+}
+var PlatformSweepRefusal;
+(function (PlatformSweepRefusal) {
+    PlatformSweepRefusal["NoSweep"] = "no_sweep";
+    PlatformSweepRefusal["UnknownSweep"] = "unknown_sweep";
+    PlatformSweepRefusal["UnnamedService"] = "unnamed_service";
+    PlatformSweepRefusal["OrgMismatch"] = "org_mismatch";
+    PlatformSweepRefusal["OutOfReach"] = "out_of_reach";
+})(PlatformSweepRefusal || (exports.PlatformSweepRefusal = PlatformSweepRefusal = {}));
+function admitPlatformSweep(input) {
+    const stated = input.platformSweep;
+    if (stated === undefined || stated === '') {
+        return { admitted: false, refusal: PlatformSweepRefusal.NoSweep };
+    }
+    const sweep = parsePlatformSweep(stated);
+    if (sweep === undefined) {
+        return { admitted: false, refusal: PlatformSweepRefusal.UnknownSweep, stated };
+    }
+    if (input.callerService === undefined || input.callerService === '') {
+        return { admitted: false, refusal: PlatformSweepRefusal.UnnamedService, stated };
+    }
+    const requested = input.requestedOrgId.trim();
+    const sweepOrgId = input.orgAuthority?.source === org_authority_1.OrgAuthoritySource.OrgClaim
+        ? input.orgAuthority.tokenOrgId?.trim()
+        : undefined;
+    if (sweepOrgId === undefined ||
+        sweepOrgId === '' ||
+        requested === '' ||
+        sweepOrgId.toLowerCase() !== requested.toLowerCase()) {
+        return { admitted: false, refusal: PlatformSweepRefusal.OrgMismatch, stated };
+    }
+    if (!exports.PLATFORM_SWEEP_REACH[sweep].includes(input.reach)) {
+        return { admitted: false, refusal: PlatformSweepRefusal.OutOfReach, stated };
+    }
+    return {
+        admitted: true,
+        sweep,
+        callerService: input.callerService,
+        orgId: sweepOrgId,
+        reach: input.reach,
+    };
+}
+//# sourceMappingURL=platform-sweep.js.map

package/dist/caller-context/lib/platform-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-sweep.js","sourceRoot":"","sources":["../../../src/caller-context/lib/platform-sweep.ts"],"names":[],"mappings":";;;AA2MA,gDAEC;AA+BD,gDAMC;AA6CD,gDA4CC;AA1RD,iDAAiD;AAUxC,8FAVA,0BAAa,OAUA;AARtB,mDAA+E;AAe/E,IAAY,kBAkFX;AAlFD,WAAY,kBAAkB;IAE5B,8EAAwD,CAAA;IAExD,gEAA0C,CAAA;IAM1C,4DAAsC,CAAA;IAEtC,8DAAwC,CAAA;IAKxC,iFAA2D,CAAA;IAK3D,yEAAmD,CAAA;IAMnD,2DAAqC,CAAA;IAKrC,gFAA0D,CAAA;IAO1D,uDAAiC,CAAA;IAKjC,qEAA+C,CAAA;IAK/C,oGAA8E,CAAA;IAK9E,iFAA2D,CAAA;IAE3D,+EAAyD,CAAA;IAMzD,sGAAgF,CAAA;IAEhF,qFAA+D,CAAA;IAK/D,gFAA0D,CAAA;IAK1D,+DAAyC,CAAA;IAMzC,mFAA6D,CAAA;AAC/D,CAAC,EAlFW,kBAAkB,kCAAlB,kBAAkB,QAkF7B;AAGY,QAAA,oBAAoB,GAE7B;IAIF,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;IAEvG,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE;QAC1B,kBAAkB,CAAC,YAAY;QAC/B,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,gBAAgB;KACpC;IAED,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;IAEzD,CAAC,0BAAa,CAAC,gBAAgB,CAAC,EAAE;QAChC,kBAAkB,CAAC,uBAAuB;QAC1C,kBAAkB,CAAC,kCAAkC;QACrD,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,0BAA0B;KAC9C;IAED,CAAC,0BAAa,CAAC,sBAAsB,CAAC,EAAE;QACtC,kBAAkB,CAAC,iBAAiB;QACpC,kBAAkB,CAAC,eAAe;QAClC,kBAAkB,CAAC,gBAAgB;QACnC,kBAAkB,CAAC,2BAA2B;KAC/C;IAED,CAAC,0BAAa,CAAC,iBAAiB,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,eAAe,CAAC;IAE7G,CAAC,0BAAa,CAAC,qBAAqB,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,CAAC;IAE7E,CAAC,0BAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,CAAC,yBAAyB,CAAC;IAElF,CAAC,0BAAa,CAAC,kBAAkB,CAAC,EAAE;QAClC,kBAAkB,CAAC,qBAAqB;QACxC,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,qBAAqB;KACzC;IAED,CAAC,0BAAa,CAAC,4BAA4B,CAAC,EAAE,CAAC,kBAAkB,CAAC,wBAAwB,CAAC;IAE3F,CAAC,0BAAa,CAAC,uBAAuB,CAAC,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;IAEjF,CAAC,0BAAa,CAAC,sBAAsB,CAAC,EAAE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;CAC9E,CAAC;AAEF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAAa,CAAC,CAAC,CAAC;AAGhF,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAmBD,MAAa,uBAAwB,SAAQ,KAAK;IAC3B;IAArB,YAAqB,KAAoB;QACvC,KAAK,CAAC,qBAAqB,KAAK,4DAA4D,CAAC,CAAC;QAD3E,UAAK,GAAL,KAAK,CAAe;QAEvC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAOD,SAAgB,kBAAkB,CAAC,KAAoB,EAAE,KAAa;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAwB,CAAC;AACzD,CAAC;AAKD,IAAY,oBAWX;AAXD,WAAY,oBAAoB;IAE9B,4CAAoB,CAAA;IAEpB,sDAA8B,CAAA;IAE9B,0DAAkC,CAAA;IAElC,oDAA4B,CAAA;IAE5B,mDAA2B,CAAA;AAC7B,CAAC,EAXW,oBAAoB,oCAApB,oBAAoB,QAW/B;AA6BD,SAAgB,kBAAkB,CAAC,KAOlC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACpE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAG9C,MAAM,UAAU,GACd,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,kCAAkB,CAAC,QAAQ;QACxD,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,IACE,UAAU,KAAK,SAAS;QACxB,UAAU,KAAK,EAAE;QACjB,SAAS,KAAK,EAAE;QAChB,UAAU,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EACpD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,CAAE,4BAAoB,CAAC,KAAK,CAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,KAAK;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC"}

package/dist/caller-context/lib/receiver-audience.d.ts

@@ -0,0 +1,13 @@
+export declare const RECEIVER_AUDIENCE_PREFIX = "workload:";
+export declare const RECEIVER_WORKLOAD_NAME_PATTERN: RegExp;
+export declare const MAX_RECEIVER_WORKLOAD_NAME_CHARS = 63;
+declare const receiverAudienceBrand: unique symbol;
+export type ReceiverAudience = string & {
+    readonly [receiverAudienceBrand]: true;
+};
+export declare function isReceiverAudience(value: unknown): value is ReceiverAudience;
+export declare function receiverAudienceOf(workloadName: string): ReceiverAudience;
+export declare function receiverWorkloadOf(audience: string): string | undefined;
+export declare function isReservedReceiverAudienceSpelling(value: string): boolean;
+export {};
+//# sourceMappingURL=receiver-audience.d.ts.map

package/dist/caller-context/lib/receiver-audience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-audience.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/receiver-audience.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAGpD,eAAO,MAAM,8BAA8B,QAAoC,CAAC;AAGhF,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD,OAAO,CAAC,MAAM,qBAAqB,EAAE,OAAO,MAAM,CAAC;AAGnD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAWnF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAM5E;AAGD,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,CAQzE;AAGD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvE;AAGD,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzE"}

package/dist/caller-context/lib/receiver-audience.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RECEIVER_WORKLOAD_NAME_CHARS = exports.RECEIVER_WORKLOAD_NAME_PATTERN = exports.RECEIVER_AUDIENCE_PREFIX = void 0;
+exports.isReceiverAudience = isReceiverAudience;
+exports.receiverAudienceOf = receiverAudienceOf;
+exports.receiverWorkloadOf = receiverWorkloadOf;
+exports.isReservedReceiverAudienceSpelling = isReservedReceiverAudienceSpelling;
+exports.RECEIVER_AUDIENCE_PREFIX = 'workload:';
+exports.RECEIVER_WORKLOAD_NAME_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+exports.MAX_RECEIVER_WORKLOAD_NAME_CHARS = 63;
+function isReceiverWorkloadName(value) {
+    return (typeof value === 'string' &&
+        value.length <= exports.MAX_RECEIVER_WORKLOAD_NAME_CHARS &&
+        exports.RECEIVER_WORKLOAD_NAME_PATTERN.test(value));
+}
+function isReceiverAudience(value) {
+    return (typeof value === 'string' &&
+        value.startsWith(exports.RECEIVER_AUDIENCE_PREFIX) &&
+        isReceiverWorkloadName(value.slice(exports.RECEIVER_AUDIENCE_PREFIX.length)));
+}
+function receiverAudienceOf(workloadName) {
+    if (!isReceiverWorkloadName(workloadName)) {
+        throw new Error(`'${String(workloadName)}' is not a workload name a receiver audience can be built from: expected ` +
+            `${exports.RECEIVER_WORKLOAD_NAME_PATTERN.source}, at most ${exports.MAX_RECEIVER_WORKLOAD_NAME_CHARS} characters.`);
+    }
+    return `${exports.RECEIVER_AUDIENCE_PREFIX}${workloadName}`;
+}
+function receiverWorkloadOf(audience) {
+    return isReceiverAudience(audience)
+        ? audience.slice(exports.RECEIVER_AUDIENCE_PREFIX.length)
+        : undefined;
+}
+function isReservedReceiverAudienceSpelling(value) {
+    return value.startsWith(exports.RECEIVER_AUDIENCE_PREFIX);
+}
+//# sourceMappingURL=receiver-audience.js.map

package/dist/caller-context/lib/receiver-audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-audience.js","sourceRoot":"","sources":["../../../src/caller-context/lib/receiver-audience.ts"],"names":[],"mappings":";;;AA4CA,gDAMC;AAGD,gDAQC;AAGD,gDAIC;AAGD,gFAEC;AAnDY,QAAA,wBAAwB,GAAG,WAAW,CAAC;AAGvC,QAAA,8BAA8B,GAAG,iCAAiC,CAAC;AAGnE,QAAA,gCAAgC,GAAG,EAAE,CAAC;AAOnD,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,IAAI,wCAAgC;QAChD,sCAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAGD,SAAgB,kBAAkB,CAAC,KAAc;IAC/C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,UAAU,CAAC,gCAAwB,CAAC;QAC1C,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,gCAAwB,CAAC,MAAM,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AAGD,SAAgB,kBAAkB,CAAC,YAAoB;IACrD,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,IAAI,MAAM,CAAC,YAAY,CAAC,2EAA2E;YACjG,GAAG,sCAA8B,CAAC,MAAM,aAAa,wCAAgC,cAAc,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,gCAAwB,GAAG,YAAY,EAAsB,CAAC;AAC1E,CAAC;AAGD,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,kBAAkB,CAAC,QAAQ,CAAC;QACjC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,gCAAwB,CAAC,MAAM,CAAC;QACjD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAGD,SAAgB,kCAAkC,CAAC,KAAa;IAC9D,OAAO,KAAK,CAAC,UAAU,CAAC,gCAAwB,CAAC,CAAC;AACpD,CAAC"}

package/dist/caller-context/lib/receiver-operation.d.ts

@@ -0,0 +1,10 @@
+export declare const RECEIVER_OPERATION_ID_PATTERN: RegExp;
+export declare const MAX_RECEIVER_OPERATION_ID_CHARS: number;
+declare const receiverOperationIdBrand: unique symbol;
+export type ReceiverOperationId = string & {
+    readonly [receiverOperationIdBrand]: true;
+};
+export declare function isReceiverOperationId(value: unknown): value is ReceiverOperationId;
+export declare function receiverOperationId(text: string): ReceiverOperationId;
+export {};
+//# sourceMappingURL=receiver-operation.d.ts.map

package/dist/caller-context/lib/receiver-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-operation.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/receiver-operation.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,6BAA6B,EAAE,MAA6B,CAAC;AAG1E,eAAO,MAAM,+BAA+B,EAAE,MAA+B,CAAC;AAE9E,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AAGtD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAGzF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAMlF;AAGD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CASrE"}

package/dist/caller-context/lib/receiver-operation.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RECEIVER_OPERATION_ID_CHARS = exports.RECEIVER_OPERATION_ID_PATTERN = void 0;
+exports.isReceiverOperationId = isReceiverOperationId;
+exports.receiverOperationId = receiverOperationId;
+const deployment_1 = require("../../deployment");
+exports.RECEIVER_OPERATION_ID_PATTERN = deployment_1.OPERATION_ID_PATTERN;
+exports.MAX_RECEIVER_OPERATION_ID_CHARS = deployment_1.MAX_OPERATION_ID_CHARS;
+function isReceiverOperationId(value) {
+    return (typeof value === 'string' &&
+        value.length <= exports.MAX_RECEIVER_OPERATION_ID_CHARS &&
+        exports.RECEIVER_OPERATION_ID_PATTERN.test(value));
+}
+function receiverOperationId(text) {
+    if (!isReceiverOperationId(text)) {
+        throw new Error(`'${String(text)}' is not a receiver operation id: expected ` +
+            `<domain>:<operation>@<version> (${exports.RECEIVER_OPERATION_ID_PATTERN.source}), ` +
+            `at most ${exports.MAX_RECEIVER_OPERATION_ID_CHARS} characters.`);
+    }
+    return text;
+}
+//# sourceMappingURL=receiver-operation.js.map

package/dist/caller-context/lib/receiver-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-operation.js","sourceRoot":"","sources":["../../../src/caller-context/lib/receiver-operation.ts"],"names":[],"mappings":";;;AAwCA,sDAMC;AAGD,kDASC;AArCD,iDAAgF;AAQnE,QAAA,6BAA6B,GAAW,iCAAoB,CAAC;AAG7D,QAAA,+BAA+B,GAAW,mCAAsB,CAAC;AAQ9E,SAAgB,qBAAqB,CAAC,KAAc;IAClD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,IAAI,uCAA+B;QAC/C,qCAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAC1C,CAAC;AACJ,CAAC;AAGD,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,IAAI,MAAM,CAAC,IAAI,CAAC,6CAA6C;YAC3D,mCAAmC,qCAA6B,CAAC,MAAM,KAAK;YAC5E,WAAW,uCAA+B,cAAc,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/caller-context/lib/request-context.d.ts

@@ -0,0 +1,49 @@
+import { TokenClass } from '../../subject';
+import type { SubjectRef, ActingForRef, DelegatedAuthority } from '../../subject';
+import type { OrgAuthorityVerdict } from './org-authority';
+import type { AdmittedPlatformSweep } from './platform-sweep';
+import type { LentCapabilityAdmission } from './lent-capability';
+import type { VerifiedWorkerContext } from './worker-context';
+import type { OrgRole } from '../../tenant';
+import type { PipelineApprovalMode } from './approval-mode';
+export interface RequestContext {
+    orgId: string;
+    orgAuthority?: OrgAuthorityVerdict;
+    projectId?: string;
+    subject: SubjectRef;
+    tokenClass: TokenClass;
+    actorChain: ActingForRef[];
+    actorId: string;
+    actorType: 'human' | 'agent' | 'service';
+    orgRoles?: Record<string, OrgRole>;
+    orgRole?: OrgRole;
+    correlationId: string;
+    causationId?: string;
+    authorization?: string;
+    bearerToken?: string;
+    pipelineRunId?: string;
+    pipelinePhaseKey?: string;
+    pipelinePackageId?: string;
+    approvalModeOverride?: PipelineApprovalMode;
+    clientId?: string;
+    principalId?: string;
+    callerService?: string;
+    endUserSession?: boolean;
+    platformSweep?: string;
+    declaredOrgRelay?: true;
+    workloadGrants?: readonly string[];
+    admittedPlatformSweep?: AdmittedPlatformSweep;
+    presentingService?: string;
+    workerContext?: VerifiedWorkerContext;
+    roles: string[];
+    realmId?: string;
+    issuer?: string;
+    actAs?: string;
+    delegationId?: string;
+    delegation?: DelegatedAuthority;
+    lentCapabilityAdmission?: LentCapabilityAdmission;
+}
+export declare const REQUEST_CONTEXT: unique symbol;
+export declare function getRequestContext(req: object): RequestContext;
+export declare function tryGetRequestContext(req: object): RequestContext | undefined;
+//# sourceMappingURL=request-context.d.ts.map

package/dist/caller-context/lib/request-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EACZ,kBAAkB,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,MAAM,WAAW,cAAc;IAQ7B,KAAK,EAAE,MAAM,CAAC;IAyBd,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IAMnB,OAAO,EAAE,UAAU,CAAC;IAOpB,UAAU,EAAE,UAAU,CAAC;IAMvB,UAAU,EAAE,YAAY,EAAE,CAAC;IAE3B,OAAO,EAAE,MAAM,CAAC;IAMhB,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IASzC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IASnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAmC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAyBlB,WAAW,CAAC,EAAE,MAAM,CAAC;IAyBrB,aAAa,CAAC,EAAE,MAAM,CAAC;IAcvB,cAAc,CAAC,EAAE,OAAO,CAAC;IAUzB,aAAa,CAAC,EAAE,MAAM,CAAC;IAWvB,gBAAgB,CAAC,EAAE,IAAI,CAAC;IAWxB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IASnC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAU9C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAkB3B,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAEtC,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;IAQjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAYhB,KAAK,CAAC,EAAE,MAAM,CAAC;IAgBf,YAAY,CAAC,EAAE,MAAM,CAAC;IA2BtB,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAQhC,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD;AAeD,eAAO,MAAM,eAAe,eAAqD,CAAC;AAalF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAQ7D;AASD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CA+B5E"}

package/dist/caller-context/lib/request-context.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REQUEST_CONTEXT = void 0;
+exports.getRequestContext = getRequestContext;
+exports.tryGetRequestContext = tryGetRequestContext;
+exports.REQUEST_CONTEXT = Symbol.for('xema.platform-common.request-context');
+function getRequestContext(req) {
+    const ctx = tryGetRequestContext(req);
+    if (!ctx) {
+        throw new Error('RequestContext not found on request. Ensure RequestContextMiddleware is applied.');
+    }
+    return ctx;
+}
+function tryGetRequestContext(req) {
+    const direct = req[exports.REQUEST_CONTEXT];
+    if (direct !== undefined) {
+        return direct;
+    }
+    const raw = req.raw;
+    if (raw !== null && typeof raw === 'object') {
+        return raw[exports.REQUEST_CONTEXT];
+    }
+    return undefined;
+}
+//# sourceMappingURL=request-context.js.map

package/dist/caller-context/lib/request-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../../src/caller-context/lib/request-context.ts"],"names":[],"mappings":";;;AAuXA,8CAQC;AASD,oDA+BC;AA7DY,QAAA,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AAalF,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,MAAM,MAAM,GAAI,GAA+B,CAAC,uBAAe,CAAC,CAAC;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAwB,CAAC;IAClC,CAAC;IAoBD,MAAM,GAAG,GAAI,GAAyB,CAAC,GAAG,CAAC;IAC3C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAQ,GAA+B,CAAC,uBAAe,CAE1C,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/caller-context/lib/resolve-acting-user.d.ts

@@ -0,0 +1,8 @@
+import type { SubjectRef } from '../../subject';
+import type { RequestContext } from './request-context';
+export declare class ActingUserUnresolvableError extends Error {
+    constructor(ctx: Pick<RequestContext, 'subject' | 'actorChain'>);
+}
+export declare function tryResolveActingUserSubject(ctx: Pick<RequestContext, 'subject' | 'actorChain'>): SubjectRef | undefined;
+export declare function resolveActingUserSubject(ctx: Pick<RequestContext, 'subject' | 'actorChain'>): SubjectRef;
+//# sourceMappingURL=resolve-acting-user.d.ts.map

package/dist/caller-context/lib/resolve-acting-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-acting-user.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/resolve-acting-user.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAUxD,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,YAAY,CAAC;CAgBhE;AAyBD,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,YAAY,CAAC,GAClD,UAAU,GAAG,SAAS,CAcxB;AAWD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,YAAY,CAAC,GAClD,UAAU,CAMZ"}

package/dist/caller-context/lib/resolve-acting-user.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActingUserUnresolvableError = void 0;
+exports.tryResolveActingUserSubject = tryResolveActingUserSubject;
+exports.resolveActingUserSubject = resolveActingUserSubject;
+const subject_1 = require("../../subject");
+class ActingUserUnresolvableError extends Error {
+    constructor(ctx) {
+        const chain = (ctx.actorChain ?? [])
+            .map((a) => `${a.kind}:${a.id}`)
+            .join(',');
+        super('No acting USER could be resolved from the request context. ' +
+            `subject=${ctx.subject.kind}:${ctx.subject.id} ` +
+            `actingFor=${ctx.subject.actingFor
+                ? `${ctx.subject.actingFor.kind}:${ctx.subject.actingFor.id}`
+                : 'none'} actorChain=[${chain}]. ` +
+            'Ownership cannot be attributed to a non-human actor (fail-closed).');
+        this.name = 'ActingUserUnresolvableError';
+    }
+}
+exports.ActingUserUnresolvableError = ActingUserUnresolvableError;
+function tryResolveActingUserSubject(ctx) {
+    if (ctx.subject.kind === subject_1.SubjectKind.User) {
+        return { kind: subject_1.SubjectKind.User, id: ctx.subject.id };
+    }
+    const actingFor = ctx.subject.actingFor;
+    if (actingFor && actingFor.kind === subject_1.SubjectKind.User) {
+        return { kind: subject_1.SubjectKind.User, id: actingFor.id };
+    }
+    for (const actor of ctx.actorChain ?? []) {
+        if (actor.kind === subject_1.SubjectKind.User) {
+            return { kind: subject_1.SubjectKind.User, id: actor.id };
+        }
+    }
+    return undefined;
+}
+function resolveActingUserSubject(ctx) {
+    const user = tryResolveActingUserSubject(ctx);
+    if (user === undefined) {
+        throw new ActingUserUnresolvableError(ctx);
+    }
+    return user;
+}
+//# sourceMappingURL=resolve-acting-user.js.map

package/dist/caller-context/lib/resolve-acting-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-acting-user.js","sourceRoot":"","sources":["../../../src/caller-context/lib/resolve-acting-user.ts"],"names":[],"mappings":";;;AAuDA,kEAgBC;AAWD,4DAQC;AA1FD,2CAA4C;AAa5C,MAAa,2BAA4B,SAAQ,KAAK;IACpD,YAAY,GAAmD;QAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;aAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,KAAK,CACH,6DAA6D;YAC3D,WAAW,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG;YAChD,aACE,GAAG,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;gBAC7D,CAAC,CAAC,MACN,gBAAgB,KAAK,KAAK;YAC1B,oEAAoE,CACvE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAjBD,kEAiBC;AAyBD,SAAgB,2BAA2B,CACzC,GAAmD;IAEnD,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,SAAgB,wBAAwB,CACtC,GAAmD;IAEnD,MAAM,IAAI,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/caller-context/lib/worker-context.d.ts

@@ -0,0 +1,13 @@
+export declare enum WorkerContextAttributionKind {
+    Session = "session",
+    Allocation = "allocation"
+}
+export interface WorkerContextAttribution {
+    readonly kind: WorkerContextAttributionKind;
+    readonly id: string;
+}
+export interface VerifiedWorkerContext {
+    readonly mintedBy: string;
+    readonly attribution?: WorkerContextAttribution;
+}
+//# sourceMappingURL=worker-context.d.ts.map

package/dist/caller-context/lib/worker-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-context.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/worker-context.ts"],"names":[],"mappings":"AASA,oBAAY,4BAA4B;IACtC,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACjD"}

package/dist/caller-context/lib/worker-context.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkerContextAttributionKind = void 0;
+var WorkerContextAttributionKind;
+(function (WorkerContextAttributionKind) {
+    WorkerContextAttributionKind["Session"] = "session";
+    WorkerContextAttributionKind["Allocation"] = "allocation";
+})(WorkerContextAttributionKind || (exports.WorkerContextAttributionKind = WorkerContextAttributionKind = {}));
+//# sourceMappingURL=worker-context.js.map

package/dist/caller-context/lib/worker-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-context.js","sourceRoot":"","sources":["../../../src/caller-context/lib/worker-context.ts"],"names":[],"mappings":";;;AASA,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IACtC,mDAAmB,CAAA;IACnB,yDAAyB,CAAA;AAC3B,CAAC,EAHW,4BAA4B,4CAA5B,4BAA4B,QAGvC"}

package/dist/capability/index.d.ts

@@ -8,6 +8,7 @@ export * from './lib/capability-effect-class';
 export * from './lib/capability-aperture';
 export * from './lib/capability-agent-exposure';
 export * from './lib/capability-delegable';
+export * from './lib/capability-descriptor-kind';
 export * from './lib/capability-human-baseline';
 export * from './lib/capability-grant';
 export * from './lib/capability-policy';

package/dist/capability/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,cAAc,CAAC;AAC7B,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,cAAc,CAAC;AAC7B,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC"}

package/dist/capability/index.js

@@ -24,6 +24,7 @@ __exportStar(require("./lib/capability-effect-class"), exports);
 __exportStar(require("./lib/capability-aperture"), exports);
 __exportStar(require("./lib/capability-agent-exposure"), exports);
 __exportStar(require("./lib/capability-delegable"), exports);
+__exportStar(require("./lib/capability-descriptor-kind"), exports);
 __exportStar(require("./lib/capability-human-baseline"), exports);
 __exportStar(require("./lib/capability-grant"), exports);
 __exportStar(require("./lib/capability-policy"), exports);

package/dist/capability/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,+DAA6C;AAC7C,iEAA+C;AAC/C,0DAAwC;AACxC,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,4DAA0C;AAC1C,kEAAgD;AAChD,6DAA2C;AAC3C,kEAAgD;AAChD,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,iEAA+C;AAC/C,uEAAqD;AACrD,gEAA8C;AAC9C,mEAAiD;AACjD,+CAA6B;AAC7B,yEAAuD;AACvD,gEAA8C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,+DAA6C;AAC7C,iEAA+C;AAC/C,0DAAwC;AACxC,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,4DAA0C;AAC1C,kEAAgD;AAChD,6DAA2C;AAC3C,mEAAiD;AACjD,kEAAgD;AAChD,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,iEAA+C;AAC/C,uEAAqD;AACrD,gEAA8C;AAC9C,mEAAiD;AACjD,+CAA6B;AAC7B,yEAAuD;AACvD,gEAA8C"}

package/dist/capability/lib/capability-contribution.d.ts

@@ -7,6 +7,7 @@ import { type RequiredResourceRoleBinding } from './required-resource-role-bindi
 import { CapabilityRiskTier } from './permission-profile';
 import { type DataClassification } from '../../space';
 import { type HumanBaseline } from './capability-human-baseline';
+import { type CapabilityDescriptorKind } from './capability-descriptor-kind';
 import { type TrustedContextProjection } from './trusted-context-projection';
 export interface CapabilityContributionManifest {
     readonly ref: CapabilityRef;
@@ -29,6 +30,7 @@ export interface CapabilityContributionManifest {
     readonly safeForAgents?: boolean | undefined;
     readonly humanBaseline?: HumanBaseline | undefined;
     readonly delegable?: true | undefined;
+    readonly descriptorKind?: CapabilityDescriptorKind | undefined;
 }
 export declare const CapabilityContributionManifestSchema: z.ZodObject<{
     ref: z.ZodType<CapabilityRef, unknown, z.core.$ZodTypeInternals<CapabilityRef, unknown>>;
@@ -51,5 +53,6 @@ export declare const CapabilityContributionManifestSchema: z.ZodObject<{
     safeForAgents: z.ZodOptional<z.ZodBoolean>;
     humanBaseline: z.ZodOptional<z.ZodType<HumanBaseline, unknown, z.core.$ZodTypeInternals<HumanBaseline, unknown>>>;
     delegable: z.ZodOptional<z.ZodLiteral<true>>;
+    descriptorKind: z.ZodOptional<z.ZodEnum<typeof CapabilityDescriptorKind>>;
 }, z.core.$strict>;
 //# sourceMappingURL=capability-contribution.d.ts.map

package/dist/capability/lib/capability-contribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAsBtC,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE/C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAKtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAKnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAUnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOjD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAoB1D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAgB/D,QAAQ,CAAC,eAAe,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAqBjE,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IA0B7C,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAQzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAgBzE,QAAQ,CAAC,gBAAgB,CAAC,EACtB,SAAS,2BAA2B,EAAE,GACtC,SAAS,CAAC;IAuDd,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAa7C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAcnD,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACvC;AAcD,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;kBAuEO,CAAC"}
+{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAsBtC,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE/C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAKtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAKnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAUnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOjD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAoB1D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAgB/D,QAAQ,CAAC,eAAe,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAqBjE,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IA0B7C,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAQzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAgBzE,QAAQ,CAAC,gBAAgB,CAAC,EACtB,SAAS,2BAA2B,EAAE,GACtC,SAAS,CAAC;IAuDd,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAa7C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAcnD,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IActC,QAAQ,CAAC,cAAc,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CAChE;AAcD,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;kBAwEO,CAAC"}

package/dist/capability/lib/capability-contribution.js

@@ -11,6 +11,7 @@ const permission_profile_1 = require("./permission-profile");
 const space_1 = require("../../space");
 const capability_human_baseline_1 = require("./capability-human-baseline");
 const capability_delegable_1 = require("./capability-delegable");
+const capability_descriptor_kind_1 = require("./capability-descriptor-kind");
 const trusted_context_projection_1 = require("./trusted-context-projection");
 exports.CapabilityContributionManifestSchema = zod_1.z
     .object({
@@ -37,6 +38,7 @@ exports.CapabilityContributionManifestSchema = zod_1.z
     safeForAgents: zod_1.z.boolean().optional(),
     humanBaseline: capability_human_baseline_1.HumanBaselineSchema.optional(),
     delegable: capability_delegable_1.CapabilityDelegableSchema.optional(),
+    descriptorKind: capability_descriptor_kind_1.CapabilityDescriptorKindSchema.optional(),
 })
     .strict()
     .superRefine((manifest, context) => {