@xemahq/contracts 0.81.0 → 0.82.0

package/dist/caller-context/lib/caller-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-context.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/caller-context.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEjF,OAAO,CAAC,MAAM,8BAA8B,EAAE,OAAO,MAAM,CAAC;AAO5D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,CAAC,8BAA8B,CAAC,EAAE,IAAI,CAAC;IAEhD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAGD,oBAAY,oBAAoB;IAE9B,QAAQ,cAAc;IAEtB,WAAW,iBAAiB;CAC7B;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IAEvD,QAAQ,CAAC,OAAO,EAAE,oBAAoB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS;gBADzB,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,GAAG,SAAS;CAWrC;AASD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACzD,GAAG,sBAAsB,CAazB;AAOD,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAMnE,MAAM,WAAW,sBAAsB;IACrC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACnC;AAQD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,sBAAsB,EAC/B,SAAS,EAAE,sBAAsB,GAChC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CASjC;AAGD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAE9E"}

package/dist/caller-context/lib/caller-context.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRESENTER_CONTEXT_HEADER = exports.CallerContextNotForwardableError = exports.CallerContextRefusal = void 0;
+exports.forwardCallerContext = forwardCallerContext;
+exports.forwardedCallerHeaders = forwardedCallerHeaders;
+exports.forwardedAuthorization = forwardedAuthorization;
+const org_authority_1 = require("./org-authority");
+var CallerContextRefusal;
+(function (CallerContextRefusal) {
+    CallerContextRefusal["NoBearer"] = "no_bearer";
+    CallerContextRefusal["OrgUnproven"] = "org_unproven";
+})(CallerContextRefusal || (exports.CallerContextRefusal = CallerContextRefusal = {}));
+class CallerContextNotForwardableError extends Error {
+    refusal;
+    orgId;
+    constructor(refusal, orgId) {
+        super(refusal === CallerContextRefusal.NoBearer
+            ? 'The request carries no verified bearer to forward; a synchronous peer call ' +
+                'presents the caller’s own context or does not happen.'
+            : `The caller’s token does not prove organization "${orgId ?? ''}", so there is ` +
+                'no authority to forward for it. A relayed org header is context, not proof.');
+        this.refusal = refusal;
+        this.orgId = orgId;
+        this.name = 'CallerContextNotForwardableError';
+    }
+}
+exports.CallerContextNotForwardableError = CallerContextNotForwardableError;
+function forwardCallerContext(request) {
+    const bearer = request.bearerToken;
+    if (bearer === undefined || bearer === '') {
+        throw new CallerContextNotForwardableError(CallerContextRefusal.NoBearer, undefined);
+    }
+    const verdict = request.orgAuthority;
+    if (verdict === undefined || !(0, org_authority_1.isOrgAuthorityProven)(verdict)) {
+        throw new CallerContextNotForwardableError(CallerContextRefusal.OrgUnproven, verdict?.assertedOrgId);
+    }
+    return { bearer, orgId: verdict.assertedOrgId.trim() };
+}
+exports.PRESENTER_CONTEXT_HEADER = 'X-Xema-Presenter-Context';
+async function forwardedCallerHeaders(context, presenter) {
+    const presenterContext = await presenter.getAccessToken();
+    if (presenterContext === '') {
+        throw new Error('The presenting service has no workload context to state.');
+    }
+    return {
+        Authorization: forwardedAuthorization(context),
+        [exports.PRESENTER_CONTEXT_HEADER]: presenterContext,
+    };
+}
+function forwardedAuthorization(context) {
+    return `Bearer ${context.bearer}`;
+}
+//# sourceMappingURL=caller-context.js.map

package/dist/caller-context/lib/caller-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-context.js","sourceRoot":"","sources":["../../../src/caller-context/lib/caller-context.ts"],"names":[],"mappings":";;;AAiEA,oDAgBC;AAuBD,wDAYC;AAGD,wDAEC;AAxGD,mDAAiF;AAkBjF,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAE9B,8CAAsB,CAAA;IAEtB,oDAA4B,CAAA;AAC9B,CAAC,EALW,oBAAoB,oCAApB,oBAAoB,QAK/B;AAED,MAAa,gCAAiC,SAAQ,KAAK;IAE9C;IACA;IAFX,YACW,OAA6B,EAC7B,KAAyB;QAElC,KAAK,CACH,OAAO,KAAK,oBAAoB,CAAC,QAAQ;YACvC,CAAC,CAAC,6EAA6E;gBAC3E,uDAAuD;YAC3D,CAAC,CAAC,mDAAmD,KAAK,IAAI,EAAE,iBAAiB;gBAC7E,6EAA6E,CACpF,CAAC;QATO,YAAO,GAAP,OAAO,CAAsB;QAC7B,UAAK,GAAL,KAAK,CAAoB;QASlC,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAdD,4EAcC;AASD,SAAgB,oBAAoB,CAAC,OAGpC;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAA,oCAAoB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,gCAAgC,CACxC,oBAAoB,CAAC,WAAW,EAChC,OAAO,EAAE,aAAa,CACvB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,EAA4B,CAAC;AACnF,CAAC;AAOY,QAAA,wBAAwB,GAAG,0BAA0B,CAAC;AAgB5D,KAAK,UAAU,sBAAsB,CAC1C,OAA+B,EAC/B,SAAiC;IAEjC,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,cAAc,EAAE,CAAC;IAC1D,IAAI,gBAAgB,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO;QACL,aAAa,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC9C,CAAC,gCAAwB,CAAC,EAAE,gBAAgB;KAC7C,CAAC;AACJ,CAAC;AAGD,SAAgB,sBAAsB,CAAC,OAA+B;IACpE,OAAO,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/caller-context/lib/caller-org-scope.d.ts

@@ -0,0 +1,4 @@
+import { type CallerOrgScope } from '../../tenant';
+import type { RequestContext } from './request-context';
+export declare function resolveCallerOrgScope(ctx: RequestContext | undefined): CallerOrgScope;
+//# sourceMappingURL=caller-org-scope.d.ts.map

package/dist/caller-context/lib/caller-org-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-org-scope.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/caller-org-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA0ExD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,cAAc,GAAG,SAAS,GAC9B,cAAc,CAuBhB"}

package/dist/caller-context/lib/caller-org-scope.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCallerOrgScope = resolveCallerOrgScope;
+const tenant_1 = require("../../tenant");
+function resolveCallerOrgScope(ctx) {
+    if (!ctx) {
+        throw new Error('RequestContext missing on an org-scoped route — RequestContextMiddleware ' +
+            'is not applied. Refusing to resolve a caller org scope without it.');
+    }
+    if (!ctx.orgId) {
+        return (0, tenant_1.callerOrgScope)(null);
+    }
+    const orgId = (0, tenant_1.toOrgId)(ctx.orgId);
+    if (orgId === null) {
+        throw new Error(`RequestContext carries a malformed organisation id "${ctx.orgId}". ` +
+            'Refusing to resolve a caller org scope: an unusable org id is NOT ' +
+            '"no org", and answering it with the cross-org platform scope would ' +
+            'grant it more authority than a well-formed one.');
+    }
+    return (0, tenant_1.callerOrgScope)(orgId);
+}
+//# sourceMappingURL=caller-org-scope.js.map

package/dist/caller-context/lib/caller-org-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-org-scope.js","sourceRoot":"","sources":["../../../src/caller-context/lib/caller-org-scope.ts"],"names":[],"mappings":";;AAgFA,sDAyBC;AAzGD,yCAIsB;AA4EtB,SAAgB,qBAAqB,CACnC,GAA+B;IAE/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,oEAAoE,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,IAAA,uBAAc,EAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,gBAAO,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,uDAAuD,GAAG,CAAC,KAAK,KAAK;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,IAAA,uBAAc,EAAC,KAAK,CAAC,CAAC;AAC/B,CAAC"}

package/dist/caller-context/lib/direct-service-actor.d.ts

@@ -0,0 +1,3 @@
+import type { RequestContext } from './request-context';
+export declare function isDirectServiceActor(ctx: Pick<RequestContext, 'tokenClass' | 'actorChain'>): boolean;
+//# sourceMappingURL=direct-service-actor.d.ts.map

package/dist/caller-context/lib/direct-service-actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-service-actor.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/direct-service-actor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAexD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,YAAY,CAAC,GACrD,OAAO,CAET"}

package/dist/caller-context/lib/direct-service-actor.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isDirectServiceActor = isDirectServiceActor;
+const subject_1 = require("../../subject");
+function isDirectServiceActor(ctx) {
+    return ctx.tokenClass === subject_1.TokenClass.ServiceJwt && ctx.actorChain.length === 0;
+}
+//# sourceMappingURL=direct-service-actor.js.map

package/dist/caller-context/lib/direct-service-actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-service-actor.js","sourceRoot":"","sources":["../../../src/caller-context/lib/direct-service-actor.ts"],"names":[],"mappings":";;AAgBA,oDAIC;AApBD,2CAA2C;AAgB3C,SAAgB,oBAAoB,CAClC,GAAsD;IAEtD,OAAO,GAAG,CAAC,UAAU,KAAK,oBAAU,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;AACjF,CAAC"}

package/dist/caller-context/lib/holds-org-authority.d.ts

@@ -0,0 +1,10 @@
+import { AuditAuthorityKind } from '../../audit';
+import { OrgRole } from '../../tenant';
+import type { RequestContext } from './request-context';
+export type OrgAuthorityInstrument = {
+    readonly kind: AuditAuthorityKind.OrgRole;
+    readonly orgRole: OrgRole;
+};
+export declare function resolveOrgAuthorityInstrument(ctx: Pick<RequestContext, 'orgRole'>, required: OrgRole): OrgAuthorityInstrument | undefined;
+export declare function holdsOrgAuthority(ctx: Pick<RequestContext, 'orgRole'>, required: OrgRole): boolean;
+//# sourceMappingURL=holds-org-authority.d.ts.map

package/dist/caller-context/lib/holds-org-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holds-org-authority.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/holds-org-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAoB,MAAM,cAAc,CAAC;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAWxD,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC;IAE1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,CAAC;AA8BF,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,EACpC,QAAQ,EAAE,OAAO,GAChB,sBAAsB,GAAG,SAAS,CAKpC;AAyBD,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,EACpC,QAAQ,EAAE,OAAO,GAChB,OAAO,CAET"}

package/dist/caller-context/lib/holds-org-authority.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveOrgAuthorityInstrument = resolveOrgAuthorityInstrument;
+exports.holdsOrgAuthority = holdsOrgAuthority;
+const audit_1 = require("../../audit");
+const tenant_1 = require("../../tenant");
+function resolveOrgAuthorityInstrument(ctx, required) {
+    if (ctx.orgRole !== undefined && (0, tenant_1.orgRoleSatisfies)(ctx.orgRole, required)) {
+        return { kind: audit_1.AuditAuthorityKind.OrgRole, orgRole: ctx.orgRole };
+    }
+    return undefined;
+}
+function holdsOrgAuthority(ctx, required) {
+    return resolveOrgAuthorityInstrument(ctx, required) !== undefined;
+}
+//# sourceMappingURL=holds-org-authority.js.map

package/dist/caller-context/lib/holds-org-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holds-org-authority.js","sourceRoot":"","sources":["../../../src/caller-context/lib/holds-org-authority.ts"],"names":[],"mappings":";;AAiDA,sEAQC;AAyBD,8CAKC;AAvFD,uCAAiD;AAEjD,yCAAyD;AA+CzD,SAAgB,6BAA6B,CAC3C,GAAoC,EACpC,QAAiB;IAEjB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,IAAA,yBAAgB,EAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAyBD,SAAgB,iBAAiB,CAC/B,GAAoC,EACpC,QAAiB;IAEjB,OAAO,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC;AACpE,CAAC"}

package/dist/caller-context/lib/lent-capability.d.ts

@@ -0,0 +1,11 @@
+import type { DelegatedAuthority } from '../../subject';
+export declare enum LentCapabilityVia {
+    Operation = "operation",
+    ReachedThrough = "reached-through"
+}
+export interface LentCapabilityAdmission {
+    readonly capability: string;
+    readonly via: LentCapabilityVia;
+}
+export declare function lentCapabilityAdmitting(delegation: Pick<DelegatedAuthority, 'capabilities'>, operation: string, reachedThrough?: readonly string[]): LentCapabilityAdmission | undefined;
+//# sourceMappingURL=lent-capability.d.ts.map

package/dist/caller-context/lib/lent-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lent-capability.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/lent-capability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AASxD,oBAAY,iBAAiB;IAE3B,SAAS,cAAc;IAEvB,cAAc,oBAAoB;CACnC;AAGD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;CACjC;AAYD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC,EACpD,SAAS,EAAE,MAAM,EACjB,cAAc,GAAE,SAAS,MAAM,EAAO,GACrC,uBAAuB,GAAG,SAAS,CAQrC"}

package/dist/caller-context/lib/lent-capability.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LentCapabilityVia = void 0;
+exports.lentCapabilityAdmitting = lentCapabilityAdmitting;
+var LentCapabilityVia;
+(function (LentCapabilityVia) {
+    LentCapabilityVia["Operation"] = "operation";
+    LentCapabilityVia["ReachedThrough"] = "reached-through";
+})(LentCapabilityVia || (exports.LentCapabilityVia = LentCapabilityVia = {}));
+function lentCapabilityAdmitting(delegation, operation, reachedThrough = []) {
+    if (delegation.capabilities.includes(operation)) {
+        return Object.freeze({ capability: operation, via: LentCapabilityVia.Operation });
+    }
+    const step = reachedThrough.find((capability) => delegation.capabilities.includes(capability));
+    return step === undefined
+        ? undefined
+        : Object.freeze({ capability: step, via: LentCapabilityVia.ReachedThrough });
+}
+//# sourceMappingURL=lent-capability.js.map

package/dist/caller-context/lib/lent-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lent-capability.js","sourceRoot":"","sources":["../../../src/caller-context/lib/lent-capability.ts"],"names":[],"mappings":";;;AAiCA,0DAYC;AApCD,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAE3B,4CAAuB,CAAA;IAEvB,uDAAkC,CAAA;AACpC,CAAC,EALW,iBAAiB,iCAAjB,iBAAiB,QAK5B;AAmBD,SAAgB,uBAAuB,CACrC,UAAoD,EACpD,SAAiB,EACjB,iBAAoC,EAAE;IAEtC,IAAI,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/F,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;AACjF,CAAC"}

package/dist/caller-context/lib/org-authority.d.ts

@@ -0,0 +1,29 @@
+import { SubjectKind } from '../../subject';
+import type { TokenClass } from '../../subject';
+export declare enum OrgAuthoritySource {
+    OrgClaim = "org_claim",
+    OrgMembership = "org_membership",
+    NoOrgAsserted = "no_org_asserted",
+    ClaimMismatch = "claim_mismatch",
+    ServiceRelayedContext = "service_relayed_context",
+    Unproven = "unproven_header"
+}
+export interface OrgAuthorityCaller {
+    readonly subjectKind: SubjectKind;
+    readonly delegated: boolean;
+}
+export interface OrgAuthorityVerdict {
+    readonly source: OrgAuthoritySource;
+    readonly assertedOrgId: string;
+    readonly tokenOrgId?: string;
+}
+export declare function resolveOrgAuthority(claims: Record<string, unknown>, assertedOrgId: string, caller: OrgAuthorityCaller): OrgAuthorityVerdict;
+export declare function isOrgAuthorityProven(verdict: OrgAuthorityVerdict): boolean;
+export declare function orgAuthorityRequiresProof(verdict: OrgAuthorityVerdict): boolean;
+export interface OrgAuthorityCallerFacts {
+    readonly clientId: string;
+    readonly tokenClass: TokenClass;
+    readonly subjectKind: SubjectKind;
+    readonly delegated: boolean;
+}
+//# sourceMappingURL=org-authority.d.ts.map

package/dist/caller-context/lib/org-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/org-authority.ts"],"names":[],"mappings":"AA8IA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAahD,oBAAY,kBAAkB;IAE5B,QAAQ,cAAc;IAEtB,aAAa,mBAAmB;IAKhC,aAAa,oBAAoB;IAYjC,aAAa,mBAAmB;IAgBhC,qBAAqB,4BAA4B;IAKjD,QAAQ,oBAAoB;CAC7B;AAaD,MAAM,WAAW,kBAAkB;IAQjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAMlC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAGD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAEpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAO/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2BD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,kBAAkB,GACzB,mBAAmB,CA6DrB;AAGD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAW1E;AAYD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAWT;AAQD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B"}

package/dist/caller-context/lib/org-authority.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgAuthoritySource = void 0;
+exports.resolveOrgAuthority = resolveOrgAuthority;
+exports.isOrgAuthorityProven = isOrgAuthorityProven;
+exports.orgAuthorityRequiresProof = orgAuthorityRequiresProof;
+const subject_1 = require("../../subject");
+const org_claim_1 = require("./org-claim");
+const org_role_1 = require("./org-role");
+var OrgAuthoritySource;
+(function (OrgAuthoritySource) {
+    OrgAuthoritySource["OrgClaim"] = "org_claim";
+    OrgAuthoritySource["OrgMembership"] = "org_membership";
+    OrgAuthoritySource["NoOrgAsserted"] = "no_org_asserted";
+    OrgAuthoritySource["ClaimMismatch"] = "claim_mismatch";
+    OrgAuthoritySource["ServiceRelayedContext"] = "service_relayed_context";
+    OrgAuthoritySource["Unproven"] = "unproven_header";
+})(OrgAuthoritySource || (exports.OrgAuthoritySource = OrgAuthoritySource = {}));
+function resolveOrgAuthority(claims, assertedOrgId, caller) {
+    const asserted = assertedOrgId.trim();
+    const claim = (0, org_claim_1.resolveOrgClaim)(claims);
+    if (asserted.length === 0) {
+        return {
+            source: OrgAuthoritySource.NoOrgAsserted,
+            assertedOrgId: '',
+            ...(claim ? { tokenOrgId: claim.value } : {}),
+        };
+    }
+    if (claim) {
+        return claim.value.toLowerCase() === asserted.toLowerCase()
+            ? {
+                source: OrgAuthoritySource.OrgClaim,
+                assertedOrgId: asserted,
+                tokenOrgId: claim.value,
+            }
+            : {
+                source: OrgAuthoritySource.ClaimMismatch,
+                assertedOrgId: asserted,
+                tokenOrgId: claim.value,
+            };
+    }
+    const orgRoles = (0, org_role_1.resolveOrgRoles)(claims);
+    const assertedLower = asserted.toLowerCase();
+    for (const memberOrgId of Object.keys(orgRoles)) {
+        if (memberOrgId.toLowerCase() === assertedLower) {
+            return {
+                source: OrgAuthoritySource.OrgMembership,
+                assertedOrgId: asserted,
+            };
+        }
+    }
+    if (!caller.delegated && caller.subjectKind === subject_1.SubjectKind.Service) {
+        return {
+            source: OrgAuthoritySource.ServiceRelayedContext,
+            assertedOrgId: asserted,
+        };
+    }
+    return { source: OrgAuthoritySource.Unproven, assertedOrgId: asserted };
+}
+function isOrgAuthorityProven(verdict) {
+    switch (verdict.source) {
+        case OrgAuthoritySource.OrgClaim:
+        case OrgAuthoritySource.OrgMembership:
+            return true;
+        case OrgAuthoritySource.NoOrgAsserted:
+        case OrgAuthoritySource.ServiceRelayedContext:
+        case OrgAuthoritySource.ClaimMismatch:
+        case OrgAuthoritySource.Unproven:
+            return false;
+    }
+}
+function orgAuthorityRequiresProof(verdict) {
+    switch (verdict.source) {
+        case OrgAuthoritySource.Unproven:
+            return true;
+        case OrgAuthoritySource.OrgClaim:
+        case OrgAuthoritySource.OrgMembership:
+        case OrgAuthoritySource.NoOrgAsserted:
+        case OrgAuthoritySource.ServiceRelayedContext:
+        case OrgAuthoritySource.ClaimMismatch:
+            return false;
+    }
+}
+//# sourceMappingURL=org-authority.js.map

package/dist/caller-context/lib/org-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority.js","sourceRoot":"","sources":["../../../src/caller-context/lib/org-authority.ts"],"names":[],"mappings":";;;AA6QA,kDAiEC;AAGD,oDAWC;AAYD,8DAaC;AAvOD,2CAA4C;AAG5C,2CAA8C;AAC9C,yCAA6C;AAU7C,IAAY,kBA2CX;AA3CD,WAAY,kBAAkB;IAE5B,4CAAsB,CAAA;IAEtB,sDAAgC,CAAA;IAKhC,uDAAiC,CAAA;IAYjC,sDAAgC,CAAA;IAgBhC,uEAAiD,CAAA;IAKjD,kDAA4B,CAAA;AAC9B,CAAC,EA3CW,kBAAkB,kCAAlB,kBAAkB,QA2C7B;AAsED,SAAgB,mBAAmB,CACjC,MAA+B,EAC/B,aAAqB,EACrB,MAA0B;IAE1B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAI1B,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;YACxC,aAAa,EAAE,EAAE;YACjB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;YACzD,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,QAAQ;gBACnC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB,CAAC;IACR,CAAC;IAKD,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7C,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;YAChD,OAAO;gBACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAaD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,qBAAW,CAAC,OAAO,EAAE,CAAC;QACpE,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,qBAAqB;YAChD,aAAa,EAAE,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAGD,SAAgB,oBAAoB,CAAC,OAA4B;IAC/D,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,qBAAqB,CAAC;QAC9C,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAYD,SAAgB,yBAAyB,CACvC,OAA4B;IAE5B,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,qBAAqB,CAAC;QAC9C,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/caller-context/lib/org-claim.d.ts

@@ -0,0 +1,15 @@
+export declare enum OrgClaimKey {
+    Canonical = "xema_org_id"
+}
+export declare const ORG_CLAIM_KEYS: readonly OrgClaimKey[];
+export declare enum OrgHeaderName {
+    Canonical = "X-Xema-Org-Id"
+}
+export declare enum ProjectHeaderName {
+    Canonical = "X-Project-Id"
+}
+export declare function resolveOrgClaim(claims: Record<string, unknown>): {
+    key: OrgClaimKey;
+    value: string;
+} | null;
+//# sourceMappingURL=org-claim.d.ts.map

package/dist/caller-context/lib/org-claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-claim.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/org-claim.ts"],"names":[],"mappings":"AA8BA,oBAAY,WAAW;IAErB,SAAS,gBAAgB;CAC1B;AAOD,eAAO,MAAM,cAAc,EAAE,SAAS,WAAW,EAEvC,CAAC;AAQX,oBAAY,aAAa;IAEvB,SAAS,kBAAkB;CAC5B;AAkBD,oBAAY,iBAAiB;IAE3B,SAAS,iBAAiB;CAC3B;AAeD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ5C"}

package/dist/caller-context/lib/org-claim.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProjectHeaderName = exports.OrgHeaderName = exports.ORG_CLAIM_KEYS = exports.OrgClaimKey = void 0;
+exports.resolveOrgClaim = resolveOrgClaim;
+var OrgClaimKey;
+(function (OrgClaimKey) {
+    OrgClaimKey["Canonical"] = "xema_org_id";
+})(OrgClaimKey || (exports.OrgClaimKey = OrgClaimKey = {}));
+exports.ORG_CLAIM_KEYS = [
+    OrgClaimKey.Canonical,
+];
+var OrgHeaderName;
+(function (OrgHeaderName) {
+    OrgHeaderName["Canonical"] = "X-Xema-Org-Id";
+})(OrgHeaderName || (exports.OrgHeaderName = OrgHeaderName = {}));
+var ProjectHeaderName;
+(function (ProjectHeaderName) {
+    ProjectHeaderName["Canonical"] = "X-Project-Id";
+})(ProjectHeaderName || (exports.ProjectHeaderName = ProjectHeaderName = {}));
+function resolveOrgClaim(claims) {
+    for (const key of exports.ORG_CLAIM_KEYS) {
+        const raw = claims[key];
+        if (typeof raw === 'string' && raw.length > 0) {
+            return { key, value: raw };
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=org-claim.js.map

package/dist/caller-context/lib/org-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-claim.js","sourceRoot":"","sources":["../../../src/caller-context/lib/org-claim.ts"],"names":[],"mappings":";;;AAyFA,0CAUC;AArED,IAAY,WAGX;AAHD,WAAY,WAAW;IAErB,wCAAyB,CAAA;AAC3B,CAAC,EAHW,WAAW,2BAAX,WAAW,QAGtB;AAOY,QAAA,cAAc,GAA2B;IACpD,WAAW,CAAC,SAAS;CACb,CAAC;AAQX,IAAY,aAGX;AAHD,WAAY,aAAa;IAEvB,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,6BAAb,aAAa,QAGxB;AAkBD,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAE3B,+CAA0B,CAAA;AAC5B,CAAC,EAHW,iBAAiB,iCAAjB,iBAAiB,QAG5B;AAeD,SAAgB,eAAe,CAC7B,MAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,sBAAc,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/caller-context/lib/org-role.d.ts

@@ -0,0 +1,8 @@
+import { OrgRole } from '../../tenant';
+export declare enum OrgRolesClaimKey {
+    Canonical = "org_roles"
+}
+export declare const ORG_ROLES_CLAIM_KEYS: readonly OrgRolesClaimKey[];
+export declare function resolveOrgRoles(claims: Record<string, unknown>): Record<string, OrgRole>;
+export declare function resolveOrgRoleForOrg(claims: Record<string, unknown>, orgId: string): OrgRole | null;
+//# sourceMappingURL=org-role.d.ts.map

package/dist/caller-context/lib/org-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/org-role.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAsCvC,oBAAY,gBAAgB;IAE1B,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,gBAAgB,EAElD,CAAC;AAuBX,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazB;AAMD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,MAAM,GACZ,OAAO,GAAG,IAAI,CAGhB"}

package/dist/caller-context/lib/org-role.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = void 0;
+exports.resolveOrgRoles = resolveOrgRoles;
+exports.resolveOrgRoleForOrg = resolveOrgRoleForOrg;
+const tenant_1 = require("../../tenant");
+var OrgRolesClaimKey;
+(function (OrgRolesClaimKey) {
+    OrgRolesClaimKey["Canonical"] = "org_roles";
+})(OrgRolesClaimKey || (exports.OrgRolesClaimKey = OrgRolesClaimKey = {}));
+exports.ORG_ROLES_CLAIM_KEYS = [
+    OrgRolesClaimKey.Canonical,
+];
+function isOrgRole(value) {
+    return (typeof value === 'string' &&
+        Object.values(tenant_1.OrgRole).includes(value));
+}
+function resolveOrgRoles(claims) {
+    for (const key of exports.ORG_ROLES_CLAIM_KEYS) {
+        const parsed = coerceClaimObject(claims[key]);
+        if (!parsed)
+            continue;
+        const out = {};
+        for (const [orgId, role] of Object.entries(parsed)) {
+            if (orgId.length > 0 && isOrgRole(role)) {
+                out[orgId] = role;
+            }
+        }
+        return out;
+    }
+    return {};
+}
+function resolveOrgRoleForOrg(claims, orgId) {
+    if (!orgId)
+        return null;
+    return resolveOrgRoles(claims)[orgId] ?? null;
+}
+function coerceClaimObject(raw) {
+    let value = raw;
+    if (Array.isArray(value)) {
+        value = value.length === 1 ? value[0] : undefined;
+    }
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        if (trimmed.length === 0)
+            return null;
+        try {
+            value = JSON.parse(trimmed);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+//# sourceMappingURL=org-role.js.map

package/dist/caller-context/lib/org-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.js","sourceRoot":"","sources":["../../../src/caller-context/lib/org-role.ts"],"names":[],"mappings":";;;AAoEA,0CAeC;AAMD,oDAMC;AA/FD,yCAAuC;AAsCvC,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAE1B,2CAAuB,CAAA;AACzB,CAAC,EAHW,gBAAgB,gCAAhB,gBAAgB,QAG3B;AAEY,QAAA,oBAAoB,GAAgC;IAC/D,gBAAgB,CAAC,SAAS;CAClB,CAAC;AASX,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,MAAM,CAAC,MAAM,CAAC,gBAAO,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;AACJ,CAAC;AASD,SAAgB,eAAe,CAC7B,MAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,4BAAoB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAMD,SAAgB,oBAAoB,CAClC,MAA+B,EAC/B,KAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAQD,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAgC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/caller-context/lib/org-scope-mint.d.ts

@@ -0,0 +1,22 @@
+export declare enum OrgScopeProvenance {
+    OwningRow = "owning_row"
+}
+declare const ORG_SCOPE_WITNESS_BRAND: unique symbol;
+export interface OrgScopeWitness {
+    readonly [ORG_SCOPE_WITNESS_BRAND]: true;
+    readonly orgId: string;
+    readonly provenance: OrgScopeProvenance;
+    readonly evidence: string;
+}
+export declare class UnprovenOrgScopeError extends Error {
+    readonly assertedOrgId: string;
+    readonly source: string;
+    constructor(assertedOrgId: string, source: string);
+}
+export declare function orgScopeFromOwningRow(orgId: string, row: {
+    readonly entity: string;
+    readonly id: string;
+}): OrgScopeWitness;
+export declare function describeOrgScopeWitness(w: OrgScopeWitness): string;
+export {};
+//# sourceMappingURL=org-scope-mint.d.ts.map

package/dist/caller-context/lib/org-scope-mint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-scope-mint.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/org-scope-mint.ts"],"names":[],"mappings":"AA2BA,oBAAY,kBAAkB;IAM5B,SAAS,eAAe;CACzB;AAED,OAAO,CAAC,MAAM,uBAAuB,EAAE,OAAO,MAAM,CAAC;AAMrD,MAAM,WAAW,eAAe;IAE9B,QAAQ,CAAC,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IAExC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAGD,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM;CAQ1B;AAGD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACpD,eAAe,CAUjB;AAGD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAElE"}

package/dist/caller-context/lib/org-scope-mint.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnprovenOrgScopeError = exports.OrgScopeProvenance = void 0;
+exports.orgScopeFromOwningRow = orgScopeFromOwningRow;
+exports.describeOrgScopeWitness = describeOrgScopeWitness;
+var OrgScopeProvenance;
+(function (OrgScopeProvenance) {
+    OrgScopeProvenance["OwningRow"] = "owning_row";
+})(OrgScopeProvenance || (exports.OrgScopeProvenance = OrgScopeProvenance = {}));
+class UnprovenOrgScopeError extends Error {
+    assertedOrgId;
+    source;
+    constructor(assertedOrgId, source) {
+        super(`Refusing to state org "${assertedOrgId}" in a worker context: ` +
+            `(authority=${source}). Resolve the tenant from the owning row.`);
+        this.assertedOrgId = assertedOrgId;
+        this.source = source;
+        this.name = 'UnprovenOrgScopeError';
+    }
+}
+exports.UnprovenOrgScopeError = UnprovenOrgScopeError;
+function orgScopeFromOwningRow(orgId, row) {
+    const trimmed = orgId.trim();
+    if (trimmed.length === 0) {
+        throw new UnprovenOrgScopeError('', `empty-org/${OrgScopeProvenance.OwningRow}`);
+    }
+    return {
+        orgId: trimmed,
+        provenance: OrgScopeProvenance.OwningRow,
+        evidence: `row:${row.entity}:${row.id}`,
+    };
+}
+function describeOrgScopeWitness(w) {
+    return `owning row (${w.evidence})`;
+}
+//# sourceMappingURL=org-scope-mint.js.map

package/dist/caller-context/lib/org-scope-mint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-scope-mint.js","sourceRoot":"","sources":["../../../src/caller-context/lib/org-scope-mint.ts"],"names":[],"mappings":";;;AAkEA,sDAaC;AAGD,0DAEC;AAzDD,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAM5B,8CAAwB,CAAA;AAC1B,CAAC,EAPW,kBAAkB,kCAAlB,kBAAkB,QAO7B;AAkBD,MAAa,qBAAsB,SAAQ,KAAK;IAEnC;IACA;IAFX,YACW,aAAqB,EACrB,MAAc;QAEvB,KAAK,CACH,0BAA0B,aAAa,yBAAyB;YAC9D,cAAc,MAAM,4CAA4C,CACnE,CAAC;QANO,kBAAa,GAAb,aAAa,CAAQ;QACrB,WAAM,GAAN,MAAM,CAAQ;QAMvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAXD,sDAWC;AAGD,SAAgB,qBAAqB,CACnC,KAAa,EACb,GAAqD;IAErD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAqB,CAAC,EAAE,EAAE,aAAa,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,kBAAkB,CAAC,SAAS;QACxC,QAAQ,EAAE,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE;KACrB,CAAC;AACvB,CAAC;AAGD,SAAgB,uBAAuB,CAAC,CAAkB;IACxD,OAAO,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC;AACtC,CAAC"}

package/dist/caller-context/lib/platform-sweep.d.ts

@@ -0,0 +1,64 @@
+import { PlatformSweep } from '../../deployment';
+import { type OrgAuthorityVerdict } from './org-authority';
+import type { ReceiverOperationId } from './receiver-operation';
+export { PlatformSweep };
+export declare enum PlatformSweepReach {
+    ModelGatewaySessionMint = "model:gateway-session.mint@1",
+    CredentialResolve = "credential:resolve@1",
+    CredentialWrite = "credential:write@1",
+    CredentialRevoke = "credential:revoke@1",
+    MemberNotificationPublish = "notification:member.publish@1",
+    WorkspaceStorageErase = "workspace-storage:erase@1",
+    AppErase = "app-platform:app-erase@1",
+    ResourceRoleBindingWrite = "resource-role:binding.write@1",
+    OrgDataErase = "org-data:erase@1",
+    ContributionOrgSync = "contribution:org-sync@1",
+    EmbeddingCommitmentMigrationReport = "embedding-commitment:migration.report@1",
+    LegalHoldOrgErasureFence = "legal-hold:org-erasure-fence@1",
+    WorkspaceAllocationErase = "workspace:allocation.erase@1",
+    EndedHolderCheckWrite = "agent-session:session-sweep.ended-holder-check.write@1",
+    ConnectorInstallationVerify = "connector:installation-verify@1",
+    AuditCapabilityUsageRead = "audit:capability-usage.read@1",
+    LegalHoldResolve = "legal-hold:resolve@1",
+    AuthorizationFactsSnapshot = "authorization-facts:snapshot@1"
+}
+export declare const PLATFORM_SWEEP_REACH: Readonly<Record<PlatformSweep, readonly PlatformSweepReach[]>>;
+export declare function parsePlatformSweep(name: string): PlatformSweep | undefined;
+declare const PLATFORM_SWEEP_GRANT_BRAND: unique symbol;
+export interface PlatformSweepGrant {
+    readonly [PLATFORM_SWEEP_GRANT_BRAND]: true;
+    readonly sweep: PlatformSweep;
+    readonly orgId: string;
+}
+export declare class PlatformSweepGrantError extends Error {
+    readonly sweep: PlatformSweep;
+    constructor(sweep: PlatformSweep);
+}
+export declare function platformSweepGrant(sweep: PlatformSweep, orgId: string): PlatformSweepGrant;
+export declare enum PlatformSweepRefusal {
+    NoSweep = "no_sweep",
+    UnknownSweep = "unknown_sweep",
+    UnnamedService = "unnamed_service",
+    OrgMismatch = "org_mismatch",
+    OutOfReach = "out_of_reach"
+}
+export interface AdmittedPlatformSweep {
+    readonly admitted: true;
+    readonly sweep: PlatformSweep;
+    readonly callerService: string;
+    readonly orgId: string;
+    readonly reach: ReceiverOperationId;
+}
+export interface RefusedPlatformSweep {
+    readonly admitted: false;
+    readonly refusal: PlatformSweepRefusal;
+    readonly stated?: string;
+}
+export declare function admitPlatformSweep(input: {
+    readonly platformSweep: string | undefined;
+    readonly callerService: string | undefined;
+    readonly orgAuthority: OrgAuthorityVerdict | undefined;
+    readonly requestedOrgId: string;
+    readonly reach: ReceiverOperationId;
+}): AdmittedPlatformSweep | RefusedPlatformSweep;
+//# sourceMappingURL=platform-sweep.d.ts.map

package/dist/caller-context/lib/platform-sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-sweep.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/platform-sweep.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAOhE,OAAO,EAAE,aAAa,EAAE,CAAC;AAOzB,oBAAY,kBAAkB;IAE5B,uBAAuB,iCAAiC;IAExD,iBAAiB,yBAAyB;IAM1C,eAAe,uBAAuB;IAEtC,gBAAgB,wBAAwB;IAKxC,yBAAyB,kCAAkC;IAK3D,qBAAqB,8BAA8B;IAMnD,QAAQ,6BAA6B;IAKrC,wBAAwB,kCAAkC;IAO1D,YAAY,qBAAqB;IAKjC,mBAAmB,4BAA4B;IAK/C,kCAAkC,4CAA4C;IAK9E,wBAAwB,mCAAmC;IAE3D,wBAAwB,iCAAiC;IAMzD,qBAAqB,2DAA2D;IAEhF,2BAA2B,oCAAoC;IAK/D,wBAAwB,kCAAkC;IAK1D,gBAAgB,yBAAyB;IAMzC,0BAA0B,mCAAmC;CAC9D;AAGD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CACzC,MAAM,CAAC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC,CA8CrD,CAAC;AAKF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE1E;AAID,OAAO,CAAC,MAAM,0BAA0B,EAAE,OAAO,MAAM,CAAC;AAQxD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,KAAK,EAAE,aAAa;gBAApB,KAAK,EAAE,aAAa;CAI1C;AAOD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAM1F;AAKD,oBAAY,oBAAoB;IAE9B,OAAO,aAAa;IAEpB,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,WAAW,iBAAiB;IAE5B,UAAU,iBAAiB;CAC5B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IAEvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAYD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC,GAAG,qBAAqB,GAAG,oBAAoB,CAqC/C"}