@xemahq/contracts 0.81.0 → 0.83.0

package/dist/caller-context/lib/lent-capability.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LentCapabilityVia = void 0;
+exports.lentCapabilityAdmitting = lentCapabilityAdmitting;
+var LentCapabilityVia;
+(function (LentCapabilityVia) {
+    LentCapabilityVia["Operation"] = "operation";
+    LentCapabilityVia["ReachedThrough"] = "reached-through";
+})(LentCapabilityVia || (exports.LentCapabilityVia = LentCapabilityVia = {}));
+function lentCapabilityAdmitting(delegation, operation, reachedThrough = []) {
+    if (delegation.capabilities.includes(operation)) {
+        return Object.freeze({ capability: operation, via: LentCapabilityVia.Operation });
+    }
+    const step = reachedThrough.find((capability) => delegation.capabilities.includes(capability));
+    return step === undefined
+        ? undefined
+        : Object.freeze({ capability: step, via: LentCapabilityVia.ReachedThrough });
+}
+//# sourceMappingURL=lent-capability.js.map

package/dist/caller-context/lib/lent-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lent-capability.js","sourceRoot":"","sources":["../../../src/caller-context/lib/lent-capability.ts"],"names":[],"mappings":";;;AAiCA,0DAYC;AApCD,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAE3B,4CAAuB,CAAA;IAEvB,uDAAkC,CAAA;AACpC,CAAC,EALW,iBAAiB,iCAAjB,iBAAiB,QAK5B;AAmBD,SAAgB,uBAAuB,CACrC,UAAoD,EACpD,SAAiB,EACjB,iBAAoC,EAAE;IAEtC,IAAI,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/F,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;AACjF,CAAC"}

package/dist/caller-context/lib/org-authority.d.ts

@@ -0,0 +1,29 @@
+import { SubjectKind } from '../../subject';
+import type { TokenClass } from '../../subject';
+export declare enum OrgAuthoritySource {
+    OrgClaim = "org_claim",
+    OrgMembership = "org_membership",
+    NoOrgAsserted = "no_org_asserted",
+    ClaimMismatch = "claim_mismatch",
+    ServiceRelayedContext = "service_relayed_context",
+    Unproven = "unproven_header"
+}
+export interface OrgAuthorityCaller {
+    readonly subjectKind: SubjectKind;
+    readonly delegated: boolean;
+}
+export interface OrgAuthorityVerdict {
+    readonly source: OrgAuthoritySource;
+    readonly assertedOrgId: string;
+    readonly tokenOrgId?: string;
+}
+export declare function resolveOrgAuthority(claims: Record<string, unknown>, assertedOrgId: string, caller: OrgAuthorityCaller): OrgAuthorityVerdict;
+export declare function isOrgAuthorityProven(verdict: OrgAuthorityVerdict): boolean;
+export declare function orgAuthorityRequiresProof(verdict: OrgAuthorityVerdict): boolean;
+export interface OrgAuthorityCallerFacts {
+    readonly clientId: string;
+    readonly tokenClass: TokenClass;
+    readonly subjectKind: SubjectKind;
+    readonly delegated: boolean;
+}
+//# sourceMappingURL=org-authority.d.ts.map

package/dist/caller-context/lib/org-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/org-authority.ts"],"names":[],"mappings":"AA8IA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAahD,oBAAY,kBAAkB;IAE5B,QAAQ,cAAc;IAEtB,aAAa,mBAAmB;IAKhC,aAAa,oBAAoB;IAYjC,aAAa,mBAAmB;IAkBhC,qBAAqB,4BAA4B;IAKjD,QAAQ,oBAAoB;CAC7B;AAaD,MAAM,WAAW,kBAAkB;IAQjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAMlC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAGD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAEpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAO/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2BD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,kBAAkB,GACzB,mBAAmB,CA6DrB;AAGD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAW1E;AAYD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAWT;AAQD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B"}

package/dist/caller-context/lib/org-authority.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgAuthoritySource = void 0;
+exports.resolveOrgAuthority = resolveOrgAuthority;
+exports.isOrgAuthorityProven = isOrgAuthorityProven;
+exports.orgAuthorityRequiresProof = orgAuthorityRequiresProof;
+const subject_1 = require("../../subject");
+const org_claim_1 = require("./org-claim");
+const org_role_1 = require("./org-role");
+var OrgAuthoritySource;
+(function (OrgAuthoritySource) {
+    OrgAuthoritySource["OrgClaim"] = "org_claim";
+    OrgAuthoritySource["OrgMembership"] = "org_membership";
+    OrgAuthoritySource["NoOrgAsserted"] = "no_org_asserted";
+    OrgAuthoritySource["ClaimMismatch"] = "claim_mismatch";
+    OrgAuthoritySource["ServiceRelayedContext"] = "service_relayed_context";
+    OrgAuthoritySource["Unproven"] = "unproven_header";
+})(OrgAuthoritySource || (exports.OrgAuthoritySource = OrgAuthoritySource = {}));
+function resolveOrgAuthority(claims, assertedOrgId, caller) {
+    const asserted = assertedOrgId.trim();
+    const claim = (0, org_claim_1.resolveOrgClaim)(claims);
+    if (asserted.length === 0) {
+        return {
+            source: OrgAuthoritySource.NoOrgAsserted,
+            assertedOrgId: '',
+            ...(claim ? { tokenOrgId: claim.value } : {}),
+        };
+    }
+    if (claim) {
+        return claim.value.toLowerCase() === asserted.toLowerCase()
+            ? {
+                source: OrgAuthoritySource.OrgClaim,
+                assertedOrgId: asserted,
+                tokenOrgId: claim.value,
+            }
+            : {
+                source: OrgAuthoritySource.ClaimMismatch,
+                assertedOrgId: asserted,
+                tokenOrgId: claim.value,
+            };
+    }
+    const orgRoles = (0, org_role_1.resolveOrgRoles)(claims);
+    const assertedLower = asserted.toLowerCase();
+    for (const memberOrgId of Object.keys(orgRoles)) {
+        if (memberOrgId.toLowerCase() === assertedLower) {
+            return {
+                source: OrgAuthoritySource.OrgMembership,
+                assertedOrgId: asserted,
+            };
+        }
+    }
+    if (!caller.delegated && caller.subjectKind === subject_1.SubjectKind.Service) {
+        return {
+            source: OrgAuthoritySource.ServiceRelayedContext,
+            assertedOrgId: asserted,
+        };
+    }
+    return { source: OrgAuthoritySource.Unproven, assertedOrgId: asserted };
+}
+function isOrgAuthorityProven(verdict) {
+    switch (verdict.source) {
+        case OrgAuthoritySource.OrgClaim:
+        case OrgAuthoritySource.OrgMembership:
+            return true;
+        case OrgAuthoritySource.NoOrgAsserted:
+        case OrgAuthoritySource.ServiceRelayedContext:
+        case OrgAuthoritySource.ClaimMismatch:
+        case OrgAuthoritySource.Unproven:
+            return false;
+    }
+}
+function orgAuthorityRequiresProof(verdict) {
+    switch (verdict.source) {
+        case OrgAuthoritySource.Unproven:
+            return true;
+        case OrgAuthoritySource.OrgClaim:
+        case OrgAuthoritySource.OrgMembership:
+        case OrgAuthoritySource.NoOrgAsserted:
+        case OrgAuthoritySource.ServiceRelayedContext:
+        case OrgAuthoritySource.ClaimMismatch:
+            return false;
+    }
+}
+//# sourceMappingURL=org-authority.js.map

package/dist/caller-context/lib/org-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority.js","sourceRoot":"","sources":["../../../src/caller-context/lib/org-authority.ts"],"names":[],"mappings":";;;AA+QA,kDAiEC;AAGD,oDAWC;AAYD,8DAaC;AAzOD,2CAA4C;AAG5C,2CAA8C;AAC9C,yCAA6C;AAU7C,IAAY,kBA6CX;AA7CD,WAAY,kBAAkB;IAE5B,4CAAsB,CAAA;IAEtB,sDAAgC,CAAA;IAKhC,uDAAiC,CAAA;IAYjC,sDAAgC,CAAA;IAkBhC,uEAAiD,CAAA;IAKjD,kDAA4B,CAAA;AAC9B,CAAC,EA7CW,kBAAkB,kCAAlB,kBAAkB,QA6C7B;AAsED,SAAgB,mBAAmB,CACjC,MAA+B,EAC/B,aAAqB,EACrB,MAA0B;IAE1B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAI1B,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;YACxC,aAAa,EAAE,EAAE;YACjB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;YACzD,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,QAAQ;gBACnC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB,CAAC;IACR,CAAC;IAKD,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7C,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;YAChD,OAAO;gBACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAaD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,qBAAW,CAAC,OAAO,EAAE,CAAC;QACpE,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,qBAAqB;YAChD,aAAa,EAAE,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAGD,SAAgB,oBAAoB,CAAC,OAA4B;IAC/D,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,qBAAqB,CAAC;QAC9C,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAYD,SAAgB,yBAAyB,CACvC,OAA4B;IAE5B,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,qBAAqB,CAAC;QAC9C,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/caller-context/lib/org-claim.d.ts

@@ -0,0 +1,15 @@
+export declare enum OrgClaimKey {
+    Canonical = "xema_org_id"
+}
+export declare const ORG_CLAIM_KEYS: readonly OrgClaimKey[];
+export declare enum OrgHeaderName {
+    Canonical = "X-Xema-Org-Id"
+}
+export declare enum ProjectHeaderName {
+    Canonical = "X-Project-Id"
+}
+export declare function resolveOrgClaim(claims: Record<string, unknown>): {
+    key: OrgClaimKey;
+    value: string;
+} | null;
+//# sourceMappingURL=org-claim.d.ts.map

package/dist/caller-context/lib/org-claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-claim.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/org-claim.ts"],"names":[],"mappings":"AA8BA,oBAAY,WAAW;IAErB,SAAS,gBAAgB;CAC1B;AAOD,eAAO,MAAM,cAAc,EAAE,SAAS,WAAW,EAEvC,CAAC;AAQX,oBAAY,aAAa;IAEvB,SAAS,kBAAkB;CAC5B;AAkBD,oBAAY,iBAAiB;IAE3B,SAAS,iBAAiB;CAC3B;AAeD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ5C"}

package/dist/caller-context/lib/org-claim.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProjectHeaderName = exports.OrgHeaderName = exports.ORG_CLAIM_KEYS = exports.OrgClaimKey = void 0;
+exports.resolveOrgClaim = resolveOrgClaim;
+var OrgClaimKey;
+(function (OrgClaimKey) {
+    OrgClaimKey["Canonical"] = "xema_org_id";
+})(OrgClaimKey || (exports.OrgClaimKey = OrgClaimKey = {}));
+exports.ORG_CLAIM_KEYS = [
+    OrgClaimKey.Canonical,
+];
+var OrgHeaderName;
+(function (OrgHeaderName) {
+    OrgHeaderName["Canonical"] = "X-Xema-Org-Id";
+})(OrgHeaderName || (exports.OrgHeaderName = OrgHeaderName = {}));
+var ProjectHeaderName;
+(function (ProjectHeaderName) {
+    ProjectHeaderName["Canonical"] = "X-Project-Id";
+})(ProjectHeaderName || (exports.ProjectHeaderName = ProjectHeaderName = {}));
+function resolveOrgClaim(claims) {
+    for (const key of exports.ORG_CLAIM_KEYS) {
+        const raw = claims[key];
+        if (typeof raw === 'string' && raw.length > 0) {
+            return { key, value: raw };
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=org-claim.js.map

package/dist/caller-context/lib/org-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-claim.js","sourceRoot":"","sources":["../../../src/caller-context/lib/org-claim.ts"],"names":[],"mappings":";;;AAyFA,0CAUC;AArED,IAAY,WAGX;AAHD,WAAY,WAAW;IAErB,wCAAyB,CAAA;AAC3B,CAAC,EAHW,WAAW,2BAAX,WAAW,QAGtB;AAOY,QAAA,cAAc,GAA2B;IACpD,WAAW,CAAC,SAAS;CACb,CAAC;AAQX,IAAY,aAGX;AAHD,WAAY,aAAa;IAEvB,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,6BAAb,aAAa,QAGxB;AAkBD,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAE3B,+CAA0B,CAAA;AAC5B,CAAC,EAHW,iBAAiB,iCAAjB,iBAAiB,QAG5B;AAeD,SAAgB,eAAe,CAC7B,MAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,sBAAc,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/caller-context/lib/org-role.d.ts

@@ -0,0 +1,8 @@
+import { OrgRole } from '../../tenant';
+export declare enum OrgRolesClaimKey {
+    Canonical = "org_roles"
+}
+export declare const ORG_ROLES_CLAIM_KEYS: readonly OrgRolesClaimKey[];
+export declare function resolveOrgRoles(claims: Record<string, unknown>): Record<string, OrgRole>;
+export declare function resolveOrgRoleForOrg(claims: Record<string, unknown>, orgId: string): OrgRole | null;
+//# sourceMappingURL=org-role.d.ts.map

package/dist/caller-context/lib/org-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/org-role.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAsCvC,oBAAY,gBAAgB;IAE1B,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,gBAAgB,EAElD,CAAC;AAuBX,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazB;AAMD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,MAAM,GACZ,OAAO,GAAG,IAAI,CAGhB"}

package/dist/caller-context/lib/org-role.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = void 0;
+exports.resolveOrgRoles = resolveOrgRoles;
+exports.resolveOrgRoleForOrg = resolveOrgRoleForOrg;
+const tenant_1 = require("../../tenant");
+var OrgRolesClaimKey;
+(function (OrgRolesClaimKey) {
+    OrgRolesClaimKey["Canonical"] = "org_roles";
+})(OrgRolesClaimKey || (exports.OrgRolesClaimKey = OrgRolesClaimKey = {}));
+exports.ORG_ROLES_CLAIM_KEYS = [
+    OrgRolesClaimKey.Canonical,
+];
+function isOrgRole(value) {
+    return (typeof value === 'string' &&
+        Object.values(tenant_1.OrgRole).includes(value));
+}
+function resolveOrgRoles(claims) {
+    for (const key of exports.ORG_ROLES_CLAIM_KEYS) {
+        const parsed = coerceClaimObject(claims[key]);
+        if (!parsed)
+            continue;
+        const out = {};
+        for (const [orgId, role] of Object.entries(parsed)) {
+            if (orgId.length > 0 && isOrgRole(role)) {
+                out[orgId] = role;
+            }
+        }
+        return out;
+    }
+    return {};
+}
+function resolveOrgRoleForOrg(claims, orgId) {
+    if (!orgId)
+        return null;
+    return resolveOrgRoles(claims)[orgId] ?? null;
+}
+function coerceClaimObject(raw) {
+    let value = raw;
+    if (Array.isArray(value)) {
+        value = value.length === 1 ? value[0] : undefined;
+    }
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        if (trimmed.length === 0)
+            return null;
+        try {
+            value = JSON.parse(trimmed);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+//# sourceMappingURL=org-role.js.map

package/dist/caller-context/lib/org-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.js","sourceRoot":"","sources":["../../../src/caller-context/lib/org-role.ts"],"names":[],"mappings":";;;AAoEA,0CAeC;AAMD,oDAMC;AA/FD,yCAAuC;AAsCvC,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAE1B,2CAAuB,CAAA;AACzB,CAAC,EAHW,gBAAgB,gCAAhB,gBAAgB,QAG3B;AAEY,QAAA,oBAAoB,GAAgC;IAC/D,gBAAgB,CAAC,SAAS;CAClB,CAAC;AASX,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,MAAM,CAAC,MAAM,CAAC,gBAAO,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;AACJ,CAAC;AASD,SAAgB,eAAe,CAC7B,MAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,4BAAoB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAMD,SAAgB,oBAAoB,CAClC,MAA+B,EAC/B,KAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAQD,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAgC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/caller-context/lib/org-scope-mint.d.ts

@@ -0,0 +1,22 @@
+export declare enum OrgScopeProvenance {
+    OwningRow = "owning_row"
+}
+declare const ORG_SCOPE_WITNESS_BRAND: unique symbol;
+export interface OrgScopeWitness {
+    readonly [ORG_SCOPE_WITNESS_BRAND]: true;
+    readonly orgId: string;
+    readonly provenance: OrgScopeProvenance;
+    readonly evidence: string;
+}
+export declare class UnprovenOrgScopeError extends Error {
+    readonly assertedOrgId: string;
+    readonly source: string;
+    constructor(assertedOrgId: string, source: string);
+}
+export declare function orgScopeFromOwningRow(orgId: string, row: {
+    readonly entity: string;
+    readonly id: string;
+}): OrgScopeWitness;
+export declare function describeOrgScopeWitness(w: OrgScopeWitness): string;
+export {};
+//# sourceMappingURL=org-scope-mint.d.ts.map

package/dist/caller-context/lib/org-scope-mint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-scope-mint.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/org-scope-mint.ts"],"names":[],"mappings":"AA2BA,oBAAY,kBAAkB;IAM5B,SAAS,eAAe;CACzB;AAED,OAAO,CAAC,MAAM,uBAAuB,EAAE,OAAO,MAAM,CAAC;AAMrD,MAAM,WAAW,eAAe;IAE9B,QAAQ,CAAC,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IAExC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAGD,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM;CAQ1B;AAGD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACpD,eAAe,CAUjB;AAGD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAElE"}

package/dist/caller-context/lib/org-scope-mint.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnprovenOrgScopeError = exports.OrgScopeProvenance = void 0;
+exports.orgScopeFromOwningRow = orgScopeFromOwningRow;
+exports.describeOrgScopeWitness = describeOrgScopeWitness;
+var OrgScopeProvenance;
+(function (OrgScopeProvenance) {
+    OrgScopeProvenance["OwningRow"] = "owning_row";
+})(OrgScopeProvenance || (exports.OrgScopeProvenance = OrgScopeProvenance = {}));
+class UnprovenOrgScopeError extends Error {
+    assertedOrgId;
+    source;
+    constructor(assertedOrgId, source) {
+        super(`Refusing to state org "${assertedOrgId}" in a worker context: ` +
+            `(authority=${source}). Resolve the tenant from the owning row.`);
+        this.assertedOrgId = assertedOrgId;
+        this.source = source;
+        this.name = 'UnprovenOrgScopeError';
+    }
+}
+exports.UnprovenOrgScopeError = UnprovenOrgScopeError;
+function orgScopeFromOwningRow(orgId, row) {
+    const trimmed = orgId.trim();
+    if (trimmed.length === 0) {
+        throw new UnprovenOrgScopeError('', `empty-org/${OrgScopeProvenance.OwningRow}`);
+    }
+    return {
+        orgId: trimmed,
+        provenance: OrgScopeProvenance.OwningRow,
+        evidence: `row:${row.entity}:${row.id}`,
+    };
+}
+function describeOrgScopeWitness(w) {
+    return `owning row (${w.evidence})`;
+}
+//# sourceMappingURL=org-scope-mint.js.map

package/dist/caller-context/lib/org-scope-mint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-scope-mint.js","sourceRoot":"","sources":["../../../src/caller-context/lib/org-scope-mint.ts"],"names":[],"mappings":";;;AAkEA,sDAaC;AAGD,0DAEC;AAzDD,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAM5B,8CAAwB,CAAA;AAC1B,CAAC,EAPW,kBAAkB,kCAAlB,kBAAkB,QAO7B;AAkBD,MAAa,qBAAsB,SAAQ,KAAK;IAEnC;IACA;IAFX,YACW,aAAqB,EACrB,MAAc;QAEvB,KAAK,CACH,0BAA0B,aAAa,yBAAyB;YAC9D,cAAc,MAAM,4CAA4C,CACnE,CAAC;QANO,kBAAa,GAAb,aAAa,CAAQ;QACrB,WAAM,GAAN,MAAM,CAAQ;QAMvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAXD,sDAWC;AAGD,SAAgB,qBAAqB,CACnC,KAAa,EACb,GAAqD;IAErD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAqB,CAAC,EAAE,EAAE,aAAa,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,kBAAkB,CAAC,SAAS;QACxC,QAAQ,EAAE,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE;KACrB,CAAC;AACvB,CAAC;AAGD,SAAgB,uBAAuB,CAAC,CAAkB;IACxD,OAAO,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC;AACtC,CAAC"}

package/dist/caller-context/lib/platform-sweep.d.ts

@@ -0,0 +1,68 @@
+import { PlatformSweep } from '../../deployment';
+import { type OrgAuthorityVerdict } from './org-authority';
+import type { ReceiverOperationId } from './receiver-operation';
+export { PlatformSweep };
+export declare enum PlatformSweepReach {
+    ModelGatewaySessionMint = "model:gateway-session.mint@1",
+    CredentialResolve = "credential:resolve@1",
+    CredentialWrite = "credential:write@1",
+    CredentialRevoke = "credential:revoke@1",
+    MemberNotificationPublish = "notification:member.publish@1",
+    WorkspaceStorageErase = "workspace-storage:erase@1",
+    AppErase = "app-platform:app-erase@1",
+    ResourceRoleBindingWrite = "resource-role:binding.write@1",
+    OrgDataErase = "org-data:erase@1",
+    ContributionOrgSync = "contribution:org-sync@1",
+    EmbeddingCommitmentMigrationReport = "embedding-commitment:migration.report@1",
+    LegalHoldOrgErasureFence = "legal-hold:org-erasure-fence@1",
+    WorkspaceAllocationErase = "workspace:allocation.erase@1",
+    EndedHolderCheckWrite = "agent-session:session-sweep.ended-holder-check.write@1",
+    ConnectorInstallationVerify = "connector:installation-verify@1",
+    AuditCapabilityUsageRead = "audit:capability-usage.read@1",
+    LegalHoldResolve = "legal-hold:resolve@1",
+    AuthorizationFactsSnapshot = "authorization-facts:snapshot@1",
+    OrgDatabasePoolInstallationCleanup = "org-database-pool:installation-cleanup.write@1",
+    DeliverableSpecsInstallationCleanup = "deliverable-specs:installation-cleanup.write@1",
+    WorkflowEngineInstallationCleanup = "workflow-engine:installation-cleanup.write@1",
+    McpGatewayInstallationCleanup = "mcp-gateway:installation-cleanup.write@1"
+}
+export declare const PLATFORM_SWEEP_REACH: Readonly<Record<PlatformSweep, readonly PlatformSweepReach[]>>;
+export declare function parsePlatformSweep(name: string): PlatformSweep | undefined;
+declare const PLATFORM_SWEEP_GRANT_BRAND: unique symbol;
+export interface PlatformSweepGrant {
+    readonly [PLATFORM_SWEEP_GRANT_BRAND]: true;
+    readonly sweep: PlatformSweep;
+    readonly orgId: string;
+}
+export declare class PlatformSweepGrantError extends Error {
+    readonly sweep: PlatformSweep;
+    constructor(sweep: PlatformSweep);
+}
+export declare function platformSweepGrant(sweep: PlatformSweep, orgId: string): PlatformSweepGrant;
+export declare enum PlatformSweepRefusal {
+    NoSweep = "no_sweep",
+    UnknownSweep = "unknown_sweep",
+    UnnamedService = "unnamed_service",
+    OrgMismatch = "org_mismatch",
+    OutOfReach = "out_of_reach"
+}
+export interface AdmittedPlatformSweep {
+    readonly admitted: true;
+    readonly sweep: PlatformSweep;
+    readonly callerService: string;
+    readonly orgId: string;
+    readonly reach: ReceiverOperationId;
+}
+export interface RefusedPlatformSweep {
+    readonly admitted: false;
+    readonly refusal: PlatformSweepRefusal;
+    readonly stated?: string;
+}
+export declare function admitPlatformSweep(input: {
+    readonly platformSweep: string | undefined;
+    readonly callerService: string | undefined;
+    readonly orgAuthority: OrgAuthorityVerdict | undefined;
+    readonly requestedOrgId: string;
+    readonly reach: ReceiverOperationId;
+}): AdmittedPlatformSweep | RefusedPlatformSweep;
+//# sourceMappingURL=platform-sweep.d.ts.map

package/dist/caller-context/lib/platform-sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-sweep.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/platform-sweep.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAOhE,OAAO,EAAE,aAAa,EAAE,CAAC;AAOzB,oBAAY,kBAAkB;IAE5B,uBAAuB,iCAAiC;IAExD,iBAAiB,yBAAyB;IAM1C,eAAe,uBAAuB;IAEtC,gBAAgB,wBAAwB;IAKxC,yBAAyB,kCAAkC;IAK3D,qBAAqB,8BAA8B;IAMnD,QAAQ,6BAA6B;IAKrC,wBAAwB,kCAAkC;IAO1D,YAAY,qBAAqB;IAKjC,mBAAmB,4BAA4B;IAK/C,kCAAkC,4CAA4C;IAK9E,wBAAwB,mCAAmC;IAE3D,wBAAwB,iCAAiC;IAMzD,qBAAqB,2DAA2D;IAEhF,2BAA2B,oCAAoC;IAK/D,wBAAwB,kCAAkC;IAK1D,gBAAgB,yBAAyB;IAMzC,0BAA0B,mCAAmC;IAE7D,kCAAkC,mDAAmD;IAErF,mCAAmC,mDAAmD;IAEtF,iCAAiC,iDAAiD;IAElF,6BAA6B,6CAA6C;CAC3E;AAGD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CACzC,MAAM,CAAC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAqDrD,CAAC;AAKF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE1E;AAID,OAAO,CAAC,MAAM,0BAA0B,EAAE,OAAO,MAAM,CAAC;AAQxD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,KAAK,EAAE,aAAa;gBAApB,KAAK,EAAE,aAAa;CAI1C;AAOD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAM1F;AAKD,oBAAY,oBAAoB;IAE9B,OAAO,aAAa;IAEpB,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,WAAW,iBAAiB;IAE5B,UAAU,iBAAiB;CAC5B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IAEvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAYD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC,GAAG,qBAAqB,GAAG,oBAAoB,CAqC/C"}

package/dist/caller-context/lib/platform-sweep.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PlatformSweepRefusal = exports.PlatformSweepGrantError = exports.PLATFORM_SWEEP_REACH = exports.PlatformSweepReach = exports.PlatformSweep = void 0;
+exports.parsePlatformSweep = parsePlatformSweep;
+exports.platformSweepGrant = platformSweepGrant;
+exports.admitPlatformSweep = admitPlatformSweep;
+const deployment_1 = require("../../deployment");
+Object.defineProperty(exports, "PlatformSweep", { enumerable: true, get: function () { return deployment_1.PlatformSweep; } });
+const org_authority_1 = require("./org-authority");
+var PlatformSweepReach;
+(function (PlatformSweepReach) {
+    PlatformSweepReach["ModelGatewaySessionMint"] = "model:gateway-session.mint@1";
+    PlatformSweepReach["CredentialResolve"] = "credential:resolve@1";
+    PlatformSweepReach["CredentialWrite"] = "credential:write@1";
+    PlatformSweepReach["CredentialRevoke"] = "credential:revoke@1";
+    PlatformSweepReach["MemberNotificationPublish"] = "notification:member.publish@1";
+    PlatformSweepReach["WorkspaceStorageErase"] = "workspace-storage:erase@1";
+    PlatformSweepReach["AppErase"] = "app-platform:app-erase@1";
+    PlatformSweepReach["ResourceRoleBindingWrite"] = "resource-role:binding.write@1";
+    PlatformSweepReach["OrgDataErase"] = "org-data:erase@1";
+    PlatformSweepReach["ContributionOrgSync"] = "contribution:org-sync@1";
+    PlatformSweepReach["EmbeddingCommitmentMigrationReport"] = "embedding-commitment:migration.report@1";
+    PlatformSweepReach["LegalHoldOrgErasureFence"] = "legal-hold:org-erasure-fence@1";
+    PlatformSweepReach["WorkspaceAllocationErase"] = "workspace:allocation.erase@1";
+    PlatformSweepReach["EndedHolderCheckWrite"] = "agent-session:session-sweep.ended-holder-check.write@1";
+    PlatformSweepReach["ConnectorInstallationVerify"] = "connector:installation-verify@1";
+    PlatformSweepReach["AuditCapabilityUsageRead"] = "audit:capability-usage.read@1";
+    PlatformSweepReach["LegalHoldResolve"] = "legal-hold:resolve@1";
+    PlatformSweepReach["AuthorizationFactsSnapshot"] = "authorization-facts:snapshot@1";
+    PlatformSweepReach["OrgDatabasePoolInstallationCleanup"] = "org-database-pool:installation-cleanup.write@1";
+    PlatformSweepReach["DeliverableSpecsInstallationCleanup"] = "deliverable-specs:installation-cleanup.write@1";
+    PlatformSweepReach["WorkflowEngineInstallationCleanup"] = "workflow-engine:installation-cleanup.write@1";
+    PlatformSweepReach["McpGatewayInstallationCleanup"] = "mcp-gateway:installation-cleanup.write@1";
+})(PlatformSweepReach || (exports.PlatformSweepReach = PlatformSweepReach = {}));
+exports.PLATFORM_SWEEP_REACH = {
+    [deployment_1.PlatformSweep.EraseSweep]: [PlatformSweepReach.CredentialResolve, PlatformSweepReach.CredentialRevoke],
+    [deployment_1.PlatformSweep.OrgErasure]: [
+        PlatformSweepReach.OrgDataErase,
+        PlatformSweepReach.LegalHoldOrgErasureFence,
+        PlatformSweepReach.LegalHoldResolve,
+    ],
+    [deployment_1.PlatformSweep.AppErasure]: [PlatformSweepReach.AppErase],
+    [deployment_1.PlatformSweep.IndexMaintenance]: [
+        PlatformSweepReach.ModelGatewaySessionMint,
+        PlatformSweepReach.EmbeddingCommitmentMigrationReport,
+        PlatformSweepReach.AuditCapabilityUsageRead,
+        PlatformSweepReach.AuthorizationFactsSnapshot,
+    ],
+    [deployment_1.PlatformSweep.ConnectorSecretCustody]: [
+        PlatformSweepReach.CredentialResolve,
+        PlatformSweepReach.CredentialWrite,
+        PlatformSweepReach.CredentialRevoke,
+        PlatformSweepReach.ConnectorInstallationVerify,
+    ],
+    [deployment_1.PlatformSweep.CredentialRefresh]: [PlatformSweepReach.CredentialResolve, PlatformSweepReach.CredentialWrite],
+    [deployment_1.PlatformSweep.ConnectionHealthProbe]: [PlatformSweepReach.CredentialResolve],
+    [deployment_1.PlatformSweep.MemberNotification]: [PlatformSweepReach.MemberNotificationPublish],
+    [deployment_1.PlatformSweep.EndedHolderErasure]: [
+        PlatformSweepReach.WorkspaceStorageErase,
+        PlatformSweepReach.WorkspaceAllocationErase,
+        PlatformSweepReach.EndedHolderCheckWrite,
+    ],
+    [deployment_1.PlatformSweep.ScmProjectBindingMaintenance]: [PlatformSweepReach.ResourceRoleBindingWrite],
+    [deployment_1.PlatformSweep.ContributionConvergence]: [PlatformSweepReach.ContributionOrgSync],
+    [deployment_1.PlatformSweep.RetentionExpiryErasure]: [PlatformSweepReach.LegalHoldResolve],
+    [deployment_1.PlatformSweep.InstallationCleanup]: [
+        PlatformSweepReach.OrgDatabasePoolInstallationCleanup,
+        PlatformSweepReach.DeliverableSpecsInstallationCleanup,
+        PlatformSweepReach.WorkflowEngineInstallationCleanup,
+        PlatformSweepReach.McpGatewayInstallationCleanup,
+    ],
+};
+const SWEEP_VALUES = new Set(Object.values(deployment_1.PlatformSweep));
+function parsePlatformSweep(name) {
+    return SWEEP_VALUES.has(name) ? name : undefined;
+}
+class PlatformSweepGrantError extends Error {
+    sweep;
+    constructor(sweep) {
+        super(`A platform sweep '${sweep}' names the ONE organization it runs over; none was given.`);
+        this.sweep = sweep;
+        this.name = 'PlatformSweepGrantError';
+    }
+}
+exports.PlatformSweepGrantError = PlatformSweepGrantError;
+function platformSweepGrant(sweep, orgId) {
+    const trimmed = orgId.trim();
+    if (trimmed === '') {
+        throw new PlatformSweepGrantError(sweep);
+    }
+    return { sweep, orgId: trimmed };
+}
+var PlatformSweepRefusal;
+(function (PlatformSweepRefusal) {
+    PlatformSweepRefusal["NoSweep"] = "no_sweep";
+    PlatformSweepRefusal["UnknownSweep"] = "unknown_sweep";
+    PlatformSweepRefusal["UnnamedService"] = "unnamed_service";
+    PlatformSweepRefusal["OrgMismatch"] = "org_mismatch";
+    PlatformSweepRefusal["OutOfReach"] = "out_of_reach";
+})(PlatformSweepRefusal || (exports.PlatformSweepRefusal = PlatformSweepRefusal = {}));
+function admitPlatformSweep(input) {
+    const stated = input.platformSweep;
+    if (stated === undefined || stated === '') {
+        return { admitted: false, refusal: PlatformSweepRefusal.NoSweep };
+    }
+    const sweep = parsePlatformSweep(stated);
+    if (sweep === undefined) {
+        return { admitted: false, refusal: PlatformSweepRefusal.UnknownSweep, stated };
+    }
+    if (input.callerService === undefined || input.callerService === '') {
+        return { admitted: false, refusal: PlatformSweepRefusal.UnnamedService, stated };
+    }
+    const requested = input.requestedOrgId.trim();
+    const sweepOrgId = input.orgAuthority?.source === org_authority_1.OrgAuthoritySource.OrgClaim
+        ? input.orgAuthority.tokenOrgId?.trim()
+        : undefined;
+    if (sweepOrgId === undefined ||
+        sweepOrgId === '' ||
+        requested === '' ||
+        sweepOrgId.toLowerCase() !== requested.toLowerCase()) {
+        return { admitted: false, refusal: PlatformSweepRefusal.OrgMismatch, stated };
+    }
+    if (!exports.PLATFORM_SWEEP_REACH[sweep].includes(input.reach)) {
+        return { admitted: false, refusal: PlatformSweepRefusal.OutOfReach, stated };
+    }
+    return {
+        admitted: true,
+        sweep,
+        callerService: input.callerService,
+        orgId: sweepOrgId,
+        reach: input.reach,
+    };
+}
+//# sourceMappingURL=platform-sweep.js.map

package/dist/caller-context/lib/platform-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-sweep.js","sourceRoot":"","sources":["../../../src/caller-context/lib/platform-sweep.ts"],"names":[],"mappings":";;;AA0NA,gDAEC;AA+BD,gDAMC;AA6CD,gDA4CC;AAzSD,iDAAiD;AAUxC,8FAVA,0BAAa,OAUA;AARtB,mDAA+E;AAe/E,IAAY,kBA0FX;AA1FD,WAAY,kBAAkB;IAE5B,8EAAwD,CAAA;IAExD,gEAA0C,CAAA;IAM1C,4DAAsC,CAAA;IAEtC,8DAAwC,CAAA;IAKxC,iFAA2D,CAAA;IAK3D,yEAAmD,CAAA;IAMnD,2DAAqC,CAAA;IAKrC,gFAA0D,CAAA;IAO1D,uDAAiC,CAAA;IAKjC,qEAA+C,CAAA;IAK/C,oGAA8E,CAAA;IAK9E,iFAA2D,CAAA;IAE3D,+EAAyD,CAAA;IAMzD,sGAAgF,CAAA;IAEhF,qFAA+D,CAAA;IAK/D,gFAA0D,CAAA;IAK1D,+DAAyC,CAAA;IAMzC,mFAA6D,CAAA;IAE7D,2GAAqF,CAAA;IAErF,4GAAsF,CAAA;IAEtF,wGAAkF,CAAA;IAElF,gGAA0E,CAAA;AAC5E,CAAC,EA1FW,kBAAkB,kCAAlB,kBAAkB,QA0F7B;AAGY,QAAA,oBAAoB,GAE7B;IAIF,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;IAEvG,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE;QAC1B,kBAAkB,CAAC,YAAY;QAC/B,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,gBAAgB;KACpC;IAED,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;IAEzD,CAAC,0BAAa,CAAC,gBAAgB,CAAC,EAAE;QAChC,kBAAkB,CAAC,uBAAuB;QAC1C,kBAAkB,CAAC,kCAAkC;QACrD,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,0BAA0B;KAC9C;IAED,CAAC,0BAAa,CAAC,sBAAsB,CAAC,EAAE;QACtC,kBAAkB,CAAC,iBAAiB;QACpC,kBAAkB,CAAC,eAAe;QAClC,kBAAkB,CAAC,gBAAgB;QACnC,kBAAkB,CAAC,2BAA2B;KAC/C;IAED,CAAC,0BAAa,CAAC,iBAAiB,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,eAAe,CAAC;IAE7G,CAAC,0BAAa,CAAC,qBAAqB,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,CAAC;IAE7E,CAAC,0BAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,CAAC,yBAAyB,CAAC;IAElF,CAAC,0BAAa,CAAC,kBAAkB,CAAC,EAAE;QAClC,kBAAkB,CAAC,qBAAqB;QACxC,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,qBAAqB;KACzC;IAED,CAAC,0BAAa,CAAC,4BAA4B,CAAC,EAAE,CAAC,kBAAkB,CAAC,wBAAwB,CAAC;IAE3F,CAAC,0BAAa,CAAC,uBAAuB,CAAC,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;IAEjF,CAAC,0BAAa,CAAC,sBAAsB,CAAC,EAAE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;IAE7E,CAAC,0BAAa,CAAC,mBAAmB,CAAC,EAAE;QACnC,kBAAkB,CAAC,kCAAkC;QACrD,kBAAkB,CAAC,mCAAmC;QACtD,kBAAkB,CAAC,iCAAiC;QACpD,kBAAkB,CAAC,6BAA6B;KACjD;CACF,CAAC;AAEF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAAa,CAAC,CAAC,CAAC;AAGhF,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAmBD,MAAa,uBAAwB,SAAQ,KAAK;IAC3B;IAArB,YAAqB,KAAoB;QACvC,KAAK,CAAC,qBAAqB,KAAK,4DAA4D,CAAC,CAAC;QAD3E,UAAK,GAAL,KAAK,CAAe;QAEvC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAOD,SAAgB,kBAAkB,CAAC,KAAoB,EAAE,KAAa;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAwB,CAAC;AACzD,CAAC;AAKD,IAAY,oBAWX;AAXD,WAAY,oBAAoB;IAE9B,4CAAoB,CAAA;IAEpB,sDAA8B,CAAA;IAE9B,0DAAkC,CAAA;IAElC,oDAA4B,CAAA;IAE5B,mDAA2B,CAAA;AAC7B,CAAC,EAXW,oBAAoB,oCAApB,oBAAoB,QAW/B;AA6BD,SAAgB,kBAAkB,CAAC,KAOlC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACpE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAG9C,MAAM,UAAU,GACd,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,kCAAkB,CAAC,QAAQ;QACxD,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,IACE,UAAU,KAAK,SAAS;QACxB,UAAU,KAAK,EAAE;QACjB,SAAS,KAAK,EAAE;QAChB,UAAU,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EACpD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,CAAE,4BAAoB,CAAC,KAAK,CAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,KAAK;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC"}

package/dist/caller-context/lib/receiver-audience.d.ts

@@ -0,0 +1,13 @@
+export declare const RECEIVER_AUDIENCE_PREFIX = "workload:";
+export declare const RECEIVER_WORKLOAD_NAME_PATTERN: RegExp;
+export declare const MAX_RECEIVER_WORKLOAD_NAME_CHARS = 63;
+declare const receiverAudienceBrand: unique symbol;
+export type ReceiverAudience = string & {
+    readonly [receiverAudienceBrand]: true;
+};
+export declare function isReceiverAudience(value: unknown): value is ReceiverAudience;
+export declare function receiverAudienceOf(workloadName: string): ReceiverAudience;
+export declare function receiverWorkloadOf(audience: string): string | undefined;
+export declare function isReservedReceiverAudienceSpelling(value: string): boolean;
+export {};
+//# sourceMappingURL=receiver-audience.d.ts.map

package/dist/caller-context/lib/receiver-audience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-audience.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/receiver-audience.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAGpD,eAAO,MAAM,8BAA8B,QAAoC,CAAC;AAGhF,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD,OAAO,CAAC,MAAM,qBAAqB,EAAE,OAAO,MAAM,CAAC;AAGnD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAWnF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAM5E;AAGD,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,CAQzE;AAGD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvE;AAGD,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzE"}

package/dist/caller-context/lib/receiver-audience.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RECEIVER_WORKLOAD_NAME_CHARS = exports.RECEIVER_WORKLOAD_NAME_PATTERN = exports.RECEIVER_AUDIENCE_PREFIX = void 0;
+exports.isReceiverAudience = isReceiverAudience;
+exports.receiverAudienceOf = receiverAudienceOf;
+exports.receiverWorkloadOf = receiverWorkloadOf;
+exports.isReservedReceiverAudienceSpelling = isReservedReceiverAudienceSpelling;
+exports.RECEIVER_AUDIENCE_PREFIX = 'workload:';
+exports.RECEIVER_WORKLOAD_NAME_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+exports.MAX_RECEIVER_WORKLOAD_NAME_CHARS = 63;
+function isReceiverWorkloadName(value) {
+    return (typeof value === 'string' &&
+        value.length <= exports.MAX_RECEIVER_WORKLOAD_NAME_CHARS &&
+        exports.RECEIVER_WORKLOAD_NAME_PATTERN.test(value));
+}
+function isReceiverAudience(value) {
+    return (typeof value === 'string' &&
+        value.startsWith(exports.RECEIVER_AUDIENCE_PREFIX) &&
+        isReceiverWorkloadName(value.slice(exports.RECEIVER_AUDIENCE_PREFIX.length)));
+}
+function receiverAudienceOf(workloadName) {
+    if (!isReceiverWorkloadName(workloadName)) {
+        throw new Error(`'${String(workloadName)}' is not a workload name a receiver audience can be built from: expected ` +
+            `${exports.RECEIVER_WORKLOAD_NAME_PATTERN.source}, at most ${exports.MAX_RECEIVER_WORKLOAD_NAME_CHARS} characters.`);
+    }
+    return `${exports.RECEIVER_AUDIENCE_PREFIX}${workloadName}`;
+}
+function receiverWorkloadOf(audience) {
+    return isReceiverAudience(audience)
+        ? audience.slice(exports.RECEIVER_AUDIENCE_PREFIX.length)
+        : undefined;
+}
+function isReservedReceiverAudienceSpelling(value) {
+    return value.startsWith(exports.RECEIVER_AUDIENCE_PREFIX);
+}
+//# sourceMappingURL=receiver-audience.js.map

package/dist/caller-context/lib/receiver-audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-audience.js","sourceRoot":"","sources":["../../../src/caller-context/lib/receiver-audience.ts"],"names":[],"mappings":";;;AA4CA,gDAMC;AAGD,gDAQC;AAGD,gDAIC;AAGD,gFAEC;AAnDY,QAAA,wBAAwB,GAAG,WAAW,CAAC;AAGvC,QAAA,8BAA8B,GAAG,iCAAiC,CAAC;AAGnE,QAAA,gCAAgC,GAAG,EAAE,CAAC;AAOnD,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,IAAI,wCAAgC;QAChD,sCAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAGD,SAAgB,kBAAkB,CAAC,KAAc;IAC/C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,UAAU,CAAC,gCAAwB,CAAC;QAC1C,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,gCAAwB,CAAC,MAAM,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AAGD,SAAgB,kBAAkB,CAAC,YAAoB;IACrD,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,IAAI,MAAM,CAAC,YAAY,CAAC,2EAA2E;YACjG,GAAG,sCAA8B,CAAC,MAAM,aAAa,wCAAgC,cAAc,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,gCAAwB,GAAG,YAAY,EAAsB,CAAC;AAC1E,CAAC;AAGD,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,kBAAkB,CAAC,QAAQ,CAAC;QACjC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,gCAAwB,CAAC,MAAM,CAAC;QACjD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAGD,SAAgB,kCAAkC,CAAC,KAAa;IAC9D,OAAO,KAAK,CAAC,UAAU,CAAC,gCAAwB,CAAC,CAAC;AACpD,CAAC"}