@xemahq/contracts 0.81.0 → 0.83.0

package/dist/caller-context/lib/receiver-operation.d.ts

@@ -0,0 +1,10 @@
+export declare const RECEIVER_OPERATION_ID_PATTERN: RegExp;
+export declare const MAX_RECEIVER_OPERATION_ID_CHARS: number;
+declare const receiverOperationIdBrand: unique symbol;
+export type ReceiverOperationId = string & {
+    readonly [receiverOperationIdBrand]: true;
+};
+export declare function isReceiverOperationId(value: unknown): value is ReceiverOperationId;
+export declare function receiverOperationId(text: string): ReceiverOperationId;
+export {};
+//# sourceMappingURL=receiver-operation.d.ts.map

package/dist/caller-context/lib/receiver-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-operation.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/receiver-operation.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,6BAA6B,EAAE,MAA6B,CAAC;AAG1E,eAAO,MAAM,+BAA+B,EAAE,MAA+B,CAAC;AAE9E,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AAGtD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAGzF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAMlF;AAGD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CASrE"}

package/dist/caller-context/lib/receiver-operation.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RECEIVER_OPERATION_ID_CHARS = exports.RECEIVER_OPERATION_ID_PATTERN = void 0;
+exports.isReceiverOperationId = isReceiverOperationId;
+exports.receiverOperationId = receiverOperationId;
+const deployment_1 = require("../../deployment");
+exports.RECEIVER_OPERATION_ID_PATTERN = deployment_1.OPERATION_ID_PATTERN;
+exports.MAX_RECEIVER_OPERATION_ID_CHARS = deployment_1.MAX_OPERATION_ID_CHARS;
+function isReceiverOperationId(value) {
+    return (typeof value === 'string' &&
+        value.length <= exports.MAX_RECEIVER_OPERATION_ID_CHARS &&
+        exports.RECEIVER_OPERATION_ID_PATTERN.test(value));
+}
+function receiverOperationId(text) {
+    if (!isReceiverOperationId(text)) {
+        throw new Error(`'${String(text)}' is not a receiver operation id: expected ` +
+            `<domain>:<operation>@<version> (${exports.RECEIVER_OPERATION_ID_PATTERN.source}), ` +
+            `at most ${exports.MAX_RECEIVER_OPERATION_ID_CHARS} characters.`);
+    }
+    return text;
+}
+//# sourceMappingURL=receiver-operation.js.map

package/dist/caller-context/lib/receiver-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-operation.js","sourceRoot":"","sources":["../../../src/caller-context/lib/receiver-operation.ts"],"names":[],"mappings":";;;AAwCA,sDAMC;AAGD,kDASC;AArCD,iDAAgF;AAQnE,QAAA,6BAA6B,GAAW,iCAAoB,CAAC;AAG7D,QAAA,+BAA+B,GAAW,mCAAsB,CAAC;AAQ9E,SAAgB,qBAAqB,CAAC,KAAc;IAClD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,IAAI,uCAA+B;QAC/C,qCAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAC1C,CAAC;AACJ,CAAC;AAGD,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,IAAI,MAAM,CAAC,IAAI,CAAC,6CAA6C;YAC3D,mCAAmC,qCAA6B,CAAC,MAAM,KAAK;YAC5E,WAAW,uCAA+B,cAAc,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/caller-context/lib/request-context.d.ts

@@ -0,0 +1,51 @@
+import { TokenClass } from '../../subject';
+import type { SubjectRef, ActingForRef, DelegatedAuthority } from '../../subject';
+import type { OrgAuthorityVerdict } from './org-authority';
+import type { AdmittedPlatformSweep } from './platform-sweep';
+import type { LentCapabilityAdmission } from './lent-capability';
+import type { VerifiedWorkerContext } from './worker-context';
+import type { ProvedWorkflowStepCredential } from './workflow-step-credential';
+import type { OrgRole } from '../../tenant';
+import type { PipelineApprovalMode } from './approval-mode';
+export interface RequestContext {
+    orgId: string;
+    orgAuthority?: OrgAuthorityVerdict;
+    projectId?: string;
+    subject: SubjectRef;
+    tokenClass: TokenClass;
+    actorChain: ActingForRef[];
+    actorId: string;
+    actorType: 'human' | 'agent' | 'service';
+    orgRoles?: Record<string, OrgRole>;
+    orgRole?: OrgRole;
+    correlationId: string;
+    causationId?: string;
+    authorization?: string;
+    bearerToken?: string;
+    pipelineRunId?: string;
+    pipelinePhaseKey?: string;
+    pipelinePackageId?: string;
+    approvalModeOverride?: PipelineApprovalMode;
+    clientId?: string;
+    principalId?: string;
+    callerService?: string;
+    endUserSession?: boolean;
+    platformSweep?: string;
+    declaredOrgRelay?: true;
+    workloadGrants?: readonly string[];
+    admittedPlatformSweep?: AdmittedPlatformSweep;
+    presentingService?: string;
+    workerContext?: VerifiedWorkerContext;
+    workflowStepCredential?: ProvedWorkflowStepCredential;
+    roles: string[];
+    realmId?: string;
+    issuer?: string;
+    actAs?: string;
+    delegationId?: string;
+    delegation?: DelegatedAuthority;
+    lentCapabilityAdmission?: LentCapabilityAdmission;
+}
+export declare const REQUEST_CONTEXT: unique symbol;
+export declare function getRequestContext(req: object): RequestContext;
+export declare function tryGetRequestContext(req: object): RequestContext | undefined;
+//# sourceMappingURL=request-context.d.ts.map

package/dist/caller-context/lib/request-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EACZ,kBAAkB,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,MAAM,WAAW,cAAc;IAQ7B,KAAK,EAAE,MAAM,CAAC;IAyBd,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IAMnB,OAAO,EAAE,UAAU,CAAC;IAOpB,UAAU,EAAE,UAAU,CAAC;IAMvB,UAAU,EAAE,YAAY,EAAE,CAAC;IAE3B,OAAO,EAAE,MAAM,CAAC;IAMhB,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IASzC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IASnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAmC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAyBlB,WAAW,CAAC,EAAE,MAAM,CAAC;IAyBrB,aAAa,CAAC,EAAE,MAAM,CAAC;IAcvB,cAAc,CAAC,EAAE,OAAO,CAAC;IAUzB,aAAa,CAAC,EAAE,MAAM,CAAC;IAWvB,gBAAgB,CAAC,EAAE,IAAI,CAAC;IAWxB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IASnC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAU9C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAkB3B,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAQtC,sBAAsB,CAAC,EAAE,4BAA4B,CAAC;IAEtD,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;IAQjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAYhB,KAAK,CAAC,EAAE,MAAM,CAAC;IAgBf,YAAY,CAAC,EAAE,MAAM,CAAC;IA2BtB,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAQhC,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD;AAeD,eAAO,MAAM,eAAe,eAAqD,CAAC;AAalF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAQ7D;AASD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CA+B5E"}

package/dist/caller-context/lib/request-context.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REQUEST_CONTEXT = void 0;
+exports.getRequestContext = getRequestContext;
+exports.tryGetRequestContext = tryGetRequestContext;
+exports.REQUEST_CONTEXT = Symbol.for('xema.platform-common.request-context');
+function getRequestContext(req) {
+    const ctx = tryGetRequestContext(req);
+    if (!ctx) {
+        throw new Error('RequestContext not found on request. Ensure RequestContextMiddleware is applied.');
+    }
+    return ctx;
+}
+function tryGetRequestContext(req) {
+    const direct = req[exports.REQUEST_CONTEXT];
+    if (direct !== undefined) {
+        return direct;
+    }
+    const raw = req.raw;
+    if (raw !== null && typeof raw === 'object') {
+        return raw[exports.REQUEST_CONTEXT];
+    }
+    return undefined;
+}
+//# sourceMappingURL=request-context.js.map

package/dist/caller-context/lib/request-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../../src/caller-context/lib/request-context.ts"],"names":[],"mappings":";;;AAgYA,8CAQC;AASD,oDA+BC;AA7DY,QAAA,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AAalF,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,MAAM,MAAM,GAAI,GAA+B,CAAC,uBAAe,CAAC,CAAC;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAwB,CAAC;IAClC,CAAC;IAoBD,MAAM,GAAG,GAAI,GAAyB,CAAC,GAAG,CAAC;IAC3C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAQ,GAA+B,CAAC,uBAAe,CAE1C,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/caller-context/lib/resolve-acting-user.d.ts

@@ -0,0 +1,8 @@
+import type { SubjectRef } from '../../subject';
+import type { RequestContext } from './request-context';
+export declare class ActingUserUnresolvableError extends Error {
+    constructor(ctx: Pick<RequestContext, 'subject' | 'actorChain'>);
+}
+export declare function tryResolveActingUserSubject(ctx: Pick<RequestContext, 'subject' | 'actorChain'>): SubjectRef | undefined;
+export declare function resolveActingUserSubject(ctx: Pick<RequestContext, 'subject' | 'actorChain'>): SubjectRef;
+//# sourceMappingURL=resolve-acting-user.d.ts.map

package/dist/caller-context/lib/resolve-acting-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-acting-user.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/resolve-acting-user.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAUxD,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,YAAY,CAAC;CAgBhE;AAyBD,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,YAAY,CAAC,GAClD,UAAU,GAAG,SAAS,CAcxB;AAWD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,YAAY,CAAC,GAClD,UAAU,CAMZ"}

package/dist/caller-context/lib/resolve-acting-user.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActingUserUnresolvableError = void 0;
+exports.tryResolveActingUserSubject = tryResolveActingUserSubject;
+exports.resolveActingUserSubject = resolveActingUserSubject;
+const subject_1 = require("../../subject");
+class ActingUserUnresolvableError extends Error {
+    constructor(ctx) {
+        const chain = (ctx.actorChain ?? [])
+            .map((a) => `${a.kind}:${a.id}`)
+            .join(',');
+        super('No acting USER could be resolved from the request context. ' +
+            `subject=${ctx.subject.kind}:${ctx.subject.id} ` +
+            `actingFor=${ctx.subject.actingFor
+                ? `${ctx.subject.actingFor.kind}:${ctx.subject.actingFor.id}`
+                : 'none'} actorChain=[${chain}]. ` +
+            'Ownership cannot be attributed to a non-human actor (fail-closed).');
+        this.name = 'ActingUserUnresolvableError';
+    }
+}
+exports.ActingUserUnresolvableError = ActingUserUnresolvableError;
+function tryResolveActingUserSubject(ctx) {
+    if (ctx.subject.kind === subject_1.SubjectKind.User) {
+        return { kind: subject_1.SubjectKind.User, id: ctx.subject.id };
+    }
+    const actingFor = ctx.subject.actingFor;
+    if (actingFor && actingFor.kind === subject_1.SubjectKind.User) {
+        return { kind: subject_1.SubjectKind.User, id: actingFor.id };
+    }
+    for (const actor of ctx.actorChain ?? []) {
+        if (actor.kind === subject_1.SubjectKind.User) {
+            return { kind: subject_1.SubjectKind.User, id: actor.id };
+        }
+    }
+    return undefined;
+}
+function resolveActingUserSubject(ctx) {
+    const user = tryResolveActingUserSubject(ctx);
+    if (user === undefined) {
+        throw new ActingUserUnresolvableError(ctx);
+    }
+    return user;
+}
+//# sourceMappingURL=resolve-acting-user.js.map

package/dist/caller-context/lib/resolve-acting-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-acting-user.js","sourceRoot":"","sources":["../../../src/caller-context/lib/resolve-acting-user.ts"],"names":[],"mappings":";;;AAuDA,kEAgBC;AAWD,4DAQC;AA1FD,2CAA4C;AAa5C,MAAa,2BAA4B,SAAQ,KAAK;IACpD,YAAY,GAAmD;QAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;aAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,KAAK,CACH,6DAA6D;YAC3D,WAAW,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG;YAChD,aACE,GAAG,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;gBAC7D,CAAC,CAAC,MACN,gBAAgB,KAAK,KAAK;YAC1B,oEAAoE,CACvE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAjBD,kEAiBC;AAyBD,SAAgB,2BAA2B,CACzC,GAAmD;IAEnD,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,SAAgB,wBAAwB,CACtC,GAAmD;IAEnD,MAAM,IAAI,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/caller-context/lib/worker-context.d.ts

@@ -0,0 +1,13 @@
+export declare enum WorkerContextAttributionKind {
+    Session = "session",
+    Allocation = "allocation"
+}
+export interface WorkerContextAttribution {
+    readonly kind: WorkerContextAttributionKind;
+    readonly id: string;
+}
+export interface VerifiedWorkerContext {
+    readonly mintedBy: string;
+    readonly attribution?: WorkerContextAttribution;
+}
+//# sourceMappingURL=worker-context.d.ts.map

package/dist/caller-context/lib/worker-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-context.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/worker-context.ts"],"names":[],"mappings":"AASA,oBAAY,4BAA4B;IACtC,OAAO,YAAY;IACnB,UAAU,eAAe;CAC1B;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACjD"}

package/dist/caller-context/lib/worker-context.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkerContextAttributionKind = void 0;
+var WorkerContextAttributionKind;
+(function (WorkerContextAttributionKind) {
+    WorkerContextAttributionKind["Session"] = "session";
+    WorkerContextAttributionKind["Allocation"] = "allocation";
+})(WorkerContextAttributionKind || (exports.WorkerContextAttributionKind = WorkerContextAttributionKind = {}));
+//# sourceMappingURL=worker-context.js.map

package/dist/caller-context/lib/worker-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-context.js","sourceRoot":"","sources":["../../../src/caller-context/lib/worker-context.ts"],"names":[],"mappings":";;;AASA,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IACtC,mDAAmB,CAAA;IACnB,yDAAyB,CAAA;AAC3B,CAAC,EAHW,4BAA4B,4CAA5B,4BAA4B,QAGvC"}

package/dist/caller-context/lib/workflow-step-credential.d.ts

@@ -0,0 +1,120 @@
+import { z } from 'zod';
+import { type CapabilityRef } from '../../capability';
+import type { ReceiverAudience } from './receiver-audience';
+export declare const WORKFLOW_STEP_CREDENTIAL_HEADER = "X-Xema-Workflow-Step-Credential";
+export declare const TASK_CONTEXT_CLAIM = "task_context";
+export declare const WORKFLOW_STEP_TASK_CONTEXT_KIND = "workflow-step";
+export declare const WORKFLOW_STEP_CREDENTIAL_MAX_LIFETIME_SECONDS = 60;
+export declare enum WorkflowStepInitiatorKind {
+    User = "user",
+    Delegation = "delegation"
+}
+export declare const WorkflowStepContextClaimSchema: z.ZodObject<{
+    installation_id: z.ZodString;
+    workflow_definition_id: z.ZodString;
+    workflow_revision: z.ZodNumber;
+    run_id: z.ZodString;
+    job_key: z.ZodString;
+    matrix_index: z.ZodNullable<z.ZodNumber>;
+    attempt: z.ZodNumber;
+    org_id: z.ZodString;
+    project_id: z.ZodNullable<z.ZodString>;
+    resource_scope: z.ZodArray<z.ZodString>;
+    capability_ref: z.ZodType<CapabilityRef, unknown, z.core.$ZodTypeInternals<CapabilityRef, unknown>>;
+    initiator: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<WorkflowStepInitiatorKind.User>;
+        user_id: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<WorkflowStepInitiatorKind.Delegation>;
+        delegation_id: z.ZodString;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+export declare const WorkflowStepTaskContextClaimSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"workflow-step">;
+    asserted_by: z.ZodString;
+    context: z.ZodObject<{
+        installation_id: z.ZodString;
+        workflow_definition_id: z.ZodString;
+        workflow_revision: z.ZodNumber;
+        run_id: z.ZodString;
+        job_key: z.ZodString;
+        matrix_index: z.ZodNullable<z.ZodNumber>;
+        attempt: z.ZodNumber;
+        org_id: z.ZodString;
+        project_id: z.ZodNullable<z.ZodString>;
+        resource_scope: z.ZodArray<z.ZodString>;
+        capability_ref: z.ZodType<CapabilityRef, unknown, z.core.$ZodTypeInternals<CapabilityRef, unknown>>;
+        initiator: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<WorkflowStepInitiatorKind.User>;
+            user_id: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<WorkflowStepInitiatorKind.Delegation>;
+            delegation_id: z.ZodString;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type WorkflowStepContextClaim = z.infer<typeof WorkflowStepContextClaimSchema>;
+export type WorkflowStepTaskContextClaim = z.infer<typeof WorkflowStepTaskContextClaimSchema>;
+export type WorkflowStepInitiator = {
+    readonly kind: WorkflowStepInitiatorKind.User;
+    readonly userId: string;
+} | {
+    readonly kind: WorkflowStepInitiatorKind.Delegation;
+    readonly delegationId: string;
+};
+export interface WorkflowStepContext {
+    readonly installationId: string;
+    readonly workflowDefinitionId: string;
+    readonly workflowRevision: number;
+    readonly runId: string;
+    readonly jobKey: string;
+    readonly matrixIndex: number | null;
+    readonly attempt: number;
+    readonly orgId: string;
+    readonly projectId: string | null;
+    readonly resourceScope: readonly string[];
+    readonly capabilityRef: CapabilityRef;
+    readonly initiator: WorkflowStepInitiator;
+    readonly installedWorkloadSubject: string;
+    readonly stepExecutor: string;
+    readonly jti: string;
+}
+export interface ProvedWorkflowStepCredential {
+    readonly claims: Readonly<Record<string, unknown>>;
+    readonly receiverAudience: ReceiverAudience | undefined;
+}
+export interface WorkflowStepExpectation {
+    readonly capabilityRef: CapabilityRef;
+    readonly orgId: string;
+    readonly projectId: string | null;
+    readonly audience: ReceiverAudience;
+    readonly installedWorkload: string;
+    readonly stepExecutors: readonly string[];
+    readonly nowSeconds: number;
+}
+export declare enum WorkflowStepCredentialRefusal {
+    NotAStepCredential = "WORKFLOW_STEP_CREDENTIAL_ABSENT",
+    Malformed = "WORKFLOW_STEP_CREDENTIAL_MALFORMED",
+    Expired = "WORKFLOW_STEP_CREDENTIAL_EXPIRED",
+    MissingJti = "WORKFLOW_STEP_CREDENTIAL_JTI_MISSING",
+    WrongAudience = "WORKFLOW_STEP_CREDENTIAL_WRONG_AUDIENCE",
+    ActorInvalid = "WORKFLOW_STEP_CREDENTIAL_ACTOR_INVALID",
+    SubjectNotWorkload = "WORKFLOW_STEP_CREDENTIAL_SUBJECT_NOT_WORKLOAD",
+    WrongInstalledWorkload = "WORKFLOW_STEP_CREDENTIAL_WRONG_INSTALLED_WORKLOAD",
+    UndeclaredStepExecutor = "WORKFLOW_STEP_CREDENTIAL_UNDECLARED_EXECUTOR",
+    Replayed = "WORKFLOW_STEP_CREDENTIAL_REPLAYED",
+    WrongCapability = "WORKFLOW_STEP_CREDENTIAL_WRONG_CAPABILITY",
+    WrongOrg = "WORKFLOW_STEP_CREDENTIAL_WRONG_ORG",
+    WrongProject = "WORKFLOW_STEP_CREDENTIAL_WRONG_PROJECT"
+}
+export type WorkflowStepVerdict = {
+    readonly admitted: true;
+    readonly step: WorkflowStepContext;
+} | {
+    readonly admitted: false;
+    readonly refusal: WorkflowStepCredentialRefusal;
+    readonly detail: string;
+};
+export declare function statesWorkflowStepCredential(claims: Readonly<Record<string, unknown>>): boolean;
+export declare function verifyWorkflowStepCredential(claims: Readonly<Record<string, unknown>>, expected: WorkflowStepExpectation): WorkflowStepVerdict;
+//# sourceMappingURL=workflow-step-credential.d.ts.map

package/dist/caller-context/lib/workflow-step-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-step-credential.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/workflow-step-credential.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ5D,eAAO,MAAM,+BAA+B,oCAAoC,CAAC;AAGjF,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAGjD,eAAO,MAAM,+BAA+B,kBAAkB,CAAC;AAG/D,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAOhE,oBAAY,yBAAyB;IAEnC,IAAI,SAAS;IAKb,UAAU,eAAe;CAC1B;AAYD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;kBAehC,CAAC;AAGZ,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;kBAMpC,CAAC;AAEZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAG9F,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,UAAU,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAG3F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAE1C,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAE1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAOD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACzD;AAGD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAEtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAGD,oBAAY,6BAA6B;IAEvC,kBAAkB,oCAAoC;IAEtD,SAAS,uCAAuC;IAEhD,OAAO,qCAAqC;IAE5C,UAAU,yCAAyC;IAEnD,aAAa,4CAA4C;IAEzD,YAAY,2CAA2C;IAEvD,kBAAkB,kDAAkD;IAEpE,sBAAsB,sDAAsD;IAE5E,sBAAsB,iDAAiD;IAEvE,QAAQ,sCAAsC;IAE9C,eAAe,8CAA8C;IAE7D,QAAQ,uCAAuC;IAE/C,YAAY,2CAA2C;CACxD;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC/D;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,6BAA6B,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAwBN,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAG/F;AAUD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,QAAQ,EAAE,uBAAuB,GAChC,mBAAmB,CAuIrB"}

package/dist/caller-context/lib/workflow-step-credential.js

@@ -0,0 +1,169 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowStepCredentialRefusal = exports.WorkflowStepTaskContextClaimSchema = exports.WorkflowStepContextClaimSchema = exports.WorkflowStepInitiatorKind = exports.WORKFLOW_STEP_CREDENTIAL_MAX_LIFETIME_SECONDS = exports.WORKFLOW_STEP_TASK_CONTEXT_KIND = exports.TASK_CONTEXT_CLAIM = exports.WORKFLOW_STEP_CREDENTIAL_HEADER = void 0;
+exports.statesWorkflowStepCredential = statesWorkflowStepCredential;
+exports.verifyWorkflowStepCredential = verifyWorkflowStepCredential;
+const zod_1 = require("zod");
+const capability_1 = require("../../capability");
+const org_claim_1 = require("./org-claim");
+exports.WORKFLOW_STEP_CREDENTIAL_HEADER = 'X-Xema-Workflow-Step-Credential';
+exports.TASK_CONTEXT_CLAIM = 'task_context';
+exports.WORKFLOW_STEP_TASK_CONTEXT_KIND = 'workflow-step';
+exports.WORKFLOW_STEP_CREDENTIAL_MAX_LIFETIME_SECONDS = 60;
+const WORKLOAD_SUBJECT_KIND = 'workload';
+const SUBJECT_KIND = 'subject_kind';
+var WorkflowStepInitiatorKind;
+(function (WorkflowStepInitiatorKind) {
+    WorkflowStepInitiatorKind["User"] = "user";
+    WorkflowStepInitiatorKind["Delegation"] = "delegation";
+})(WorkflowStepInitiatorKind || (exports.WorkflowStepInitiatorKind = WorkflowStepInitiatorKind = {}));
+const NonEmpty = zod_1.z.string().min(1).max(256);
+const WorkflowStepInitiatorClaimSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({ kind: zod_1.z.literal(WorkflowStepInitiatorKind.User), user_id: NonEmpty }).strict(),
+    zod_1.z
+        .object({ kind: zod_1.z.literal(WorkflowStepInitiatorKind.Delegation), delegation_id: NonEmpty })
+        .strict(),
+]);
+exports.WorkflowStepContextClaimSchema = zod_1.z
+    .object({
+    installation_id: NonEmpty,
+    workflow_definition_id: NonEmpty,
+    workflow_revision: zod_1.z.number().int().min(1),
+    run_id: NonEmpty,
+    job_key: NonEmpty,
+    matrix_index: zod_1.z.number().int().min(0).nullable(),
+    attempt: zod_1.z.number().int().min(1),
+    org_id: NonEmpty,
+    project_id: NonEmpty.nullable(),
+    resource_scope: zod_1.z.array(NonEmpty).max(64),
+    capability_ref: capability_1.CapabilityRefSchema,
+    initiator: WorkflowStepInitiatorClaimSchema,
+})
+    .strict();
+exports.WorkflowStepTaskContextClaimSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(exports.WORKFLOW_STEP_TASK_CONTEXT_KIND),
+    asserted_by: NonEmpty,
+    context: exports.WorkflowStepContextClaimSchema,
+})
+    .strict();
+var WorkflowStepCredentialRefusal;
+(function (WorkflowStepCredentialRefusal) {
+    WorkflowStepCredentialRefusal["NotAStepCredential"] = "WORKFLOW_STEP_CREDENTIAL_ABSENT";
+    WorkflowStepCredentialRefusal["Malformed"] = "WORKFLOW_STEP_CREDENTIAL_MALFORMED";
+    WorkflowStepCredentialRefusal["Expired"] = "WORKFLOW_STEP_CREDENTIAL_EXPIRED";
+    WorkflowStepCredentialRefusal["MissingJti"] = "WORKFLOW_STEP_CREDENTIAL_JTI_MISSING";
+    WorkflowStepCredentialRefusal["WrongAudience"] = "WORKFLOW_STEP_CREDENTIAL_WRONG_AUDIENCE";
+    WorkflowStepCredentialRefusal["ActorInvalid"] = "WORKFLOW_STEP_CREDENTIAL_ACTOR_INVALID";
+    WorkflowStepCredentialRefusal["SubjectNotWorkload"] = "WORKFLOW_STEP_CREDENTIAL_SUBJECT_NOT_WORKLOAD";
+    WorkflowStepCredentialRefusal["WrongInstalledWorkload"] = "WORKFLOW_STEP_CREDENTIAL_WRONG_INSTALLED_WORKLOAD";
+    WorkflowStepCredentialRefusal["UndeclaredStepExecutor"] = "WORKFLOW_STEP_CREDENTIAL_UNDECLARED_EXECUTOR";
+    WorkflowStepCredentialRefusal["Replayed"] = "WORKFLOW_STEP_CREDENTIAL_REPLAYED";
+    WorkflowStepCredentialRefusal["WrongCapability"] = "WORKFLOW_STEP_CREDENTIAL_WRONG_CAPABILITY";
+    WorkflowStepCredentialRefusal["WrongOrg"] = "WORKFLOW_STEP_CREDENTIAL_WRONG_ORG";
+    WorkflowStepCredentialRefusal["WrongProject"] = "WORKFLOW_STEP_CREDENTIAL_WRONG_PROJECT";
+})(WorkflowStepCredentialRefusal || (exports.WorkflowStepCredentialRefusal = WorkflowStepCredentialRefusal = {}));
+function refuse(refusal, detail) {
+    return { admitted: false, refusal, detail };
+}
+function isObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function nonEmptyString(value) {
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+function audiencesOf(aud) {
+    if (typeof aud === 'string')
+        return [aud];
+    return Array.isArray(aud) ? aud.filter((a) => typeof a === 'string') : [];
+}
+function statesWorkflowStepCredential(claims) {
+    const raw = claims[exports.TASK_CONTEXT_CLAIM];
+    return isObject(raw) && raw['kind'] === exports.WORKFLOW_STEP_TASK_CONTEXT_KIND;
+}
+function verifyWorkflowStepCredential(claims, expected) {
+    if (expected.stepExecutors.length === 0) {
+        throw new Error('verifyWorkflowStepCredential: no step executor is declared, so no step credential can be admitted.');
+    }
+    if (!statesWorkflowStepCredential(claims)) {
+        return refuse(WorkflowStepCredentialRefusal.NotAStepCredential, `the context carries no "${exports.TASK_CONTEXT_CLAIM}" of kind "${exports.WORKFLOW_STEP_TASK_CONTEXT_KIND}".`);
+    }
+    const parsed = exports.WorkflowStepTaskContextClaimSchema.safeParse(claims[exports.TASK_CONTEXT_CLAIM]);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        return refuse(WorkflowStepCredentialRefusal.Malformed, `"${exports.TASK_CONTEXT_CLAIM}.${issue?.path.join('.') ?? ''}": ${issue?.message ?? 'invalid'}.`);
+    }
+    const task = parsed.data;
+    const context = task.context;
+    const exp = claims['exp'];
+    const iat = claims['iat'];
+    if (typeof exp !== 'number' || typeof iat !== 'number') {
+        return refuse(WorkflowStepCredentialRefusal.Expired, 'it states no numeric exp and iat.');
+    }
+    if (exp - iat > exports.WORKFLOW_STEP_CREDENTIAL_MAX_LIFETIME_SECONDS) {
+        return refuse(WorkflowStepCredentialRefusal.Expired, `its lifetime ${exp - iat}s exceeds ${exports.WORKFLOW_STEP_CREDENTIAL_MAX_LIFETIME_SECONDS}s.`);
+    }
+    if (expected.nowSeconds >= exp) {
+        return refuse(WorkflowStepCredentialRefusal.Expired, 'it has expired.');
+    }
+    const jti = nonEmptyString(claims['jti']);
+    if (jti === undefined) {
+        return refuse(WorkflowStepCredentialRefusal.MissingJti, 'it states no jti.');
+    }
+    if (!audiencesOf(claims['aud']).includes(expected.audience)) {
+        return refuse(WorkflowStepCredentialRefusal.WrongAudience, `its aud does not name ${expected.audience}.`);
+    }
+    const sub = nonEmptyString(claims['sub']);
+    if (sub === undefined || claims[SUBJECT_KIND] !== WORKLOAD_SUBJECT_KIND) {
+        return refuse(WorkflowStepCredentialRefusal.SubjectNotWorkload, 'its subject is not an installed workload.');
+    }
+    if (nonEmptyString(claims['workload_name']) !== expected.installedWorkload) {
+        return refuse(WorkflowStepCredentialRefusal.WrongInstalledWorkload, `its signed workload_name is absent or is not '${expected.installedWorkload}'.`);
+    }
+    const act = claims['act'];
+    if (!isObject(act) ||
+        nonEmptyString(act['sub']) === undefined ||
+        act[SUBJECT_KIND] !== WORKLOAD_SUBJECT_KIND ||
+        act['act'] !== undefined) {
+        return refuse(WorkflowStepCredentialRefusal.ActorInvalid, 'its act must be exactly one workload hop, the step executor.');
+    }
+    if (!expected.stepExecutors.includes(task.asserted_by)) {
+        return refuse(WorkflowStepCredentialRefusal.UndeclaredStepExecutor, `'${task.asserted_by}' is not a declared step executor.`);
+    }
+    if (context.capability_ref !== expected.capabilityRef) {
+        return refuse(WorkflowStepCredentialRefusal.WrongCapability, `it was minted for ${context.capability_ref}, not ${expected.capabilityRef}.`);
+    }
+    if (context.org_id !== expected.orgId || claims[org_claim_1.OrgClaimKey.Canonical] !== context.org_id) {
+        return refuse(WorkflowStepCredentialRefusal.WrongOrg, 'its org is not the org of the call, or its tenant claim disagrees with it.');
+    }
+    if (context.project_id !== expected.projectId) {
+        return refuse(WorkflowStepCredentialRefusal.WrongProject, 'its project is not the project of the call.');
+    }
+    const initiator = context.initiator.kind === WorkflowStepInitiatorKind.User
+        ? { kind: WorkflowStepInitiatorKind.User, userId: context.initiator.user_id }
+        : {
+            kind: WorkflowStepInitiatorKind.Delegation,
+            delegationId: context.initiator.delegation_id,
+        };
+    return {
+        admitted: true,
+        step: Object.freeze({
+            installationId: context.installation_id,
+            workflowDefinitionId: context.workflow_definition_id,
+            workflowRevision: context.workflow_revision,
+            runId: context.run_id,
+            jobKey: context.job_key,
+            matrixIndex: context.matrix_index,
+            attempt: context.attempt,
+            orgId: context.org_id,
+            projectId: context.project_id,
+            resourceScope: Object.freeze([...context.resource_scope]),
+            capabilityRef: context.capability_ref,
+            initiator: Object.freeze(initiator),
+            installedWorkloadSubject: sub,
+            stepExecutor: task.asserted_by,
+            jti,
+        }),
+    };
+}
+//# sourceMappingURL=workflow-step-credential.js.map

package/dist/caller-context/lib/workflow-step-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-step-credential.js","sourceRoot":"","sources":["../../../src/caller-context/lib/workflow-step-credential.ts"],"names":[],"mappings":";;;AAkOA,oEAGC;AAUD,oEA0IC;AAvVD,6BAAwB;AACxB,iDAA2E;AAE3E,2CAA0C;AAS7B,QAAA,+BAA+B,GAAG,iCAAiC,CAAC;AAGpE,QAAA,kBAAkB,GAAG,cAAc,CAAC;AAGpC,QAAA,+BAA+B,GAAG,eAAe,CAAC;AAGlD,QAAA,6CAA6C,GAAG,EAAE,CAAC;AAGhE,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC,MAAM,YAAY,GAAG,cAAc,CAAC;AAGpC,IAAY,yBAQX;AARD,WAAY,yBAAyB;IAEnC,0CAAa,CAAA;IAKb,sDAAyB,CAAA;AAC3B,CAAC,EARW,yBAAyB,yCAAzB,yBAAyB,QAQpC;AAED,MAAM,QAAQ,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE5C,MAAM,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpE,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACzF,OAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;SAC1F,MAAM,EAAE;CACZ,CAAC,CAAC;AAGU,QAAA,8BAA8B,GAAG,OAAC;KAC5C,MAAM,CAAC;IACN,eAAe,EAAE,QAAQ;IACzB,sBAAsB,EAAE,QAAQ;IAChC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACzC,cAAc,EAAE,gCAAmB;IACnC,SAAS,EAAE,gCAAgC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAGC,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,uCAA+B,CAAC;IAChD,WAAW,EAAE,QAAQ;IACrB,OAAO,EAAE,sCAA8B;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AA6DZ,IAAY,6BA2BX;AA3BD,WAAY,6BAA6B;IAEvC,uFAAsD,CAAA;IAEtD,iFAAgD,CAAA;IAEhD,6EAA4C,CAAA;IAE5C,oFAAmD,CAAA;IAEnD,0FAAyD,CAAA;IAEzD,wFAAuD,CAAA;IAEvD,qGAAoE,CAAA;IAEpE,6GAA4E,CAAA;IAE5E,wGAAuE,CAAA;IAEvE,+EAA8C,CAAA;IAE9C,8FAA6D,CAAA;IAE7D,gFAA+C,CAAA;IAE/C,wFAAuD,CAAA;AACzD,CAAC,EA3BW,6BAA6B,6CAA7B,6BAA6B,QA2BxC;AAUD,SAAS,MAAM,CAAC,OAAsC,EAAE,MAAc;IACpE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzF,CAAC;AAOD,SAAgB,4BAA4B,CAAC,MAAyC;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,0BAAkB,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,uCAA+B,CAAC;AAC1E,CAAC;AAUD,SAAgB,4BAA4B,CAC1C,MAAyC,EACzC,QAAiC;IAEjC,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,OAAO,MAAM,CACX,6BAA6B,CAAC,kBAAkB,EAChD,2BAA2B,0BAAkB,cAAc,uCAA+B,IAAI,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,0CAAkC,CAAC,SAAS,CAAC,MAAM,CAAC,0BAAkB,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,MAAM,CACX,6BAA6B,CAAC,SAAS,EACvC,IAAI,0BAAkB,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,EAAE,OAAO,IAAI,SAAS,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC,6BAA6B,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,GAAG,qDAA6C,EAAE,CAAC;QAC9D,OAAO,MAAM,CACX,6BAA6B,CAAC,OAAO,EACrC,gBAAgB,GAAG,GAAG,GAAG,aAAa,qDAA6C,IAAI,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,6BAA6B,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,6BAA6B,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,OAAO,MAAM,CACX,6BAA6B,CAAC,aAAa,EAC3C,yBAAyB,QAAQ,CAAC,QAAQ,GAAG,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,qBAAqB,EAAE,CAAC;QACxE,OAAO,MAAM,CACX,6BAA6B,CAAC,kBAAkB,EAChD,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAID,IAAI,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC3E,OAAO,MAAM,CACX,6BAA6B,CAAC,sBAAsB,EACpD,iDAAiD,QAAQ,CAAC,iBAAiB,IAAI,CAChF,CAAC;IACJ,CAAC;IAOD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC;QACd,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS;QACxC,GAAG,CAAC,YAAY,CAAC,KAAK,qBAAqB;QAC3C,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,EACxB,CAAC;QACD,OAAO,MAAM,CACX,6BAA6B,CAAC,YAAY,EAC1C,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,OAAO,MAAM,CACX,6BAA6B,CAAC,sBAAsB,EACpD,IAAI,IAAI,CAAC,WAAW,oCAAoC,CACzD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACtD,OAAO,MAAM,CACX,6BAA6B,CAAC,eAAe,EAC7C,qBAAqB,OAAO,CAAC,cAAc,SAAS,QAAQ,CAAC,aAAa,GAAG,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,uBAAW,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1F,OAAO,MAAM,CACX,6BAA6B,CAAC,QAAQ,EACtC,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC9C,OAAO,MAAM,CACX,6BAA6B,CAAC,YAAY,EAC1C,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,yBAAyB,CAAC,IAAI;QACvD,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE;QAC7E,CAAC,CAAC;YACE,IAAI,EAAE,yBAAyB,CAAC,UAAU;YAC1C,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa;SAC9C,CAAC;IACR,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,cAAc,EAAE,OAAO,CAAC,eAAe;YACvC,oBAAoB,EAAE,OAAO,CAAC,sBAAsB;YACpD,gBAAgB,EAAE,OAAO,CAAC,iBAAiB;YAC3C,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,WAAW,EAAE,OAAO,CAAC,YAAY;YACjC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;YACzD,aAAa,EAAE,OAAO,CAAC,cAAc;YACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACnC,wBAAwB,EAAE,GAAG;YAC7B,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,GAAG;SACJ,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/capability/index.d.ts

@@ -1,7 +1,8 @@
+export * from './lib/capability-ref-error';
 export * from './lib/capability-ref';
 export * from './lib/capability-ref-pattern';
 export * from './lib/connector-capability-ref';
-export * from './lib/capability-domain';
+export * from '../capability-domain';
 export * from './lib/authority-effect';
 export * from './lib/capability-reach';
 export * from './lib/capability-effect-class';
@@ -9,6 +10,7 @@ export * from './lib/capability-aperture';
 export * from './lib/capability-agent-exposure';
 export * from './lib/capability-delegable';
 export * from './lib/capability-descriptor-kind';
+export * from './lib/capability-caller-constraint';
 export * from './lib/capability-human-baseline';
 export * from './lib/capability-grant';
 export * from './lib/capability-policy';
@@ -19,7 +21,5 @@ export * from './lib/effective-capability-set';
 export * from './lib/required-resource-role-binding';
 export * from './lib/capability-contribution';
 export * from './lib/trusted-context-projection';
-export * from './lib/errors';
-export * from './lib/capability-invocation-descriptor';
 export * from './lib/long-running-invocation';
 //# sourceMappingURL=index.d.ts.map

package/dist/capability/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,cAAc,CAAC;AAC7B,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC"}

package/dist/capability/index.js

@@ -14,10 +14,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/capability-ref-error"), exports);
 __exportStar(require("./lib/capability-ref"), exports);
 __exportStar(require("./lib/capability-ref-pattern"), exports);
 __exportStar(require("./lib/connector-capability-ref"), exports);
-__exportStar(require("./lib/capability-domain"), exports);
+__exportStar(require("../capability-domain"), exports);
 __exportStar(require("./lib/authority-effect"), exports);
 __exportStar(require("./lib/capability-reach"), exports);
 __exportStar(require("./lib/capability-effect-class"), exports);
@@ -25,6 +26,7 @@ __exportStar(require("./lib/capability-aperture"), exports);
 __exportStar(require("./lib/capability-agent-exposure"), exports);
 __exportStar(require("./lib/capability-delegable"), exports);
 __exportStar(require("./lib/capability-descriptor-kind"), exports);
+__exportStar(require("./lib/capability-caller-constraint"), exports);
 __exportStar(require("./lib/capability-human-baseline"), exports);
 __exportStar(require("./lib/capability-grant"), exports);
 __exportStar(require("./lib/capability-policy"), exports);
@@ -35,7 +37,5 @@ __exportStar(require("./lib/effective-capability-set"), exports);
 __exportStar(require("./lib/required-resource-role-binding"), exports);
 __exportStar(require("./lib/capability-contribution"), exports);
 __exportStar(require("./lib/trusted-context-projection"), exports);
-__exportStar(require("./lib/errors"), exports);
-__exportStar(require("./lib/capability-invocation-descriptor"), exports);
 __exportStar(require("./lib/long-running-invocation"), exports);
 //# sourceMappingURL=index.js.map

package/dist/capability/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,+DAA6C;AAC7C,iEAA+C;AAC/C,0DAAwC;AACxC,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,4DAA0C;AAC1C,kEAAgD;AAChD,6DAA2C;AAC3C,mEAAiD;AACjD,kEAAgD;AAChD,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,iEAA+C;AAC/C,uEAAqD;AACrD,gEAA8C;AAC9C,mEAAiD;AACjD,+CAA6B;AAC7B,yEAAuD;AACvD,gEAA8C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6DAA2C;AAC3C,uDAAqC;AACrC,+DAA6C;AAC7C,iEAA+C;AAC/C,uDAAqC;AACrC,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,4DAA0C;AAC1C,kEAAgD;AAChD,6DAA2C;AAC3C,mEAAiD;AACjD,qEAAmD;AACnD,kEAAgD;AAChD,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,iEAA+C;AAC/C,uEAAqD;AACrD,gEAA8C;AAC9C,mEAAiD;AACjD,gEAA8C"}

package/dist/capability/lib/capability-aperture.js

@@ -15,7 +15,7 @@ exports.apertureRequiresLivePrincipalBinding = apertureRequiresLivePrincipalBind
 exports.apertureEnumeratesNothing = apertureEnumeratesNothing;
 const zod_1 = require("zod");
 const capability_effect_class_1 = require("./capability-effect-class");
-const capability_domain_1 = require("./capability-domain");
+const capability_domain_1 = require("../../capability-domain");
 const capability_ref_1 = require("./capability-ref");
 const capability_ref_pattern_1 = require("./capability-ref-pattern");
 var CapabilityApertureKind;