@xemahq/contracts 0.82.0 → 0.83.0

package/dist/caller-context/lib/acting-chain.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActingChain = void 0;
+exports.classifyActingChain = classifyActingChain;
+exports.actingChainOf = actingChainOf;
+exports.isRecordedDelegation = isRecordedDelegation;
+exports.isUnrecordedActingChain = isUnrecordedActingChain;
+const subject_1 = require("../../subject");
+var ActingChain;
+(function (ActingChain) {
+    ActingChain["Direct"] = "direct";
+    ActingChain["RecordedDelegation"] = "recorded-delegation";
+    ActingChain["WorkflowStepCredential"] = "workflow-step-credential";
+    ActingChain["OnBehalfOf"] = "on-behalf-of";
+    ActingChain["Unrecorded"] = "unrecorded";
+})(ActingChain || (exports.ActingChain = ActingChain = {}));
+function classifyActingChain(facts) {
+    if (facts.hops === 0)
+        return ActingChain.Direct;
+    if (facts.delegationId !== undefined && facts.delegationId !== '') {
+        return ActingChain.RecordedDelegation;
+    }
+    if (facts.hops !== 1)
+        return ActingChain.Unrecorded;
+    if (facts.statesWorkflowStepCredential) {
+        return facts.subjectKind === subject_1.SubjectKind.Service
+            ? ActingChain.WorkflowStepCredential
+            : ActingChain.Unrecorded;
+    }
+    return facts.subjectKind === subject_1.SubjectKind.User ? ActingChain.OnBehalfOf : ActingChain.Unrecorded;
+}
+function actingChainOf(ctx) {
+    return classifyActingChain({
+        hops: ctx.actorChain.length,
+        delegationId: ctx.delegationId,
+        subjectKind: ctx.subject.kind,
+        statesWorkflowStepCredential: ctx.workflowStepCredential !== undefined,
+    });
+}
+function isRecordedDelegation(ctx) {
+    return actingChainOf(ctx) === ActingChain.RecordedDelegation;
+}
+function isUnrecordedActingChain(chain) {
+    return chain !== ActingChain.Direct && chain !== ActingChain.RecordedDelegation;
+}
+//# sourceMappingURL=acting-chain.js.map

package/dist/caller-context/lib/acting-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acting-chain.js","sourceRoot":"","sources":["../../../src/caller-context/lib/acting-chain.ts"],"names":[],"mappings":";;;AA6CA,kDAYC;AAGD,sCASC;AAGD,oDAIC;AAGD,0DAEC;AAjFD,2CAA4C;AAW5C,IAAY,WAmBX;AAnBD,WAAY,WAAW;IAErB,gCAAiB,CAAA;IAEjB,yDAA0C,CAAA;IAM1C,kEAAmD,CAAA;IAMnD,0CAA2B,CAAA;IAE3B,wCAAyB,CAAA;AAC3B,CAAC,EAnBW,WAAW,2BAAX,WAAW,QAmBtB;AAeD,SAAgB,mBAAmB,CAAC,KAAuB;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC;IAChD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAClE,OAAO,WAAW,CAAC,kBAAkB,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,UAAU,CAAC;IACpD,IAAI,KAAK,CAAC,4BAA4B,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,WAAW,KAAK,qBAAW,CAAC,OAAO;YAC9C,CAAC,CAAC,WAAW,CAAC,sBAAsB;YACpC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,KAAK,qBAAW,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC;AAClG,CAAC;AAGD,SAAgB,aAAa,CAC3B,GAA+F;IAE/F,OAAO,mBAAmB,CAAC;QACzB,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM;QAC3B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;QAC7B,4BAA4B,EAAE,GAAG,CAAC,sBAAsB,KAAK,SAAS;KACvE,CAAC,CAAC;AACL,CAAC;AAGD,SAAgB,oBAAoB,CAClC,GAA+F;IAE/F,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,kBAAkB,CAAC;AAC/D,CAAC;AAGD,SAAgB,uBAAuB,CAAC,KAAkB;IACxD,OAAO,KAAK,KAAK,WAAW,CAAC,MAAM,IAAI,KAAK,KAAK,WAAW,CAAC,kBAAkB,CAAC;AAClF,CAAC"}

package/dist/caller-context/lib/org-authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-authority.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/org-authority.ts"],"names":[],"mappings":"AA8IA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAahD,oBAAY,kBAAkB;IAE5B,QAAQ,cAAc;IAEtB,aAAa,mBAAmB;IAKhC,aAAa,oBAAoB;IAYjC,aAAa,mBAAmB;IAgBhC,qBAAqB,4BAA4B;IAKjD,QAAQ,oBAAoB;CAC7B;AAaD,MAAM,WAAW,kBAAkB;IAQjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAMlC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAGD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAEpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAO/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2BD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,kBAAkB,GACzB,mBAAmB,CA6DrB;AAGD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAW1E;AAYD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAWT;AAQD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B"}
+{"version":3,"file":"org-authority.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/org-authority.ts"],"names":[],"mappings":"AA8IA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAahD,oBAAY,kBAAkB;IAE5B,QAAQ,cAAc;IAEtB,aAAa,mBAAmB;IAKhC,aAAa,oBAAoB;IAYjC,aAAa,mBAAmB;IAkBhC,qBAAqB,4BAA4B;IAKjD,QAAQ,oBAAoB;CAC7B;AAaD,MAAM,WAAW,kBAAkB;IAQjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAMlC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAGD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAEpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAO/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2BD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,kBAAkB,GACzB,mBAAmB,CA6DrB;AAGD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAW1E;AAYD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAWT;AAQD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B"}

package/dist/caller-context/lib/org-authority.js.map

@@ -1 +1 @@
-{"version":3,"file":"org-authority.js","sourceRoot":"","sources":["../../../src/caller-context/lib/org-authority.ts"],"names":[],"mappings":";;;AA6QA,kDAiEC;AAGD,oDAWC;AAYD,8DAaC;AAvOD,2CAA4C;AAG5C,2CAA8C;AAC9C,yCAA6C;AAU7C,IAAY,kBA2CX;AA3CD,WAAY,kBAAkB;IAE5B,4CAAsB,CAAA;IAEtB,sDAAgC,CAAA;IAKhC,uDAAiC,CAAA;IAYjC,sDAAgC,CAAA;IAgBhC,uEAAiD,CAAA;IAKjD,kDAA4B,CAAA;AAC9B,CAAC,EA3CW,kBAAkB,kCAAlB,kBAAkB,QA2C7B;AAsED,SAAgB,mBAAmB,CACjC,MAA+B,EAC/B,aAAqB,EACrB,MAA0B;IAE1B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAI1B,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;YACxC,aAAa,EAAE,EAAE;YACjB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;YACzD,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,QAAQ;gBACnC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB,CAAC;IACR,CAAC;IAKD,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7C,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;YAChD,OAAO;gBACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAaD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,qBAAW,CAAC,OAAO,EAAE,CAAC;QACpE,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,qBAAqB;YAChD,aAAa,EAAE,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAGD,SAAgB,oBAAoB,CAAC,OAA4B;IAC/D,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,qBAAqB,CAAC;QAC9C,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAYD,SAAgB,yBAAyB,CACvC,OAA4B;IAE5B,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,qBAAqB,CAAC;QAC9C,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}
+{"version":3,"file":"org-authority.js","sourceRoot":"","sources":["../../../src/caller-context/lib/org-authority.ts"],"names":[],"mappings":";;;AA+QA,kDAiEC;AAGD,oDAWC;AAYD,8DAaC;AAzOD,2CAA4C;AAG5C,2CAA8C;AAC9C,yCAA6C;AAU7C,IAAY,kBA6CX;AA7CD,WAAY,kBAAkB;IAE5B,4CAAsB,CAAA;IAEtB,sDAAgC,CAAA;IAKhC,uDAAiC,CAAA;IAYjC,sDAAgC,CAAA;IAkBhC,uEAAiD,CAAA;IAKjD,kDAA4B,CAAA;AAC9B,CAAC,EA7CW,kBAAkB,kCAAlB,kBAAkB,QA6C7B;AAsED,SAAgB,mBAAmB,CACjC,MAA+B,EAC/B,aAAqB,EACrB,MAA0B;IAE1B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAI1B,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;YACxC,aAAa,EAAE,EAAE;YACjB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;YACzD,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,QAAQ;gBACnC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB,CAAC;IACR,CAAC;IAKD,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7C,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;YAChD,OAAO;gBACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAaD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,qBAAW,CAAC,OAAO,EAAE,CAAC;QACpE,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,qBAAqB;YAChD,aAAa,EAAE,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAGD,SAAgB,oBAAoB,CAAC,OAA4B;IAC/D,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,qBAAqB,CAAC;QAC9C,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAYD,SAAgB,yBAAyB,CACvC,OAA4B;IAE5B,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,qBAAqB,CAAC;QAC9C,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/caller-context/lib/platform-sweep.d.ts

@@ -20,7 +20,11 @@ export declare enum PlatformSweepReach {
     ConnectorInstallationVerify = "connector:installation-verify@1",
     AuditCapabilityUsageRead = "audit:capability-usage.read@1",
     LegalHoldResolve = "legal-hold:resolve@1",
-    AuthorizationFactsSnapshot = "authorization-facts:snapshot@1"
+    AuthorizationFactsSnapshot = "authorization-facts:snapshot@1",
+    OrgDatabasePoolInstallationCleanup = "org-database-pool:installation-cleanup.write@1",
+    DeliverableSpecsInstallationCleanup = "deliverable-specs:installation-cleanup.write@1",
+    WorkflowEngineInstallationCleanup = "workflow-engine:installation-cleanup.write@1",
+    McpGatewayInstallationCleanup = "mcp-gateway:installation-cleanup.write@1"
 }
 export declare const PLATFORM_SWEEP_REACH: Readonly<Record<PlatformSweep, readonly PlatformSweepReach[]>>;
 export declare function parsePlatformSweep(name: string): PlatformSweep | undefined;

package/dist/caller-context/lib/platform-sweep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-sweep.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/platform-sweep.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAOhE,OAAO,EAAE,aAAa,EAAE,CAAC;AAOzB,oBAAY,kBAAkB;IAE5B,uBAAuB,iCAAiC;IAExD,iBAAiB,yBAAyB;IAM1C,eAAe,uBAAuB;IAEtC,gBAAgB,wBAAwB;IAKxC,yBAAyB,kCAAkC;IAK3D,qBAAqB,8BAA8B;IAMnD,QAAQ,6BAA6B;IAKrC,wBAAwB,kCAAkC;IAO1D,YAAY,qBAAqB;IAKjC,mBAAmB,4BAA4B;IAK/C,kCAAkC,4CAA4C;IAK9E,wBAAwB,mCAAmC;IAE3D,wBAAwB,iCAAiC;IAMzD,qBAAqB,2DAA2D;IAEhF,2BAA2B,oCAAoC;IAK/D,wBAAwB,kCAAkC;IAK1D,gBAAgB,yBAAyB;IAMzC,0BAA0B,mCAAmC;CAC9D;AAGD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CACzC,MAAM,CAAC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC,CA8CrD,CAAC;AAKF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE1E;AAID,OAAO,CAAC,MAAM,0BAA0B,EAAE,OAAO,MAAM,CAAC;AAQxD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,KAAK,EAAE,aAAa;gBAApB,KAAK,EAAE,aAAa;CAI1C;AAOD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAM1F;AAKD,oBAAY,oBAAoB;IAE9B,OAAO,aAAa;IAEpB,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,WAAW,iBAAiB;IAE5B,UAAU,iBAAiB;CAC5B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IAEvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAYD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC,GAAG,qBAAqB,GAAG,oBAAoB,CAqC/C"}
+{"version":3,"file":"platform-sweep.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/platform-sweep.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAOhE,OAAO,EAAE,aAAa,EAAE,CAAC;AAOzB,oBAAY,kBAAkB;IAE5B,uBAAuB,iCAAiC;IAExD,iBAAiB,yBAAyB;IAM1C,eAAe,uBAAuB;IAEtC,gBAAgB,wBAAwB;IAKxC,yBAAyB,kCAAkC;IAK3D,qBAAqB,8BAA8B;IAMnD,QAAQ,6BAA6B;IAKrC,wBAAwB,kCAAkC;IAO1D,YAAY,qBAAqB;IAKjC,mBAAmB,4BAA4B;IAK/C,kCAAkC,4CAA4C;IAK9E,wBAAwB,mCAAmC;IAE3D,wBAAwB,iCAAiC;IAMzD,qBAAqB,2DAA2D;IAEhF,2BAA2B,oCAAoC;IAK/D,wBAAwB,kCAAkC;IAK1D,gBAAgB,yBAAyB;IAMzC,0BAA0B,mCAAmC;IAE7D,kCAAkC,mDAAmD;IAErF,mCAAmC,mDAAmD;IAEtF,iCAAiC,iDAAiD;IAElF,6BAA6B,6CAA6C;CAC3E;AAGD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CACzC,MAAM,CAAC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAqDrD,CAAC;AAKF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE1E;AAID,OAAO,CAAC,MAAM,0BAA0B,EAAE,OAAO,MAAM,CAAC;AAQxD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,KAAK,EAAE,aAAa;gBAApB,KAAK,EAAE,aAAa;CAI1C;AAOD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAM1F;AAKD,oBAAY,oBAAoB;IAE9B,OAAO,aAAa;IAEpB,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,WAAW,iBAAiB;IAE5B,UAAU,iBAAiB;CAC5B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IAEvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAYD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC,GAAG,qBAAqB,GAAG,oBAAoB,CAqC/C"}

package/dist/caller-context/lib/platform-sweep.js

@@ -27,6 +27,10 @@ var PlatformSweepReach;
     PlatformSweepReach["AuditCapabilityUsageRead"] = "audit:capability-usage.read@1";
     PlatformSweepReach["LegalHoldResolve"] = "legal-hold:resolve@1";
     PlatformSweepReach["AuthorizationFactsSnapshot"] = "authorization-facts:snapshot@1";
+    PlatformSweepReach["OrgDatabasePoolInstallationCleanup"] = "org-database-pool:installation-cleanup.write@1";
+    PlatformSweepReach["DeliverableSpecsInstallationCleanup"] = "deliverable-specs:installation-cleanup.write@1";
+    PlatformSweepReach["WorkflowEngineInstallationCleanup"] = "workflow-engine:installation-cleanup.write@1";
+    PlatformSweepReach["McpGatewayInstallationCleanup"] = "mcp-gateway:installation-cleanup.write@1";
 })(PlatformSweepReach || (exports.PlatformSweepReach = PlatformSweepReach = {}));
 exports.PLATFORM_SWEEP_REACH = {
     [deployment_1.PlatformSweep.EraseSweep]: [PlatformSweepReach.CredentialResolve, PlatformSweepReach.CredentialRevoke],
@@ -59,6 +63,12 @@ exports.PLATFORM_SWEEP_REACH = {
     [deployment_1.PlatformSweep.ScmProjectBindingMaintenance]: [PlatformSweepReach.ResourceRoleBindingWrite],
     [deployment_1.PlatformSweep.ContributionConvergence]: [PlatformSweepReach.ContributionOrgSync],
     [deployment_1.PlatformSweep.RetentionExpiryErasure]: [PlatformSweepReach.LegalHoldResolve],
+    [deployment_1.PlatformSweep.InstallationCleanup]: [
+        PlatformSweepReach.OrgDatabasePoolInstallationCleanup,
+        PlatformSweepReach.DeliverableSpecsInstallationCleanup,
+        PlatformSweepReach.WorkflowEngineInstallationCleanup,
+        PlatformSweepReach.McpGatewayInstallationCleanup,
+    ],
 };
 const SWEEP_VALUES = new Set(Object.values(deployment_1.PlatformSweep));
 function parsePlatformSweep(name) {

package/dist/caller-context/lib/platform-sweep.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-sweep.js","sourceRoot":"","sources":["../../../src/caller-context/lib/platform-sweep.ts"],"names":[],"mappings":";;;AA2MA,gDAEC;AA+BD,gDAMC;AA6CD,gDA4CC;AA1RD,iDAAiD;AAUxC,8FAVA,0BAAa,OAUA;AARtB,mDAA+E;AAe/E,IAAY,kBAkFX;AAlFD,WAAY,kBAAkB;IAE5B,8EAAwD,CAAA;IAExD,gEAA0C,CAAA;IAM1C,4DAAsC,CAAA;IAEtC,8DAAwC,CAAA;IAKxC,iFAA2D,CAAA;IAK3D,yEAAmD,CAAA;IAMnD,2DAAqC,CAAA;IAKrC,gFAA0D,CAAA;IAO1D,uDAAiC,CAAA;IAKjC,qEAA+C,CAAA;IAK/C,oGAA8E,CAAA;IAK9E,iFAA2D,CAAA;IAE3D,+EAAyD,CAAA;IAMzD,sGAAgF,CAAA;IAEhF,qFAA+D,CAAA;IAK/D,gFAA0D,CAAA;IAK1D,+DAAyC,CAAA;IAMzC,mFAA6D,CAAA;AAC/D,CAAC,EAlFW,kBAAkB,kCAAlB,kBAAkB,QAkF7B;AAGY,QAAA,oBAAoB,GAE7B;IAIF,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;IAEvG,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE;QAC1B,kBAAkB,CAAC,YAAY;QAC/B,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,gBAAgB;KACpC;IAED,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;IAEzD,CAAC,0BAAa,CAAC,gBAAgB,CAAC,EAAE;QAChC,kBAAkB,CAAC,uBAAuB;QAC1C,kBAAkB,CAAC,kCAAkC;QACrD,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,0BAA0B;KAC9C;IAED,CAAC,0BAAa,CAAC,sBAAsB,CAAC,EAAE;QACtC,kBAAkB,CAAC,iBAAiB;QACpC,kBAAkB,CAAC,eAAe;QAClC,kBAAkB,CAAC,gBAAgB;QACnC,kBAAkB,CAAC,2BAA2B;KAC/C;IAED,CAAC,0BAAa,CAAC,iBAAiB,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,eAAe,CAAC;IAE7G,CAAC,0BAAa,CAAC,qBAAqB,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,CAAC;IAE7E,CAAC,0BAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,CAAC,yBAAyB,CAAC;IAElF,CAAC,0BAAa,CAAC,kBAAkB,CAAC,EAAE;QAClC,kBAAkB,CAAC,qBAAqB;QACxC,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,qBAAqB;KACzC;IAED,CAAC,0BAAa,CAAC,4BAA4B,CAAC,EAAE,CAAC,kBAAkB,CAAC,wBAAwB,CAAC;IAE3F,CAAC,0BAAa,CAAC,uBAAuB,CAAC,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;IAEjF,CAAC,0BAAa,CAAC,sBAAsB,CAAC,EAAE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;CAC9E,CAAC;AAEF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAAa,CAAC,CAAC,CAAC;AAGhF,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAmBD,MAAa,uBAAwB,SAAQ,KAAK;IAC3B;IAArB,YAAqB,KAAoB;QACvC,KAAK,CAAC,qBAAqB,KAAK,4DAA4D,CAAC,CAAC;QAD3E,UAAK,GAAL,KAAK,CAAe;QAEvC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAOD,SAAgB,kBAAkB,CAAC,KAAoB,EAAE,KAAa;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAwB,CAAC;AACzD,CAAC;AAKD,IAAY,oBAWX;AAXD,WAAY,oBAAoB;IAE9B,4CAAoB,CAAA;IAEpB,sDAA8B,CAAA;IAE9B,0DAAkC,CAAA;IAElC,oDAA4B,CAAA;IAE5B,mDAA2B,CAAA;AAC7B,CAAC,EAXW,oBAAoB,oCAApB,oBAAoB,QAW/B;AA6BD,SAAgB,kBAAkB,CAAC,KAOlC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACpE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAG9C,MAAM,UAAU,GACd,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,kCAAkB,CAAC,QAAQ;QACxD,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,IACE,UAAU,KAAK,SAAS;QACxB,UAAU,KAAK,EAAE;QACjB,SAAS,KAAK,EAAE;QAChB,UAAU,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EACpD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,CAAE,4BAAoB,CAAC,KAAK,CAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,KAAK;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"platform-sweep.js","sourceRoot":"","sources":["../../../src/caller-context/lib/platform-sweep.ts"],"names":[],"mappings":";;;AA0NA,gDAEC;AA+BD,gDAMC;AA6CD,gDA4CC;AAzSD,iDAAiD;AAUxC,8FAVA,0BAAa,OAUA;AARtB,mDAA+E;AAe/E,IAAY,kBA0FX;AA1FD,WAAY,kBAAkB;IAE5B,8EAAwD,CAAA;IAExD,gEAA0C,CAAA;IAM1C,4DAAsC,CAAA;IAEtC,8DAAwC,CAAA;IAKxC,iFAA2D,CAAA;IAK3D,yEAAmD,CAAA;IAMnD,2DAAqC,CAAA;IAKrC,gFAA0D,CAAA;IAO1D,uDAAiC,CAAA;IAKjC,qEAA+C,CAAA;IAK/C,oGAA8E,CAAA;IAK9E,iFAA2D,CAAA;IAE3D,+EAAyD,CAAA;IAMzD,sGAAgF,CAAA;IAEhF,qFAA+D,CAAA;IAK/D,gFAA0D,CAAA;IAK1D,+DAAyC,CAAA;IAMzC,mFAA6D,CAAA;IAE7D,2GAAqF,CAAA;IAErF,4GAAsF,CAAA;IAEtF,wGAAkF,CAAA;IAElF,gGAA0E,CAAA;AAC5E,CAAC,EA1FW,kBAAkB,kCAAlB,kBAAkB,QA0F7B;AAGY,QAAA,oBAAoB,GAE7B;IAIF,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;IAEvG,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE;QAC1B,kBAAkB,CAAC,YAAY;QAC/B,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,gBAAgB;KACpC;IAED,CAAC,0BAAa,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;IAEzD,CAAC,0BAAa,CAAC,gBAAgB,CAAC,EAAE;QAChC,kBAAkB,CAAC,uBAAuB;QAC1C,kBAAkB,CAAC,kCAAkC;QACrD,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,0BAA0B;KAC9C;IAED,CAAC,0BAAa,CAAC,sBAAsB,CAAC,EAAE;QACtC,kBAAkB,CAAC,iBAAiB;QACpC,kBAAkB,CAAC,eAAe;QAClC,kBAAkB,CAAC,gBAAgB;QACnC,kBAAkB,CAAC,2BAA2B;KAC/C;IAED,CAAC,0BAAa,CAAC,iBAAiB,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,eAAe,CAAC;IAE7G,CAAC,0BAAa,CAAC,qBAAqB,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,CAAC;IAE7E,CAAC,0BAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,CAAC,yBAAyB,CAAC;IAElF,CAAC,0BAAa,CAAC,kBAAkB,CAAC,EAAE;QAClC,kBAAkB,CAAC,qBAAqB;QACxC,kBAAkB,CAAC,wBAAwB;QAC3C,kBAAkB,CAAC,qBAAqB;KACzC;IAED,CAAC,0BAAa,CAAC,4BAA4B,CAAC,EAAE,CAAC,kBAAkB,CAAC,wBAAwB,CAAC;IAE3F,CAAC,0BAAa,CAAC,uBAAuB,CAAC,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;IAEjF,CAAC,0BAAa,CAAC,sBAAsB,CAAC,EAAE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;IAE7E,CAAC,0BAAa,CAAC,mBAAmB,CAAC,EAAE;QACnC,kBAAkB,CAAC,kCAAkC;QACrD,kBAAkB,CAAC,mCAAmC;QACtD,kBAAkB,CAAC,iCAAiC;QACpD,kBAAkB,CAAC,6BAA6B;KACjD;CACF,CAAC;AAEF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAAa,CAAC,CAAC,CAAC;AAGhF,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAmBD,MAAa,uBAAwB,SAAQ,KAAK;IAC3B;IAArB,YAAqB,KAAoB;QACvC,KAAK,CAAC,qBAAqB,KAAK,4DAA4D,CAAC,CAAC;QAD3E,UAAK,GAAL,KAAK,CAAe;QAEvC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAOD,SAAgB,kBAAkB,CAAC,KAAoB,EAAE,KAAa;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAwB,CAAC;AACzD,CAAC;AAKD,IAAY,oBAWX;AAXD,WAAY,oBAAoB;IAE9B,4CAAoB,CAAA;IAEpB,sDAA8B,CAAA;IAE9B,0DAAkC,CAAA;IAElC,oDAA4B,CAAA;IAE5B,mDAA2B,CAAA;AAC7B,CAAC,EAXW,oBAAoB,oCAApB,oBAAoB,QAW/B;AA6BD,SAAgB,kBAAkB,CAAC,KAOlC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACpE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAG9C,MAAM,UAAU,GACd,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,kCAAkB,CAAC,QAAQ;QACxD,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,IACE,UAAU,KAAK,SAAS;QACxB,UAAU,KAAK,EAAE;QACjB,SAAS,KAAK,EAAE;QAChB,UAAU,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EACpD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,CAAE,4BAAoB,CAAC,KAAK,CAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,KAAK;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC"}

package/dist/caller-context/lib/request-context.d.ts

@@ -4,6 +4,7 @@ import type { OrgAuthorityVerdict } from './org-authority';
 import type { AdmittedPlatformSweep } from './platform-sweep';
 import type { LentCapabilityAdmission } from './lent-capability';
 import type { VerifiedWorkerContext } from './worker-context';
+import type { ProvedWorkflowStepCredential } from './workflow-step-credential';
 import type { OrgRole } from '../../tenant';
 import type { PipelineApprovalMode } from './approval-mode';
 export interface RequestContext {
@@ -35,6 +36,7 @@ export interface RequestContext {
     admittedPlatformSweep?: AdmittedPlatformSweep;
     presentingService?: string;
     workerContext?: VerifiedWorkerContext;
+    workflowStepCredential?: ProvedWorkflowStepCredential;
     roles: string[];
     realmId?: string;
     issuer?: string;

package/dist/caller-context/lib/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EACZ,kBAAkB,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,MAAM,WAAW,cAAc;IAQ7B,KAAK,EAAE,MAAM,CAAC;IAyBd,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IAMnB,OAAO,EAAE,UAAU,CAAC;IAOpB,UAAU,EAAE,UAAU,CAAC;IAMvB,UAAU,EAAE,YAAY,EAAE,CAAC;IAE3B,OAAO,EAAE,MAAM,CAAC;IAMhB,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IASzC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IASnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAmC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAyBlB,WAAW,CAAC,EAAE,MAAM,CAAC;IAyBrB,aAAa,CAAC,EAAE,MAAM,CAAC;IAcvB,cAAc,CAAC,EAAE,OAAO,CAAC;IAUzB,aAAa,CAAC,EAAE,MAAM,CAAC;IAWvB,gBAAgB,CAAC,EAAE,IAAI,CAAC;IAWxB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IASnC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAU9C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAkB3B,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAEtC,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;IAQjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAYhB,KAAK,CAAC,EAAE,MAAM,CAAC;IAgBf,YAAY,CAAC,EAAE,MAAM,CAAC;IA2BtB,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAQhC,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD;AAeD,eAAO,MAAM,eAAe,eAAqD,CAAC;AAalF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAQ7D;AASD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CA+B5E"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EACZ,kBAAkB,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,MAAM,WAAW,cAAc;IAQ7B,KAAK,EAAE,MAAM,CAAC;IAyBd,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IAMnB,OAAO,EAAE,UAAU,CAAC;IAOpB,UAAU,EAAE,UAAU,CAAC;IAMvB,UAAU,EAAE,YAAY,EAAE,CAAC;IAE3B,OAAO,EAAE,MAAM,CAAC;IAMhB,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IASzC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IASnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAmC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAyBlB,WAAW,CAAC,EAAE,MAAM,CAAC;IAyBrB,aAAa,CAAC,EAAE,MAAM,CAAC;IAcvB,cAAc,CAAC,EAAE,OAAO,CAAC;IAUzB,aAAa,CAAC,EAAE,MAAM,CAAC;IAWvB,gBAAgB,CAAC,EAAE,IAAI,CAAC;IAWxB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IASnC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAU9C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAkB3B,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAQtC,sBAAsB,CAAC,EAAE,4BAA4B,CAAC;IAEtD,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;IAQjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAYhB,KAAK,CAAC,EAAE,MAAM,CAAC;IAgBf,YAAY,CAAC,EAAE,MAAM,CAAC;IA2BtB,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAQhC,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD;AAeD,eAAO,MAAM,eAAe,eAAqD,CAAC;AAalF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAQ7D;AASD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CA+B5E"}

package/dist/caller-context/lib/request-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../../src/caller-context/lib/request-context.ts"],"names":[],"mappings":";;;AAuXA,8CAQC;AASD,oDA+BC;AA7DY,QAAA,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AAalF,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,MAAM,MAAM,GAAI,GAA+B,CAAC,uBAAe,CAAC,CAAC;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAwB,CAAC;IAClC,CAAC;IAoBD,MAAM,GAAG,GAAI,GAAyB,CAAC,GAAG,CAAC;IAC3C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAQ,GAA+B,CAAC,uBAAe,CAE1C,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../../src/caller-context/lib/request-context.ts"],"names":[],"mappings":";;;AAgYA,8CAQC;AASD,oDA+BC;AA7DY,QAAA,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AAalF,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,MAAM,MAAM,GAAI,GAA+B,CAAC,uBAAe,CAAC,CAAC;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAwB,CAAC;IAClC,CAAC;IAoBD,MAAM,GAAG,GAAI,GAAyB,CAAC,GAAG,CAAC;IAC3C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAQ,GAA+B,CAAC,uBAAe,CAE1C,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/caller-context/lib/workflow-step-credential.d.ts

@@ -0,0 +1,120 @@
+import { z } from 'zod';
+import { type CapabilityRef } from '../../capability';
+import type { ReceiverAudience } from './receiver-audience';
+export declare const WORKFLOW_STEP_CREDENTIAL_HEADER = "X-Xema-Workflow-Step-Credential";
+export declare const TASK_CONTEXT_CLAIM = "task_context";
+export declare const WORKFLOW_STEP_TASK_CONTEXT_KIND = "workflow-step";
+export declare const WORKFLOW_STEP_CREDENTIAL_MAX_LIFETIME_SECONDS = 60;
+export declare enum WorkflowStepInitiatorKind {
+    User = "user",
+    Delegation = "delegation"
+}
+export declare const WorkflowStepContextClaimSchema: z.ZodObject<{
+    installation_id: z.ZodString;
+    workflow_definition_id: z.ZodString;
+    workflow_revision: z.ZodNumber;
+    run_id: z.ZodString;
+    job_key: z.ZodString;
+    matrix_index: z.ZodNullable<z.ZodNumber>;
+    attempt: z.ZodNumber;
+    org_id: z.ZodString;
+    project_id: z.ZodNullable<z.ZodString>;
+    resource_scope: z.ZodArray<z.ZodString>;
+    capability_ref: z.ZodType<CapabilityRef, unknown, z.core.$ZodTypeInternals<CapabilityRef, unknown>>;
+    initiator: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<WorkflowStepInitiatorKind.User>;
+        user_id: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<WorkflowStepInitiatorKind.Delegation>;
+        delegation_id: z.ZodString;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+export declare const WorkflowStepTaskContextClaimSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"workflow-step">;
+    asserted_by: z.ZodString;
+    context: z.ZodObject<{
+        installation_id: z.ZodString;
+        workflow_definition_id: z.ZodString;
+        workflow_revision: z.ZodNumber;
+        run_id: z.ZodString;
+        job_key: z.ZodString;
+        matrix_index: z.ZodNullable<z.ZodNumber>;
+        attempt: z.ZodNumber;
+        org_id: z.ZodString;
+        project_id: z.ZodNullable<z.ZodString>;
+        resource_scope: z.ZodArray<z.ZodString>;
+        capability_ref: z.ZodType<CapabilityRef, unknown, z.core.$ZodTypeInternals<CapabilityRef, unknown>>;
+        initiator: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<WorkflowStepInitiatorKind.User>;
+            user_id: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<WorkflowStepInitiatorKind.Delegation>;
+            delegation_id: z.ZodString;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type WorkflowStepContextClaim = z.infer<typeof WorkflowStepContextClaimSchema>;
+export type WorkflowStepTaskContextClaim = z.infer<typeof WorkflowStepTaskContextClaimSchema>;
+export type WorkflowStepInitiator = {
+    readonly kind: WorkflowStepInitiatorKind.User;
+    readonly userId: string;
+} | {
+    readonly kind: WorkflowStepInitiatorKind.Delegation;
+    readonly delegationId: string;
+};
+export interface WorkflowStepContext {
+    readonly installationId: string;
+    readonly workflowDefinitionId: string;
+    readonly workflowRevision: number;
+    readonly runId: string;
+    readonly jobKey: string;
+    readonly matrixIndex: number | null;
+    readonly attempt: number;
+    readonly orgId: string;
+    readonly projectId: string | null;
+    readonly resourceScope: readonly string[];
+    readonly capabilityRef: CapabilityRef;
+    readonly initiator: WorkflowStepInitiator;
+    readonly installedWorkloadSubject: string;
+    readonly stepExecutor: string;
+    readonly jti: string;
+}
+export interface ProvedWorkflowStepCredential {
+    readonly claims: Readonly<Record<string, unknown>>;
+    readonly receiverAudience: ReceiverAudience | undefined;
+}
+export interface WorkflowStepExpectation {
+    readonly capabilityRef: CapabilityRef;
+    readonly orgId: string;
+    readonly projectId: string | null;
+    readonly audience: ReceiverAudience;
+    readonly installedWorkload: string;
+    readonly stepExecutors: readonly string[];
+    readonly nowSeconds: number;
+}
+export declare enum WorkflowStepCredentialRefusal {
+    NotAStepCredential = "WORKFLOW_STEP_CREDENTIAL_ABSENT",
+    Malformed = "WORKFLOW_STEP_CREDENTIAL_MALFORMED",
+    Expired = "WORKFLOW_STEP_CREDENTIAL_EXPIRED",
+    MissingJti = "WORKFLOW_STEP_CREDENTIAL_JTI_MISSING",
+    WrongAudience = "WORKFLOW_STEP_CREDENTIAL_WRONG_AUDIENCE",
+    ActorInvalid = "WORKFLOW_STEP_CREDENTIAL_ACTOR_INVALID",
+    SubjectNotWorkload = "WORKFLOW_STEP_CREDENTIAL_SUBJECT_NOT_WORKLOAD",
+    WrongInstalledWorkload = "WORKFLOW_STEP_CREDENTIAL_WRONG_INSTALLED_WORKLOAD",
+    UndeclaredStepExecutor = "WORKFLOW_STEP_CREDENTIAL_UNDECLARED_EXECUTOR",
+    Replayed = "WORKFLOW_STEP_CREDENTIAL_REPLAYED",
+    WrongCapability = "WORKFLOW_STEP_CREDENTIAL_WRONG_CAPABILITY",
+    WrongOrg = "WORKFLOW_STEP_CREDENTIAL_WRONG_ORG",
+    WrongProject = "WORKFLOW_STEP_CREDENTIAL_WRONG_PROJECT"
+}
+export type WorkflowStepVerdict = {
+    readonly admitted: true;
+    readonly step: WorkflowStepContext;
+} | {
+    readonly admitted: false;
+    readonly refusal: WorkflowStepCredentialRefusal;
+    readonly detail: string;
+};
+export declare function statesWorkflowStepCredential(claims: Readonly<Record<string, unknown>>): boolean;
+export declare function verifyWorkflowStepCredential(claims: Readonly<Record<string, unknown>>, expected: WorkflowStepExpectation): WorkflowStepVerdict;
+//# sourceMappingURL=workflow-step-credential.d.ts.map

package/dist/caller-context/lib/workflow-step-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-step-credential.d.ts","sourceRoot":"","sources":["../../../src/caller-context/lib/workflow-step-credential.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ5D,eAAO,MAAM,+BAA+B,oCAAoC,CAAC;AAGjF,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAGjD,eAAO,MAAM,+BAA+B,kBAAkB,CAAC;AAG/D,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAOhE,oBAAY,yBAAyB;IAEnC,IAAI,SAAS;IAKb,UAAU,eAAe;CAC1B;AAYD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;kBAehC,CAAC;AAGZ,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;kBAMpC,CAAC;AAEZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAG9F,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,UAAU,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAG3F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAE1C,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAE1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAOD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACzD;AAGD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAEtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAGD,oBAAY,6BAA6B;IAEvC,kBAAkB,oCAAoC;IAEtD,SAAS,uCAAuC;IAEhD,OAAO,qCAAqC;IAE5C,UAAU,yCAAyC;IAEnD,aAAa,4CAA4C;IAEzD,YAAY,2CAA2C;IAEvD,kBAAkB,kDAAkD;IAEpE,sBAAsB,sDAAsD;IAE5E,sBAAsB,iDAAiD;IAEvE,QAAQ,sCAAsC;IAE9C,eAAe,8CAA8C;IAE7D,QAAQ,uCAAuC;IAE/C,YAAY,2CAA2C;CACxD;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC/D;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,6BAA6B,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAwBN,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAG/F;AAUD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,QAAQ,EAAE,uBAAuB,GAChC,mBAAmB,CAuIrB"}

package/dist/caller-context/lib/workflow-step-credential.js

@@ -0,0 +1,169 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowStepCredentialRefusal = exports.WorkflowStepTaskContextClaimSchema = exports.WorkflowStepContextClaimSchema = exports.WorkflowStepInitiatorKind = exports.WORKFLOW_STEP_CREDENTIAL_MAX_LIFETIME_SECONDS = exports.WORKFLOW_STEP_TASK_CONTEXT_KIND = exports.TASK_CONTEXT_CLAIM = exports.WORKFLOW_STEP_CREDENTIAL_HEADER = void 0;
+exports.statesWorkflowStepCredential = statesWorkflowStepCredential;
+exports.verifyWorkflowStepCredential = verifyWorkflowStepCredential;
+const zod_1 = require("zod");
+const capability_1 = require("../../capability");
+const org_claim_1 = require("./org-claim");
+exports.WORKFLOW_STEP_CREDENTIAL_HEADER = 'X-Xema-Workflow-Step-Credential';
+exports.TASK_CONTEXT_CLAIM = 'task_context';
+exports.WORKFLOW_STEP_TASK_CONTEXT_KIND = 'workflow-step';
+exports.WORKFLOW_STEP_CREDENTIAL_MAX_LIFETIME_SECONDS = 60;
+const WORKLOAD_SUBJECT_KIND = 'workload';
+const SUBJECT_KIND = 'subject_kind';
+var WorkflowStepInitiatorKind;
+(function (WorkflowStepInitiatorKind) {
+    WorkflowStepInitiatorKind["User"] = "user";
+    WorkflowStepInitiatorKind["Delegation"] = "delegation";
+})(WorkflowStepInitiatorKind || (exports.WorkflowStepInitiatorKind = WorkflowStepInitiatorKind = {}));
+const NonEmpty = zod_1.z.string().min(1).max(256);
+const WorkflowStepInitiatorClaimSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({ kind: zod_1.z.literal(WorkflowStepInitiatorKind.User), user_id: NonEmpty }).strict(),
+    zod_1.z
+        .object({ kind: zod_1.z.literal(WorkflowStepInitiatorKind.Delegation), delegation_id: NonEmpty })
+        .strict(),
+]);
+exports.WorkflowStepContextClaimSchema = zod_1.z
+    .object({
+    installation_id: NonEmpty,
+    workflow_definition_id: NonEmpty,
+    workflow_revision: zod_1.z.number().int().min(1),
+    run_id: NonEmpty,
+    job_key: NonEmpty,
+    matrix_index: zod_1.z.number().int().min(0).nullable(),
+    attempt: zod_1.z.number().int().min(1),
+    org_id: NonEmpty,
+    project_id: NonEmpty.nullable(),
+    resource_scope: zod_1.z.array(NonEmpty).max(64),
+    capability_ref: capability_1.CapabilityRefSchema,
+    initiator: WorkflowStepInitiatorClaimSchema,
+})
+    .strict();
+exports.WorkflowStepTaskContextClaimSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(exports.WORKFLOW_STEP_TASK_CONTEXT_KIND),
+    asserted_by: NonEmpty,
+    context: exports.WorkflowStepContextClaimSchema,
+})
+    .strict();
+var WorkflowStepCredentialRefusal;
+(function (WorkflowStepCredentialRefusal) {
+    WorkflowStepCredentialRefusal["NotAStepCredential"] = "WORKFLOW_STEP_CREDENTIAL_ABSENT";
+    WorkflowStepCredentialRefusal["Malformed"] = "WORKFLOW_STEP_CREDENTIAL_MALFORMED";
+    WorkflowStepCredentialRefusal["Expired"] = "WORKFLOW_STEP_CREDENTIAL_EXPIRED";
+    WorkflowStepCredentialRefusal["MissingJti"] = "WORKFLOW_STEP_CREDENTIAL_JTI_MISSING";
+    WorkflowStepCredentialRefusal["WrongAudience"] = "WORKFLOW_STEP_CREDENTIAL_WRONG_AUDIENCE";
+    WorkflowStepCredentialRefusal["ActorInvalid"] = "WORKFLOW_STEP_CREDENTIAL_ACTOR_INVALID";
+    WorkflowStepCredentialRefusal["SubjectNotWorkload"] = "WORKFLOW_STEP_CREDENTIAL_SUBJECT_NOT_WORKLOAD";
+    WorkflowStepCredentialRefusal["WrongInstalledWorkload"] = "WORKFLOW_STEP_CREDENTIAL_WRONG_INSTALLED_WORKLOAD";
+    WorkflowStepCredentialRefusal["UndeclaredStepExecutor"] = "WORKFLOW_STEP_CREDENTIAL_UNDECLARED_EXECUTOR";
+    WorkflowStepCredentialRefusal["Replayed"] = "WORKFLOW_STEP_CREDENTIAL_REPLAYED";
+    WorkflowStepCredentialRefusal["WrongCapability"] = "WORKFLOW_STEP_CREDENTIAL_WRONG_CAPABILITY";
+    WorkflowStepCredentialRefusal["WrongOrg"] = "WORKFLOW_STEP_CREDENTIAL_WRONG_ORG";
+    WorkflowStepCredentialRefusal["WrongProject"] = "WORKFLOW_STEP_CREDENTIAL_WRONG_PROJECT";
+})(WorkflowStepCredentialRefusal || (exports.WorkflowStepCredentialRefusal = WorkflowStepCredentialRefusal = {}));
+function refuse(refusal, detail) {
+    return { admitted: false, refusal, detail };
+}
+function isObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function nonEmptyString(value) {
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+function audiencesOf(aud) {
+    if (typeof aud === 'string')
+        return [aud];
+    return Array.isArray(aud) ? aud.filter((a) => typeof a === 'string') : [];
+}
+function statesWorkflowStepCredential(claims) {
+    const raw = claims[exports.TASK_CONTEXT_CLAIM];
+    return isObject(raw) && raw['kind'] === exports.WORKFLOW_STEP_TASK_CONTEXT_KIND;
+}
+function verifyWorkflowStepCredential(claims, expected) {
+    if (expected.stepExecutors.length === 0) {
+        throw new Error('verifyWorkflowStepCredential: no step executor is declared, so no step credential can be admitted.');
+    }
+    if (!statesWorkflowStepCredential(claims)) {
+        return refuse(WorkflowStepCredentialRefusal.NotAStepCredential, `the context carries no "${exports.TASK_CONTEXT_CLAIM}" of kind "${exports.WORKFLOW_STEP_TASK_CONTEXT_KIND}".`);
+    }
+    const parsed = exports.WorkflowStepTaskContextClaimSchema.safeParse(claims[exports.TASK_CONTEXT_CLAIM]);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        return refuse(WorkflowStepCredentialRefusal.Malformed, `"${exports.TASK_CONTEXT_CLAIM}.${issue?.path.join('.') ?? ''}": ${issue?.message ?? 'invalid'}.`);
+    }
+    const task = parsed.data;
+    const context = task.context;
+    const exp = claims['exp'];
+    const iat = claims['iat'];
+    if (typeof exp !== 'number' || typeof iat !== 'number') {
+        return refuse(WorkflowStepCredentialRefusal.Expired, 'it states no numeric exp and iat.');
+    }
+    if (exp - iat > exports.WORKFLOW_STEP_CREDENTIAL_MAX_LIFETIME_SECONDS) {
+        return refuse(WorkflowStepCredentialRefusal.Expired, `its lifetime ${exp - iat}s exceeds ${exports.WORKFLOW_STEP_CREDENTIAL_MAX_LIFETIME_SECONDS}s.`);
+    }
+    if (expected.nowSeconds >= exp) {
+        return refuse(WorkflowStepCredentialRefusal.Expired, 'it has expired.');
+    }
+    const jti = nonEmptyString(claims['jti']);
+    if (jti === undefined) {
+        return refuse(WorkflowStepCredentialRefusal.MissingJti, 'it states no jti.');
+    }
+    if (!audiencesOf(claims['aud']).includes(expected.audience)) {
+        return refuse(WorkflowStepCredentialRefusal.WrongAudience, `its aud does not name ${expected.audience}.`);
+    }
+    const sub = nonEmptyString(claims['sub']);
+    if (sub === undefined || claims[SUBJECT_KIND] !== WORKLOAD_SUBJECT_KIND) {
+        return refuse(WorkflowStepCredentialRefusal.SubjectNotWorkload, 'its subject is not an installed workload.');
+    }
+    if (nonEmptyString(claims['workload_name']) !== expected.installedWorkload) {
+        return refuse(WorkflowStepCredentialRefusal.WrongInstalledWorkload, `its signed workload_name is absent or is not '${expected.installedWorkload}'.`);
+    }
+    const act = claims['act'];
+    if (!isObject(act) ||
+        nonEmptyString(act['sub']) === undefined ||
+        act[SUBJECT_KIND] !== WORKLOAD_SUBJECT_KIND ||
+        act['act'] !== undefined) {
+        return refuse(WorkflowStepCredentialRefusal.ActorInvalid, 'its act must be exactly one workload hop, the step executor.');
+    }
+    if (!expected.stepExecutors.includes(task.asserted_by)) {
+        return refuse(WorkflowStepCredentialRefusal.UndeclaredStepExecutor, `'${task.asserted_by}' is not a declared step executor.`);
+    }
+    if (context.capability_ref !== expected.capabilityRef) {
+        return refuse(WorkflowStepCredentialRefusal.WrongCapability, `it was minted for ${context.capability_ref}, not ${expected.capabilityRef}.`);
+    }
+    if (context.org_id !== expected.orgId || claims[org_claim_1.OrgClaimKey.Canonical] !== context.org_id) {
+        return refuse(WorkflowStepCredentialRefusal.WrongOrg, 'its org is not the org of the call, or its tenant claim disagrees with it.');
+    }
+    if (context.project_id !== expected.projectId) {
+        return refuse(WorkflowStepCredentialRefusal.WrongProject, 'its project is not the project of the call.');
+    }
+    const initiator = context.initiator.kind === WorkflowStepInitiatorKind.User
+        ? { kind: WorkflowStepInitiatorKind.User, userId: context.initiator.user_id }
+        : {
+            kind: WorkflowStepInitiatorKind.Delegation,
+            delegationId: context.initiator.delegation_id,
+        };
+    return {
+        admitted: true,
+        step: Object.freeze({
+            installationId: context.installation_id,
+            workflowDefinitionId: context.workflow_definition_id,
+            workflowRevision: context.workflow_revision,
+            runId: context.run_id,
+            jobKey: context.job_key,
+            matrixIndex: context.matrix_index,
+            attempt: context.attempt,
+            orgId: context.org_id,
+            projectId: context.project_id,
+            resourceScope: Object.freeze([...context.resource_scope]),
+            capabilityRef: context.capability_ref,
+            initiator: Object.freeze(initiator),
+            installedWorkloadSubject: sub,
+            stepExecutor: task.asserted_by,
+            jti,
+        }),
+    };
+}
+//# sourceMappingURL=workflow-step-credential.js.map

package/dist/caller-context/lib/workflow-step-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-step-credential.js","sourceRoot":"","sources":["../../../src/caller-context/lib/workflow-step-credential.ts"],"names":[],"mappings":";;;AAkOA,oEAGC;AAUD,oEA0IC;AAvVD,6BAAwB;AACxB,iDAA2E;AAE3E,2CAA0C;AAS7B,QAAA,+BAA+B,GAAG,iCAAiC,CAAC;AAGpE,QAAA,kBAAkB,GAAG,cAAc,CAAC;AAGpC,QAAA,+BAA+B,GAAG,eAAe,CAAC;AAGlD,QAAA,6CAA6C,GAAG,EAAE,CAAC;AAGhE,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC,MAAM,YAAY,GAAG,cAAc,CAAC;AAGpC,IAAY,yBAQX;AARD,WAAY,yBAAyB;IAEnC,0CAAa,CAAA;IAKb,sDAAyB,CAAA;AAC3B,CAAC,EARW,yBAAyB,yCAAzB,yBAAyB,QAQpC;AAED,MAAM,QAAQ,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE5C,MAAM,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpE,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACzF,OAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;SAC1F,MAAM,EAAE;CACZ,CAAC,CAAC;AAGU,QAAA,8BAA8B,GAAG,OAAC;KAC5C,MAAM,CAAC;IACN,eAAe,EAAE,QAAQ;IACzB,sBAAsB,EAAE,QAAQ;IAChC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACzC,cAAc,EAAE,gCAAmB;IACnC,SAAS,EAAE,gCAAgC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAGC,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,uCAA+B,CAAC;IAChD,WAAW,EAAE,QAAQ;IACrB,OAAO,EAAE,sCAA8B;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AA6DZ,IAAY,6BA2BX;AA3BD,WAAY,6BAA6B;IAEvC,uFAAsD,CAAA;IAEtD,iFAAgD,CAAA;IAEhD,6EAA4C,CAAA;IAE5C,oFAAmD,CAAA;IAEnD,0FAAyD,CAAA;IAEzD,wFAAuD,CAAA;IAEvD,qGAAoE,CAAA;IAEpE,6GAA4E,CAAA;IAE5E,wGAAuE,CAAA;IAEvE,+EAA8C,CAAA;IAE9C,8FAA6D,CAAA;IAE7D,gFAA+C,CAAA;IAE/C,wFAAuD,CAAA;AACzD,CAAC,EA3BW,6BAA6B,6CAA7B,6BAA6B,QA2BxC;AAUD,SAAS,MAAM,CAAC,OAAsC,EAAE,MAAc;IACpE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzF,CAAC;AAOD,SAAgB,4BAA4B,CAAC,MAAyC;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,0BAAkB,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,uCAA+B,CAAC;AAC1E,CAAC;AAUD,SAAgB,4BAA4B,CAC1C,MAAyC,EACzC,QAAiC;IAEjC,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,OAAO,MAAM,CACX,6BAA6B,CAAC,kBAAkB,EAChD,2BAA2B,0BAAkB,cAAc,uCAA+B,IAAI,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,0CAAkC,CAAC,SAAS,CAAC,MAAM,CAAC,0BAAkB,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,MAAM,CACX,6BAA6B,CAAC,SAAS,EACvC,IAAI,0BAAkB,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,EAAE,OAAO,IAAI,SAAS,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC,6BAA6B,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,GAAG,qDAA6C,EAAE,CAAC;QAC9D,OAAO,MAAM,CACX,6BAA6B,CAAC,OAAO,EACrC,gBAAgB,GAAG,GAAG,GAAG,aAAa,qDAA6C,IAAI,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,6BAA6B,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,6BAA6B,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,OAAO,MAAM,CACX,6BAA6B,CAAC,aAAa,EAC3C,yBAAyB,QAAQ,CAAC,QAAQ,GAAG,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,qBAAqB,EAAE,CAAC;QACxE,OAAO,MAAM,CACX,6BAA6B,CAAC,kBAAkB,EAChD,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAID,IAAI,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC3E,OAAO,MAAM,CACX,6BAA6B,CAAC,sBAAsB,EACpD,iDAAiD,QAAQ,CAAC,iBAAiB,IAAI,CAChF,CAAC;IACJ,CAAC;IAOD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC;QACd,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS;QACxC,GAAG,CAAC,YAAY,CAAC,KAAK,qBAAqB;QAC3C,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,EACxB,CAAC;QACD,OAAO,MAAM,CACX,6BAA6B,CAAC,YAAY,EAC1C,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,OAAO,MAAM,CACX,6BAA6B,CAAC,sBAAsB,EACpD,IAAI,IAAI,CAAC,WAAW,oCAAoC,CACzD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACtD,OAAO,MAAM,CACX,6BAA6B,CAAC,eAAe,EAC7C,qBAAqB,OAAO,CAAC,cAAc,SAAS,QAAQ,CAAC,aAAa,GAAG,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,uBAAW,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1F,OAAO,MAAM,CACX,6BAA6B,CAAC,QAAQ,EACtC,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC9C,OAAO,MAAM,CACX,6BAA6B,CAAC,YAAY,EAC1C,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,yBAAyB,CAAC,IAAI;QACvD,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE;QAC7E,CAAC,CAAC;YACE,IAAI,EAAE,yBAAyB,CAAC,UAAU;YAC1C,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa;SAC9C,CAAC;IACR,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,cAAc,EAAE,OAAO,CAAC,eAAe;YACvC,oBAAoB,EAAE,OAAO,CAAC,sBAAsB;YACpD,gBAAgB,EAAE,OAAO,CAAC,iBAAiB;YAC3C,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,WAAW,EAAE,OAAO,CAAC,YAAY;YACjC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;YACzD,aAAa,EAAE,OAAO,CAAC,cAAc;YACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACnC,wBAAwB,EAAE,GAAG;YAC7B,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,GAAG;SACJ,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/capability/index.d.ts

@@ -1,7 +1,8 @@
+export * from './lib/capability-ref-error';
 export * from './lib/capability-ref';
 export * from './lib/capability-ref-pattern';
 export * from './lib/connector-capability-ref';
-export * from './lib/capability-domain';
+export * from '../capability-domain';
 export * from './lib/authority-effect';
 export * from './lib/capability-reach';
 export * from './lib/capability-effect-class';
@@ -9,6 +10,7 @@ export * from './lib/capability-aperture';
 export * from './lib/capability-agent-exposure';
 export * from './lib/capability-delegable';
 export * from './lib/capability-descriptor-kind';
+export * from './lib/capability-caller-constraint';
 export * from './lib/capability-human-baseline';
 export * from './lib/capability-grant';
 export * from './lib/capability-policy';
@@ -19,7 +21,5 @@ export * from './lib/effective-capability-set';
 export * from './lib/required-resource-role-binding';
 export * from './lib/capability-contribution';
 export * from './lib/trusted-context-projection';
-export * from './lib/errors';
-export * from './lib/capability-invocation-descriptor';
 export * from './lib/long-running-invocation';
 //# sourceMappingURL=index.d.ts.map

package/dist/capability/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,cAAc,CAAC;AAC7B,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC"}

package/dist/capability/index.js

@@ -14,10 +14,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/capability-ref-error"), exports);
 __exportStar(require("./lib/capability-ref"), exports);
 __exportStar(require("./lib/capability-ref-pattern"), exports);
 __exportStar(require("./lib/connector-capability-ref"), exports);
-__exportStar(require("./lib/capability-domain"), exports);
+__exportStar(require("../capability-domain"), exports);
 __exportStar(require("./lib/authority-effect"), exports);
 __exportStar(require("./lib/capability-reach"), exports);
 __exportStar(require("./lib/capability-effect-class"), exports);
@@ -25,6 +26,7 @@ __exportStar(require("./lib/capability-aperture"), exports);
 __exportStar(require("./lib/capability-agent-exposure"), exports);
 __exportStar(require("./lib/capability-delegable"), exports);
 __exportStar(require("./lib/capability-descriptor-kind"), exports);
+__exportStar(require("./lib/capability-caller-constraint"), exports);
 __exportStar(require("./lib/capability-human-baseline"), exports);
 __exportStar(require("./lib/capability-grant"), exports);
 __exportStar(require("./lib/capability-policy"), exports);
@@ -35,7 +37,5 @@ __exportStar(require("./lib/effective-capability-set"), exports);
 __exportStar(require("./lib/required-resource-role-binding"), exports);
 __exportStar(require("./lib/capability-contribution"), exports);
 __exportStar(require("./lib/trusted-context-projection"), exports);
-__exportStar(require("./lib/errors"), exports);
-__exportStar(require("./lib/capability-invocation-descriptor"), exports);
 __exportStar(require("./lib/long-running-invocation"), exports);
 //# sourceMappingURL=index.js.map

package/dist/capability/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,+DAA6C;AAC7C,iEAA+C;AAC/C,0DAAwC;AACxC,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,4DAA0C;AAC1C,kEAAgD;AAChD,6DAA2C;AAC3C,mEAAiD;AACjD,kEAAgD;AAChD,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,iEAA+C;AAC/C,uEAAqD;AACrD,gEAA8C;AAC9C,mEAAiD;AACjD,+CAA6B;AAC7B,yEAAuD;AACvD,gEAA8C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6DAA2C;AAC3C,uDAAqC;AACrC,+DAA6C;AAC7C,iEAA+C;AAC/C,uDAAqC;AACrC,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,4DAA0C;AAC1C,kEAAgD;AAChD,6DAA2C;AAC3C,mEAAiD;AACjD,qEAAmD;AACnD,kEAAgD;AAChD,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,iEAA+C;AAC/C,uEAAqD;AACrD,gEAA8C;AAC9C,mEAAiD;AACjD,gEAA8C"}

package/dist/capability/lib/capability-aperture.js

@@ -15,7 +15,7 @@ exports.apertureRequiresLivePrincipalBinding = apertureRequiresLivePrincipalBind
 exports.apertureEnumeratesNothing = apertureEnumeratesNothing;
 const zod_1 = require("zod");
 const capability_effect_class_1 = require("./capability-effect-class");
-const capability_domain_1 = require("./capability-domain");
+const capability_domain_1 = require("../../capability-domain");
 const capability_ref_1 = require("./capability-ref");
 const capability_ref_pattern_1 = require("./capability-ref-pattern");
 var CapabilityApertureKind;