@xemahq/kernel-contracts 0.1.0

package/dist/biome/lib/biome-permissions.d.ts

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+import { BiomePermissionProfile, type PermissionGroup, type PermissionHint } from '../../capability';
+export interface BiomePermissionsManifest {
+    defaultProfile: BiomePermissionProfile;
+    hints: readonly PermissionHint[];
+    groups?: readonly PermissionGroup[];
+}
+export declare const BiomePermissionsManifestSchema: z.ZodType<BiomePermissionsManifest>;
+//# sourceMappingURL=biome-permissions.d.ts.map

package/dist/biome/lib/biome-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"biome-permissions.d.ts","sourceRoot":"","sources":["../../../src/biome/lib/biome-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sBAAsB,EAItB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAgB1B,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,sBAAsB,CAAC;IACvC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACrC;AAED,eAAO,MAAM,8BAA8B,EAIrC,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC"}

package/dist/biome/lib/biome-permissions.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BiomePermissionsManifestSchema = void 0;
+const zod_1 = require("zod");
+const capability_1 = require("../../capability");
+exports.BiomePermissionsManifestSchema = zod_1.z.object({
+    defaultProfile: capability_1.BiomePermissionProfileSchema,
+    hints: zod_1.z.array(capability_1.PermissionHintSchema).readonly(),
+    groups: zod_1.z.array(capability_1.PermissionGroupSchema).readonly().optional(),
+});
+//# sourceMappingURL=biome-permissions.js.map

package/dist/biome/lib/biome-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"biome-permissions.js","sourceRoot":"","sources":["../../../src/biome/lib/biome-permissions.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,iDAO0B;AAsBb,QAAA,8BAA8B,GAAG,OAAC,CAAC,MAAM,CAAC;IACrD,cAAc,EAAE,yCAA4B;IAC5C,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,iCAAoB,CAAC,CAAC,QAAQ,EAAE;IAC/C,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,kCAAqB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC7D,CAAwC,CAAC"}

package/dist/biome/lib/biome-scope.d.ts

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+export declare enum BiomeScope {
+    System = "system",
+    Org = "org",
+    Project = "project",
+    Sandbox = "sandbox"
+}
+export declare const BiomeScopeSchema: z.ZodEnum<typeof BiomeScope>;
+//# sourceMappingURL=biome-scope.d.ts.map

package/dist/biome/lib/biome-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"biome-scope.d.ts","sourceRoot":"","sources":["../../../src/biome/lib/biome-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED,eAAO,MAAM,gBAAgB,8BAA2B,CAAC"}

package/dist/biome/lib/biome-scope.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BiomeScopeSchema = exports.BiomeScope = void 0;
+const zod_1 = require("zod");
+var BiomeScope;
+(function (BiomeScope) {
+    BiomeScope["System"] = "system";
+    BiomeScope["Org"] = "org";
+    BiomeScope["Project"] = "project";
+    BiomeScope["Sandbox"] = "sandbox";
+})(BiomeScope || (exports.BiomeScope = BiomeScope = {}));
+exports.BiomeScopeSchema = zod_1.z.nativeEnum(BiomeScope);
+//# sourceMappingURL=biome-scope.js.map

package/dist/biome/lib/biome-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"biome-scope.js","sourceRoot":"","sources":["../../../src/biome/lib/biome-scope.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAWxB,IAAY,UAKX;AALD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,yBAAW,CAAA;IACX,iCAAmB,CAAA;IACnB,iCAAmB,CAAA;AACrB,CAAC,EALW,UAAU,0BAAV,UAAU,QAKrB;AAEY,QAAA,gBAAgB,GAAG,OAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC"}

package/dist/biome/lib/biome-trust-tier.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+export declare enum BiomeTrustTier {
+    System = "system",
+    FirstParty = "first-party",
+    VerifiedStore = "verified-store",
+    CommunityStore = "community-store",
+    PrivateOrg = "private-org",
+    GeneratedSandbox = "generated-sandbox"
+}
+export declare const BiomeTrustTierSchema: z.ZodEnum<typeof BiomeTrustTier>;
+//# sourceMappingURL=biome-trust-tier.d.ts.map

package/dist/biome/lib/biome-trust-tier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"biome-trust-tier.d.ts","sourceRoot":"","sources":["../../../src/biome/lib/biome-trust-tier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,cAAc;IACxB,MAAM,WAAW;IACjB,UAAU,gBAAgB;IAC1B,aAAa,mBAAmB;IAChC,cAAc,oBAAoB;IAClC,UAAU,gBAAgB;IAC1B,gBAAgB,sBAAsB;CACvC;AAED,eAAO,MAAM,oBAAoB,kCAA+B,CAAC"}

package/dist/biome/lib/biome-trust-tier.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BiomeTrustTierSchema = exports.BiomeTrustTier = void 0;
+const zod_1 = require("zod");
+var BiomeTrustTier;
+(function (BiomeTrustTier) {
+    BiomeTrustTier["System"] = "system";
+    BiomeTrustTier["FirstParty"] = "first-party";
+    BiomeTrustTier["VerifiedStore"] = "verified-store";
+    BiomeTrustTier["CommunityStore"] = "community-store";
+    BiomeTrustTier["PrivateOrg"] = "private-org";
+    BiomeTrustTier["GeneratedSandbox"] = "generated-sandbox";
+})(BiomeTrustTier || (exports.BiomeTrustTier = BiomeTrustTier = {}));
+exports.BiomeTrustTierSchema = zod_1.z.nativeEnum(BiomeTrustTier);
+//# sourceMappingURL=biome-trust-tier.js.map

package/dist/biome/lib/biome-trust-tier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"biome-trust-tier.js","sourceRoot":"","sources":["../../../src/biome/lib/biome-trust-tier.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAWxB,IAAY,cAOX;AAPD,WAAY,cAAc;IACxB,mCAAiB,CAAA;IACjB,4CAA0B,CAAA;IAC1B,kDAAgC,CAAA;IAChC,oDAAkC,CAAA;IAClC,4CAA0B,CAAA;IAC1B,wDAAsC,CAAA;AACxC,CAAC,EAPW,cAAc,8BAAd,cAAc,QAOzB;AAEY,QAAA,oBAAoB,GAAG,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC"}

package/dist/biome/lib/trust-tier-policies.d.ts

@@ -0,0 +1,8 @@
+import { BiomeTrustTier } from './biome-trust-tier';
+export interface BiomeTrustTierDefaultPolicy {
+    readonly allowsProdZones: boolean;
+    readonly requiresHumanApproval: boolean;
+    readonly allowedEnvironments: readonly string[];
+}
+export declare const TRUST_TIER_DEFAULT_CAPABILITY_POLICIES: Readonly<Record<BiomeTrustTier, BiomeTrustTierDefaultPolicy>>;
+//# sourceMappingURL=trust-tier-policies.d.ts.map

package/dist/biome/lib/trust-tier-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-tier-policies.d.ts","sourceRoot":"","sources":["../../../src/biome/lib/trust-tier-policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AA8BpD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,cAAc,EAAE,2BAA2B,CAAC,CA6DnD,CAAC"}

package/dist/biome/lib/trust-tier-policies.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRUST_TIER_DEFAULT_CAPABILITY_POLICIES = void 0;
+const biome_trust_tier_1 = require("./biome-trust-tier");
+exports.TRUST_TIER_DEFAULT_CAPABILITY_POLICIES = Object.freeze({
+    [biome_trust_tier_1.BiomeTrustTier.System]: Object.freeze({
+        allowsProdZones: true,
+        requiresHumanApproval: false,
+        allowedEnvironments: Object.freeze([
+            'system',
+            'org',
+            'project',
+            'app',
+            'session',
+            'sandbox',
+            'public',
+            'store-review',
+        ]),
+    }),
+    [biome_trust_tier_1.BiomeTrustTier.FirstParty]: Object.freeze({
+        allowsProdZones: true,
+        requiresHumanApproval: false,
+        allowedEnvironments: Object.freeze([
+            'org',
+            'project',
+            'app',
+            'session',
+            'sandbox',
+            'store-review',
+        ]),
+    }),
+    [biome_trust_tier_1.BiomeTrustTier.VerifiedStore]: Object.freeze({
+        allowsProdZones: true,
+        requiresHumanApproval: true,
+        allowedEnvironments: Object.freeze([
+            'org',
+            'project',
+            'app',
+            'session',
+            'sandbox',
+            'store-review',
+        ]),
+    }),
+    [biome_trust_tier_1.BiomeTrustTier.CommunityStore]: Object.freeze({
+        allowsProdZones: false,
+        requiresHumanApproval: true,
+        allowedEnvironments: Object.freeze(['sandbox', 'store-review']),
+    }),
+    [biome_trust_tier_1.BiomeTrustTier.PrivateOrg]: Object.freeze({
+        allowsProdZones: true,
+        requiresHumanApproval: true,
+        allowedEnvironments: Object.freeze([
+            'org',
+            'project',
+            'app',
+            'session',
+            'sandbox',
+        ]),
+    }),
+    [biome_trust_tier_1.BiomeTrustTier.GeneratedSandbox]: Object.freeze({
+        allowsProdZones: false,
+        requiresHumanApproval: true,
+        allowedEnvironments: Object.freeze(['sandbox']),
+    }),
+});
+//# sourceMappingURL=trust-tier-policies.js.map

package/dist/biome/lib/trust-tier-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-tier-policies.js","sourceRoot":"","sources":["../../../src/biome/lib/trust-tier-policies.ts"],"names":[],"mappings":";;;AAAA,yDAAoD;AAoCvC,QAAA,sCAAsC,GAE/C,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,iCAAc,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,eAAe,EAAE,IAAI;QACrB,qBAAqB,EAAE,KAAK;QAC5B,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC;YACjC,QAAQ;YACR,KAAK;YACL,SAAS;YACT,KAAK;YACL,SAAS;YACT,SAAS;YACT,QAAQ;YACR,cAAc;SACN,CAAC;KACZ,CAAC;IACF,CAAC,iCAAc,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACzC,eAAe,EAAE,IAAI;QACrB,qBAAqB,EAAE,KAAK;QAC5B,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC;YACjC,KAAK;YACL,SAAS;YACT,KAAK;YACL,SAAS;YACT,SAAS;YACT,cAAc;SACN,CAAC;KACZ,CAAC;IACF,CAAC,iCAAc,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5C,eAAe,EAAE,IAAI;QACrB,qBAAqB,EAAE,IAAI;QAC3B,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC;YACjC,KAAK;YACL,SAAS;YACT,KAAK;YACL,SAAS;YACT,SAAS;YACT,cAAc;SACN,CAAC;KACZ,CAAC;IACF,CAAC,iCAAc,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,eAAe,EAAE,KAAK;QACtB,qBAAqB,EAAE,IAAI;QAC3B,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,cAAc,CAAU,CAAC;KACzE,CAAC;IACF,CAAC,iCAAc,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACzC,eAAe,EAAE,IAAI;QACrB,qBAAqB,EAAE,IAAI;QAC3B,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC;YACjC,KAAK;YACL,SAAS;YACT,KAAK;YACL,SAAS;YACT,SAAS;SACD,CAAC;KACZ,CAAC;IACF,CAAC,iCAAc,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC/C,eAAe,EAAE,KAAK;QACtB,qBAAqB,EAAE,IAAI;QAC3B,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAU,CAAC;KACzD,CAAC;CACH,CAAC,CAAC"}

package/dist/capability/index.d.ts

@@ -0,0 +1,9 @@
+export * from './lib/capability-ref';
+export * from './lib/capability-grant';
+export * from './lib/capability-policy';
+export * from './lib/permission-profile';
+export * from './lib/shell-command-descriptor';
+export * from './lib/meta-tool';
+export * from './lib/capability-contribution';
+export * from './lib/errors';
+//# sourceMappingURL=index.d.ts.map

package/dist/capability/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,cAAc,CAAC"}

package/dist/capability/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/capability-ref"), exports);
+__exportStar(require("./lib/capability-grant"), exports);
+__exportStar(require("./lib/capability-policy"), exports);
+__exportStar(require("./lib/permission-profile"), exports);
+__exportStar(require("./lib/shell-command-descriptor"), exports);
+__exportStar(require("./lib/meta-tool"), exports);
+__exportStar(require("./lib/capability-contribution"), exports);
+__exportStar(require("./lib/errors"), exports);
+//# sourceMappingURL=index.js.map

package/dist/capability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/capability/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,yDAAuC;AACvC,0DAAwC;AACxC,2DAAyC;AACzC,iEAA+C;AAC/C,kDAAgC;AAChC,gEAA8C;AAC9C,+CAA6B"}

package/dist/capability/lib/capability-contribution.d.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+import { type CapabilityRef } from './capability-ref';
+import { type CapabilityRiskTier } from './permission-profile';
+export interface CapabilityContributionManifest {
+    readonly ref: CapabilityRef;
+    readonly title: string;
+    readonly summary: string;
+    readonly sideEffects: string;
+    readonly inputSchema: Record<string, unknown>;
+    readonly outputSchema: Record<string, unknown>;
+    readonly riskTier: CapabilityRiskTier;
+    readonly requiresApproval: boolean;
+    readonly examples?: readonly Record<string, unknown>[];
+    readonly externalServiceRef?: string;
+    readonly defaultCredentialBindingRef?: string;
+}
+export declare const CapabilityContributionManifestSchema: z.ZodType<CapabilityContributionManifest>;
+//# sourceMappingURL=capability-contribution.d.ts.map

package/dist/capability/lib/capability-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-contribution.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAoB9B,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE/C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAKtC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAKnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAUvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAOrC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;CAC/C;AAcD,eAAO,MAAM,oCAAoC,EAAE,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAgB1C,CAAC"}

package/dist/capability/lib/capability-contribution.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityContributionManifestSchema = void 0;
+const zod_1 = require("zod");
+const capability_ref_1 = require("./capability-ref");
+const permission_profile_1 = require("./permission-profile");
+exports.CapabilityContributionManifestSchema = zod_1.z.object({
+    ref: capability_ref_1.CapabilityRefSchema,
+    title: zod_1.z.string().min(1).max(200),
+    summary: zod_1.z.string().min(1).max(1000),
+    sideEffects: zod_1.z.string().min(1).max(1000),
+    inputSchema: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    outputSchema: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    riskTier: permission_profile_1.CapabilityRiskTierSchema,
+    requiresApproval: zod_1.z.boolean(),
+    examples: zod_1.z
+        .array(zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()))
+        .max(20)
+        .optional(),
+    externalServiceRef: zod_1.z.string().min(1).max(200).optional(),
+    defaultCredentialBindingRef: zod_1.z.string().min(1).max(200).optional(),
+});
+//# sourceMappingURL=capability-contribution.js.map

package/dist/capability/lib/capability-contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-contribution.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,qDAA2E;AAC3E,6DAG8B;AA4EjB,QAAA,oCAAoC,GAC/C,OAAC,CAAC,MAAM,CAAC;IACP,GAAG,EAAE,oCAAmB;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC;IAC/C,QAAQ,EAAE,6CAAwB;IAClC,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE;IAC7B,QAAQ,EAAE,OAAC;SACR,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SACxC,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;IACb,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,2BAA2B,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACnE,CAA8C,CAAC"}

package/dist/capability/lib/capability-grant.d.ts

@@ -0,0 +1,22 @@
+import { z } from 'zod';
+import { type CapabilityRef } from './capability-ref';
+import { SubjectKind, SubjectKindSchema, SubjectRefSchema, ActingForRefSchema, subjectRefToString, parseSubjectRef, type SubjectRef, type ActingForRef } from '../../subject';
+export { SubjectKind, SubjectKindSchema, SubjectRefSchema, ActingForRefSchema, subjectRefToString, parseSubjectRef, };
+export type { SubjectRef, ActingForRef };
+export interface GrantConstraints {
+    maxCallsPerHour?: number;
+    maxCostUsd?: number;
+    rateLimit?: string;
+}
+export declare const GrantConstraintsSchema: z.ZodType<GrantConstraints>;
+export interface CapabilityGrant {
+    grantId: string;
+    subject: SubjectRef;
+    capability: CapabilityRef;
+    resourceGlob: string;
+    allowedEnvironments: readonly string[];
+    constraints?: GrantConstraints;
+    requiresApproval?: boolean;
+}
+export declare const CapabilityGrantSchema: z.ZodType<CapabilityGrant>;
+//# sourceMappingURL=capability-grant.d.ts.map

package/dist/capability/lib/capability-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-grant.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAavB,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAChB,CAAC;AACF,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AAOzC,MAAM,WAAW,gBAAgB;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IAMpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,sBAAsB,EAI7B,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAalC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,aAAa,CAAC;IAK1B,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,eAAO,MAAM,qBAAqB,EAQ5B,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC"}

package/dist/capability/lib/capability-grant.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityGrantSchema = exports.GrantConstraintsSchema = exports.parseSubjectRef = exports.subjectRefToString = exports.ActingForRefSchema = exports.SubjectRefSchema = exports.SubjectKindSchema = exports.SubjectKind = void 0;
+const zod_1 = require("zod");
+const capability_ref_1 = require("./capability-ref");
+const subject_1 = require("../../subject");
+Object.defineProperty(exports, "SubjectKind", { enumerable: true, get: function () { return subject_1.SubjectKind; } });
+Object.defineProperty(exports, "SubjectKindSchema", { enumerable: true, get: function () { return subject_1.SubjectKindSchema; } });
+Object.defineProperty(exports, "SubjectRefSchema", { enumerable: true, get: function () { return subject_1.SubjectRefSchema; } });
+Object.defineProperty(exports, "ActingForRefSchema", { enumerable: true, get: function () { return subject_1.ActingForRefSchema; } });
+Object.defineProperty(exports, "subjectRefToString", { enumerable: true, get: function () { return subject_1.subjectRefToString; } });
+Object.defineProperty(exports, "parseSubjectRef", { enumerable: true, get: function () { return subject_1.parseSubjectRef; } });
+exports.GrantConstraintsSchema = zod_1.z.object({
+    maxCallsPerHour: zod_1.z.number().int().nonnegative().optional(),
+    maxCostUsd: zod_1.z.number().nonnegative().optional(),
+    rateLimit: zod_1.z.string().min(1).optional(),
+});
+exports.CapabilityGrantSchema = zod_1.z.object({
+    grantId: zod_1.z.string().min(1),
+    subject: subject_1.SubjectRefSchema,
+    capability: capability_ref_1.CapabilityRefSchema,
+    resourceGlob: zod_1.z.string().min(1),
+    allowedEnvironments: zod_1.z.array(zod_1.z.string().min(1)).readonly(),
+    constraints: exports.GrantConstraintsSchema.optional(),
+    requiresApproval: zod_1.z.boolean().optional(),
+});
+//# sourceMappingURL=capability-grant.js.map

package/dist/capability/lib/capability-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-grant.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-grant.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,qDAA2E;AAC3E,2CASuB;AAcrB,4FAtBA,qBAAW,OAsBA;AACX,kGAtBA,2BAAiB,OAsBA;AACjB,iGAtBA,0BAAgB,OAsBA;AAChB,mGAtBA,4BAAkB,OAsBA;AAClB,mGAtBA,4BAAkB,OAsBA;AAClB,gGAtBA,yBAAe,OAsBA;AAoBJ,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC1D,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAgC,CAAC;AA2BrB,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,0BAAgB;IACzB,UAAU,EAAE,oCAAmB;IAC/B,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,mBAAmB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,8BAAsB,CAAC,QAAQ,EAAE;IAC9C,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzC,CAA+B,CAAC"}

package/dist/capability/lib/capability-policy.d.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+import { type CapabilityRef } from './capability-ref';
+import { type GrantConstraints } from './capability-grant';
+export type { GrantConstraints } from './capability-grant';
+export { GrantConstraintsSchema } from './capability-grant';
+export interface CapabilityPolicy {
+    capability: CapabilityRef;
+    allowedResources: readonly string[];
+    constraints?: GrantConstraints;
+}
+export declare const CapabilityPolicySchema: z.ZodType<CapabilityPolicy>;
+//# sourceMappingURL=capability-policy.d.ts.map

package/dist/capability/lib/capability-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-policy.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAa5D,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,aAAa,CAAC;IAM1B,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AAED,eAAO,MAAM,sBAAsB,EAI7B,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/capability/lib/capability-policy.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityPolicySchema = exports.GrantConstraintsSchema = void 0;
+const zod_1 = require("zod");
+const capability_ref_1 = require("./capability-ref");
+const capability_grant_1 = require("./capability-grant");
+var capability_grant_2 = require("./capability-grant");
+Object.defineProperty(exports, "GrantConstraintsSchema", { enumerable: true, get: function () { return capability_grant_2.GrantConstraintsSchema; } });
+exports.CapabilityPolicySchema = zod_1.z.object({
+    capability: capability_ref_1.CapabilityRefSchema,
+    allowedResources: zod_1.z.array(zod_1.z.string().min(1)).readonly(),
+    constraints: capability_grant_1.GrantConstraintsSchema.optional(),
+});
+//# sourceMappingURL=capability-policy.js.map

package/dist/capability/lib/capability-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-policy.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-policy.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,qDAA2E;AAC3E,yDAG4B;AAG5B,uDAA4D;AAAnD,0HAAA,sBAAsB,OAAA;AAwBlB,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,oCAAmB;IAC/B,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,yCAAsB,CAAC,QAAQ,EAAE;CAC/C,CAAgC,CAAC"}

package/dist/capability/lib/capability-ref.d.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+export type CapabilityRef = `${string}:${string}.${string}@${number}` & {
+    readonly __capabilityRef?: never;
+};
+export declare const CapabilityRefSchema: z.ZodType<CapabilityRef>;
+export interface ParsedCapabilityRef {
+    readonly domain: string;
+    readonly resource: string;
+    readonly verbPath: readonly string[];
+    readonly major: number;
+    readonly raw: CapabilityRef;
+}
+export declare function parseCapabilityRef(ref: string): ParsedCapabilityRef;
+export declare function formatCapabilityRef(parts: {
+    domain: string;
+    verbPath: readonly string[];
+    major: number;
+}): CapabilityRef;
+//# sourceMappingURL=capability-ref.d.ts.map

package/dist/capability/lib/capability-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-ref.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/capability-ref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0CxB,MAAM,MAAM,aAAa,GACvB,GAAG,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,GAAG;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC;CAClC,CAAC;AAEJ,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAKd,CAAC;AAE5C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;CAC7B;AAWD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAgCnE;AASD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,aAAa,CAehB"}

package/dist/capability/lib/capability-ref.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityRefSchema = void 0;
+exports.parseCapabilityRef = parseCapabilityRef;
+exports.formatCapabilityRef = formatCapabilityRef;
+const zod_1 = require("zod");
+const errors_1 = require("./errors");
+const CAPABILITY_REF_REGEX = /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*@\d+$/;
+exports.CapabilityRefSchema = zod_1.z
+    .string()
+    .regex(CAPABILITY_REF_REGEX, {
+    message: 'CapabilityRef must match <domain>:<resource>.<verb>@<major> (lowercase kebab; positive integer major).',
+});
+function parseCapabilityRef(ref) {
+    if (typeof ref !== 'string' || ref.length === 0) {
+        throw new errors_1.CapabilityRefParseError({
+            message: 'CapabilityRef must be a non-empty string.',
+            raw: String(ref),
+        });
+    }
+    if (!CAPABILITY_REF_REGEX.test(ref)) {
+        throw new errors_1.CapabilityRefParseError({
+            message: `CapabilityRef "${ref}" does not match <domain>:<resource>.<verb>@<major>.`,
+            raw: ref,
+        });
+    }
+    const atIdx = ref.lastIndexOf('@');
+    const colonIdx = ref.indexOf(':');
+    const domain = ref.slice(0, colonIdx);
+    const verbPath = ref.slice(colonIdx + 1, atIdx).split('.');
+    const majorStr = ref.slice(atIdx + 1);
+    const major = Number(majorStr);
+    if (!Number.isInteger(major) || major <= 0) {
+        throw new errors_1.CapabilityRefParseError({
+            message: `CapabilityRef "${ref}" has a non-integer major "${majorStr}".`,
+            raw: ref,
+        });
+    }
+    return {
+        domain,
+        resource: verbPath[0],
+        verbPath,
+        major,
+        raw: ref,
+    };
+}
+function formatCapabilityRef(parts) {
+    if (parts.verbPath.length === 0) {
+        throw new errors_1.CapabilityRefParseError({
+            message: 'CapabilityRef verbPath must contain at least one segment.',
+            raw: `${parts.domain}:@${parts.major}`,
+        });
+    }
+    const raw = `${parts.domain}:${parts.verbPath.join('.')}@${parts.major}`;
+    if (!CAPABILITY_REF_REGEX.test(raw)) {
+        throw new errors_1.CapabilityRefParseError({
+            message: `formatCapabilityRef produced invalid ref "${raw}".`,
+            raw,
+        });
+    }
+    return raw;
+}
+//# sourceMappingURL=capability-ref.js.map

package/dist/capability/lib/capability-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-ref.js","sourceRoot":"","sources":["../../../src/capability/lib/capability-ref.ts"],"names":[],"mappings":";;;AA6EA,gDAgCC;AASD,kDAmBC;AAzID,6BAAwB;AACxB,qCAAmD;AAgCnD,MAAM,oBAAoB,GACxB,2DAA2D,CAAC;AAajD,QAAA,mBAAmB,GAA6B,OAAC;KAC3D,MAAM,EAAE;KACR,KAAK,CAAC,oBAAoB,EAAE;IAC3B,OAAO,EACL,wGAAwG;CAC3G,CAAwC,CAAC;AAyB5C,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,gCAAuB,CAAC;YAChC,OAAO,EAAE,2CAA2C;YACpD,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,gCAAuB,CAAC;YAChC,OAAO,EAAE,kBAAkB,GAAG,sDAAsD;YACpF,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,gCAAuB,CAAC;YAChC,OAAO,EAAE,kBAAkB,GAAG,8BAA8B,QAAQ,IAAI;YACxE,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAE;QACtB,QAAQ;QACR,KAAK;QACL,GAAG,EAAE,GAAoB;KAC1B,CAAC;AACJ,CAAC;AASD,SAAgB,mBAAmB,CAAC,KAInC;IACC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gCAAuB,CAAC;YAChC,OAAO,EAAE,2DAA2D;YACpE,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;IACzE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,gCAAuB,CAAC;YAChC,OAAO,EAAE,6CAA6C,GAAG,IAAI;YAC7D,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAoB,CAAC;AAC9B,CAAC"}

package/dist/capability/lib/errors.d.ts

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+export declare enum CapabilityErrorCode {
+    CapabilityRefInvalid = "CAPABILITY_REF_INVALID",
+    CapabilityUnresolved = "CAPABILITY_UNRESOLVED",
+    CapabilityDeniedByZone = "CAPABILITY_DENIED_BY_ZONE",
+    CapabilityDeniedByGrant = "CAPABILITY_DENIED_BY_GRANT",
+    CapabilityDeniedByRateLimit = "CAPABILITY_DENIED_BY_RATE_LIMIT",
+    CapabilityRequiresApproval = "CAPABILITY_REQUIRES_APPROVAL",
+    CapabilityRequiresGrant = "CAPABILITY_REQUIRES_GRANT",
+    AuthorizationUnreachable = "AUTHORIZATION_UNREACHABLE",
+    AuditLogUnavailable = "AUDIT_LOG_UNAVAILABLE",
+    CapabilityInvocationMissingOrg = "CAPABILITY_INVOCATION_MISSING_ORG",
+    NoRunnerAvailable = "NO_RUNNER_AVAILABLE",
+    MissingCredentialBinding = "MISSING_CREDENTIAL_BINDING"
+}
+export declare const CapabilityErrorCodeSchema: z.ZodEnum<typeof CapabilityErrorCode>;
+export interface CapabilityDenialDetail {
+    code: CapabilityErrorCode;
+    detail: string;
+}
+export declare const CapabilityDenialDetailSchema: z.ZodType<CapabilityDenialDetail>;
+export type CapabilityDenialSuggestion = {
+    kind: 'request-grant';
+    capability: string;
+    environment?: string;
+    resource?: string;
+} | {
+    kind: 'switch-environment';
+    from: string;
+    to: string;
+} | {
+    kind: 'request-approval';
+    capability: string;
+    approver?: string;
+};
+export declare const CapabilityDenialSuggestionSchema: z.ZodType<CapabilityDenialSuggestion>;
+export declare class CapabilityError extends Error {
+    readonly code: CapabilityErrorCode;
+    readonly capability: string | undefined;
+    readonly subject: string | undefined;
+    readonly environment: string | undefined;
+    readonly auditId: string | undefined;
+    readonly details: readonly CapabilityDenialDetail[] | undefined;
+    constructor(args: {
+        code: CapabilityErrorCode;
+        message: string;
+        capability?: string;
+        subject?: string;
+        environment?: string;
+        auditId?: string;
+        details?: readonly CapabilityDenialDetail[];
+    });
+}
+export declare class CapabilityRefParseError extends CapabilityError {
+    constructor(args: {
+        message: string;
+        raw: string;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/capability/lib/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/capability/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgBxB,oBAAY,mBAAmB;IAC7B,oBAAoB,2BAA2B;IAC/C,oBAAoB,0BAA0B;IAC9C,sBAAsB,8BAA8B;IACpD,uBAAuB,+BAA+B;IACtD,2BAA2B,oCAAoC;IAC/D,0BAA0B,iCAAiC;IAC3D,uBAAuB,8BAA8B;IACrD,wBAAwB,8BAA8B;IAStD,mBAAmB,0BAA0B;IAQ7C,8BAA8B,sCAAsC;IAOpE,iBAAiB,wBAAwB;IAWzC,wBAAwB,+BAA+B;CACxD;AAED,eAAO,MAAM,yBAAyB,uCAAoC,CAAC;AAS3E,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,4BAA4B,EAGnC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAWxC,MAAM,MAAM,0BAA0B,GAClC;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,eAAO,MAAM,gCAAgC,EAiBvC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAU5C,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAgB,IAAI,EAAE,mBAAmB,CAAC;IAC1C,SAAgB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,SAAgB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,SAAgB,OAAO,EAAE,SAAS,sBAAsB,EAAE,GAAG,SAAS,CAAC;gBAE3D,IAAI,EAAE;QAChB,IAAI,EAAE,mBAAmB,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;KAC7C;CAUF;AASD,qBAAa,uBAAwB,SAAQ,eAAe;gBAC9C,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;CAQnD"}

package/dist/capability/lib/errors.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityRefParseError = exports.CapabilityError = exports.CapabilityDenialSuggestionSchema = exports.CapabilityDenialDetailSchema = exports.CapabilityErrorCodeSchema = exports.CapabilityErrorCode = void 0;
+const zod_1 = require("zod");
+var CapabilityErrorCode;
+(function (CapabilityErrorCode) {
+    CapabilityErrorCode["CapabilityRefInvalid"] = "CAPABILITY_REF_INVALID";
+    CapabilityErrorCode["CapabilityUnresolved"] = "CAPABILITY_UNRESOLVED";
+    CapabilityErrorCode["CapabilityDeniedByZone"] = "CAPABILITY_DENIED_BY_ZONE";
+    CapabilityErrorCode["CapabilityDeniedByGrant"] = "CAPABILITY_DENIED_BY_GRANT";
+    CapabilityErrorCode["CapabilityDeniedByRateLimit"] = "CAPABILITY_DENIED_BY_RATE_LIMIT";
+    CapabilityErrorCode["CapabilityRequiresApproval"] = "CAPABILITY_REQUIRES_APPROVAL";
+    CapabilityErrorCode["CapabilityRequiresGrant"] = "CAPABILITY_REQUIRES_GRANT";
+    CapabilityErrorCode["AuthorizationUnreachable"] = "AUTHORIZATION_UNREACHABLE";
+    CapabilityErrorCode["AuditLogUnavailable"] = "AUDIT_LOG_UNAVAILABLE";
+    CapabilityErrorCode["CapabilityInvocationMissingOrg"] = "CAPABILITY_INVOCATION_MISSING_ORG";
+    CapabilityErrorCode["NoRunnerAvailable"] = "NO_RUNNER_AVAILABLE";
+    CapabilityErrorCode["MissingCredentialBinding"] = "MISSING_CREDENTIAL_BINDING";
+})(CapabilityErrorCode || (exports.CapabilityErrorCode = CapabilityErrorCode = {}));
+exports.CapabilityErrorCodeSchema = zod_1.z.nativeEnum(CapabilityErrorCode);
+exports.CapabilityDenialDetailSchema = zod_1.z.object({
+    code: exports.CapabilityErrorCodeSchema,
+    detail: zod_1.z.string().min(1),
+});
+exports.CapabilityDenialSuggestionSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({
+        kind: zod_1.z.literal('request-grant'),
+        capability: zod_1.z.string().min(1),
+        environment: zod_1.z.string().min(1).optional(),
+        resource: zod_1.z.string().min(1).optional(),
+    }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('switch-environment'),
+        from: zod_1.z.string().min(1),
+        to: zod_1.z.string().min(1),
+    }),
+    zod_1.z.object({
+        kind: zod_1.z.literal('request-approval'),
+        capability: zod_1.z.string().min(1),
+        approver: zod_1.z.string().min(1).optional(),
+    }),
+]);
+class CapabilityError extends Error {
+    code;
+    capability;
+    subject;
+    environment;
+    auditId;
+    details;
+    constructor(args) {
+        super(args.message);
+        this.name = 'CapabilityError';
+        this.code = args.code;
+        this.capability = args.capability;
+        this.subject = args.subject;
+        this.environment = args.environment;
+        this.auditId = args.auditId;
+        this.details = args.details;
+    }
+}
+exports.CapabilityError = CapabilityError;
+class CapabilityRefParseError extends CapabilityError {
+    constructor(args) {
+        super({
+            code: CapabilityErrorCode.CapabilityRefInvalid,
+            message: args.message,
+            capability: args.raw,
+        });
+        this.name = 'CapabilityRefParseError';
+    }
+}
+exports.CapabilityRefParseError = CapabilityRefParseError;
+//# sourceMappingURL=errors.js.map

package/dist/capability/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/capability/lib/errors.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAgBxB,IAAY,mBA4CX;AA5CD,WAAY,mBAAmB;IAC7B,sEAA+C,CAAA;IAC/C,qEAA8C,CAAA;IAC9C,2EAAoD,CAAA;IACpD,6EAAsD,CAAA;IACtD,sFAA+D,CAAA;IAC/D,kFAA2D,CAAA;IAC3D,4EAAqD,CAAA;IACrD,6EAAsD,CAAA;IAStD,oEAA6C,CAAA;IAQ7C,2FAAoE,CAAA;IAOpE,gEAAyC,CAAA;IAWzC,8EAAuD,CAAA;AACzD,CAAC,EA5CW,mBAAmB,mCAAnB,mBAAmB,QA4C9B;AAEY,QAAA,yBAAyB,GAAG,OAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAc9D,QAAA,4BAA4B,GAAG,OAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,iCAAyB;IAC/B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAsC,CAAC;AA6B3B,QAAA,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QAChC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACzC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACvC,CAAC;IACF,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACrC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACtB,CAAC;IACF,OAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACnC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACvC,CAAC;CACH,CAA0C,CAAC;AAU5C,MAAa,eAAgB,SAAQ,KAAK;IACxB,IAAI,CAAsB;IAC1B,UAAU,CAAqB;IAC/B,OAAO,CAAqB;IAC5B,WAAW,CAAqB;IAChC,OAAO,CAAqB;IAC5B,OAAO,CAAgD;IAEvE,YAAY,IAQX;QACC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;CACF;AA1BD,0CA0BC;AASD,MAAa,uBAAwB,SAAQ,eAAe;IAC1D,YAAY,IAAsC;QAChD,KAAK,CAAC;YACJ,IAAI,EAAE,mBAAmB,CAAC,oBAAoB;YAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,GAAG;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AATD,0DASC"}