@xemahq/kernel-contracts 0.1.0

package/dist/object/lib/xema-object-kind.d.ts

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+export declare enum XemaObjectKind {
+    Biome = "biome",
+    App = "app",
+    AppClient = "app-client",
+    AudiencePolicy = "audience-policy",
+    ExternalSubject = "external-subject",
+    DelegatedSession = "delegated-session",
+    Agent = "agent",
+    AgentComposition = "agent-composition",
+    Skill = "skill",
+    Tool = "tool",
+    Model = "model",
+    ModelResolutionRule = "model-resolution-rule",
+    Workflow = "workflow",
+    WorkflowRun = "workflow-run",
+    GateAction = "gate-action",
+    Connector = "connector",
+    ConnectorBinding = "connector-binding",
+    MountSource = "mount-source",
+    ArtifactType = "artifact-type",
+    Artifact = "artifact",
+    KnowledgeSpace = "knowledge-space",
+    KnowledgePage = "knowledge-page",
+    DocumentTemplate = "document-template",
+    DocumentTheme = "document-theme",
+    ChartRuntime = "chart-runtime",
+    PresentationRuntime = "presentation-runtime",
+    WidgetKind = "widget-kind",
+    Capability = "capability",
+    ExecutionEnvironment = "execution-environment",
+    CapabilityGrant = "capability-grant",
+    ApprovalRule = "approval-rule",
+    Memory = "memory",
+    MemoryRelation = "memory-relation",
+    Session = "session",
+    EventStream = "event-stream",
+    EventSubscription = "event-subscription",
+    ContributionEntry = "contribution-entry",
+    Concept = "concept"
+}
+export declare const XemaObjectKindSchema: z.ZodEnum<typeof XemaObjectKind>;
+//# sourceMappingURL=xema-object-kind.d.ts.map

package/dist/object/lib/xema-object-kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-object-kind.d.ts","sourceRoot":"","sources":["../../../src/object/lib/xema-object-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,oBAAY,cAAc;IAExB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,SAAS,eAAe;IACxB,cAAc,oBAAoB;IAClC,eAAe,qBAAqB;IACpC,gBAAgB,sBAAsB;IAGtC,KAAK,UAAU;IACf,gBAAgB,sBAAsB;IACtC,KAAK,UAAU;IACf,IAAI,SAAS;IACb,KAAK,UAAU;IACf,mBAAmB,0BAA0B;IAG7C,QAAQ,aAAa;IACrB,WAAW,iBAAiB;IAC5B,UAAU,gBAAgB;IAG1B,SAAS,cAAc;IACvB,gBAAgB,sBAAsB;IACtC,WAAW,iBAAiB;IAC5B,YAAY,kBAAkB;IAC9B,QAAQ,aAAa;IAGrB,cAAc,oBAAoB;IAClC,aAAa,mBAAmB;IAChC,gBAAgB,sBAAsB;IACtC,aAAa,mBAAmB;IAChC,YAAY,kBAAkB;IAC9B,mBAAmB,yBAAyB;IAC5C,UAAU,gBAAgB;IAG1B,UAAU,eAAe;IACzB,oBAAoB,0BAA0B;IAC9C,eAAe,qBAAqB;IACpC,YAAY,kBAAkB;IAG9B,MAAM,WAAW;IACjB,cAAc,oBAAoB;IAGlC,OAAO,YAAY;IACnB,WAAW,iBAAiB;IAC5B,iBAAiB,uBAAuB;IAGxC,iBAAiB,uBAAuB;IAGxC,OAAO,YAAY;CACpB;AAED,eAAO,MAAM,oBAAoB,kCAA+B,CAAC"}

package/dist/object/lib/xema-object-kind.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaObjectKindSchema = exports.XemaObjectKind = void 0;
+const zod_1 = require("zod");
+var XemaObjectKind;
+(function (XemaObjectKind) {
+    XemaObjectKind["Biome"] = "biome";
+    XemaObjectKind["App"] = "app";
+    XemaObjectKind["AppClient"] = "app-client";
+    XemaObjectKind["AudiencePolicy"] = "audience-policy";
+    XemaObjectKind["ExternalSubject"] = "external-subject";
+    XemaObjectKind["DelegatedSession"] = "delegated-session";
+    XemaObjectKind["Agent"] = "agent";
+    XemaObjectKind["AgentComposition"] = "agent-composition";
+    XemaObjectKind["Skill"] = "skill";
+    XemaObjectKind["Tool"] = "tool";
+    XemaObjectKind["Model"] = "model";
+    XemaObjectKind["ModelResolutionRule"] = "model-resolution-rule";
+    XemaObjectKind["Workflow"] = "workflow";
+    XemaObjectKind["WorkflowRun"] = "workflow-run";
+    XemaObjectKind["GateAction"] = "gate-action";
+    XemaObjectKind["Connector"] = "connector";
+    XemaObjectKind["ConnectorBinding"] = "connector-binding";
+    XemaObjectKind["MountSource"] = "mount-source";
+    XemaObjectKind["ArtifactType"] = "artifact-type";
+    XemaObjectKind["Artifact"] = "artifact";
+    XemaObjectKind["KnowledgeSpace"] = "knowledge-space";
+    XemaObjectKind["KnowledgePage"] = "knowledge-page";
+    XemaObjectKind["DocumentTemplate"] = "document-template";
+    XemaObjectKind["DocumentTheme"] = "document-theme";
+    XemaObjectKind["ChartRuntime"] = "chart-runtime";
+    XemaObjectKind["PresentationRuntime"] = "presentation-runtime";
+    XemaObjectKind["WidgetKind"] = "widget-kind";
+    XemaObjectKind["Capability"] = "capability";
+    XemaObjectKind["ExecutionEnvironment"] = "execution-environment";
+    XemaObjectKind["CapabilityGrant"] = "capability-grant";
+    XemaObjectKind["ApprovalRule"] = "approval-rule";
+    XemaObjectKind["Memory"] = "memory";
+    XemaObjectKind["MemoryRelation"] = "memory-relation";
+    XemaObjectKind["Session"] = "session";
+    XemaObjectKind["EventStream"] = "event-stream";
+    XemaObjectKind["EventSubscription"] = "event-subscription";
+    XemaObjectKind["ContributionEntry"] = "contribution-entry";
+    XemaObjectKind["Concept"] = "concept";
+})(XemaObjectKind || (exports.XemaObjectKind = XemaObjectKind = {}));
+exports.XemaObjectKindSchema = zod_1.z.nativeEnum(XemaObjectKind);
+//# sourceMappingURL=xema-object-kind.js.map

package/dist/object/lib/xema-object-kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-object-kind.js","sourceRoot":"","sources":["../../../src/object/lib/xema-object-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAYxB,IAAY,cA0DX;AA1DD,WAAY,cAAc;IAExB,iCAAe,CAAA;IACf,6BAAW,CAAA;IACX,0CAAwB,CAAA;IACxB,oDAAkC,CAAA;IAClC,sDAAoC,CAAA;IACpC,wDAAsC,CAAA;IAGtC,iCAAe,CAAA;IACf,wDAAsC,CAAA;IACtC,iCAAe,CAAA;IACf,+BAAa,CAAA;IACb,iCAAe,CAAA;IACf,+DAA6C,CAAA;IAG7C,uCAAqB,CAAA;IACrB,8CAA4B,CAAA;IAC5B,4CAA0B,CAAA;IAG1B,yCAAuB,CAAA;IACvB,wDAAsC,CAAA;IACtC,8CAA4B,CAAA;IAC5B,gDAA8B,CAAA;IAC9B,uCAAqB,CAAA;IAGrB,oDAAkC,CAAA;IAClC,kDAAgC,CAAA;IAChC,wDAAsC,CAAA;IACtC,kDAAgC,CAAA;IAChC,gDAA8B,CAAA;IAC9B,8DAA4C,CAAA;IAC5C,4CAA0B,CAAA;IAG1B,2CAAyB,CAAA;IACzB,gEAA8C,CAAA;IAC9C,sDAAoC,CAAA;IACpC,gDAA8B,CAAA;IAG9B,mCAAiB,CAAA;IACjB,oDAAkC,CAAA;IAGlC,qCAAmB,CAAA;IACnB,8CAA4B,CAAA;IAC5B,0DAAwC,CAAA;IAGxC,0DAAwC,CAAA;IAGxC,qCAAmB,CAAA;AACrB,CAAC,EA1DW,cAAc,8BAAd,cAAc,QA0DzB;AAEY,QAAA,oBAAoB,GAAG,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC"}

package/dist/object/lib/xema-object-ref.d.ts

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+import { SpaceRef } from '../../space';
+import { XemaObjectKind } from './xema-object-kind';
+export type XemaObjectRef = `xema://${string}`;
+export declare const XemaObjectRefSchema: z.ZodString & z.ZodType<`xema://${string}`, string, z.core.$ZodTypeInternals<`xema://${string}`, string>>;
+export declare class XemaObjectRefParseError extends Error {
+    readonly code = "XEMA_OBJECT_REF_INVALID";
+    readonly ref: string;
+    readonly reason: string;
+    constructor(ref: string, reason: string);
+}
+export interface XemaObjectRefParts {
+    scope: SpaceRef;
+    kind: XemaObjectKind;
+    slug: string;
+    version?: string;
+}
+export declare function parseXemaObjectRef(ref: string): XemaObjectRefParts;
+export declare function formatXemaObjectRef(parts: XemaObjectRefParts): XemaObjectRef;
+//# sourceMappingURL=xema-object-ref.d.ts.map

package/dist/object/lib/xema-object-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-object-ref.d.ts","sourceRoot":"","sources":["../../../src/object/lib/xema-object-ref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAA6B,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,cAAc,EAAwB,MAAM,oBAAoB,CAAC;AAe1E,MAAM,MAAM,aAAa,GAAG,UAAU,MAAM,EAAE,CAAC;AAI/C,eAAO,MAAM,mBAAmB,2GAK7B,CAAC;AAOJ,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,SAAgB,IAAI,6BAA6B;IACjD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,MAAM,EAAE,MAAM,CAAC;gBAEZ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM/C;AAQD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,QAAQ,CAAC;IAChB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA0ED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CA4ElE;AAOD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAkB5E"}

package/dist/object/lib/xema-object-ref.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaObjectRefParseError = exports.XemaObjectRefSchema = void 0;
+exports.parseXemaObjectRef = parseXemaObjectRef;
+exports.formatXemaObjectRef = formatXemaObjectRef;
+const zod_1 = require("zod");
+const space_1 = require("../../space");
+const xema_object_kind_1 = require("./xema-object-kind");
+const XEMA_OBJECT_REF_PREFIX = 'xema://';
+exports.XemaObjectRefSchema = zod_1.z
+    .string()
+    .refine((value) => value.startsWith(XEMA_OBJECT_REF_PREFIX), { message: `XemaObjectRef must start with "${XEMA_OBJECT_REF_PREFIX}"` });
+class XemaObjectRefParseError extends Error {
+    code = 'XEMA_OBJECT_REF_INVALID';
+    ref;
+    reason;
+    constructor(ref, reason) {
+        super(`Invalid XemaObjectRef "${ref}": ${reason}`);
+        this.name = 'XemaObjectRefParseError';
+        this.ref = ref;
+        this.reason = reason;
+    }
+}
+exports.XemaObjectRefParseError = XemaObjectRefParseError;
+const SLUG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
+const VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.+-]*$/;
+function requireSegment(segments, index, ref, label) {
+    const value = segments[index];
+    if (value === undefined || value.length === 0) {
+        throw new XemaObjectRefParseError(ref, `missing ${label} segment`);
+    }
+    return value;
+}
+function parseScope(segments, ref) {
+    const head = requireSegment(segments, 0, ref, 'scope');
+    switch (head) {
+        case 'system':
+            return { scope: { tier: space_1.SpaceKind.System }, consumed: 1 };
+        case 'biomes': {
+            const biomeId = requireSegment(segments, 1, ref, 'biomeId');
+            return {
+                scope: { tier: space_1.SpaceKind.Biome, biomeId },
+                consumed: 2,
+            };
+        }
+        case 'users': {
+            const userId = requireSegment(segments, 1, ref, 'userId');
+            return {
+                scope: { tier: space_1.SpaceKind.User, userId },
+                consumed: 2,
+            };
+        }
+        case 'orgs': {
+            const orgId = requireSegment(segments, 1, ref, 'orgId');
+            if (segments.length >= 4 && segments[2] === 'projects') {
+                const projectId = requireSegment(segments, 3, ref, 'projectId');
+                return {
+                    scope: {
+                        tier: space_1.SpaceKind.Project,
+                        orgId,
+                        projectId,
+                    },
+                    consumed: 4,
+                };
+            }
+            return {
+                scope: { tier: space_1.SpaceKind.Org, orgId },
+                consumed: 2,
+            };
+        }
+        default:
+            throw new XemaObjectRefParseError(ref, `unknown scope head "${head}" (expected one of: system, biomes, orgs, users)`);
+    }
+}
+function parseXemaObjectRef(ref) {
+    if (!ref.startsWith(XEMA_OBJECT_REF_PREFIX)) {
+        throw new XemaObjectRefParseError(ref, `must start with "${XEMA_OBJECT_REF_PREFIX}"`);
+    }
+    const body = ref.slice(XEMA_OBJECT_REF_PREFIX.length);
+    if (body.length === 0) {
+        throw new XemaObjectRefParseError(ref, 'empty body after scheme');
+    }
+    let version;
+    let pathBody = body;
+    const atIndex = body.lastIndexOf('@');
+    const lastSlash = body.lastIndexOf('/');
+    if (atIndex > lastSlash) {
+        version = body.slice(atIndex + 1);
+        pathBody = body.slice(0, atIndex);
+        if (version.length === 0) {
+            throw new XemaObjectRefParseError(ref, 'empty version suffix after "@"');
+        }
+        if (!VERSION_PATTERN.test(version)) {
+            throw new XemaObjectRefParseError(ref, `version "${version}" contains invalid characters`);
+        }
+    }
+    const segments = pathBody.split('/').filter((segment) => segment.length > 0);
+    if (segments.length < 3) {
+        throw new XemaObjectRefParseError(ref, 'must contain at least <scope>/<kind>/<slug>');
+    }
+    const { scope, consumed } = parseScope(segments, ref);
+    const remaining = segments.slice(consumed);
+    if (remaining.length < 2) {
+        throw new XemaObjectRefParseError(ref, 'missing <kind>/<slug> after scope segments');
+    }
+    if (remaining.length > 2) {
+        throw new XemaObjectRefParseError(ref, `unexpected trailing path segments after <kind>/<slug>: ${remaining.slice(2).join('/')}`);
+    }
+    const kindRaw = requireSegment(remaining, 0, ref, 'kind');
+    const slug = requireSegment(remaining, 1, ref, 'slug');
+    const kindParsed = xema_object_kind_1.XemaObjectKindSchema.safeParse(kindRaw);
+    if (!kindParsed.success) {
+        throw new XemaObjectRefParseError(ref, `unknown XemaObjectKind "${kindRaw}"`);
+    }
+    if (!SLUG_PATTERN.test(slug)) {
+        throw new XemaObjectRefParseError(ref, `slug "${slug}" must match ${SLUG_PATTERN}`);
+    }
+    return version === undefined
+        ? { scope, kind: kindParsed.data, slug }
+        : { scope, kind: kindParsed.data, slug, version };
+}
+function formatXemaObjectRef(parts) {
+    if (!SLUG_PATTERN.test(parts.slug)) {
+        throw new XemaObjectRefParseError(`<unformatted>`, `slug "${parts.slug}" must match ${SLUG_PATTERN}`);
+    }
+    if (parts.version !== undefined && !VERSION_PATTERN.test(parts.version)) {
+        throw new XemaObjectRefParseError(`<unformatted>`, `version "${parts.version}" contains invalid characters`);
+    }
+    const scopePath = (0, space_1.spaceRefToPath)(parts.scope).replace(/^\//, '');
+    const versionSuffix = parts.version ? `@${parts.version}` : '';
+    return `${XEMA_OBJECT_REF_PREFIX}${scopePath}/${parts.kind}/${parts.slug}${versionSuffix}`;
+}
+//# sourceMappingURL=xema-object-ref.js.map

package/dist/object/lib/xema-object-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-object-ref.js","sourceRoot":"","sources":["../../../src/object/lib/xema-object-ref.ts"],"names":[],"mappings":";;;AAmIA,gDA4EC;AAOD,kDAkBC;AAxOD,6BAAwB;AACxB,uCAAkE;AAClE,yDAA0E;AAiB1E,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAE5B,QAAA,mBAAmB,GAAG,OAAC;KACjC,MAAM,EAAE;KACR,MAAM,CACL,CAAC,KAAK,EAA0B,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAC3E,EAAE,OAAO,EAAE,kCAAkC,sBAAsB,GAAG,EAAE,CACzE,CAAC;AAOJ,MAAa,uBAAwB,SAAQ,KAAK;IAChC,IAAI,GAAG,yBAAyB,CAAC;IACjC,GAAG,CAAS;IACZ,MAAM,CAAS;IAE/B,YAAmB,GAAW,EAAE,MAAc;QAC5C,KAAK,CAAC,0BAA0B,GAAG,MAAM,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAXD,0DAWC;AAeD,MAAM,YAAY,GAAG,8BAA8B,CAAC;AACpD,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAOxD,SAAS,cAAc,CACrB,QAAkB,EAClB,KAAa,EACb,GAAW,EACX,KAAa;IAEb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,WAAW,KAAK,UAAU,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,QAAkB,EAAE,GAAW;IACjD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACvD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAS,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC5D,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC5D,OAAO;gBACL,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAS,CAAC,KAAK,EAAE,OAAO,EAAE;gBACzC,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1D,OAAO;gBACL,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAS,CAAC,IAAI,EAAE,MAAM,EAAE;gBACvC,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;gBACvD,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBAChE,OAAO;oBACL,KAAK,EAAE;wBACL,IAAI,EAAE,iBAAS,CAAC,OAAO;wBACvB,KAAK;wBACL,SAAS;qBACV;oBACD,QAAQ,EAAE,CAAC;iBACZ,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAS,CAAC,GAAG,EAAE,KAAK,EAAE;gBACrC,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QACD;YACE,MAAM,IAAI,uBAAuB,CAC/B,GAAG,EACH,uBAAuB,IAAI,kDAAkD,CAC9E,CAAC;IACN,CAAC;AACH,CAAC;AAQD,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,uBAAuB,CAC/B,GAAG,EACH,oBAAoB,sBAAsB,GAAG,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IACpE,CAAC;IAID,IAAI,OAA2B,CAAC;IAChC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,SAAS,EAAE,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAClC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,uBAAuB,CAC/B,GAAG,EACH,YAAY,OAAO,+BAA+B,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,uBAAuB,CAC/B,GAAG,EACH,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAC/B,GAAG,EACH,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAC/B,GAAG,EACH,0DAA0D,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,uCAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,uBAAuB,CAC/B,GAAG,EACH,2BAA2B,OAAO,GAAG,CACtC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,EACH,SAAS,IAAI,gBAAgB,YAAY,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE;QACxC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACtD,CAAC;AAOD,SAAgB,mBAAmB,CAAC,KAAyB;IAC3D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,SAAS,KAAK,CAAC,IAAI,gBAAgB,YAAY,EAAE,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,YAAY,KAAK,CAAC,OAAO,+BAA+B,CACzD,CAAC;IACJ,CAAC;IAGD,MAAM,SAAS,GAAG,IAAA,sBAAc,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,OAAO,GAAG,sBAAsB,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,aAAa,EAAmB,CAAC;AAC9G,CAAC"}

package/dist/object/lib/xema-object.d.ts

@@ -0,0 +1,24 @@
+import { z, ZodTypeAny } from 'zod';
+import { ObjectLifecycle } from './object-lifecycle';
+import { SpaceRef } from '../../space';
+import { XemaObjectKind } from './xema-object-kind';
+import { XemaObjectRef } from './xema-object-ref';
+export interface SubjectRef {
+    kind: string;
+    ref: string;
+}
+export declare const SubjectRefSchema: z.ZodObject<{
+    kind: z.ZodString;
+    ref: z.ZodString;
+}, z.core.$strip>;
+export interface XemaObject<TKind extends XemaObjectKind = XemaObjectKind, TPayload = unknown> {
+    ref: XemaObjectRef;
+    kind: TKind;
+    scope: SpaceRef;
+    owner: SubjectRef;
+    version: string;
+    lifecycle: ObjectLifecycle;
+    payload: TPayload;
+}
+export declare function xemaObjectSchema<TKind extends XemaObjectKind, TPayloadSchema extends ZodTypeAny>(kindSchema: z.ZodType<TKind>, payloadSchema: TPayloadSchema): z.ZodType<XemaObject<TKind, z.infer<TPayloadSchema>>>;
+//# sourceMappingURL=xema-object.d.ts.map

package/dist/object/lib/xema-object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-object.d.ts","sourceRoot":"","sources":["../../../src/object/lib/xema-object.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,eAAe,EAAyB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAkB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAuB,MAAM,mBAAmB,CAAC;AAcvE,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AAmBH,MAAM,WAAW,UAAU,CACzB,KAAK,SAAS,cAAc,GAAG,cAAc,EAC7C,QAAQ,GAAG,OAAO;IAElB,GAAG,EAAE,aAAa,CAAC;IACnB,IAAI,EAAE,KAAK,CAAC;IACZ,KAAK,EAAE,QAAQ,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,QAAQ,CAAC;CACnB;AAQD,wBAAgB,gBAAgB,CAC9B,KAAK,SAAS,cAAc,EAC5B,cAAc,SAAS,UAAU,EAEjC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAC5B,aAAa,EAAE,cAAc,GAC5B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAUvD"}

package/dist/object/lib/xema-object.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SubjectRefSchema = void 0;
+exports.xemaObjectSchema = xemaObjectSchema;
+const zod_1 = require("zod");
+const object_lifecycle_1 = require("./object-lifecycle");
+const space_1 = require("../../space");
+const xema_object_ref_1 = require("./xema-object-ref");
+exports.SubjectRefSchema = zod_1.z.object({
+    kind: zod_1.z.string().min(1),
+    ref: zod_1.z.string().min(1),
+});
+function xemaObjectSchema(kindSchema, payloadSchema) {
+    return zod_1.z.object({
+        ref: xema_object_ref_1.XemaObjectRefSchema,
+        kind: kindSchema,
+        scope: space_1.SpaceRefSchema,
+        owner: exports.SubjectRefSchema,
+        version: zod_1.z.string().min(1),
+        lifecycle: object_lifecycle_1.ObjectLifecycleSchema,
+        payload: payloadSchema,
+    });
+}
+//# sourceMappingURL=xema-object.js.map

package/dist/object/lib/xema-object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-object.js","sourceRoot":"","sources":["../../../src/object/lib/xema-object.ts"],"names":[],"mappings":";;;AAgEA,4CAgBC;AAhFD,6BAAoC;AACpC,yDAA4E;AAC5E,uCAAuD;AAEvD,uDAAuE;AAmB1D,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC,CAAC;AAsCH,SAAgB,gBAAgB,CAI9B,UAA4B,EAC5B,aAA6B;IAE7B,OAAO,OAAC,CAAC,MAAM,CAAC;QACd,GAAG,EAAE,qCAAmB;QACxB,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,sBAAc;QACrB,KAAK,EAAE,wBAAgB;QACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,SAAS,EAAE,wCAAqB;QAChC,OAAO,EAAE,aAAa;KACvB,CAAqE,CAAC;AACzE,CAAC"}

package/dist/policy/index.d.ts

@@ -0,0 +1,4 @@
+export * from './lib/obligations';
+export * from './lib/route-hints';
+export * from './lib/policy';
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC"}

package/dist/policy/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/obligations"), exports);
+__exportStar(require("./lib/route-hints"), exports);
+__exportStar(require("./lib/policy"), exports);
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,oDAAkC;AAClC,+CAA6B"}

package/dist/policy/lib/obligations.d.ts

@@ -0,0 +1,91 @@
+import { z } from 'zod';
+export declare enum PolicyObligationKind {
+    Audit = "audit",
+    RedactSecrets = "redact-secrets",
+    RequireRunnerKind = "require-runner-kind",
+    RequireHumanApproval = "require-human-approval",
+    MaxDurationSeconds = "max-duration-seconds",
+    MaxCostUsd = "max-cost-usd",
+    RestrictOutputClassification = "restrict-output-classification",
+    DataResidency = "data-residency"
+}
+export declare const PolicyObligationKindSchema: z.ZodEnum<typeof PolicyObligationKind>;
+export declare enum RunnerKind {
+    Local = "local",
+    Cloud = "cloud",
+    CustomerEdge = "customer-edge",
+    GPU = "gpu",
+    Sandbox = "sandbox",
+    CI = "ci",
+    McpExternal = "mcp-external"
+}
+export declare const RunnerKindSchema: z.ZodEnum<typeof RunnerKind>;
+export declare enum DataResidency {
+    Eu = "eu",
+    Us = "us",
+    CustomerPrivate = "customer-private"
+}
+export declare const DataResidencySchema: z.ZodEnum<typeof DataResidency>;
+export declare const AuditObligationSchema: z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.Audit>;
+}, z.core.$strip>;
+export type AuditObligation = z.infer<typeof AuditObligationSchema>;
+export declare const RedactSecretsObligationSchema: z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.RedactSecrets>;
+}, z.core.$strip>;
+export type RedactSecretsObligation = z.infer<typeof RedactSecretsObligationSchema>;
+export declare const RequireRunnerKindObligationSchema: z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.RequireRunnerKind>;
+    runnerKind: z.ZodEnum<typeof RunnerKind>;
+}, z.core.$strip>;
+export type RequireRunnerKindObligation = z.infer<typeof RequireRunnerKindObligationSchema>;
+export declare const RequireHumanApprovalObligationSchema: z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.RequireHumanApproval>;
+    approverRole: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type RequireHumanApprovalObligation = z.infer<typeof RequireHumanApprovalObligationSchema>;
+export declare const MaxDurationSecondsObligationSchema: z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.MaxDurationSeconds>;
+    maxDurationSeconds: z.ZodNumber;
+}, z.core.$strip>;
+export type MaxDurationSecondsObligation = z.infer<typeof MaxDurationSecondsObligationSchema>;
+export declare const MaxCostUsdObligationSchema: z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.MaxCostUsd>;
+    maxCostUsd: z.ZodNumber;
+}, z.core.$strip>;
+export type MaxCostUsdObligation = z.infer<typeof MaxCostUsdObligationSchema>;
+export declare const RestrictOutputClassificationObligationSchema: z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.RestrictOutputClassification>;
+    maxClassification: z.ZodEnum<typeof import("../../space").DataClassification>;
+}, z.core.$strip>;
+export type RestrictOutputClassificationObligation = z.infer<typeof RestrictOutputClassificationObligationSchema>;
+export declare const DataResidencyObligationSchema: z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.DataResidency>;
+    residency: z.ZodEnum<typeof DataResidency>;
+}, z.core.$strip>;
+export type DataResidencyObligation = z.infer<typeof DataResidencyObligationSchema>;
+export declare const PolicyObligationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.Audit>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.RedactSecrets>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.RequireRunnerKind>;
+    runnerKind: z.ZodEnum<typeof RunnerKind>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.RequireHumanApproval>;
+    approverRole: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.MaxDurationSeconds>;
+    maxDurationSeconds: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.MaxCostUsd>;
+    maxCostUsd: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.RestrictOutputClassification>;
+    maxClassification: z.ZodEnum<typeof import("../../space").DataClassification>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<PolicyObligationKind.DataResidency>;
+    residency: z.ZodEnum<typeof DataResidency>;
+}, z.core.$strip>], "kind">;
+export type PolicyObligation = z.infer<typeof PolicyObligationSchema>;
+//# sourceMappingURL=obligations.d.ts.map

package/dist/policy/lib/obligations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"obligations.d.ts","sourceRoot":"","sources":["../../../src/policy/lib/obligations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,oBAAoB;IAC9B,KAAK,UAAU;IACf,aAAa,mBAAmB;IAChC,iBAAiB,wBAAwB;IACzC,oBAAoB,2BAA2B;IAC/C,kBAAkB,yBAAyB;IAC3C,UAAU,iBAAiB;IAC3B,4BAA4B,mCAAmC;IAC/D,aAAa,mBAAmB;CACjC;AAED,eAAO,MAAM,0BAA0B,wCAAqC,CAAC;AAa7E,oBAAY,UAAU;IACpB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,EAAE,OAAO;IAQT,WAAW,iBAAiB;CAC7B;AAED,eAAO,MAAM,gBAAgB,8BAA2B,CAAC;AAWzD,oBAAY,aAAa;IACvB,EAAE,OAAO;IACT,EAAE,OAAO;IACT,eAAe,qBAAqB;CACrC;AAED,eAAO,MAAM,mBAAmB,iCAA8B,CAAC;AAU/D,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;iBAI/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAClD,OAAO,oCAAoC,CAC5C,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,4CAA4C;;;iBAGvD,CAAC;AACH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,4CAA4C,CACpD,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AASF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;2BASjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/policy/lib/obligations.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyObligationSchema = exports.DataResidencyObligationSchema = exports.RestrictOutputClassificationObligationSchema = exports.MaxCostUsdObligationSchema = exports.MaxDurationSecondsObligationSchema = exports.RequireHumanApprovalObligationSchema = exports.RequireRunnerKindObligationSchema = exports.RedactSecretsObligationSchema = exports.AuditObligationSchema = exports.DataResidencySchema = exports.DataResidency = exports.RunnerKindSchema = exports.RunnerKind = exports.PolicyObligationKindSchema = exports.PolicyObligationKind = void 0;
+const zod_1 = require("zod");
+const space_1 = require("../../space");
+var PolicyObligationKind;
+(function (PolicyObligationKind) {
+    PolicyObligationKind["Audit"] = "audit";
+    PolicyObligationKind["RedactSecrets"] = "redact-secrets";
+    PolicyObligationKind["RequireRunnerKind"] = "require-runner-kind";
+    PolicyObligationKind["RequireHumanApproval"] = "require-human-approval";
+    PolicyObligationKind["MaxDurationSeconds"] = "max-duration-seconds";
+    PolicyObligationKind["MaxCostUsd"] = "max-cost-usd";
+    PolicyObligationKind["RestrictOutputClassification"] = "restrict-output-classification";
+    PolicyObligationKind["DataResidency"] = "data-residency";
+})(PolicyObligationKind || (exports.PolicyObligationKind = PolicyObligationKind = {}));
+exports.PolicyObligationKindSchema = zod_1.z.nativeEnum(PolicyObligationKind);
+var RunnerKind;
+(function (RunnerKind) {
+    RunnerKind["Local"] = "local";
+    RunnerKind["Cloud"] = "cloud";
+    RunnerKind["CustomerEdge"] = "customer-edge";
+    RunnerKind["GPU"] = "gpu";
+    RunnerKind["Sandbox"] = "sandbox";
+    RunnerKind["CI"] = "ci";
+    RunnerKind["McpExternal"] = "mcp-external";
+})(RunnerKind || (exports.RunnerKind = RunnerKind = {}));
+exports.RunnerKindSchema = zod_1.z.nativeEnum(RunnerKind);
+var DataResidency;
+(function (DataResidency) {
+    DataResidency["Eu"] = "eu";
+    DataResidency["Us"] = "us";
+    DataResidency["CustomerPrivate"] = "customer-private";
+})(DataResidency || (exports.DataResidency = DataResidency = {}));
+exports.DataResidencySchema = zod_1.z.nativeEnum(DataResidency);
+exports.AuditObligationSchema = zod_1.z.object({
+    kind: zod_1.z.literal(PolicyObligationKind.Audit),
+});
+exports.RedactSecretsObligationSchema = zod_1.z.object({
+    kind: zod_1.z.literal(PolicyObligationKind.RedactSecrets),
+});
+exports.RequireRunnerKindObligationSchema = zod_1.z.object({
+    kind: zod_1.z.literal(PolicyObligationKind.RequireRunnerKind),
+    runnerKind: exports.RunnerKindSchema,
+});
+exports.RequireHumanApprovalObligationSchema = zod_1.z.object({
+    kind: zod_1.z.literal(PolicyObligationKind.RequireHumanApproval),
+    approverRole: zod_1.z.string().min(1).optional(),
+});
+exports.MaxDurationSecondsObligationSchema = zod_1.z.object({
+    kind: zod_1.z.literal(PolicyObligationKind.MaxDurationSeconds),
+    maxDurationSeconds: zod_1.z.number().int().positive(),
+});
+exports.MaxCostUsdObligationSchema = zod_1.z.object({
+    kind: zod_1.z.literal(PolicyObligationKind.MaxCostUsd),
+    maxCostUsd: zod_1.z.number().positive(),
+});
+exports.RestrictOutputClassificationObligationSchema = zod_1.z.object({
+    kind: zod_1.z.literal(PolicyObligationKind.RestrictOutputClassification),
+    maxClassification: space_1.DataClassificationSchema,
+});
+exports.DataResidencyObligationSchema = zod_1.z.object({
+    kind: zod_1.z.literal(PolicyObligationKind.DataResidency),
+    residency: exports.DataResidencySchema,
+});
+exports.PolicyObligationSchema = zod_1.z.discriminatedUnion('kind', [
+    exports.AuditObligationSchema,
+    exports.RedactSecretsObligationSchema,
+    exports.RequireRunnerKindObligationSchema,
+    exports.RequireHumanApprovalObligationSchema,
+    exports.MaxDurationSecondsObligationSchema,
+    exports.MaxCostUsdObligationSchema,
+    exports.RestrictOutputClassificationObligationSchema,
+    exports.DataResidencyObligationSchema,
+]);
+//# sourceMappingURL=obligations.js.map

package/dist/policy/lib/obligations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obligations.js","sourceRoot":"","sources":["../../../src/policy/lib/obligations.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,uCAAuD;AAUvD,IAAY,oBASX;AATD,WAAY,oBAAoB;IAC9B,uCAAe,CAAA;IACf,wDAAgC,CAAA;IAChC,iEAAyC,CAAA;IACzC,uEAA+C,CAAA;IAC/C,mEAA2C,CAAA;IAC3C,mDAA2B,CAAA;IAC3B,uFAA+D,CAAA;IAC/D,wDAAgC,CAAA;AAClC,CAAC,EATW,oBAAoB,oCAApB,oBAAoB,QAS/B;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAa7E,IAAY,UAeX;AAfD,WAAY,UAAU;IACpB,6BAAe,CAAA;IACf,6BAAe,CAAA;IACf,4CAA8B,CAAA;IAC9B,yBAAW,CAAA;IACX,iCAAmB,CAAA;IACnB,uBAAS,CAAA;IAQT,0CAA4B,CAAA;AAC9B,CAAC,EAfW,UAAU,0BAAV,UAAU,QAerB;AAEY,QAAA,gBAAgB,GAAG,OAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAWzD,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,0BAAS,CAAA;IACT,0BAAS,CAAA;IACT,qDAAoC,CAAA;AACtC,CAAC,EAJW,aAAa,6BAAb,aAAa,QAIxB;AAEY,QAAA,mBAAmB,GAAG,OAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAUlD,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;CAC5C,CAAC,CAAC;AAGU,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,aAAa,CAAC;CACpD,CAAC,CAAC;AAGU,QAAA,iCAAiC,GAAG,OAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,iBAAiB,CAAC;IACvD,UAAU,EAAE,wBAAgB;CAC7B,CAAC,CAAC;AAKU,QAAA,oCAAoC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3D,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,oBAAoB,CAAC;IAE1D,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAKU,QAAA,kCAAkC,GAAG,OAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;IACxD,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAKU,QAAA,0BAA0B,GAAG,OAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,UAAU,CAAC;IAChD,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGU,QAAA,4CAA4C,GAAG,OAAC,CAAC,MAAM,CAAC;IACnE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,4BAA4B,CAAC;IAClE,iBAAiB,EAAE,gCAAwB;CAC5C,CAAC,CAAC;AAKU,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,aAAa,CAAC;IACnD,SAAS,EAAE,2BAAmB;CAC/B,CAAC,CAAC;AAYU,QAAA,sBAAsB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,6BAAqB;IACrB,qCAA6B;IAC7B,yCAAiC;IACjC,4CAAoC;IACpC,0CAAkC;IAClC,kCAA0B;IAC1B,oDAA4C;IAC5C,qCAA6B;CAC9B,CAAC,CAAC"}

package/dist/policy/lib/policy.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+import { type ExecutionContext } from '../../execution-context';
+import { type PolicyObligation } from './obligations';
+import { type RouteHint } from './route-hints';
+export declare enum PolicyDecisionKind {
+    Allow = "allow",
+    Deny = "deny",
+    NeedsApproval = "needs_approval"
+}
+export declare const PolicyDecisionKindSchema: z.ZodEnum<typeof PolicyDecisionKind>;
+export declare enum CredentialPrecedenceSource {
+    Explicit = "explicit",
+    CapabilityDefault = "capability_default",
+    ProjectDefault = "project_default",
+    OrgDefault = "org_default"
+}
+export declare const CredentialPrecedenceSourceSchema: z.ZodEnum<typeof CredentialPrecedenceSource>;
+export type PolicyRequest = ExecutionContext;
+export declare const PolicyRequestSchema: z.ZodType<PolicyRequest>;
+export interface PolicyDecision {
+    kind: PolicyDecisionKind;
+    reason?: string;
+    obligations?: PolicyObligation[];
+    routeHints?: RouteHint;
+    credentialBindingId?: string;
+    credentialPrecedenceApplied?: CredentialPrecedenceSource;
+}
+export declare const PolicyDecisionSchema: z.ZodType<PolicyDecision>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy/lib/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/policy/lib/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAShE,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,IAAI,SAAS;IACb,aAAa,mBAAmB;CACjC;AAED,eAAO,MAAM,wBAAwB,sCAAmC,CAAC;AAczE,oBAAY,0BAA0B;IACpC,QAAQ,aAAa;IACrB,iBAAiB,uBAAuB;IACxC,cAAc,oBAAoB;IAClC,UAAU,gBAAgB;CAC3B;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAWF,MAAM,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE7C,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CACjC,CAAC;AAWzB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,SAAS,CAAC;IAWvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAM7B,2BAA2B,CAAC,EAAE,0BAA0B,CAAC;CAC1D;AAED,eAAO,MAAM,oBAAoB,EAO3B,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC"}

package/dist/policy/lib/policy.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyDecisionSchema = exports.PolicyRequestSchema = exports.CredentialPrecedenceSourceSchema = exports.CredentialPrecedenceSource = exports.PolicyDecisionKindSchema = exports.PolicyDecisionKind = void 0;
+const zod_1 = require("zod");
+const execution_context_1 = require("../../execution-context");
+const obligations_1 = require("./obligations");
+const route_hints_1 = require("./route-hints");
+var PolicyDecisionKind;
+(function (PolicyDecisionKind) {
+    PolicyDecisionKind["Allow"] = "allow";
+    PolicyDecisionKind["Deny"] = "deny";
+    PolicyDecisionKind["NeedsApproval"] = "needs_approval";
+})(PolicyDecisionKind || (exports.PolicyDecisionKind = PolicyDecisionKind = {}));
+exports.PolicyDecisionKindSchema = zod_1.z.nativeEnum(PolicyDecisionKind);
+var CredentialPrecedenceSource;
+(function (CredentialPrecedenceSource) {
+    CredentialPrecedenceSource["Explicit"] = "explicit";
+    CredentialPrecedenceSource["CapabilityDefault"] = "capability_default";
+    CredentialPrecedenceSource["ProjectDefault"] = "project_default";
+    CredentialPrecedenceSource["OrgDefault"] = "org_default";
+})(CredentialPrecedenceSource || (exports.CredentialPrecedenceSource = CredentialPrecedenceSource = {}));
+exports.CredentialPrecedenceSourceSchema = zod_1.z.nativeEnum(CredentialPrecedenceSource);
+exports.PolicyRequestSchema = execution_context_1.ExecutionContextSchema;
+exports.PolicyDecisionSchema = zod_1.z.object({
+    kind: exports.PolicyDecisionKindSchema,
+    reason: zod_1.z.string().min(1).optional(),
+    obligations: zod_1.z.array(obligations_1.PolicyObligationSchema).optional(),
+    routeHints: route_hints_1.RouteHintSchema.optional(),
+    credentialBindingId: zod_1.z.string().min(1).optional(),
+    credentialPrecedenceApplied: exports.CredentialPrecedenceSourceSchema.optional(),
+});
+//# sourceMappingURL=policy.js.map

package/dist/policy/lib/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/policy/lib/policy.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,+DAGiC;AACjC,+CAGuB;AACvB,+CAAgE;AAShE,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mCAAa,CAAA;IACb,sDAAgC,CAAA;AAClC,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAEY,QAAA,wBAAwB,GAAG,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAczE,IAAY,0BAKX;AALD,WAAY,0BAA0B;IACpC,mDAAqB,CAAA;IACrB,sEAAwC,CAAA;IACxC,gEAAkC,CAAA;IAClC,wDAA0B,CAAA;AAC5B,CAAC,EALW,0BAA0B,0CAA1B,0BAA0B,QAKrC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAaW,QAAA,mBAAmB,GAC9B,0CAAsB,CAAC;AAmCZ,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,gCAAwB;IAC9B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,oCAAsB,CAAC,CAAC,QAAQ,EAAE;IACvD,UAAU,EAAE,6BAAe,CAAC,QAAQ,EAAE;IACtC,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,2BAA2B,EAAE,wCAAgC,CAAC,QAAQ,EAAE;CACzE,CAA8B,CAAC"}

package/dist/policy/lib/route-hints.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+import { RunnerKind } from './obligations';
+export interface RouteHint {
+    requiredRunnerLabels?: Record<string, string>;
+    preferredRunnerKind?: RunnerKind;
+    requiredRegion?: string;
+    requireCustomerEdge?: boolean;
+}
+export declare const RouteHintSchema: z.ZodType<RouteHint>;
+export { RunnerKind, RunnerKindSchema } from './obligations';
+//# sourceMappingURL=route-hints.d.ts.map

package/dist/policy/lib/route-hints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-hints.d.ts","sourceRoot":"","sources":["../../../src/policy/lib/route-hints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAoB,MAAM,eAAe,CAAC;AAW7D,MAAM,WAAW,SAAS;IAMxB,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAQ9C,mBAAmB,CAAC,EAAE,UAAU,CAAC;IAMjC,cAAc,CAAC,EAAE,MAAM,CAAC;IAQxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,eAAO,MAAM,eAAe,EAKtB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAE3B,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}