@xemahq/kernel-contracts 0.16.2 → 0.18.0

package/dist/agent-workspace/awp-spec.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://xema.dev/schemas/awp-spec.v1.json",
-  "emittedAt": "2026-06-26T20:48:27.706Z",
+  "emittedAt": "2026-06-27T11:25:54.369Z",
   "spec": {
     "id": "awp/v1",
     "version": "1.2.0",

package/dist/contribution/lib/contribution-kind.d.ts

@@ -38,6 +38,7 @@ export declare enum ContributionKind {
     DeliverableSpecKind = "deliverable-spec-kind",
     RuntimeMountKind = "runtime-mount-kind",
     Capability = "capability",
+    ResourceOwnership = "resource-ownership",
     StageMachine = "stage-machine"
 }
 export declare const ContributionKindSchema: z.ZodEnum<typeof ContributionKind>;

package/dist/contribution/lib/contribution-kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,oBAAY,gBAAgB;IAE1B,gBAAgB,sBAAsB;IACtC,WAAW,iBAAiB;IAC5B,OAAO,aAAa;IACpB,gBAAgB,sBAAsB;IACtC,aAAa,mBAAmB;IAChC,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,YAAY,kBAAkB;IAC9B,mBAAmB,yBAAyB;IAC5C,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAC5B,wBAAwB,+BAA+B;IACvD,UAAU,gBAAgB;IAI1B,YAAY,kBAAkB;IAE9B,WAAW,iBAAiB;IAQ5B,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAElC,kBAAkB,yBAAyB;IAE3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAE1B,oBAAoB,0BAA0B;IAE9C,oBAAoB,2BAA2B;IAE/C,yBAAyB,gCAAgC;IAGzD,mBAAmB,yBAAyB;IAI5C,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAExC,yBAAyB,gCAAgC;IAEzD,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IAE1B,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,WAAW,iBAAiB;IAI5B,eAAe,sBAAsB;IAErC,mBAAmB,0BAA0B;IAE7C,gBAAgB,uBAAuB;IAiBvC,UAAU,eAAe;IAczB,YAAY,kBAAkB;CAC/B;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,oBAAY,gBAAgB;IAE1B,gBAAgB,sBAAsB;IACtC,WAAW,iBAAiB;IAC5B,OAAO,aAAa;IACpB,gBAAgB,sBAAsB;IACtC,aAAa,mBAAmB;IAChC,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,YAAY,kBAAkB;IAC9B,mBAAmB,yBAAyB;IAC5C,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAC5B,wBAAwB,+BAA+B;IACvD,UAAU,gBAAgB;IAI1B,YAAY,kBAAkB;IAE9B,WAAW,iBAAiB;IAQ5B,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAElC,kBAAkB,yBAAyB;IAE3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAE1B,oBAAoB,0BAA0B;IAE9C,oBAAoB,2BAA2B;IAE/C,yBAAyB,gCAAgC;IAGzD,mBAAmB,yBAAyB;IAI5C,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAExC,yBAAyB,gCAAgC;IAEzD,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IAE1B,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,WAAW,iBAAiB;IAI5B,eAAe,sBAAsB;IAErC,mBAAmB,0BAA0B;IAE7C,gBAAgB,uBAAuB;IAiBvC,UAAU,eAAe;IAezB,iBAAiB,uBAAuB;IAcxC,YAAY,kBAAkB;CAC/B;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}

package/dist/contribution/lib/contribution-kind.js

@@ -42,6 +42,7 @@ var ContributionKind;
     ContributionKind["DeliverableSpecKind"] = "deliverable-spec-kind";
     ContributionKind["RuntimeMountKind"] = "runtime-mount-kind";
     ContributionKind["Capability"] = "capability";
+    ContributionKind["ResourceOwnership"] = "resource-ownership";
     ContributionKind["StageMachine"] = "stage-machine";
 })(ContributionKind || (exports.ContributionKind = ContributionKind = {}));
 exports.ContributionKindSchema = zod_1.z.nativeEnum(ContributionKind);

package/dist/contribution/lib/contribution-kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAexB,IAAY,gBA0HX;AA1HD,WAAY,gBAAgB;IAE1B,0DAAsC,CAAA;IACtC,gDAA4B,CAAA;IAC5B,wCAAoB,CAAA;IACpB,0DAAsC,CAAA;IACtC,oDAAgC,CAAA;IAChC,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,kDAA8B,CAAA;IAC9B,gEAA4C,CAAA;IAC5C,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAC5B,2EAAuD,CAAA;IACvD,8CAA0B,CAAA;IAI1B,kDAA8B,CAAA;IAE9B,gDAA4B,CAAA;IAQ5B,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAElC,+DAA2C,CAAA;IAE3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAE1B,kEAA8C,CAAA;IAE9C,mEAA+C,CAAA;IAE/C,6EAAyD,CAAA;IAGzD,gEAA4C,CAAA;IAI5C,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAExC,6EAAyD,CAAA;IAEzD,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IAE1B,kDAA8B,CAAA;IAE9B,sDAAkC,CAAA;IAElC,gDAA4B,CAAA;IAI5B,yDAAqC,CAAA;IAErC,iEAA6C,CAAA;IAE7C,2DAAuC,CAAA;IAiBvC,6CAAyB,CAAA;IAczB,kDAA8B,CAAA;AAChC,CAAC,EA1HW,gBAAgB,gCAAhB,gBAAgB,QA0H3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAexB,IAAY,gBAyIX;AAzID,WAAY,gBAAgB;IAE1B,0DAAsC,CAAA;IACtC,gDAA4B,CAAA;IAC5B,wCAAoB,CAAA;IACpB,0DAAsC,CAAA;IACtC,oDAAgC,CAAA;IAChC,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,kDAA8B,CAAA;IAC9B,gEAA4C,CAAA;IAC5C,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAC5B,2EAAuD,CAAA;IACvD,8CAA0B,CAAA;IAI1B,kDAA8B,CAAA;IAE9B,gDAA4B,CAAA;IAQ5B,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAElC,+DAA2C,CAAA;IAE3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAE1B,kEAA8C,CAAA;IAE9C,mEAA+C,CAAA;IAE/C,6EAAyD,CAAA;IAGzD,gEAA4C,CAAA;IAI5C,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAExC,6EAAyD,CAAA;IAEzD,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IAE1B,kDAA8B,CAAA;IAE9B,sDAAkC,CAAA;IAElC,gDAA4B,CAAA;IAI5B,yDAAqC,CAAA;IAErC,iEAA6C,CAAA;IAE7C,2DAAuC,CAAA;IAiBvC,6CAAyB,CAAA;IAezB,4DAAwC,CAAA;IAcxC,kDAA8B,CAAA;AAChC,CAAC,EAzIW,gBAAgB,gCAAhB,gBAAgB,QAyI3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/lifecycle-events/index.d.ts

@@ -0,0 +1,2 @@
+export * from './lib/lifecycle-events';
+//# sourceMappingURL=index.d.ts.map

package/dist/lifecycle-events/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lifecycle-events/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC"}

package/dist/lifecycle-events/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/lifecycle-events"), exports);
+//# sourceMappingURL=index.js.map

package/dist/lifecycle-events/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lifecycle-events/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC"}

package/dist/lifecycle-events/lib/lifecycle-events.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+export declare enum LifecycleEventType {
+    OrganizationDeleted = "organization.organization.deleted",
+    ProjectDeleted = "project.project.deleted",
+    UserDeleted = "user.user.deleted"
+}
+export declare const IDENTITY_LIFECYCLE_EVENT_SOURCE: "/services/identity-api";
+export declare const PROJECT_LIFECYCLE_EVENT_SOURCE: "/services/project-registry-api";
+export declare const LIFECYCLE_EVENT_SCHEMA_VERSION: "1.0.0";
+export declare const OrganizationDeletedEventSchema: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strict>;
+export declare const ProjectDeletedEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    orgId: z.ZodString;
+    projectId: z.ZodString;
+}, z.core.$strict>;
+export declare const UserDeletedEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    orgId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type OrganizationDeletedEventPayload = z.infer<typeof OrganizationDeletedEventSchema>;
+export type ProjectDeletedEventPayload = z.infer<typeof ProjectDeletedEventSchema>;
+export type UserDeletedEventPayload = z.infer<typeof UserDeletedEventSchema>;
+//# sourceMappingURL=lifecycle-events.d.ts.map

package/dist/lifecycle-events/lib/lifecycle-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-events.d.ts","sourceRoot":"","sources":["../../../src/lifecycle-events/lib/lifecycle-events.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,oBAAY,kBAAkB;IAE5B,mBAAmB,sCAAsC;IAEzD,cAAc,4BAA4B;IAS1C,WAAW,sBAAsB;CAClC;AAGD,eAAO,MAAM,+BAA+B,EAAG,wBAAiC,CAAC;AAGjF,eAAO,MAAM,8BAA8B,EACzC,gCAAyC,CAAC;AAG5C,eAAO,MAAM,8BAA8B,EAAG,OAAgB,CAAC;AAO/D,eAAO,MAAM,8BAA8B;;kBAIhC,CAAC;AAOZ,eAAO,MAAM,yBAAyB;;;;kBAM3B,CAAC;AAOZ,eAAO,MAAM,sBAAsB;;;kBAKxB,CAAC;AAEZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,yBAAyB,CACjC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/lifecycle-events/lib/lifecycle-events.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserDeletedEventSchema = exports.ProjectDeletedEventSchema = exports.OrganizationDeletedEventSchema = exports.LIFECYCLE_EVENT_SCHEMA_VERSION = exports.PROJECT_LIFECYCLE_EVENT_SOURCE = exports.IDENTITY_LIFECYCLE_EVENT_SOURCE = exports.LifecycleEventType = void 0;
+const zod_1 = require("zod");
+var LifecycleEventType;
+(function (LifecycleEventType) {
+    LifecycleEventType["OrganizationDeleted"] = "organization.organization.deleted";
+    LifecycleEventType["ProjectDeleted"] = "project.project.deleted";
+    LifecycleEventType["UserDeleted"] = "user.user.deleted";
+})(LifecycleEventType || (exports.LifecycleEventType = LifecycleEventType = {}));
+exports.IDENTITY_LIFECYCLE_EVENT_SOURCE = '/services/identity-api';
+exports.PROJECT_LIFECYCLE_EVENT_SOURCE = '/services/project-registry-api';
+exports.LIFECYCLE_EVENT_SCHEMA_VERSION = '1.0.0';
+exports.OrganizationDeletedEventSchema = zod_1.z
+    .object({
+    id: zod_1.z.string(),
+})
+    .strict();
+exports.ProjectDeletedEventSchema = zod_1.z
+    .object({
+    id: zod_1.z.string(),
+    orgId: zod_1.z.string(),
+    projectId: zod_1.z.string(),
+})
+    .strict();
+exports.UserDeletedEventSchema = zod_1.z
+    .object({
+    id: zod_1.z.string(),
+    orgId: zod_1.z.string().optional(),
+})
+    .strict();
+//# sourceMappingURL=lifecycle-events.js.map

package/dist/lifecycle-events/lib/lifecycle-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-events.js","sourceRoot":"","sources":["../../../src/lifecycle-events/lib/lifecycle-events.ts"],"names":[],"mappings":";;;AA2BA,6BAAwB;AAOxB,IAAY,kBAcX;AAdD,WAAY,kBAAkB;IAE5B,+EAAyD,CAAA;IAEzD,gEAA0C,CAAA;IAS1C,uDAAiC,CAAA;AACnC,CAAC,EAdW,kBAAkB,kCAAlB,kBAAkB,QAc7B;AAGY,QAAA,+BAA+B,GAAG,wBAAiC,CAAC;AAGpE,QAAA,8BAA8B,GACzC,gCAAyC,CAAC;AAG/B,QAAA,8BAA8B,GAAG,OAAgB,CAAC;AAOlD,QAAA,8BAA8B,GAAG,OAAC;KAC5C,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE;CACf,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,sBAAsB,GAAG,OAAC;KACpC,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/resource/index.d.ts

@@ -4,4 +4,6 @@ export * from './lib/resource-declaration';
 export * from './lib/xema-manifest';
 export * from './lib/stack';
 export * from './lib/plan';
+export * from './lib/resource-ownership-contribution';
+export * from './lib/resource-ref';
 //# sourceMappingURL=index.d.ts.map

package/dist/resource/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resource/index.ts"],"names":[],"mappings":"AAgBA,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resource/index.ts"],"names":[],"mappings":"AAqBA,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,uCAAuC,CAAC;AACtD,cAAc,oBAAoB,CAAC"}

package/dist/resource/index.js

@@ -20,4 +20,6 @@ __exportStar(require("./lib/resource-declaration"), exports);
 __exportStar(require("./lib/xema-manifest"), exports);
 __exportStar(require("./lib/stack"), exports);
 __exportStar(require("./lib/plan"), exports);
+__exportStar(require("./lib/resource-ownership-contribution"), exports);
+__exportStar(require("./lib/resource-ref"), exports);
 //# sourceMappingURL=index.js.map

package/dist/resource/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resource/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAgBA,sDAAoC;AACpC,4DAA0C;AAC1C,6DAA2C;AAC3C,sDAAoC;AACpC,8CAA4B;AAC5B,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resource/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAqBA,sDAAoC;AACpC,4DAA0C;AAC1C,6DAA2C;AAC3C,sDAAoC;AACpC,8CAA4B;AAC5B,6CAA2B;AAC3B,wEAAsD;AACtD,qDAAmC"}

package/dist/resource/lib/resource-ownership-contribution.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+import { SubjectKind } from '../../subject';
+export declare enum ResourceVisibilityPattern {
+    OwnerOnly = "owner-only",
+    OrgShared = "org-shared",
+    ProjectShared = "project-shared",
+    SpaceShared = "space-shared",
+    ExplicitShare = "explicit-share"
+}
+export declare const ResourceVisibilityPatternSchema: z.ZodEnum<typeof ResourceVisibilityPattern>;
+export interface OwnerRef {
+    readonly kind: SubjectKind;
+    readonly ref: string;
+}
+export declare const OwnerRefSchema: z.ZodType<OwnerRef>;
+export interface ExplicitShareRef {
+    readonly kind: SubjectKind;
+    readonly ref: string;
+}
+export declare const ExplicitShareRefSchema: z.ZodType<ExplicitShareRef>;
+export interface ResourceOwnershipContributionManifest {
+    readonly resourceType: string;
+    readonly resourceId: string;
+    readonly visibility: ResourceVisibilityPattern;
+    readonly owners: readonly OwnerRef[];
+    readonly explicitShares?: readonly ExplicitShareRef[];
+}
+export declare const ResourceOwnershipContributionManifestSchema: z.ZodType<ResourceOwnershipContributionManifest>;
+//# sourceMappingURL=resource-ownership-contribution.d.ts.map

package/dist/resource/lib/resource-ownership-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-ownership-contribution.d.ts","sourceRoot":"","sources":["../../../src/resource/lib/resource-ownership-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAqB,MAAM,eAAe,CAAC;AA0B/D,oBAAY,yBAAyB;IAEnC,SAAS,eAAe;IAExB,SAAS,eAAe;IAExB,aAAa,mBAAmB;IAEhC,WAAW,iBAAiB;IAE5B,aAAa,mBAAmB;CACjC;AAED,eAAO,MAAM,+BAA+B,6CAE3C,CAAC;AAQF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAGtB,CAAC;AAS1B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAG9B,CAAC;AAgBlC,MAAM,WAAW,qCAAqC;IAEpD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAE/C,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAMrC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACvD;AASD,eAAO,MAAM,2CAA2C,EAAE,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAUjD,CAAC"}

package/dist/resource/lib/resource-ownership-contribution.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceOwnershipContributionManifestSchema = exports.ExplicitShareRefSchema = exports.OwnerRefSchema = exports.ResourceVisibilityPatternSchema = exports.ResourceVisibilityPattern = void 0;
+const zod_1 = require("zod");
+const subject_1 = require("../../subject");
+const RESOURCE_IDENTIFIER_MAX = 200;
+const RESOURCE_PRINCIPALS_MAX = 100;
+var ResourceVisibilityPattern;
+(function (ResourceVisibilityPattern) {
+    ResourceVisibilityPattern["OwnerOnly"] = "owner-only";
+    ResourceVisibilityPattern["OrgShared"] = "org-shared";
+    ResourceVisibilityPattern["ProjectShared"] = "project-shared";
+    ResourceVisibilityPattern["SpaceShared"] = "space-shared";
+    ResourceVisibilityPattern["ExplicitShare"] = "explicit-share";
+})(ResourceVisibilityPattern || (exports.ResourceVisibilityPattern = ResourceVisibilityPattern = {}));
+exports.ResourceVisibilityPatternSchema = zod_1.z.nativeEnum(ResourceVisibilityPattern);
+exports.OwnerRefSchema = zod_1.z.object({
+    kind: subject_1.SubjectKindSchema,
+    ref: zod_1.z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+});
+exports.ExplicitShareRefSchema = zod_1.z.object({
+    kind: subject_1.SubjectKindSchema,
+    ref: zod_1.z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+});
+exports.ResourceOwnershipContributionManifestSchema = zod_1.z.object({
+    resourceType: zod_1.z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+    resourceId: zod_1.z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+    visibility: exports.ResourceVisibilityPatternSchema,
+    owners: zod_1.z.array(exports.OwnerRefSchema).min(1).max(RESOURCE_PRINCIPALS_MAX),
+    explicitShares: zod_1.z
+        .array(exports.ExplicitShareRefSchema)
+        .max(RESOURCE_PRINCIPALS_MAX)
+        .optional(),
+});
+//# sourceMappingURL=resource-ownership-contribution.js.map

package/dist/resource/lib/resource-ownership-contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-ownership-contribution.js","sourceRoot":"","sources":["../../../src/resource/lib/resource-ownership-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,2CAA+D;AAO/D,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAQpC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAWpC,IAAY,yBAWX;AAXD,WAAY,yBAAyB;IAEnC,qDAAwB,CAAA;IAExB,qDAAwB,CAAA;IAExB,6DAAgC,CAAA;IAEhC,yDAA4B,CAAA;IAE5B,6DAAgC,CAAA;AAClC,CAAC,EAXW,yBAAyB,yCAAzB,yBAAyB,QAWpC;AAEY,QAAA,+BAA+B,GAAG,OAAC,CAAC,UAAU,CACzD,yBAAyB,CAC1B,CAAC;AAaW,QAAA,cAAc,GAAwB,OAAC,CAAC,MAAM,CAAC;IAC1D,IAAI,EAAE,2BAAiB;IACvB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;CACpD,CAAwB,CAAC;AAcb,QAAA,sBAAsB,GAAgC,OAAC,CAAC,MAAM,CAAC;IAC1E,IAAI,EAAE,2BAAiB;IACvB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;CACpD,CAAgC,CAAC;AAwCrB,QAAA,2CAA2C,GACtD,OAAC,CAAC,MAAM,CAAC;IACP,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC5D,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC1D,UAAU,EAAE,uCAA+B;IAC3C,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,sBAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACnE,cAAc,EAAE,OAAC;SACd,KAAK,CAAC,8BAAsB,CAAC;SAC7B,GAAG,CAAC,uBAAuB,CAAC;SAC5B,QAAQ,EAAE;CACd,CAAqD,CAAC"}

package/dist/resource/lib/resource-ref.d.ts

@@ -0,0 +1,9 @@
+export declare const RESOURCE_REF_PREFIX: "resource";
+export declare const RESOURCE_REF_DELIMITER: ":";
+export interface ResourceRefParts {
+    readonly type: string;
+    readonly id: string;
+}
+export declare function composeResourceRef(type: string, id: string): string;
+export declare function parseResourceRef(ref: string): ResourceRefParts;
+//# sourceMappingURL=resource-ref.d.ts.map

package/dist/resource/lib/resource-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-ref.d.ts","sourceRoot":"","sources":["../../../src/resource/lib/resource-ref.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,mBAAmB,EAAG,UAAmB,CAAC;AAGvD,eAAO,MAAM,sBAAsB,EAAG,GAAY,CAAC;AAKnD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAOD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAiBnE;AAQD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAkB9D"}

package/dist/resource/lib/resource-ref.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RESOURCE_REF_DELIMITER = exports.RESOURCE_REF_PREFIX = void 0;
+exports.composeResourceRef = composeResourceRef;
+exports.parseResourceRef = parseResourceRef;
+exports.RESOURCE_REF_PREFIX = 'resource';
+exports.RESOURCE_REF_DELIMITER = ':';
+function composeResourceRef(type, id) {
+    if (type.length === 0 || id.length === 0) {
+        throw new Error(`Invalid resource ref segments: "type" and "id" must both be non-empty (got type="${type}", id="${id}").`);
+    }
+    if (type.includes(exports.RESOURCE_REF_DELIMITER)) {
+        throw new Error(`Invalid resource type "${type}": must not contain the "${exports.RESOURCE_REF_DELIMITER}" delimiter.`);
+    }
+    if (id.includes(exports.RESOURCE_REF_DELIMITER)) {
+        throw new Error(`Invalid resource id "${id}": must not contain the "${exports.RESOURCE_REF_DELIMITER}" delimiter.`);
+    }
+    return `${exports.RESOURCE_REF_PREFIX}${exports.RESOURCE_REF_DELIMITER}${type}${exports.RESOURCE_REF_DELIMITER}${id}`;
+}
+function parseResourceRef(ref) {
+    const [prefix, type, id, ...rest] = ref.split(exports.RESOURCE_REF_DELIMITER);
+    if (rest.length > 0 || prefix === undefined || type === undefined || id === undefined) {
+        throw new Error(`Invalid resource ref "${ref}": expected exactly "${exports.RESOURCE_REF_PREFIX}:<type>:<id>".`);
+    }
+    if (prefix !== exports.RESOURCE_REF_PREFIX) {
+        throw new Error(`Invalid resource ref "${ref}": must start with the "${exports.RESOURCE_REF_PREFIX}" prefix.`);
+    }
+    if (type.length === 0 || id.length === 0) {
+        throw new Error(`Invalid resource ref "${ref}": "type" and "id" segments must both be non-empty.`);
+    }
+    return { type, id };
+}
+//# sourceMappingURL=resource-ref.js.map

package/dist/resource/lib/resource-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-ref.js","sourceRoot":"","sources":["../../../src/resource/lib/resource-ref.ts"],"names":[],"mappings":";;;AA+BA,gDAiBC;AAQD,4CAkBC;AA7DY,QAAA,mBAAmB,GAAG,UAAmB,CAAC;AAG1C,QAAA,sBAAsB,GAAG,GAAY,CAAC;AAenD,SAAgB,kBAAkB,CAAC,IAAY,EAAE,EAAU;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,oFAAoF,IAAI,UAAU,EAAE,KAAK,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,8BAAsB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,4BAA4B,8BAAsB,cAAc,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,QAAQ,CAAC,8BAAsB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,4BAA4B,8BAAsB,cAAc,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,2BAAmB,GAAG,8BAAsB,GAAG,IAAI,GAAG,8BAAsB,GAAG,EAAE,EAAE,CAAC;AAChG,CAAC;AAQD,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,8BAAsB,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CACb,yBAAyB,GAAG,wBAAwB,2BAAmB,gBAAgB,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,2BAAmB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,yBAAyB,GAAG,2BAA2B,2BAAmB,WAAW,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,yBAAyB,GAAG,qDAAqD,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/kernel-contracts",
-  "version": "0.16.2",
+  "version": "0.18.0",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the 32 kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/src/contribution/lib/contribution-kind.ts

@@ -122,6 +122,21 @@ export enum ContributionKind {
    */
   Capability = 'capability',
 
+  // -- Phase 5: resource-ownership self-registration -----------------------
+  /**
+   * A resource-instance ownership/visibility declaration contributed by a
+   * biome — `resourceType` + `resourceId` + a `ResourceVisibilityPattern` +
+   * the owning subjects (and optional explicit shares). The kernel owns this
+   * enum member AND the manifest schema
+   * (`ResourceOwnershipContributionManifestSchema`, exported from
+   * `@xemahq/kernel-contracts/resource`), mirroring the `Capability` kind: a
+   * single value-identical wire shape both the contribution-file parser and
+   * the owning domain service validate fail-fast. Provenance is stamped by the
+   * parser from the discovering biome's manifest — authors do not declare it
+   * inline.
+   */
+  ResourceOwnership = 'resource-ownership',
+
   // -- Domain stage machines (MailOps asset lifecycle) ---------------------
   /**
    * A deterministic asset stage machine contributed by a domain biome to a

package/src/lifecycle-events/index.ts

@@ -0,0 +1 @@
+export * from './lib/lifecycle-events';

package/src/lifecycle-events/lib/lifecycle-events.ts

@@ -0,0 +1,103 @@
+// ═══════════════════════════════════════════════════════════════════════════
+// ── Canonical platform lifecycle-deletion event contracts ──
+//
+// `organization.organization.deleted`, `project.project.deleted`, and
+// `identity.user.deleted` are the three CANONICAL cascade-cleanup signals every
+// stateful biome subscribes to. Before this contract existed, each of the
+// ~14 consumers hand-re-declared the same `type` string, `source`, and payload
+// `data` shape in its own `consumed-events.registry.ts` — drift waiting to
+// happen on a producer-side change.
+//
+// These contracts live in the KERNEL (Layer 0) so a subscriber depends on the
+// kernel package, never on the producer service. The producers
+// (`project-registry-api` for project, `identity-api` for org + user) import
+// the SAME enum + schema to emit; subscribers import them to match — one source
+// of truth, zero service-to-service code coupling. This mirrors the
+// search-source / mail-source registries (`@xemahq/kernel-contracts/*`) that
+// let a consumer act on any producer's events without importing its client.
+//
+// NOTE: This subpath holds the type strings + payload schemas ONLY. The
+// descriptor wrapper (`defineEvent(...)`) lives in the Layer-1 runtime package
+// `@xemahq/events`, which Layer 0 must not depend on. A consumer keeps its
+// `defineEvent({ type: ..., data: ... })` call but sources the `type` from
+// `LifecycleEventType` and the `data` from these schemas instead of re-typing
+// them. Do not change a `type` string without a coordinated migration — every
+// other service matches on it.
+// ═══════════════════════════════════════════════════════════════════════════
+
+import { z } from 'zod';
+
+/**
+ * Closed set of canonical platform lifecycle-deletion event `type`s. These are
+ * the wire identifiers consumers subscribe to for cascade cleanup — never a
+ * free-form string at a call site.
+ */
+export enum LifecycleEventType {
+  /** An organization was deleted — cascade-delete all of the org's data. */
+  OrganizationDeleted = 'organization.organization.deleted',
+  /** A project was deleted — cascade-delete all project-scoped data. */
+  ProjectDeleted = 'project.project.deleted',
+  /**
+   * A user was deleted — cascade-delete that user's user-scoped data.
+   *
+   * The wire string is `user.user.deleted` — the value identity-api (the
+   * producer) actually emits (`WebhookEvents.USER_DELETED`). The lone
+   * consumer that today declares `identity.user.deleted` (memory-api) never
+   * fires on a real delete; adopting this descriptor fixes that mismatch.
+   */
+  UserDeleted = 'user.user.deleted',
+}
+
+/** Producer URI of the org + user deletion events (identity is the source). */
+export const IDENTITY_LIFECYCLE_EVENT_SOURCE = '/services/identity-api' as const;
+
+/** Producer URI of the project deletion event. */
+export const PROJECT_LIFECYCLE_EVENT_SOURCE =
+  '/services/project-registry-api' as const;
+
+/** Schema version stamped on every canonical lifecycle-deletion event. */
+export const LIFECYCLE_EVENT_SCHEMA_VERSION = '1.0.0' as const;
+
+/**
+ * `organization.organization.deleted` payload. Identity emits only the org id;
+ * the org id also rides the envelope's `ehorgid` extension, so consumers that
+ * scope by extension never even read the body.
+ */
+export const OrganizationDeletedEventSchema = z
+  .object({
+    id: z.string(),
+  })
+  .strict();
+
+/**
+ * `project.project.deleted` payload. Canonical cascade signal — carries the
+ * full project triple so a consumer can scope deletes by `orgId` and/or
+ * `projectId` without a lookup.
+ */
+export const ProjectDeletedEventSchema = z
+  .object({
+    id: z.string(),
+    orgId: z.string(),
+    projectId: z.string(),
+  })
+  .strict();
+
+/**
+ * `identity.user.deleted` payload. `orgId` is optional because a user is a
+ * cross-org subject; an org-scoped consumer reads `ehorgid` from the envelope
+ * to bound the cascade to its own org.
+ */
+export const UserDeletedEventSchema = z
+  .object({
+    id: z.string(),
+    orgId: z.string().optional(),
+  })
+  .strict();
+
+export type OrganizationDeletedEventPayload = z.infer<
+  typeof OrganizationDeletedEventSchema
+>;
+export type ProjectDeletedEventPayload = z.infer<
+  typeof ProjectDeletedEventSchema
+>;
+export type UserDeletedEventPayload = z.infer<typeof UserDeletedEventSchema>;

package/src/resource/index.ts

@@ -7,11 +7,16 @@
 // the `XemaManifest` (`xema.yaml`) document, plus the server-side `Stack` state
 // and the `ResourcePlan` diff vocabulary.
 //
-// A DAG LEAF on purpose: per-kind `spec` bodies are validated by the owning
-// domain service (which holds the authoritative DTO), so this surface drags no
-// cross-subpath dependency into the kernel. The Terraform provider, the first-
-// party `xema.yaml` apply, and the frontend all converge on these contracts.
-// Zero runtime deps beyond `zod`.
+// Per-kind `spec` bodies are validated by the owning domain service (which
+// holds the authoritative DTO), so the IaC surface drags no cross-subpath
+// dependency into the kernel. The Terraform provider, the first-party
+// `xema.yaml` apply, and the frontend all converge on these contracts.
+//
+// This subpath also carries the resource-OWNERSHIP contribution contract (the
+// `ContributionKind.ResourceOwnership` manifest + visibility enum) and the
+// `resource:<type>:<id>` ref grammar. The ownership manifest reuses the kernel
+// `SubjectKind` taxonomy, so this surface declares exactly ONE cross-subpath
+// edge (`resource -> subject`). Zero runtime deps beyond `zod`.
 // ═══════════════════════════════════════════════════════════════════════════
 
 export * from './lib/resource-kind';
@@ -20,3 +25,5 @@ export * from './lib/resource-declaration';
 export * from './lib/xema-manifest';
 export * from './lib/stack';
 export * from './lib/plan';
+export * from './lib/resource-ownership-contribution';
+export * from './lib/resource-ref';

package/src/resource/lib/resource-ownership-contribution.ts

@@ -0,0 +1,127 @@
+import { z } from 'zod';
+
+import { SubjectKind, SubjectKindSchema } from '../../subject';
+
+/**
+ * Maximum length of the `resourceType` / `resourceId` identifier strings on a
+ * resource-ownership manifest. Bounded so describe/list responses stay small
+ * and persisted rows have a predictable upper size.
+ */
+const RESOURCE_IDENTIFIER_MAX = 200;
+
+/**
+ * Hard cap on the number of owners / explicit shares carried by a single
+ * resource-ownership manifest. Keeps a contribution envelope bounded; a
+ * resource that genuinely needs more sharees is a design smell (use an
+ * org/project-shared visibility instead of enumerating principals).
+ */
+const RESOURCE_PRINCIPALS_MAX = 100;
+
+/**
+ * `ResourceVisibilityPattern` — the closed set of ownership/visibility shapes a
+ * biome may declare for a resource instance it contributes (plan §6 Phase 5).
+ *
+ * Precedence is NOT encoded here — this enum only names HOW a resource is
+ * shared; the PDP in `authorization-api` derives the effective verdict from the
+ * declared pattern plus the invocation's subject/scope. A closed set so the
+ * OpenAPI/zod schema stays a stable enum (never a free-form string).
+ */
+export enum ResourceVisibilityPattern {
+  /** Visible only to the declared owner subject(s). */
+  OwnerOnly = 'owner-only',
+  /** Visible to every member of the owning organization. */
+  OrgShared = 'org-shared',
+  /** Visible to every member of the owning project. */
+  ProjectShared = 'project-shared',
+  /** Visible to every member of the owning space. */
+  SpaceShared = 'space-shared',
+  /** Visible only to the subjects enumerated in `explicitShares`. */
+  ExplicitShare = 'explicit-share',
+}
+
+export const ResourceVisibilityPatternSchema = z.nativeEnum(
+  ResourceVisibilityPattern,
+);
+
+/**
+ * `OwnerRef` — a pointer to a subject that owns (or is explicitly shared) a
+ * resource. Reuses the kernel `SubjectKind` taxonomy so a resource may be owned
+ * by a user, an agent, a service account, a group, etc. `ref` is the bare
+ * per-kind identifier (mirrors `SubjectRef.id`), NOT a `kind:id` composite.
+ */
+export interface OwnerRef {
+  readonly kind: SubjectKind;
+  readonly ref: string;
+}
+
+export const OwnerRefSchema: z.ZodType<OwnerRef> = z.object({
+  kind: SubjectKindSchema,
+  ref: z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+}) as z.ZodType<OwnerRef>;
+
+/**
+ * `ExplicitShareRef` — one entry in a manifest's `explicitShares` list. Only
+ * meaningful when `visibility` is `ResourceVisibilityPattern.ExplicitShare`;
+ * it names a subject the resource is shared with (the same shape as
+ * `OwnerRef`, kept as its own type so a future per-share grant level can be
+ * added without churning every owner site).
+ */
+export interface ExplicitShareRef {
+  readonly kind: SubjectKind;
+  readonly ref: string;
+}
+
+export const ExplicitShareRefSchema: z.ZodType<ExplicitShareRef> = z.object({
+  kind: SubjectKindSchema,
+  ref: z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+}) as z.ZodType<ExplicitShareRef>;
+
+/**
+ * Manifest shape carried by every `ContributionKind.ResourceOwnership`
+ * envelope (plan §6 Phase 5). One contribution = one resource instance's
+ * ownership/visibility declaration.
+ *
+ * Mirrors `CapabilityContributionManifest` precisely: a value-identical subset
+ * of the wire body the owning domain service accepts, validated fail-fast at
+ * biome-discovery time. Provenance (`biome.id`, `biome.version`) is NOT a field
+ * here — the `CapabilityParser`-equivalent stamps it from the discovering
+ * biome's `xema-biome.json`. Authors do not declare provenance inline.
+ *
+ * Validation is fail-fast: a contribution that violates any constraint is
+ * rejected at boot. No silent coercion.
+ */
+export interface ResourceOwnershipContributionManifest {
+  /** The resource type slug (e.g. `document`, `dataset`). ≤ 200 chars. */
+  readonly resourceType: string;
+  /** The resource instance id within `resourceType`. ≤ 200 chars. */
+  readonly resourceId: string;
+  /** How the resource is shared — see `ResourceVisibilityPattern`. */
+  readonly visibility: ResourceVisibilityPattern;
+  /** The owning subject(s). At least one; hard-capped at 100. */
+  readonly owners: readonly OwnerRef[];
+  /**
+   * Subjects the resource is explicitly shared with. Only meaningful when
+   * `visibility` is `ResourceVisibilityPattern.ExplicitShare`. Hard-capped at
+   * 100. Omitted (not `[]`) when no explicit shares apply.
+   */
+  readonly explicitShares?: readonly ExplicitShareRef[];
+}
+
+/**
+ * Zod validator for `ResourceOwnershipContributionManifest`. The
+ * biome-discovery parser AND the owning domain service's wire DTO BOTH route
+ * every candidate envelope through this schema, so a malformed contribution
+ * fails at the boundary instead of at the wire (mirrors
+ * `CapabilityContributionManifestSchema`).
+ */
+export const ResourceOwnershipContributionManifestSchema: z.ZodType<ResourceOwnershipContributionManifest> =
+  z.object({
+    resourceType: z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+    resourceId: z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+    visibility: ResourceVisibilityPatternSchema,
+    owners: z.array(OwnerRefSchema).min(1).max(RESOURCE_PRINCIPALS_MAX),
+    explicitShares: z
+      .array(ExplicitShareRefSchema)
+      .max(RESOURCE_PRINCIPALS_MAX)
+      .optional(),
+  }) as z.ZodType<ResourceOwnershipContributionManifest>;

package/src/resource/lib/resource-ref.ts

@@ -0,0 +1,75 @@
+/**
+ * Resource-instance ref grammar — the canonical composite string for a single
+ * resource instance: `resource:<type>:<id>`.
+ *
+ * Mirrors the subject-ref grammar (`subjectRefToString` / `parseSubjectRef`)
+ * but is FIXED-arity: exactly three colon-delimited segments. Because the id
+ * sits in the final segment AND we forbid the delimiter inside both `type` and
+ * `id`, the encoding is unambiguous and losslessly round-trips — no
+ * split-on-first-colon ambiguity. Fail-fast on any malformed input; never
+ * silently coerce.
+ */
+
+/** The fixed prefix every resource ref carries. */
+export const RESOURCE_REF_PREFIX = 'resource' as const;
+
+/** The segment delimiter. Forbidden inside `type` and `id`. */
+export const RESOURCE_REF_DELIMITER = ':' as const;
+
+/**
+ * Parsed form of a resource ref.
+ */
+export interface ResourceRefParts {
+  readonly type: string;
+  readonly id: string;
+}
+
+/**
+ * Compose `resource:<type>:<id>` from a type + id. Fail-fast if either segment
+ * is empty or contains the `:` delimiter (which would make the ref ambiguous /
+ * un-round-trippable). Never coerce — an invalid segment throws.
+ */
+export function composeResourceRef(type: string, id: string): string {
+  if (type.length === 0 || id.length === 0) {
+    throw new Error(
+      `Invalid resource ref segments: "type" and "id" must both be non-empty (got type="${type}", id="${id}").`,
+    );
+  }
+  if (type.includes(RESOURCE_REF_DELIMITER)) {
+    throw new Error(
+      `Invalid resource type "${type}": must not contain the "${RESOURCE_REF_DELIMITER}" delimiter.`,
+    );
+  }
+  if (id.includes(RESOURCE_REF_DELIMITER)) {
+    throw new Error(
+      `Invalid resource id "${id}": must not contain the "${RESOURCE_REF_DELIMITER}" delimiter.`,
+    );
+  }
+  return `${RESOURCE_REF_PREFIX}${RESOURCE_REF_DELIMITER}${type}${RESOURCE_REF_DELIMITER}${id}`;
+}
+
+/**
+ * Parse `resource:<type>:<id>` back into its parts. Fail-fast on a wrong
+ * prefix, wrong arity, or an empty segment. The inverse of
+ * `composeResourceRef` — any string that `composeResourceRef` produced parses
+ * back to the identical `{ type, id }`.
+ */
+export function parseResourceRef(ref: string): ResourceRefParts {
+  const [prefix, type, id, ...rest] = ref.split(RESOURCE_REF_DELIMITER);
+  if (rest.length > 0 || prefix === undefined || type === undefined || id === undefined) {
+    throw new Error(
+      `Invalid resource ref "${ref}": expected exactly "${RESOURCE_REF_PREFIX}:<type>:<id>".`,
+    );
+  }
+  if (prefix !== RESOURCE_REF_PREFIX) {
+    throw new Error(
+      `Invalid resource ref "${ref}": must start with the "${RESOURCE_REF_PREFIX}" prefix.`,
+    );
+  }
+  if (type.length === 0 || id.length === 0) {
+    throw new Error(
+      `Invalid resource ref "${ref}": "type" and "id" segments must both be non-empty.`,
+    );
+  }
+  return { type, id };
+}