@xemahq/kernel-contracts 0.17.0 → 0.18.0

package/dist/agent-workspace/awp-spec.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://xema.dev/schemas/awp-spec.v1.json",
-  "emittedAt": "2026-06-27T10:32:41.919Z",
+  "emittedAt": "2026-06-27T11:25:54.369Z",
   "spec": {
     "id": "awp/v1",
     "version": "1.2.0",

package/dist/contribution/lib/contribution-kind.d.ts

@@ -38,6 +38,7 @@ export declare enum ContributionKind {
     DeliverableSpecKind = "deliverable-spec-kind",
     RuntimeMountKind = "runtime-mount-kind",
     Capability = "capability",
+    ResourceOwnership = "resource-ownership",
     StageMachine = "stage-machine"
 }
 export declare const ContributionKindSchema: z.ZodEnum<typeof ContributionKind>;

package/dist/contribution/lib/contribution-kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,oBAAY,gBAAgB;IAE1B,gBAAgB,sBAAsB;IACtC,WAAW,iBAAiB;IAC5B,OAAO,aAAa;IACpB,gBAAgB,sBAAsB;IACtC,aAAa,mBAAmB;IAChC,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,YAAY,kBAAkB;IAC9B,mBAAmB,yBAAyB;IAC5C,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAC5B,wBAAwB,+BAA+B;IACvD,UAAU,gBAAgB;IAI1B,YAAY,kBAAkB;IAE9B,WAAW,iBAAiB;IAQ5B,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAElC,kBAAkB,yBAAyB;IAE3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAE1B,oBAAoB,0BAA0B;IAE9C,oBAAoB,2BAA2B;IAE/C,yBAAyB,gCAAgC;IAGzD,mBAAmB,yBAAyB;IAI5C,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAExC,yBAAyB,gCAAgC;IAEzD,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IAE1B,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,WAAW,iBAAiB;IAI5B,eAAe,sBAAsB;IAErC,mBAAmB,0BAA0B;IAE7C,gBAAgB,uBAAuB;IAiBvC,UAAU,eAAe;IAczB,YAAY,kBAAkB;CAC/B;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"contribution-kind.d.ts","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,oBAAY,gBAAgB;IAE1B,gBAAgB,sBAAsB;IACtC,WAAW,iBAAiB;IAC5B,OAAO,aAAa;IACpB,gBAAgB,sBAAsB;IACtC,aAAa,mBAAmB;IAChC,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAC1B,YAAY,kBAAkB;IAC9B,mBAAmB,yBAAyB;IAC5C,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAC5B,wBAAwB,+BAA+B;IACvD,UAAU,gBAAgB;IAI1B,YAAY,kBAAkB;IAE9B,WAAW,iBAAiB;IAQ5B,YAAY,kBAAkB;IAM9B,WAAW,iBAAiB;IAW5B,cAAc,oBAAoB;IAElC,kBAAkB,yBAAyB;IAE3C,IAAI,SAAS;IAEb,UAAU,gBAAgB;IAE1B,oBAAoB,0BAA0B;IAE9C,oBAAoB,2BAA2B;IAE/C,yBAAyB,gCAAgC;IAGzD,mBAAmB,yBAAyB;IAI5C,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,iBAAiB,uBAAuB;IAExC,yBAAyB,gCAAgC;IAEzD,WAAW,iBAAiB;IAI5B,UAAU,gBAAgB;IAE1B,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,WAAW,iBAAiB;IAI5B,eAAe,sBAAsB;IAErC,mBAAmB,0BAA0B;IAE7C,gBAAgB,uBAAuB;IAiBvC,UAAU,eAAe;IAezB,iBAAiB,uBAAuB;IAcxC,YAAY,kBAAkB;CAC/B;AAMD,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,EAAE,CAAC"}

package/dist/contribution/lib/contribution-kind.js

@@ -42,6 +42,7 @@ var ContributionKind;
     ContributionKind["DeliverableSpecKind"] = "deliverable-spec-kind";
     ContributionKind["RuntimeMountKind"] = "runtime-mount-kind";
     ContributionKind["Capability"] = "capability";
+    ContributionKind["ResourceOwnership"] = "resource-ownership";
     ContributionKind["StageMachine"] = "stage-machine";
 })(ContributionKind || (exports.ContributionKind = ContributionKind = {}));
 exports.ContributionKindSchema = zod_1.z.nativeEnum(ContributionKind);

package/dist/contribution/lib/contribution-kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAexB,IAAY,gBA0HX;AA1HD,WAAY,gBAAgB;IAE1B,0DAAsC,CAAA;IACtC,gDAA4B,CAAA;IAC5B,wCAAoB,CAAA;IACpB,0DAAsC,CAAA;IACtC,oDAAgC,CAAA;IAChC,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,kDAA8B,CAAA;IAC9B,gEAA4C,CAAA;IAC5C,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAC5B,2EAAuD,CAAA;IACvD,8CAA0B,CAAA;IAI1B,kDAA8B,CAAA;IAE9B,gDAA4B,CAAA;IAQ5B,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAElC,+DAA2C,CAAA;IAE3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAE1B,kEAA8C,CAAA;IAE9C,mEAA+C,CAAA;IAE/C,6EAAyD,CAAA;IAGzD,gEAA4C,CAAA;IAI5C,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAExC,6EAAyD,CAAA;IAEzD,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IAE1B,kDAA8B,CAAA;IAE9B,sDAAkC,CAAA;IAElC,gDAA4B,CAAA;IAI5B,yDAAqC,CAAA;IAErC,iEAA6C,CAAA;IAE7C,2DAAuC,CAAA;IAiBvC,6CAAyB,CAAA;IAczB,kDAA8B,CAAA;AAChC,CAAC,EA1HW,gBAAgB,gCAAhB,gBAAgB,QA0H3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"contribution-kind.js","sourceRoot":"","sources":["../../../src/contribution/lib/contribution-kind.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAexB,IAAY,gBAyIX;AAzID,WAAY,gBAAgB;IAE1B,0DAAsC,CAAA;IACtC,gDAA4B,CAAA;IAC5B,wCAAoB,CAAA;IACpB,0DAAsC,CAAA;IACtC,oDAAgC,CAAA;IAChC,kDAA8B,CAAA;IAC9B,8CAA0B,CAAA;IAC1B,kDAA8B,CAAA;IAC9B,gEAA4C,CAAA;IAC5C,8CAA0B,CAAA;IAC1B,gDAA4B,CAAA;IAC5B,2EAAuD,CAAA;IACvD,8CAA0B,CAAA;IAI1B,kDAA8B,CAAA;IAE9B,gDAA4B,CAAA;IAQ5B,kDAA8B,CAAA;IAM9B,gDAA4B,CAAA;IAW5B,sDAAkC,CAAA;IAElC,+DAA2C,CAAA;IAE3C,iCAAa,CAAA;IAEb,8CAA0B,CAAA;IAE1B,kEAA8C,CAAA;IAE9C,mEAA+C,CAAA;IAE/C,6EAAyD,CAAA;IAGzD,gEAA4C,CAAA;IAI5C,sDAAkC,CAAA;IAElC,wDAAoC,CAAA;IAEpC,4DAAwC,CAAA;IAExC,6EAAyD,CAAA;IAEzD,gDAA4B,CAAA;IAI5B,8CAA0B,CAAA;IAE1B,kDAA8B,CAAA;IAE9B,sDAAkC,CAAA;IAElC,gDAA4B,CAAA;IAI5B,yDAAqC,CAAA;IAErC,iEAA6C,CAAA;IAE7C,2DAAuC,CAAA;IAiBvC,6CAAyB,CAAA;IAezB,4DAAwC,CAAA;IAcxC,kDAA8B,CAAA;AAChC,CAAC,EAzIW,gBAAgB,gCAAhB,gBAAgB,QAyI3B;AAMY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/resource/index.d.ts

@@ -4,4 +4,6 @@ export * from './lib/resource-declaration';
 export * from './lib/xema-manifest';
 export * from './lib/stack';
 export * from './lib/plan';
+export * from './lib/resource-ownership-contribution';
+export * from './lib/resource-ref';
 //# sourceMappingURL=index.d.ts.map

package/dist/resource/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resource/index.ts"],"names":[],"mappings":"AAgBA,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resource/index.ts"],"names":[],"mappings":"AAqBA,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,uCAAuC,CAAC;AACtD,cAAc,oBAAoB,CAAC"}

package/dist/resource/index.js

@@ -20,4 +20,6 @@ __exportStar(require("./lib/resource-declaration"), exports);
 __exportStar(require("./lib/xema-manifest"), exports);
 __exportStar(require("./lib/stack"), exports);
 __exportStar(require("./lib/plan"), exports);
+__exportStar(require("./lib/resource-ownership-contribution"), exports);
+__exportStar(require("./lib/resource-ref"), exports);
 //# sourceMappingURL=index.js.map

package/dist/resource/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resource/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAgBA,sDAAoC;AACpC,4DAA0C;AAC1C,6DAA2C;AAC3C,sDAAoC;AACpC,8CAA4B;AAC5B,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resource/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAqBA,sDAAoC;AACpC,4DAA0C;AAC1C,6DAA2C;AAC3C,sDAAoC;AACpC,8CAA4B;AAC5B,6CAA2B;AAC3B,wEAAsD;AACtD,qDAAmC"}

package/dist/resource/lib/resource-ownership-contribution.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+import { SubjectKind } from '../../subject';
+export declare enum ResourceVisibilityPattern {
+    OwnerOnly = "owner-only",
+    OrgShared = "org-shared",
+    ProjectShared = "project-shared",
+    SpaceShared = "space-shared",
+    ExplicitShare = "explicit-share"
+}
+export declare const ResourceVisibilityPatternSchema: z.ZodEnum<typeof ResourceVisibilityPattern>;
+export interface OwnerRef {
+    readonly kind: SubjectKind;
+    readonly ref: string;
+}
+export declare const OwnerRefSchema: z.ZodType<OwnerRef>;
+export interface ExplicitShareRef {
+    readonly kind: SubjectKind;
+    readonly ref: string;
+}
+export declare const ExplicitShareRefSchema: z.ZodType<ExplicitShareRef>;
+export interface ResourceOwnershipContributionManifest {
+    readonly resourceType: string;
+    readonly resourceId: string;
+    readonly visibility: ResourceVisibilityPattern;
+    readonly owners: readonly OwnerRef[];
+    readonly explicitShares?: readonly ExplicitShareRef[];
+}
+export declare const ResourceOwnershipContributionManifestSchema: z.ZodType<ResourceOwnershipContributionManifest>;
+//# sourceMappingURL=resource-ownership-contribution.d.ts.map

package/dist/resource/lib/resource-ownership-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-ownership-contribution.d.ts","sourceRoot":"","sources":["../../../src/resource/lib/resource-ownership-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAqB,MAAM,eAAe,CAAC;AA0B/D,oBAAY,yBAAyB;IAEnC,SAAS,eAAe;IAExB,SAAS,eAAe;IAExB,aAAa,mBAAmB;IAEhC,WAAW,iBAAiB;IAE5B,aAAa,mBAAmB;CACjC;AAED,eAAO,MAAM,+BAA+B,6CAE3C,CAAC;AAQF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAGtB,CAAC;AAS1B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAG9B,CAAC;AAgBlC,MAAM,WAAW,qCAAqC;IAEpD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAE/C,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAMrC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACvD;AASD,eAAO,MAAM,2CAA2C,EAAE,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAUjD,CAAC"}

package/dist/resource/lib/resource-ownership-contribution.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceOwnershipContributionManifestSchema = exports.ExplicitShareRefSchema = exports.OwnerRefSchema = exports.ResourceVisibilityPatternSchema = exports.ResourceVisibilityPattern = void 0;
+const zod_1 = require("zod");
+const subject_1 = require("../../subject");
+const RESOURCE_IDENTIFIER_MAX = 200;
+const RESOURCE_PRINCIPALS_MAX = 100;
+var ResourceVisibilityPattern;
+(function (ResourceVisibilityPattern) {
+    ResourceVisibilityPattern["OwnerOnly"] = "owner-only";
+    ResourceVisibilityPattern["OrgShared"] = "org-shared";
+    ResourceVisibilityPattern["ProjectShared"] = "project-shared";
+    ResourceVisibilityPattern["SpaceShared"] = "space-shared";
+    ResourceVisibilityPattern["ExplicitShare"] = "explicit-share";
+})(ResourceVisibilityPattern || (exports.ResourceVisibilityPattern = ResourceVisibilityPattern = {}));
+exports.ResourceVisibilityPatternSchema = zod_1.z.nativeEnum(ResourceVisibilityPattern);
+exports.OwnerRefSchema = zod_1.z.object({
+    kind: subject_1.SubjectKindSchema,
+    ref: zod_1.z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+});
+exports.ExplicitShareRefSchema = zod_1.z.object({
+    kind: subject_1.SubjectKindSchema,
+    ref: zod_1.z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+});
+exports.ResourceOwnershipContributionManifestSchema = zod_1.z.object({
+    resourceType: zod_1.z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+    resourceId: zod_1.z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+    visibility: exports.ResourceVisibilityPatternSchema,
+    owners: zod_1.z.array(exports.OwnerRefSchema).min(1).max(RESOURCE_PRINCIPALS_MAX),
+    explicitShares: zod_1.z
+        .array(exports.ExplicitShareRefSchema)
+        .max(RESOURCE_PRINCIPALS_MAX)
+        .optional(),
+});
+//# sourceMappingURL=resource-ownership-contribution.js.map

package/dist/resource/lib/resource-ownership-contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-ownership-contribution.js","sourceRoot":"","sources":["../../../src/resource/lib/resource-ownership-contribution.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,2CAA+D;AAO/D,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAQpC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAWpC,IAAY,yBAWX;AAXD,WAAY,yBAAyB;IAEnC,qDAAwB,CAAA;IAExB,qDAAwB,CAAA;IAExB,6DAAgC,CAAA;IAEhC,yDAA4B,CAAA;IAE5B,6DAAgC,CAAA;AAClC,CAAC,EAXW,yBAAyB,yCAAzB,yBAAyB,QAWpC;AAEY,QAAA,+BAA+B,GAAG,OAAC,CAAC,UAAU,CACzD,yBAAyB,CAC1B,CAAC;AAaW,QAAA,cAAc,GAAwB,OAAC,CAAC,MAAM,CAAC;IAC1D,IAAI,EAAE,2BAAiB;IACvB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;CACpD,CAAwB,CAAC;AAcb,QAAA,sBAAsB,GAAgC,OAAC,CAAC,MAAM,CAAC;IAC1E,IAAI,EAAE,2BAAiB;IACvB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;CACpD,CAAgC,CAAC;AAwCrB,QAAA,2CAA2C,GACtD,OAAC,CAAC,MAAM,CAAC;IACP,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC5D,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC1D,UAAU,EAAE,uCAA+B;IAC3C,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,sBAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACnE,cAAc,EAAE,OAAC;SACd,KAAK,CAAC,8BAAsB,CAAC;SAC7B,GAAG,CAAC,uBAAuB,CAAC;SAC5B,QAAQ,EAAE;CACd,CAAqD,CAAC"}

package/dist/resource/lib/resource-ref.d.ts

@@ -0,0 +1,9 @@
+export declare const RESOURCE_REF_PREFIX: "resource";
+export declare const RESOURCE_REF_DELIMITER: ":";
+export interface ResourceRefParts {
+    readonly type: string;
+    readonly id: string;
+}
+export declare function composeResourceRef(type: string, id: string): string;
+export declare function parseResourceRef(ref: string): ResourceRefParts;
+//# sourceMappingURL=resource-ref.d.ts.map

package/dist/resource/lib/resource-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-ref.d.ts","sourceRoot":"","sources":["../../../src/resource/lib/resource-ref.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,mBAAmB,EAAG,UAAmB,CAAC;AAGvD,eAAO,MAAM,sBAAsB,EAAG,GAAY,CAAC;AAKnD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAOD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAiBnE;AAQD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAkB9D"}

package/dist/resource/lib/resource-ref.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RESOURCE_REF_DELIMITER = exports.RESOURCE_REF_PREFIX = void 0;
+exports.composeResourceRef = composeResourceRef;
+exports.parseResourceRef = parseResourceRef;
+exports.RESOURCE_REF_PREFIX = 'resource';
+exports.RESOURCE_REF_DELIMITER = ':';
+function composeResourceRef(type, id) {
+    if (type.length === 0 || id.length === 0) {
+        throw new Error(`Invalid resource ref segments: "type" and "id" must both be non-empty (got type="${type}", id="${id}").`);
+    }
+    if (type.includes(exports.RESOURCE_REF_DELIMITER)) {
+        throw new Error(`Invalid resource type "${type}": must not contain the "${exports.RESOURCE_REF_DELIMITER}" delimiter.`);
+    }
+    if (id.includes(exports.RESOURCE_REF_DELIMITER)) {
+        throw new Error(`Invalid resource id "${id}": must not contain the "${exports.RESOURCE_REF_DELIMITER}" delimiter.`);
+    }
+    return `${exports.RESOURCE_REF_PREFIX}${exports.RESOURCE_REF_DELIMITER}${type}${exports.RESOURCE_REF_DELIMITER}${id}`;
+}
+function parseResourceRef(ref) {
+    const [prefix, type, id, ...rest] = ref.split(exports.RESOURCE_REF_DELIMITER);
+    if (rest.length > 0 || prefix === undefined || type === undefined || id === undefined) {
+        throw new Error(`Invalid resource ref "${ref}": expected exactly "${exports.RESOURCE_REF_PREFIX}:<type>:<id>".`);
+    }
+    if (prefix !== exports.RESOURCE_REF_PREFIX) {
+        throw new Error(`Invalid resource ref "${ref}": must start with the "${exports.RESOURCE_REF_PREFIX}" prefix.`);
+    }
+    if (type.length === 0 || id.length === 0) {
+        throw new Error(`Invalid resource ref "${ref}": "type" and "id" segments must both be non-empty.`);
+    }
+    return { type, id };
+}
+//# sourceMappingURL=resource-ref.js.map

package/dist/resource/lib/resource-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-ref.js","sourceRoot":"","sources":["../../../src/resource/lib/resource-ref.ts"],"names":[],"mappings":";;;AA+BA,gDAiBC;AAQD,4CAkBC;AA7DY,QAAA,mBAAmB,GAAG,UAAmB,CAAC;AAG1C,QAAA,sBAAsB,GAAG,GAAY,CAAC;AAenD,SAAgB,kBAAkB,CAAC,IAAY,EAAE,EAAU;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,oFAAoF,IAAI,UAAU,EAAE,KAAK,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,8BAAsB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,4BAA4B,8BAAsB,cAAc,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,QAAQ,CAAC,8BAAsB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,4BAA4B,8BAAsB,cAAc,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,2BAAmB,GAAG,8BAAsB,GAAG,IAAI,GAAG,8BAAsB,GAAG,EAAE,EAAE,CAAC;AAChG,CAAC;AAQD,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,8BAAsB,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CACb,yBAAyB,GAAG,wBAAwB,2BAAmB,gBAAgB,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,2BAAmB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,yBAAyB,GAAG,2BAA2B,2BAAmB,WAAW,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,yBAAyB,GAAG,qDAAqD,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/kernel-contracts",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the 32 kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/src/contribution/lib/contribution-kind.ts

@@ -122,6 +122,21 @@ export enum ContributionKind {
    */
   Capability = 'capability',
 
+  // -- Phase 5: resource-ownership self-registration -----------------------
+  /**
+   * A resource-instance ownership/visibility declaration contributed by a
+   * biome — `resourceType` + `resourceId` + a `ResourceVisibilityPattern` +
+   * the owning subjects (and optional explicit shares). The kernel owns this
+   * enum member AND the manifest schema
+   * (`ResourceOwnershipContributionManifestSchema`, exported from
+   * `@xemahq/kernel-contracts/resource`), mirroring the `Capability` kind: a
+   * single value-identical wire shape both the contribution-file parser and
+   * the owning domain service validate fail-fast. Provenance is stamped by the
+   * parser from the discovering biome's manifest — authors do not declare it
+   * inline.
+   */
+  ResourceOwnership = 'resource-ownership',
+
   // -- Domain stage machines (MailOps asset lifecycle) ---------------------
   /**
    * A deterministic asset stage machine contributed by a domain biome to a

package/src/resource/index.ts

@@ -7,11 +7,16 @@
 // the `XemaManifest` (`xema.yaml`) document, plus the server-side `Stack` state
 // and the `ResourcePlan` diff vocabulary.
 //
-// A DAG LEAF on purpose: per-kind `spec` bodies are validated by the owning
-// domain service (which holds the authoritative DTO), so this surface drags no
-// cross-subpath dependency into the kernel. The Terraform provider, the first-
-// party `xema.yaml` apply, and the frontend all converge on these contracts.
-// Zero runtime deps beyond `zod`.
+// Per-kind `spec` bodies are validated by the owning domain service (which
+// holds the authoritative DTO), so the IaC surface drags no cross-subpath
+// dependency into the kernel. The Terraform provider, the first-party
+// `xema.yaml` apply, and the frontend all converge on these contracts.
+//
+// This subpath also carries the resource-OWNERSHIP contribution contract (the
+// `ContributionKind.ResourceOwnership` manifest + visibility enum) and the
+// `resource:<type>:<id>` ref grammar. The ownership manifest reuses the kernel
+// `SubjectKind` taxonomy, so this surface declares exactly ONE cross-subpath
+// edge (`resource -> subject`). Zero runtime deps beyond `zod`.
 // ═══════════════════════════════════════════════════════════════════════════
 
 export * from './lib/resource-kind';
@@ -20,3 +25,5 @@ export * from './lib/resource-declaration';
 export * from './lib/xema-manifest';
 export * from './lib/stack';
 export * from './lib/plan';
+export * from './lib/resource-ownership-contribution';
+export * from './lib/resource-ref';

package/src/resource/lib/resource-ownership-contribution.ts

@@ -0,0 +1,127 @@
+import { z } from 'zod';
+
+import { SubjectKind, SubjectKindSchema } from '../../subject';
+
+/**
+ * Maximum length of the `resourceType` / `resourceId` identifier strings on a
+ * resource-ownership manifest. Bounded so describe/list responses stay small
+ * and persisted rows have a predictable upper size.
+ */
+const RESOURCE_IDENTIFIER_MAX = 200;
+
+/**
+ * Hard cap on the number of owners / explicit shares carried by a single
+ * resource-ownership manifest. Keeps a contribution envelope bounded; a
+ * resource that genuinely needs more sharees is a design smell (use an
+ * org/project-shared visibility instead of enumerating principals).
+ */
+const RESOURCE_PRINCIPALS_MAX = 100;
+
+/**
+ * `ResourceVisibilityPattern` — the closed set of ownership/visibility shapes a
+ * biome may declare for a resource instance it contributes (plan §6 Phase 5).
+ *
+ * Precedence is NOT encoded here — this enum only names HOW a resource is
+ * shared; the PDP in `authorization-api` derives the effective verdict from the
+ * declared pattern plus the invocation's subject/scope. A closed set so the
+ * OpenAPI/zod schema stays a stable enum (never a free-form string).
+ */
+export enum ResourceVisibilityPattern {
+  /** Visible only to the declared owner subject(s). */
+  OwnerOnly = 'owner-only',
+  /** Visible to every member of the owning organization. */
+  OrgShared = 'org-shared',
+  /** Visible to every member of the owning project. */
+  ProjectShared = 'project-shared',
+  /** Visible to every member of the owning space. */
+  SpaceShared = 'space-shared',
+  /** Visible only to the subjects enumerated in `explicitShares`. */
+  ExplicitShare = 'explicit-share',
+}
+
+export const ResourceVisibilityPatternSchema = z.nativeEnum(
+  ResourceVisibilityPattern,
+);
+
+/**
+ * `OwnerRef` — a pointer to a subject that owns (or is explicitly shared) a
+ * resource. Reuses the kernel `SubjectKind` taxonomy so a resource may be owned
+ * by a user, an agent, a service account, a group, etc. `ref` is the bare
+ * per-kind identifier (mirrors `SubjectRef.id`), NOT a `kind:id` composite.
+ */
+export interface OwnerRef {
+  readonly kind: SubjectKind;
+  readonly ref: string;
+}
+
+export const OwnerRefSchema: z.ZodType<OwnerRef> = z.object({
+  kind: SubjectKindSchema,
+  ref: z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+}) as z.ZodType<OwnerRef>;
+
+/**
+ * `ExplicitShareRef` — one entry in a manifest's `explicitShares` list. Only
+ * meaningful when `visibility` is `ResourceVisibilityPattern.ExplicitShare`;
+ * it names a subject the resource is shared with (the same shape as
+ * `OwnerRef`, kept as its own type so a future per-share grant level can be
+ * added without churning every owner site).
+ */
+export interface ExplicitShareRef {
+  readonly kind: SubjectKind;
+  readonly ref: string;
+}
+
+export const ExplicitShareRefSchema: z.ZodType<ExplicitShareRef> = z.object({
+  kind: SubjectKindSchema,
+  ref: z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+}) as z.ZodType<ExplicitShareRef>;
+
+/**
+ * Manifest shape carried by every `ContributionKind.ResourceOwnership`
+ * envelope (plan §6 Phase 5). One contribution = one resource instance's
+ * ownership/visibility declaration.
+ *
+ * Mirrors `CapabilityContributionManifest` precisely: a value-identical subset
+ * of the wire body the owning domain service accepts, validated fail-fast at
+ * biome-discovery time. Provenance (`biome.id`, `biome.version`) is NOT a field
+ * here — the `CapabilityParser`-equivalent stamps it from the discovering
+ * biome's `xema-biome.json`. Authors do not declare provenance inline.
+ *
+ * Validation is fail-fast: a contribution that violates any constraint is
+ * rejected at boot. No silent coercion.
+ */
+export interface ResourceOwnershipContributionManifest {
+  /** The resource type slug (e.g. `document`, `dataset`). ≤ 200 chars. */
+  readonly resourceType: string;
+  /** The resource instance id within `resourceType`. ≤ 200 chars. */
+  readonly resourceId: string;
+  /** How the resource is shared — see `ResourceVisibilityPattern`. */
+  readonly visibility: ResourceVisibilityPattern;
+  /** The owning subject(s). At least one; hard-capped at 100. */
+  readonly owners: readonly OwnerRef[];
+  /**
+   * Subjects the resource is explicitly shared with. Only meaningful when
+   * `visibility` is `ResourceVisibilityPattern.ExplicitShare`. Hard-capped at
+   * 100. Omitted (not `[]`) when no explicit shares apply.
+   */
+  readonly explicitShares?: readonly ExplicitShareRef[];
+}
+
+/**
+ * Zod validator for `ResourceOwnershipContributionManifest`. The
+ * biome-discovery parser AND the owning domain service's wire DTO BOTH route
+ * every candidate envelope through this schema, so a malformed contribution
+ * fails at the boundary instead of at the wire (mirrors
+ * `CapabilityContributionManifestSchema`).
+ */
+export const ResourceOwnershipContributionManifestSchema: z.ZodType<ResourceOwnershipContributionManifest> =
+  z.object({
+    resourceType: z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+    resourceId: z.string().min(1).max(RESOURCE_IDENTIFIER_MAX),
+    visibility: ResourceVisibilityPatternSchema,
+    owners: z.array(OwnerRefSchema).min(1).max(RESOURCE_PRINCIPALS_MAX),
+    explicitShares: z
+      .array(ExplicitShareRefSchema)
+      .max(RESOURCE_PRINCIPALS_MAX)
+      .optional(),
+  }) as z.ZodType<ResourceOwnershipContributionManifest>;

package/src/resource/lib/resource-ref.ts

@@ -0,0 +1,75 @@
+/**
+ * Resource-instance ref grammar — the canonical composite string for a single
+ * resource instance: `resource:<type>:<id>`.
+ *
+ * Mirrors the subject-ref grammar (`subjectRefToString` / `parseSubjectRef`)
+ * but is FIXED-arity: exactly three colon-delimited segments. Because the id
+ * sits in the final segment AND we forbid the delimiter inside both `type` and
+ * `id`, the encoding is unambiguous and losslessly round-trips — no
+ * split-on-first-colon ambiguity. Fail-fast on any malformed input; never
+ * silently coerce.
+ */
+
+/** The fixed prefix every resource ref carries. */
+export const RESOURCE_REF_PREFIX = 'resource' as const;
+
+/** The segment delimiter. Forbidden inside `type` and `id`. */
+export const RESOURCE_REF_DELIMITER = ':' as const;
+
+/**
+ * Parsed form of a resource ref.
+ */
+export interface ResourceRefParts {
+  readonly type: string;
+  readonly id: string;
+}
+
+/**
+ * Compose `resource:<type>:<id>` from a type + id. Fail-fast if either segment
+ * is empty or contains the `:` delimiter (which would make the ref ambiguous /
+ * un-round-trippable). Never coerce — an invalid segment throws.
+ */
+export function composeResourceRef(type: string, id: string): string {
+  if (type.length === 0 || id.length === 0) {
+    throw new Error(
+      `Invalid resource ref segments: "type" and "id" must both be non-empty (got type="${type}", id="${id}").`,
+    );
+  }
+  if (type.includes(RESOURCE_REF_DELIMITER)) {
+    throw new Error(
+      `Invalid resource type "${type}": must not contain the "${RESOURCE_REF_DELIMITER}" delimiter.`,
+    );
+  }
+  if (id.includes(RESOURCE_REF_DELIMITER)) {
+    throw new Error(
+      `Invalid resource id "${id}": must not contain the "${RESOURCE_REF_DELIMITER}" delimiter.`,
+    );
+  }
+  return `${RESOURCE_REF_PREFIX}${RESOURCE_REF_DELIMITER}${type}${RESOURCE_REF_DELIMITER}${id}`;
+}
+
+/**
+ * Parse `resource:<type>:<id>` back into its parts. Fail-fast on a wrong
+ * prefix, wrong arity, or an empty segment. The inverse of
+ * `composeResourceRef` — any string that `composeResourceRef` produced parses
+ * back to the identical `{ type, id }`.
+ */
+export function parseResourceRef(ref: string): ResourceRefParts {
+  const [prefix, type, id, ...rest] = ref.split(RESOURCE_REF_DELIMITER);
+  if (rest.length > 0 || prefix === undefined || type === undefined || id === undefined) {
+    throw new Error(
+      `Invalid resource ref "${ref}": expected exactly "${RESOURCE_REF_PREFIX}:<type>:<id>".`,
+    );
+  }
+  if (prefix !== RESOURCE_REF_PREFIX) {
+    throw new Error(
+      `Invalid resource ref "${ref}": must start with the "${RESOURCE_REF_PREFIX}" prefix.`,
+    );
+  }
+  if (type.length === 0 || id.length === 0) {
+    throw new Error(
+      `Invalid resource ref "${ref}": "type" and "id" segments must both be non-empty.`,
+    );
+  }
+  return { type, id };
+}