@vritti/api-sdk 0.3.11 → 0.3.13

package/dist/auth.cjs

@@ -31,18 +31,24 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/auth/index.ts
 var auth_exports = {};
 __export(auth_exports, {
+  APP_SESSION_TYPE: () => APP_SESSION_TYPE,
   AUTH_CONFIG: () => AUTH_CONFIG,
   AUTH_CONFIG_DEFAULTS: () => AUTH_CONFIG_DEFAULTS,
   AccessToken: () => AccessToken,
   AuthConfigModule: () => AuthConfigModule,
+  CLIENT_ID_HEADER: () => CLIENT_ID_HEADER,
   ClientIp: () => ClientIp,
   CookieDomain: () => CookieDomain,
   CookieName: () => CookieName,
   Hostname: () => Hostname,
+  MAX_CLOCK_SKEW_SECONDS: () => MAX_CLOCK_SKEW_SECONDS,
+  PARTY_ID_HEADER: () => PARTY_ID_HEADER,
   Public: () => Public,
+  REQUIRE_APP_KEY: () => REQUIRE_APP_KEY,
   REQUIRE_SESSION_KEY: () => REQUIRE_SESSION_KEY,
   RefreshCookieOptions: () => RefreshCookieOptions,
   RefreshTokenCookie: () => RefreshTokenCookie,
+  RequireApp: () => RequireApp,
   RequireSession: () => RequireSession,
   SKIP_CSRF_KEY: () => SKIP_CSRF_KEY,
   SessionData: () => SessionData,
@@ -53,11 +59,27 @@ __export(auth_exports, {
   UserAgent: () => UserAgent,
   UserId: () => UserId,
   VrittiAuthGuard: () => VrittiAuthGuard,
+  WORKSPACE_HEADER_ORDER: () => WORKSPACE_HEADER_ORDER,
   hashToken: () => hashToken,
   verifyTokenHash: () => verifyTokenHash
 });
 module.exports = __toCommonJS(auth_exports);
 
+// src/signing/request.ts
+var import_node_crypto = require("crypto");
+var WORKSPACE_HEADER_ORDER = [
+  "x-site-id",
+  "x-sg-id",
+  "x-le-id",
+  "x-org-id"
+];
+
+// src/auth/app-request.ts
+var CLIENT_ID_HEADER = "x-vritti-client-id";
+var PARTY_ID_HEADER = "x-party-id";
+var MAX_CLOCK_SKEW_SECONDS = 300;
+var APP_SESSION_TYPE = "APP";
+
 // src/auth/auth.config.ts
 var AUTH_CONFIG = Symbol("AUTH_CONFIG");
 var AUTH_CONFIG_DEFAULTS = {
@@ -84,7 +106,7 @@ var TokenType = /* @__PURE__ */ (function(TokenType2) {
 })({});
 
 // src/auth/auth-config.module.ts
-var import_common7 = require("@nestjs/common");
+var import_common8 = require("@nestjs/common");
 var import_config = require("@nestjs/config");
 var import_core3 = require("@nestjs/core");
 var import_jwt2 = require("@nestjs/jwt");
@@ -174,6 +196,46 @@ var RequestService = class {
   getAllHeaders() {
     return this.request.headers || {};
   }
+  // Returns the HTTP method
+  getMethod() {
+    return this.request.method ?? "";
+  }
+  /**
+  * Returns the path with any query string stripped.
+  *
+  * Signature canonicals cover the path only, so a query string must not be part
+  * of what gets signed or verified.
+  */
+  getPath() {
+    const url = this.request.url ?? "";
+    return url.split("?")[0] ?? url;
+  }
+  /**
+  * Returns the raw query string, without the leading `?`.
+  *
+  * Companion to `getPath()`, which strips it. Signed separately so a REST request's
+  * filters are covered — `getPath()` alone would sign `GET /people?search=salt` as
+  * though the filter were not there.
+  */
+  getQuery() {
+    const url = this.request.url ?? "";
+    const index = url.indexOf("?");
+    return index === -1 ? "" : url.slice(index + 1);
+  }
+  /**
+  * Returns the raw request body, as `fastify-raw-body` leaves it.
+  *
+  * Read structurally rather than through a module augmentation: that plugin is the
+  * consuming server's dependency, not this SDK's, and declaring `rawBody` here
+  * would collide with the plugin's own declaration the moment the two drift.
+  *
+  * A server that has not registered it yields `undefined`, which hashes as an empty
+  * body and therefore fails any signature made over real bytes — refused, never
+  * waved through.
+  */
+  getRawBody() {
+    return this.request.rawBody;
+  }
 };
 RequestService = _ts_decorate([
   (0, import_common.Injectable)({
@@ -214,7 +276,7 @@ RequestModule = _ts_decorate2([
 ], RequestModule);
 
 // src/auth/guards/vritti-auth.guard.ts
-var import_common6 = require("@nestjs/common");
+var import_common7 = require("@nestjs/common");
 var import_constants = require("@nestjs/common/constants");
 var import_core2 = require("@nestjs/core");
 
@@ -258,18 +320,23 @@ function getResponseFromContext(host) {
 }
 __name(getResponseFromContext, "getResponseFromContext");
 
-// src/auth/decorators/require-session.decorator.ts
+// src/auth/decorators/require-app.decorator.ts
 var import_common3 = require("@nestjs/common");
+var REQUIRE_APP_KEY = "requiredAppTypes";
+var RequireApp = /* @__PURE__ */ __name((...types) => (0, import_common3.SetMetadata)(REQUIRE_APP_KEY, types), "RequireApp");
+
+// src/auth/decorators/require-session.decorator.ts
+var import_common4 = require("@nestjs/common");
 var REQUIRE_SESSION_KEY = "requiredSessionTypes";
-var RequireSession = /* @__PURE__ */ __name((...types) => (0, import_common3.SetMetadata)(REQUIRE_SESSION_KEY, types), "RequireSession");
+var RequireSession = /* @__PURE__ */ __name((...types) => (0, import_common4.SetMetadata)(REQUIRE_SESSION_KEY, types), "RequireSession");
 
 // src/auth/decorators/skip-csrf.decorator.ts
-var import_common4 = require("@nestjs/common");
+var import_common5 = require("@nestjs/common");
 var SKIP_CSRF_KEY = "skipCsrf";
-var SkipCsrf = /* @__PURE__ */ __name(() => (0, import_common4.SetMetadata)(SKIP_CSRF_KEY, true), "SkipCsrf");
+var SkipCsrf = /* @__PURE__ */ __name(() => (0, import_common5.SetMetadata)(SKIP_CSRF_KEY, true), "SkipCsrf");
 
 // src/auth/services/token.service.ts
-var import_common5 = require("@nestjs/common");
+var import_common6 = require("@nestjs/common");
 var import_jwt = require("@nestjs/jwt");
 
 // src/utils/time.utils.ts
@@ -329,7 +396,7 @@ var TokenService = class _TokenService {
   }
   jwtService;
   config;
-  logger = new import_common5.Logger(_TokenService.name);
+  logger = new import_common6.Logger(_TokenService.name);
   constructor(jwtService, config) {
     this.jwtService = jwtService;
     this.config = config;
@@ -393,21 +460,21 @@ var TokenService = class _TokenService {
     try {
       const decoded = this.jwtService.verify(token);
       if (decoded.tokenType !== TokenType.ACCESS) {
-        throw new import_common5.UnauthorizedException("Invalid token type");
+        throw new import_common6.UnauthorizedException("Invalid token type");
       }
       return decoded;
     } catch (error) {
-      if (error instanceof import_common5.UnauthorizedException) throw error;
+      if (error instanceof import_common6.UnauthorizedException) throw error;
       const jwtError = error;
       switch (jwtError.name) {
         case "TokenExpiredError":
-          throw new import_common5.UnauthorizedException("Access token has expired");
+          throw new import_common6.UnauthorizedException("Access token has expired");
         case "JsonWebTokenError":
-          throw new import_common5.UnauthorizedException("Invalid access token");
+          throw new import_common6.UnauthorizedException("Invalid access token");
         case "NotBeforeError":
-          throw new import_common5.UnauthorizedException("Access token not yet valid");
+          throw new import_common6.UnauthorizedException("Access token not yet valid");
         default:
-          throw new import_common5.UnauthorizedException("Access token validation failed");
+          throw new import_common6.UnauthorizedException("Access token validation failed");
       }
     }
   }
@@ -416,24 +483,24 @@ var TokenService = class _TokenService {
     try {
       const decoded = this.jwtService.verify(token);
       if (decoded.tokenType !== TokenType.REFRESH) {
-        throw new import_common5.UnauthorizedException("Invalid token type");
+        throw new import_common6.UnauthorizedException("Invalid token type");
       }
       return decoded;
     } catch (error) {
-      if (error instanceof import_common5.UnauthorizedException) throw error;
-      throw new import_common5.UnauthorizedException("Invalid or expired session");
+      if (error instanceof import_common6.UnauthorizedException) throw error;
+      throw new import_common6.UnauthorizedException("Invalid or expired session");
     }
   }
   // Validates that the access token is bound to the refresh token
   validateTokenBinding(accessToken, refreshToken) {
     if (!verifyTokenHash(refreshToken, accessToken.refreshTokenHash)) {
-      throw new import_common5.UnauthorizedException("Session validation failed");
+      throw new import_common6.UnauthorizedException("Session validation failed");
     }
   }
 };
 TokenService = _ts_decorate3([
-  (0, import_common5.Injectable)(),
-  _ts_param2(1, (0, import_common5.Inject)(AUTH_CONFIG)),
+  (0, import_common6.Injectable)(),
+  _ts_param2(1, (0, import_common6.Inject)(AUTH_CONFIG)),
   _ts_metadata2("design:type", Function),
   _ts_metadata2("design:paramtypes", [
     typeof import_jwt.JwtService === "undefined" ? Object : import_jwt.JwtService,
@@ -467,7 +534,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
   requestService;
   tokenService;
   config;
-  logger = new import_common6.Logger(_VrittiAuthGuard.name);
+  logger = new import_common7.Logger(_VrittiAuthGuard.name);
   constructor(reflector, requestService, tokenService, config) {
     this.reflector = reflector;
     this.requestService = requestService;
@@ -484,6 +551,13 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       context.getHandler(),
       context.getClass()
     ]) || csrfExemptTransports.includes(context.getType());
+    const requiredAppTypes = this.reflector.getAllAndOverride(REQUIRE_APP_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (requiredAppTypes) {
+      return this.handleAppAuth(request, requiredAppTypes, route);
+    }
     const isPublic = this.reflector.getAllAndOverride("isPublic", [
       context.getHandler(),
       context.getClass()
@@ -511,26 +585,59 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
     }
     return true;
   }
+  /**
+  * Authenticates a signed request from an external app.
+  *
+  * The credential lookup and the signature check are the consuming server's job —
+  * it is the only side with a database — so this delegates to
+  * `guard.onAuthenticated`, the same hook the session path already uses to resolve
+  * organization and workspace context. That server fills in `organizationId`,
+  * `appType` and whatever else it knows.
+  *
+  * What stays here is the part only this side can do: reading the decorator's
+  * metadata and enforcing the app-type filter against what the server resolved.
+  *
+  * An empty list means "any type" — the caller is still authenticated. That makes
+  * `@RequireApp()` with no arguments mean what it reads like.
+  */
+  async handleAppAuth(request, requiredAppTypes, route) {
+    const onAuthenticated = this.config.guard.onAuthenticated;
+    if (!onAuthenticated) {
+      this.logger.error(`${route} \u2014 @RequireApp() requires guard.onAuthenticated to be configured`);
+      throw new import_common7.UnauthorizedException("App authentication is not configured");
+    }
+    const sessionInfo = {
+      sessionType: APP_SESSION_TYPE
+    };
+    request.sessionInfo = sessionInfo;
+    await onAuthenticated(this.requestService, sessionInfo);
+    if (requiredAppTypes.length && !requiredAppTypes.includes(sessionInfo.appType ?? "")) {
+      this.logger.warn(`${route} \u2014 app type ${sessionInfo.appType ?? "unknown"} not in allowed: [${requiredAppTypes.join(", ")}]`);
+      throw new import_common7.UnauthorizedException("This client is not recognised.");
+    }
+    this.logger.debug(`${route} \u2014 authenticated app (${sessionInfo.appType})`);
+    return true;
+  }
   // Authenticates standard HTTP requests using the access token from Authorization header
   async handleHttpAuth(request, requiredSessionTypes) {
     const route = `${request.method} ${request.url}`;
     const accessToken = this.requestService.getAccessToken();
     if (!accessToken) {
       this.logger.warn(`${route} \u2014 no access token found`);
-      throw new import_common6.UnauthorizedException("Access token not found");
+      throw new import_common7.UnauthorizedException("Access token not found");
     }
     const decoded = this.tokenService.validateAccessToken(accessToken);
     const refreshTokenBindingExemptSessionTypes = this.config.guard.refreshTokenBindingExemptSessionTypes ?? [];
     if (!refreshTokenBindingExemptSessionTypes.includes(decoded.sessionType)) {
       const refreshToken = this.requestService.getRefreshToken();
       if (!refreshToken) {
-        throw new import_common6.UnauthorizedException("Session validation failed");
+        throw new import_common7.UnauthorizedException("Session validation failed");
       }
       this.tokenService.validateTokenBinding(decoded, refreshToken);
     }
     if (requiredSessionTypes?.length && !requiredSessionTypes.includes(decoded.sessionType)) {
       this.logger.warn(`${route} \u2014 session type ${decoded.sessionType} not in allowed: [${requiredSessionTypes.join(", ")}]`);
-      throw new import_common6.UnauthorizedException(`${decoded.sessionType} sessions cannot access this endpoint`);
+      throw new import_common7.UnauthorizedException(`${decoded.sessionType} sessions cannot access this endpoint`);
     }
     const { tokenType: _tokenType, refreshTokenHash: _hash, exp: _exp, iat: _iat, ...sessionInfo } = decoded;
     request.sessionInfo = sessionInfo;
@@ -546,12 +653,12 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
     const refreshToken = this.requestService.getRefreshToken();
     if (!refreshToken) {
       this.logger.warn(`SSE ${request.url} \u2014 no refresh token cookie`);
-      throw new import_common6.UnauthorizedException("Authentication required");
+      throw new import_common7.UnauthorizedException("Authentication required");
     }
     const decoded = this.tokenService.validateRefreshToken(refreshToken);
     if (requiredSessionTypes?.length && !requiredSessionTypes.includes(decoded.sessionType)) {
       this.logger.warn(`SSE ${request.url} \u2014 session type ${decoded.sessionType} not allowed`);
-      throw new import_common6.UnauthorizedException(`${decoded.sessionType} sessions cannot access this endpoint`);
+      throw new import_common7.UnauthorizedException(`${decoded.sessionType} sessions cannot access this endpoint`);
     }
     const { tokenType: _tokenType, exp: _exp, iat: _iat, ...sessionInfo } = decoded;
     request.sessionInfo = sessionInfo;
@@ -570,7 +677,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       const fastifyInstance = request.server;
       const csrfProtection = fastifyInstance.csrfProtection;
       if (!csrfProtection) {
-        throw new import_common6.ForbiddenException("CSRF protection not configured");
+        throw new import_common7.ForbiddenException("CSRF protection not configured");
       }
       await new Promise((resolve, reject) => {
         const originalSend = reply.send.bind(reply);
@@ -587,7 +694,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       });
     } catch (_error) {
       this.logger.warn(`${request.method} ${request.url} \u2014 CSRF validation failed`);
-      throw new import_common6.ForbiddenException({
+      throw new import_common7.ForbiddenException({
         errors: [
           {
             field: "csrf",
@@ -600,10 +707,10 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
   }
 };
 VrittiAuthGuard = _ts_decorate4([
-  (0, import_common6.Injectable)({
-    scope: import_common6.Scope.REQUEST
+  (0, import_common7.Injectable)({
+    scope: import_common7.Scope.REQUEST
   }),
-  _ts_param3(3, (0, import_common6.Inject)(AUTH_CONFIG)),
+  _ts_param3(3, (0, import_common7.Inject)(AUTH_CONFIG)),
   _ts_metadata3("design:type", Function),
   _ts_metadata3("design:paramtypes", [
     typeof import_core2.Reflector === "undefined" ? Object : import_core2.Reflector,
@@ -646,6 +753,7 @@ var AuthConfigModule = class _AuthConfigModule {
       imports: [
         import_config.ConfigModule,
         RequestModule,
+        ...options.imports ?? [],
         import_jwt2.JwtModule.registerAsync({
           imports: [
             import_config.ConfigModule
@@ -689,27 +797,27 @@ var AuthConfigModule = class _AuthConfigModule {
   }
 };
 AuthConfigModule = _ts_decorate5([
-  (0, import_common7.Global)(),
-  (0, import_common7.Module)({})
+  (0, import_common8.Global)(),
+  (0, import_common8.Module)({})
 ], AuthConfigModule);
 
 // src/auth/decorators/access-token.decorator.ts
-var import_common8 = require("@nestjs/common");
-var AccessToken = (0, import_common8.createParamDecorator)((_data, ctx) => {
+var import_common9 = require("@nestjs/common");
+var AccessToken = (0, import_common9.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const authHeader = request.headers.authorization;
   return authHeader?.replace("Bearer ", "") || "";
 });
 
 // src/auth/decorators/client-ip.decorator.ts
-var import_common9 = require("@nestjs/common");
-var ClientIp = (0, import_common9.createParamDecorator)((_data, ctx) => {
+var import_common10 = require("@nestjs/common");
+var ClientIp = (0, import_common10.createParamDecorator)((_data, ctx) => {
   return getRequestFromContext(ctx).ip;
 });
 
 // src/auth/decorators/cookie-domain.decorator.ts
-var import_common10 = require("@nestjs/common");
-var CookieDomain = (0, import_common10.createParamDecorator)((_data, ctx) => {
+var import_common11 = require("@nestjs/common");
+var CookieDomain = (0, import_common11.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const forwarded = request.headers["x-forwarded-host"];
   const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
@@ -720,15 +828,15 @@ var CookieDomain = (0, import_common10.createParamDecorator)((_data, ctx) => {
 });
 
 // src/auth/decorators/cookie-name.decorator.ts
-var import_common11 = require("@nestjs/common");
-var CookieName = (0, import_common11.createParamDecorator)((_data, ctx) => {
+var import_common12 = require("@nestjs/common");
+var CookieName = (0, import_common12.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   return request.authConfig?.cookie.refreshCookieName ?? AUTH_CONFIG_DEFAULTS.cookie.refreshCookieName;
 });
 
 // src/auth/decorators/hostname.decorator.ts
-var import_common12 = require("@nestjs/common");
-var Hostname = (0, import_common12.createParamDecorator)((_data, ctx) => {
+var import_common13 = require("@nestjs/common");
+var Hostname = (0, import_common13.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const forwarded = request.headers["x-forwarded-host"];
   const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
@@ -737,18 +845,18 @@ var Hostname = (0, import_common12.createParamDecorator)((_data, ctx) => {
 });
 
 // src/auth/decorators/public.decorator.ts
-var import_common13 = require("@nestjs/common");
-var Public = /* @__PURE__ */ __name(() => (0, import_common13.SetMetadata)("isPublic", true), "Public");
+var import_common14 = require("@nestjs/common");
+var Public = /* @__PURE__ */ __name(() => (0, import_common14.SetMetadata)("isPublic", true), "Public");
 
 // src/auth/decorators/refresh-cookie-options.decorator.ts
-var import_common33 = require("@nestjs/common");
+var import_common34 = require("@nestjs/common");
 
 // src/exceptions/bad-gateway.exception.ts
-var import_common15 = require("@nestjs/common");
+var import_common16 = require("@nestjs/common");
 
 // src/exceptions/base-field.exception.ts
-var import_common14 = require("@nestjs/common");
-var HttpProblemException = class extends import_common14.HttpException {
+var import_common15 = require("@nestjs/common");
+var HttpProblemException = class extends import_common15.HttpException {
   static {
     __name(this, "HttpProblemException");
   }
@@ -766,63 +874,63 @@ var HttpProblemException = class extends import_common14.HttpException {
 };
 
 // src/exceptions/bad-request.exception.ts
-var import_common16 = require("@nestjs/common");
+var import_common17 = require("@nestjs/common");
 
 // src/exceptions/conflict.exception.ts
-var import_common17 = require("@nestjs/common");
+var import_common18 = require("@nestjs/common");
 
 // src/exceptions/forbidden.exception.ts
-var import_common18 = require("@nestjs/common");
+var import_common19 = require("@nestjs/common");
 
 // src/exceptions/gone.exception.ts
-var import_common19 = require("@nestjs/common");
+var import_common20 = require("@nestjs/common");
 
 // src/exceptions/internal-server-error.exception.ts
-var import_common20 = require("@nestjs/common");
+var import_common21 = require("@nestjs/common");
 
 // src/exceptions/method-not-allowed.exception.ts
-var import_common21 = require("@nestjs/common");
+var import_common22 = require("@nestjs/common");
 
 // src/exceptions/not-acceptable.exception.ts
-var import_common22 = require("@nestjs/common");
+var import_common23 = require("@nestjs/common");
 
 // src/exceptions/not-found.exception.ts
-var import_common23 = require("@nestjs/common");
+var import_common24 = require("@nestjs/common");
 
 // src/exceptions/not-implemented.exception.ts
-var import_common24 = require("@nestjs/common");
+var import_common25 = require("@nestjs/common");
 
 // src/exceptions/payload-too-large.exception.ts
-var import_common25 = require("@nestjs/common");
+var import_common26 = require("@nestjs/common");
 
 // src/exceptions/request-timeout.exception.ts
-var import_common26 = require("@nestjs/common");
+var import_common27 = require("@nestjs/common");
 
 // src/exceptions/service-unavailable.exception.ts
-var import_common27 = require("@nestjs/common");
+var import_common28 = require("@nestjs/common");
 
 // src/exceptions/too-many-requests.exception.ts
-var import_common28 = require("@nestjs/common");
+var import_common29 = require("@nestjs/common");
 
 // src/exceptions/unauthorized.exception.ts
-var import_common29 = require("@nestjs/common");
+var import_common30 = require("@nestjs/common");
 var UnauthorizedException3 = class extends HttpProblemException {
   static {
     __name(this, "UnauthorizedException");
   }
   constructor(detailOrOptions) {
-    super(detailOrOptions ?? "Unauthorized", import_common29.HttpStatus.UNAUTHORIZED);
+    super(detailOrOptions ?? "Unauthorized", import_common30.HttpStatus.UNAUTHORIZED);
   }
 };
 
 // src/exceptions/unprocessable-entity.exception.ts
-var import_common30 = require("@nestjs/common");
+var import_common31 = require("@nestjs/common");
 
 // src/exceptions/unsupported-media-type.exception.ts
-var import_common31 = require("@nestjs/common");
+var import_common32 = require("@nestjs/common");
 
 // src/exceptions/validation.exception.ts
-var import_common32 = require("@nestjs/common");
+var import_common33 = require("@nestjs/common");
 
 // src/auth/decorators/refresh-cookie-options.decorator.ts
 function buildCookieOptionsForHost(cookieConfig, hostname) {
@@ -843,7 +951,7 @@ function buildCookieOptionsForHost(cookieConfig, hostname) {
   };
 }
 __name(buildCookieOptionsForHost, "buildCookieOptionsForHost");
-var RefreshCookieOptions = (0, import_common33.createParamDecorator)((_data, ctx) => {
+var RefreshCookieOptions = (0, import_common34.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const forwarded = request.headers["x-forwarded-host"];
   const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
@@ -854,8 +962,8 @@ var RefreshCookieOptions = (0, import_common33.createParamDecorator)((_data, ctx
 });
 
 // src/auth/decorators/refresh-token-cookie.decorator.ts
-var import_common34 = require("@nestjs/common");
-var RefreshTokenCookie = (0, import_common34.createParamDecorator)((_data, ctx) => {
+var import_common35 = require("@nestjs/common");
+var RefreshTokenCookie = (0, import_common35.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const cookies = request.cookies ?? {};
   const cookieName = request.authConfig?.cookie.refreshCookieName ?? AUTH_CONFIG_DEFAULTS.cookie.refreshCookieName;
@@ -863,8 +971,8 @@ var RefreshTokenCookie = (0, import_common34.createParamDecorator)((_data, ctx)
 });
 
 // src/auth/decorators/session-data.decorator.ts
-var import_common35 = require("@nestjs/common");
-var SessionData = (0, import_common35.createParamDecorator)((_data, ctx) => {
+var import_common36 = require("@nestjs/common");
+var SessionData = (0, import_common36.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const sessionInfo = request.sessionInfo;
   if (!sessionInfo?.sessionId) {
@@ -878,8 +986,8 @@ var SessionData = (0, import_common35.createParamDecorator)((_data, ctx) => {
 });
 
 // src/auth/decorators/subdomain.decorator.ts
-var import_common36 = require("@nestjs/common");
-var Subdomain = (0, import_common36.createParamDecorator)((_data, ctx) => {
+var import_common37 = require("@nestjs/common");
+var Subdomain = (0, import_common37.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const forwarded = request.headers["x-forwarded-host"];
   const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
@@ -890,15 +998,15 @@ var Subdomain = (0, import_common36.createParamDecorator)((_data, ctx) => {
 });
 
 // src/auth/decorators/user-agent.decorator.ts
-var import_common37 = require("@nestjs/common");
-var UserAgent = (0, import_common37.createParamDecorator)((_data, ctx) => {
+var import_common38 = require("@nestjs/common");
+var UserAgent = (0, import_common38.createParamDecorator)((_data, ctx) => {
   const userAgent = getRequestFromContext(ctx).headers["user-agent"];
   return Array.isArray(userAgent) ? userAgent[0] : userAgent;
 });
 
 // src/auth/decorators/user-id.decorator.ts
-var import_common38 = require("@nestjs/common");
-var UserId = (0, import_common38.createParamDecorator)((_data, ctx) => {
+var import_common39 = require("@nestjs/common");
+var UserId = (0, import_common39.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const sessionInfo = request.sessionInfo;
   if (!sessionInfo?.userId) {
@@ -908,18 +1016,24 @@ var UserId = (0, import_common38.createParamDecorator)((_data, ctx) => {
 });
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  APP_SESSION_TYPE,
   AUTH_CONFIG,
   AUTH_CONFIG_DEFAULTS,
   AccessToken,
   AuthConfigModule,
+  CLIENT_ID_HEADER,
   ClientIp,
   CookieDomain,
   CookieName,
   Hostname,
+  MAX_CLOCK_SKEW_SECONDS,
+  PARTY_ID_HEADER,
   Public,
+  REQUIRE_APP_KEY,
   REQUIRE_SESSION_KEY,
   RefreshCookieOptions,
   RefreshTokenCookie,
+  RequireApp,
   RequireSession,
   SKIP_CSRF_KEY,
   SessionData,
@@ -930,6 +1044,7 @@ var UserId = (0, import_common38.createParamDecorator)((_data, ctx) => {
   UserAgent,
   UserId,
   VrittiAuthGuard,
+  WORKSPACE_HEADER_ORDER,
   hashToken,
   verifyTokenHash
 });