@xemahq/authorization-nest 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,175 @@
+Xema Business Source License 1.1
+
+License text copyright (c) 2020 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Parameters
+
+Licensor:  Neuralchowder Inc.
+
+Licensed Work:  Xema. The Licensed Work is (c) 2026 Neuralchowder Inc.
+
+  The Licensed Work includes, without limitation, Xema Core, Xema Runtime,
+  Xema Kernel, Xema control plane, Xema application runtime, Xema biome
+  runtime, Xema biome registry, Xema store services, Xema orchestration
+  services, Xema agents, Xema skills, Xema memory services, Xema APIs, Xema
+  user interfaces, Xema command-line tools, Xema deployment artifacts, Xema
+  templates, Xema specifications, Xema schemas, Xema manifests, Xema
+  documentation, Xema examples, and all source code, object code, binaries,
+  packages, modules, configuration files, manifests, schemas, examples,
+  templates, documentation, and derivative works included in or distributed
+  as part of the Xema software project.
+
+  The Licensed Work does not include any third-party software, libraries,
+  dependencies, packages, assets, or components that are distributed with the
+  Licensed Work but are governed by their own separate license terms. Such
+  third-party materials remain subject to their respective licenses.
+
+  A specific file, package, component, or directory may state that it is
+  governed by a different license. In that case, that specific file, package,
+  component, or directory is governed by the license expressly stated therein.
+
+Additional Use Grant:
+
+  You may make production use of the Licensed Work, provided that your use
+  does not include offering, providing, making available, distributing,
+  hosting, managing, embedding, reselling, white-labeling, sublicensing,
+  commercializing, or otherwise making the Licensed Work, or any modified
+  version or derivative work of the Licensed Work, available to Third Parties
+  as part of a Competitive Offering.
+
+The following definitions and clarifications form part of, and govern
+the interpretation of, the Additional Use Grant set out above.
+
+  1. "Production Use" means any use of the Licensed Work other than for
+     development, testing, evaluation, demonstration, experimentation,
+     benchmarking, or other non-production purposes.
+
+  2. "Affiliate" means any entity that, directly or indirectly,
+     controls, is controlled by, or is under common control with you,
+     where "control" means ownership of more than fifty percent (50%) of
+     the voting interests of the entity, or the power to direct its
+     management.
+
+  3. "Third Party" means any natural person or legal entity other than
+     you and your Affiliates.
+
+  4. "Competitive Offering" means any product or service, made available
+     to one or more Third Parties for a fee or other consideration
+     (including without limitation on a paid, subscription,
+     advertising-supported, hosted, or managed-service basis), that is
+     offered or marketed as, or that competes with, a software platform,
+     runtime, orchestration system, agent or automation system,
+     extension or distribution marketplace, or other software system
+     that provides, in substantial part, the same or substantially
+     similar capabilities as those provided by the Licensed Work. A
+     product or service is a Competitive Offering whether the Licensed
+     Work is provided in whole or in part, alone or bundled with other
+     software, and whether modified or unmodified.
+
+  5. Providing, hosting, or managing the Licensed Work for a Third Party,
+     or otherwise making the Licensed Work available to a Third Party as
+     a hosted or managed service such that the Third Party obtains the
+     principal value or functionality of the Licensed Work, is a
+     Competitive Offering and is not permitted by the Additional Use
+     Grant.
+
+  6. Subject to the foregoing, the Additional Use Grant permits you to
+     make Production Use of the Licensed Work for your own internal
+     business purposes and to build, operate, and provide your own
+     products and services to Third Parties, provided that the Licensed
+     Work itself (whether modified or unmodified) is not the product or
+     service, and is not a Competitive Offering, made available to those
+     Third Parties.
+
+  7. You may modify the Licensed Work and create derivative works for
+     any purpose permitted by this License. Any Production Use of such
+     modified or derivative works remains subject to the same
+     restrictions as the Licensed Work, including the prohibition on
+     Competitive Offerings.
+
+  8. Use of the Licensed Work by your own employees, contractors, and
+     agents, acting on your behalf and for your benefit, is not by
+     itself making the Licensed Work available to a Third Party.
+
+  9. Embedding or distributing the Licensed Work as a component of your
+     own product or service is permitted only where the Licensed Work
+     does not constitute the principal value of that product or service
+     and the product or service is not a Competitive Offering.
+
+  10. Nothing in this Additional Use Grant grants any right to use any
+      name, trademark, service mark, or logo of the Licensor or its
+      Affiliates, except as reasonably required for customary
+      attribution.
+
+  11. The rights stated in this Additional Use Grant are the maximum
+      rights granted for Production Use prior to the Change Date. Any
+      Production Use not expressly permitted requires a separate
+      commercial license from the Licensor.
+
+  12. If any provision of this Additional Use Grant is held invalid or
+      unenforceable, that provision shall be limited or eliminated to
+      the minimum extent necessary so that the remainder of this
+      Additional Use Grant, and of this License, remains in full force
+      and effect. The Licensor reserves all rights not expressly granted
+      by this License.
+
+
+Change Date:  Four years from the date the specific version of the Licensed
+  Work is first publicly released by Licensor.
+
+Change License:  Mozilla Public License, Version 2.0
+
+For information about alternative licensing arrangements, commercial
+licensing, enterprise licensing, OEM licensing, appliance licensing, managed
+service licensing, cloud provider licensing, or other commercial use of the
+Licensed Work, please contact: licensing@neuralchowder.com
+
+-----------------------------------------------------------------------------
+
+Notice
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph above
+terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works of
+the Licensed Work, are subject to this License. This License applies separately
+for each version of the Licensed Work and the Change Date may vary for each
+version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or modified
+form from a third party, the terms and conditions set forth in this License
+apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of Licensor
+or its affiliates, provided that you may use a trademark or logo of Licensor
+as expressly required by this License.
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN
+"AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS
+OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.

package/dist/anchor-predicate.d.ts

@@ -0,0 +1,61 @@
+import { z } from 'zod';
+export type XemaAnchorPredicate = {
+    readonly op: 'true';
+} | {
+    readonly op: 'false';
+} | {
+    readonly op: 'edge_in';
+    readonly relation: string;
+    readonly targetType: string;
+    readonly ids: readonly string[];
+} | {
+    readonly op: 'edge_match';
+    readonly relation: string;
+    readonly targetType: string;
+    readonly predicate: XemaAnchorPredicate;
+} | {
+    readonly op: 'subject_in';
+    readonly relation: string;
+    readonly subjects: readonly string[];
+} | {
+    readonly op: 'condition';
+    readonly relation: string;
+    readonly condition: string;
+    readonly subject: string;
+} | {
+    readonly op: 'and';
+    readonly args: readonly XemaAnchorPredicate[];
+} | {
+    readonly op: 'or';
+    readonly args: readonly XemaAnchorPredicate[];
+} | {
+    readonly op: 'not';
+    readonly arg: XemaAnchorPredicate;
+};
+export declare const XemaAnchorPredicateSchema: z.ZodType<XemaAnchorPredicate>;
+export declare const XemaAnchorSearchContextSchema: z.ZodObject<{
+    searchedType: z.ZodString;
+    predicate: z.ZodType<XemaAnchorPredicate, unknown, z.core.$ZodTypeInternals<XemaAnchorPredicate, unknown>>;
+}, z.core.$strict>;
+export type XemaAnchorSearchContext = z.infer<typeof XemaAnchorSearchContextSchema>;
+export interface AnchorSqlMapping {
+    readonly edgeColumns: Readonly<Record<string, string>>;
+    readonly subjectColumns?: Readonly<Record<string, string>>;
+    readonly nested?: Readonly<Record<string, {
+        readonly select: string;
+        readonly mapping: AnchorSqlMapping;
+    }>>;
+    readonly conditions?: Readonly<Record<string, (subjectParam: string) => string>>;
+}
+export interface AnchorSql {
+    readonly sql: string;
+    readonly params: readonly unknown[];
+}
+export declare function anchorPredicateToSql(predicate: XemaAnchorPredicate, mapping: AnchorSqlMapping, firstParamIndex?: number): AnchorSql;
+export interface AnchorRowFacts {
+    readonly values: (relation: string) => readonly string[];
+    readonly nested?: (relation: string) => readonly AnchorRowFacts[];
+    readonly condition?: (condition: string, subject: string) => boolean;
+}
+export declare function evaluateAnchorPredicate(predicate: XemaAnchorPredicate, row: AnchorRowFacts): boolean;
+//# sourceMappingURL=anchor-predicate.d.ts.map

package/dist/anchor-predicate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor-predicate.d.ts","sourceRoot":"","sources":["../src/anchor-predicate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2BxB,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GACxB;IACE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAI9D,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAwCpE,CAAC;AAGF,eAAO,MAAM,6BAA6B;;;kBAK/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAOpF,MAAM,WAAW,gBAAgB;IAE/B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEvD,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAK3D,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CACxB,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAChF,CAAC;IAKF,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAC5B,MAAM,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CACjD,CAAC;CACH;AAED,MAAM,WAAW,SAAS;IAExB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC;CACrC;AAOD,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,mBAAmB,EAC9B,OAAO,EAAE,gBAAgB,EACzB,eAAe,SAAI,GAClB,SAAS,CAgEX;AAOD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;IAEzD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,cAAc,EAAE,CAAC;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;CACtE;AAGD,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,mBAAmB,EAC9B,GAAG,EAAE,cAAc,GAClB,OAAO,CAoCT"}

package/dist/anchor-predicate.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaAnchorSearchContextSchema = exports.XemaAnchorPredicateSchema = void 0;
+exports.anchorPredicateToSql = anchorPredicateToSql;
+exports.evaluateAnchorPredicate = evaluateAnchorPredicate;
+const zod_1 = require("zod");
+const name = zod_1.z.string().min(1);
+exports.XemaAnchorPredicateSchema = zod_1.z.lazy(() => zod_1.z.discriminatedUnion('op', [
+    zod_1.z.object({ op: zod_1.z.literal('true') }).strict(),
+    zod_1.z.object({ op: zod_1.z.literal('false') }).strict(),
+    zod_1.z
+        .object({
+        op: zod_1.z.literal('edge_in'),
+        relation: name,
+        targetType: name,
+        ids: zod_1.z.array(name),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        op: zod_1.z.literal('edge_match'),
+        relation: name,
+        targetType: name,
+        predicate: exports.XemaAnchorPredicateSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        op: zod_1.z.literal('subject_in'),
+        relation: name,
+        subjects: zod_1.z.array(name),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        op: zod_1.z.literal('condition'),
+        relation: name,
+        condition: name,
+        subject: name,
+    })
+        .strict(),
+    zod_1.z.object({ op: zod_1.z.literal('and'), args: zod_1.z.array(exports.XemaAnchorPredicateSchema) }).strict(),
+    zod_1.z.object({ op: zod_1.z.literal('or'), args: zod_1.z.array(exports.XemaAnchorPredicateSchema) }).strict(),
+    zod_1.z.object({ op: zod_1.z.literal('not'), arg: exports.XemaAnchorPredicateSchema }).strict(),
+]));
+exports.XemaAnchorSearchContextSchema = zod_1.z
+    .object({
+    searchedType: name,
+    predicate: exports.XemaAnchorPredicateSchema,
+})
+    .strict();
+function anchorPredicateToSql(predicate, mapping, firstParamIndex = 1) {
+    const params = [];
+    const placeholder = (value) => {
+        params.push(value);
+        return `$${firstParamIndex + params.length - 1}`;
+    };
+    const column = (table, relation, op) => {
+        const found = table?.[relation];
+        if (found === undefined) {
+            throw new Error(`anchorPredicateToSql: the mapping has no column for relation "${relation}" (${op}).`);
+        }
+        return found;
+    };
+    const render = (p, m) => {
+        switch (p.op) {
+            case 'true':
+                return 'TRUE';
+            case 'false':
+                return 'FALSE';
+            case 'edge_in':
+                return p.ids.length === 0
+                    ? 'FALSE'
+                    : `${column(m.edgeColumns, p.relation, p.op)} = ANY(${placeholder([...p.ids])})`;
+            case 'edge_match': {
+                const nested = m.nested?.[p.targetType];
+                if (nested === undefined) {
+                    throw new Error(`anchorPredicateToSql: no nested mapping for type "${p.targetType}" (edge_match).`);
+                }
+                return `${column(m.edgeColumns, p.relation, p.op)} IN (${nested.select} ${render(p.predicate, nested.mapping)})`;
+            }
+            case 'subject_in':
+                return p.subjects.length === 0
+                    ? 'FALSE'
+                    : `${column(m.subjectColumns, p.relation, p.op)} = ANY(${placeholder([...p.subjects])})`;
+            case 'condition': {
+                const renderCondition = m.conditions?.[p.condition];
+                if (renderCondition === undefined) {
+                    throw new Error(`anchorPredicateToSql: no SQL for condition "${p.condition}" on relation "${p.relation}".`);
+                }
+                return `(${renderCondition(placeholder(p.subject))})`;
+            }
+            case 'and':
+                return p.args.length === 0
+                    ? 'TRUE'
+                    : `(${p.args.map((a) => render(a, m)).join(' AND ')})`;
+            case 'or':
+                return p.args.length === 0
+                    ? 'FALSE'
+                    : `(${p.args.map((a) => render(a, m)).join(' OR ')})`;
+            case 'not':
+                return `(NOT ${render(p.arg, m)})`;
+        }
+    };
+    return { sql: render(predicate, mapping), params };
+}
+function evaluateAnchorPredicate(predicate, row) {
+    switch (predicate.op) {
+        case 'true':
+            return true;
+        case 'false':
+            return false;
+        case 'edge_in':
+            return row.values(predicate.relation).some((v) => predicate.ids.includes(v));
+        case 'edge_match': {
+            const nested = row.nested?.(predicate.relation);
+            if (nested === undefined) {
+                throw new Error(`evaluateAnchorPredicate: the row exposes no nested rows for "${predicate.relation}".`);
+            }
+            return nested.some((n) => evaluateAnchorPredicate(predicate.predicate, n));
+        }
+        case 'subject_in':
+            return row
+                .values(predicate.relation)
+                .some((v) => predicate.subjects.includes(v));
+        case 'condition': {
+            if (row.condition === undefined) {
+                throw new Error(`evaluateAnchorPredicate: the row cannot evaluate condition "${predicate.condition}".`);
+            }
+            return row.condition(predicate.condition, predicate.subject);
+        }
+        case 'and':
+            return predicate.args.every((a) => evaluateAnchorPredicate(a, row));
+        case 'or':
+            return predicate.args.some((a) => evaluateAnchorPredicate(a, row));
+        case 'not':
+            return !evaluateAnchorPredicate(predicate.arg, row);
+    }
+}
+//# sourceMappingURL=anchor-predicate.js.map

package/dist/anchor-predicate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor-predicate.js","sourceRoot":"","sources":["../src/anchor-predicate.ts"],"names":[],"mappings":";;;AAmJA,oDAoEC;AAeD,0DAuCC;AA7QD,6BAAwB;AAyDxB,MAAM,IAAI,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAElB,QAAA,yBAAyB,GAAmC,OAAC,CAAC,IAAI,CAC7E,GAAG,EAAE,CACH,OAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE;IACzB,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5C,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7C,OAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QACxB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;QAChB,GAAG,EAAE,OAAC,CAAC,KAAK,CAAC,IAAI,CAAC;KACnB,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QAC3B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,iCAAyB;KACrC,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QAC3B,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,IAAI,CAAC;KACxB,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC1B,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;KACd,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,iCAAyB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrF,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,iCAAyB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACpF,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,iCAAyB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC5E,CAA8C,CAClD,CAAC;AAGW,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,iCAAyB;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAwCZ,SAAgB,oBAAoB,CAClC,SAA8B,EAC9B,OAAyB,EACzB,eAAe,GAAG,CAAC;IAEnB,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,CAAC,KAAc,EAAU,EAAE;QAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,IAAI,eAAe,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CACb,KAAmD,EACnD,QAAgB,EAChB,EAAU,EACF,EAAE;QACV,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,iEAAiE,QAAQ,MAAM,EAAE,IAAI,CACtF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAsB,EAAE,CAAmB,EAAU,EAAE;QACrE,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;YACb,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC;YAChB,KAAK,OAAO;gBACV,OAAO,OAAO,CAAC;YACjB,KAAK,SAAS;gBACZ,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;oBACvB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YACrF,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,KAAK,CACb,qDAAqD,CAAC,CAAC,UAAU,iBAAiB,CACnF,CAAC;gBACJ,CAAC;gBACD,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YACnH,CAAC;YACD,KAAK,YAAY;gBACf,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAC5B,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC;YAC7F,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,eAAe,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACpD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CACb,+CAA+C,CAAC,CAAC,SAAS,kBAAkB,CAAC,CAAC,QAAQ,IAAI,CAC3F,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC;YACxD,CAAC;YACD,KAAK,KAAK;gBACR,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;oBACxB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAC3D,KAAK,IAAI;gBACP,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;oBACxB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAC1D,KAAK,KAAK;gBACR,OAAO,QAAQ,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC;AAeD,SAAgB,uBAAuB,CACrC,SAA8B,EAC9B,GAAmB;IAEnB,QAAQ,SAAS,CAAC,EAAE,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,OAAO;YACV,OAAO,KAAK,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,gEAAgE,SAAS,CAAC,QAAQ,IAAI,CACvF,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,YAAY;YACf,OAAO,GAAG;iBACP,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;iBAC1B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,+DAA+D,SAAS,CAAC,SAAS,IAAI,CACvF,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,KAAK;YACR,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACtE,KAAK,IAAI;YACP,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,KAAK,KAAK;YACR,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/authorization.module.d.ts

@@ -0,0 +1,6 @@
+import { type DynamicModule } from '@nestjs/common';
+import { type XemaAuthorizationOptions } from './authorization.options';
+export declare class XemaAuthorizationModule {
+    static forRoot(options?: Partial<XemaAuthorizationOptions>): DynamicModule;
+}
+//# sourceMappingURL=authorization.module.d.ts.map

package/dist/authorization.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.module.d.ts","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAqBjC,qBACa,uBAAuB;WACpB,OAAO,CACnB,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAC1C,aAAa;CAkBjB"}

package/dist/authorization.module.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var XemaAuthorizationModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaAuthorizationModule = void 0;
+const common_1 = require("@nestjs/common");
+const authorization_options_1 = require("./authorization.options");
+const authorize_decorator_1 = require("./authorize.decorator");
+const authzen_transport_1 = require("./authzen.transport");
+const policy_decisions_1 = require("./policy-decisions");
+const xema_authz_service_1 = require("./xema-authz.service");
+let XemaAuthorizationModule = XemaAuthorizationModule_1 = class XemaAuthorizationModule {
+    static forRoot(options) {
+        return {
+            module: XemaAuthorizationModule_1,
+            global: true,
+            providers: [
+                {
+                    provide: authorization_options_1.XEMA_AUTHORIZATION_OPTIONS,
+                    useValue: (0, authorization_options_1.resolveXemaAuthorizationOptions)(options),
+                },
+                authzen_transport_1.HttpAuthzenPdpTransport,
+                { provide: authzen_transport_1.AUTHZEN_PDP_TRANSPORT, useExisting: authzen_transport_1.HttpAuthzenPdpTransport },
+                xema_authz_service_1.XemaAuthz,
+                policy_decisions_1.XemaPolicyDecisions,
+                authorize_decorator_1.XemaAuthorizeGuard,
+            ],
+            exports: [xema_authz_service_1.XemaAuthz, policy_decisions_1.XemaPolicyDecisions, authorize_decorator_1.XemaAuthorizeGuard, authzen_transport_1.AUTHZEN_PDP_TRANSPORT],
+        };
+    }
+};
+exports.XemaAuthorizationModule = XemaAuthorizationModule;
+exports.XemaAuthorizationModule = XemaAuthorizationModule = XemaAuthorizationModule_1 = __decorate([
+    (0, common_1.Module)({})
+], XemaAuthorizationModule);
+//# sourceMappingURL=authorization.module.js.map

package/dist/authorization.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA4D;AAE5D,mEAIiC;AACjC,+DAA2D;AAC3D,2DAG6B;AAC7B,yDAAyD;AACzD,6DAAiD;AAe1C,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAC3B,MAAM,CAAC,OAAO,CACnB,OAA2C;QAE3C,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kDAA0B;oBACnC,QAAQ,EAAE,IAAA,uDAA+B,EAAC,OAAO,CAAC;iBACnD;gBACD,2CAAuB;gBACvB,EAAE,OAAO,EAAE,yCAAqB,EAAE,WAAW,EAAE,2CAAuB,EAAE;gBACxE,8BAAS;gBACT,sCAAmB;gBACnB,wCAAkB;aACnB;YACD,OAAO,EAAE,CAAC,8BAAS,EAAE,sCAAmB,EAAE,wCAAkB,EAAE,yCAAqB,CAAC;SACrF,CAAC;IACJ,CAAC;CACF,CAAA;AArBY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAqBnC"}

package/dist/authorization.options.d.ts

@@ -0,0 +1,7 @@
+export interface XemaAuthorizationOptions {
+    readonly requestTimeoutMs: number;
+}
+export declare const XEMA_AUTHORIZATION_OPTIONS: unique symbol;
+export declare const DEFAULT_XEMA_AUTHORIZATION_OPTIONS: XemaAuthorizationOptions;
+export declare function resolveXemaAuthorizationOptions(overrides: Partial<XemaAuthorizationOptions> | undefined): XemaAuthorizationOptions;
+//# sourceMappingURL=authorization.options.d.ts.map

package/dist/authorization.options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.options.d.ts","sourceRoot":"","sources":["../src/authorization.options.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,eAAO,MAAM,kCAAkC,EAAE,wBACJ,CAAC;AAE9C,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,SAAS,GACvD,wBAAwB,CAQ1B"}

package/dist/authorization.options.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_XEMA_AUTHORIZATION_OPTIONS = exports.XEMA_AUTHORIZATION_OPTIONS = void 0;
+exports.resolveXemaAuthorizationOptions = resolveXemaAuthorizationOptions;
+exports.XEMA_AUTHORIZATION_OPTIONS = Symbol('XEMA_AUTHORIZATION_OPTIONS');
+exports.DEFAULT_XEMA_AUTHORIZATION_OPTIONS = Object.freeze({ requestTimeoutMs: 10_000 });
+function resolveXemaAuthorizationOptions(overrides) {
+    const resolved = { ...exports.DEFAULT_XEMA_AUTHORIZATION_OPTIONS, ...overrides };
+    if (!Number.isSafeInteger(resolved.requestTimeoutMs) || resolved.requestTimeoutMs <= 0) {
+        throw new Error(`XemaAuthorizationModule: requestTimeoutMs must be a positive integer, got ${String(resolved.requestTimeoutMs)}.`);
+    }
+    return resolved;
+}
+//# sourceMappingURL=authorization.options.js.map

package/dist/authorization.options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.options.js","sourceRoot":"","sources":["../src/authorization.options.ts"],"names":[],"mappings":";;;AAeA,0EAUC;AAfY,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElE,QAAA,kCAAkC,GAC7C,MAAM,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;AAE9C,SAAgB,+BAA+B,CAC7C,SAAwD;IAExD,MAAM,QAAQ,GAAG,EAAE,GAAG,0CAAkC,EAAE,GAAG,SAAS,EAAE,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CACb,6EAA6E,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAClH,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/authorize.decorator.d.ts

@@ -0,0 +1,19 @@
+import { type CanActivate, type ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { XemaAuthz } from './xema-authz.service';
+export interface AuthorizeRouteSpec {
+    readonly type: string;
+    readonly idParam: string;
+    readonly view: string;
+    readonly action?: string;
+    readonly capability?: string;
+}
+export declare const AUTHORIZE_ROUTE_METADATA = "xema:authorize-route";
+export declare class XemaAuthorizeGuard implements CanActivate {
+    private readonly reflector;
+    private readonly authz;
+    constructor(reflector: Reflector, authz: XemaAuthz);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+export declare function Authorize(spec: AuthorizeRouteSpec): MethodDecorator & ClassDecorator;
+//# sourceMappingURL=authorize.decorator.d.ts.map

package/dist/authorize.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.decorator.d.ts","sourceRoot":"","sources":["../src/authorize.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAQ/D,qBACa,kBAAmB,YAAW,WAAW;IAElD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,SAAS;IAGtB,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA4BtE;AAYD,wBAAgB,SAAS,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,GAAG,cAAc,CAKpF"}

package/dist/authorize.decorator.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaAuthorizeGuard = exports.AUTHORIZE_ROUTE_METADATA = void 0;
+exports.Authorize = Authorize;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const platform_common_1 = require("@xemahq/platform-common");
+const xema_authz_service_1 = require("./xema-authz.service");
+exports.AUTHORIZE_ROUTE_METADATA = 'xema:authorize-route';
+let XemaAuthorizeGuard = class XemaAuthorizeGuard {
+    reflector;
+    authz;
+    constructor(reflector, authz) {
+        this.reflector = reflector;
+        this.authz = authz;
+    }
+    async canActivate(context) {
+        const spec = this.reflector.getAllAndOverride(exports.AUTHORIZE_ROUTE_METADATA, [context.getHandler(), context.getClass()]);
+        if (spec === undefined) {
+            throw new Error('XemaAuthorizeGuard is mounted on a route with no @Authorize spec.');
+        }
+        const request = context
+            .switchToHttp()
+            .getRequest();
+        const id = request.params?.[spec.idParam];
+        if (id === undefined || id === '') {
+            throw new Error(`@Authorize names route parameter "${spec.idParam}", which the route does not carry.`);
+        }
+        await this.authz.assert((0, platform_common_1.getRequestContext)(request), spec.view, spec.action ?? spec.view, { type: spec.type, id }, spec.capability === undefined ? {} : { capability: spec.capability });
+        return true;
+    }
+};
+exports.XemaAuthorizeGuard = XemaAuthorizeGuard;
+exports.XemaAuthorizeGuard = XemaAuthorizeGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        xema_authz_service_1.XemaAuthz])
+], XemaAuthorizeGuard);
+function Authorize(spec) {
+    return (0, common_1.applyDecorators)((0, common_1.SetMetadata)(exports.AUTHORIZE_ROUTE_METADATA, spec), (0, common_1.UseGuards)(XemaAuthorizeGuard));
+}
+//# sourceMappingURL=authorize.decorator.js.map

package/dist/authorize.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.decorator.js","sourceRoot":"","sources":["../src/authorize.decorator.ts"],"names":[],"mappings":";;;;;;;;;;;;AAkFA,8BAKC;AAvFD,2CAOwB;AACxB,uCAAyC;AACzC,6DAA4D;AAE5D,6DAAiD;AAgBpC,QAAA,wBAAwB,GAAG,sBAAsB,CAAC;AASxD,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAEV;IACA;IAFnB,YACmB,SAAoB,EACpB,KAAgB;QADhB,cAAS,GAAT,SAAS,CAAW;QACpB,UAAK,GAAL,KAAK,CAAW;IAChC,CAAC;IAEG,KAAK,CAAC,WAAW,CAAC,OAAyB;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC3C,gCAAwB,EACxB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,OAAO;aACpB,YAAY,EAAE;aACd,UAAU,EAAmD,CAAC;QACjE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,OAAO,oCAAoC,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CACrB,IAAA,mCAAiB,EAAC,OAAO,CAAC,EAC1B,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EACxB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EACvB,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CACrE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAlCY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAGmB,gBAAS;QACb,8BAAS;GAHxB,kBAAkB,CAkC9B;AAYD,SAAgB,SAAS,CAAC,IAAwB;IAChD,OAAO,IAAA,wBAAe,EACpB,IAAA,oBAAW,EAAC,gCAAwB,EAAE,IAAI,CAAC,EAC3C,IAAA,kBAAS,EAAC,kBAAkB,CAAC,CAC9B,CAAC;AACJ,CAAC"}

package/dist/authzen.transport.d.ts

@@ -0,0 +1,30 @@
+import { type AccessEvaluationRequest, type AccessEvaluationResponse, type AccessEvaluationsRequest, type AccessEvaluationsResponse, type ActionSearchRequest, type ActionSearchResponse, type ResourceSearchRequest, type ResourceSearchResponse, type SubjectSearchRequest, type SubjectSearchResponse } from '@xemahq/contracts/authzen';
+import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
+import { IdentityBootstrapService } from '@xemahq/identity-client';
+import { type XemaAuthorizationOptions } from './authorization.options';
+export interface AuthzenPdpTransport {
+    evaluation(orgId: string, request: AccessEvaluationRequest): Promise<AccessEvaluationResponse>;
+    evaluations(orgId: string, request: AccessEvaluationsRequest): Promise<AccessEvaluationsResponse>;
+    searchResource(orgId: string, request: ResourceSearchRequest): Promise<ResourceSearchResponse>;
+    searchSubject(orgId: string, request: SubjectSearchRequest): Promise<SubjectSearchResponse>;
+    searchAction(orgId: string, request: ActionSearchRequest): Promise<ActionSearchResponse>;
+}
+export declare const AUTHZEN_PDP_TRANSPORT: unique symbol;
+export declare class AuthzenPdpError extends Error {
+    readonly status: number;
+    readonly code: string | undefined;
+    constructor(message: string, status: number, code: string | undefined);
+}
+export declare class HttpAuthzenPdpTransport implements AuthzenPdpTransport {
+    private readonly registry;
+    private readonly identityBootstrap;
+    private readonly options;
+    constructor(registry: ServiceRegistry, identityBootstrap: IdentityBootstrapService, options: XemaAuthorizationOptions);
+    evaluation(orgId: string, request: AccessEvaluationRequest): Promise<AccessEvaluationResponse>;
+    evaluations(orgId: string, request: AccessEvaluationsRequest): Promise<AccessEvaluationsResponse>;
+    searchResource(orgId: string, request: ResourceSearchRequest): Promise<ResourceSearchResponse>;
+    searchSubject(orgId: string, request: SubjectSearchRequest): Promise<SubjectSearchResponse>;
+    searchAction(orgId: string, request: ActionSearchRequest): Promise<ActionSearchResponse>;
+    private post;
+}
+//# sourceMappingURL=authzen.transport.d.ts.map

package/dist/authzen.transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen.transport.d.ts","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAMnE,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAajC,MAAM,WAAW,mBAAmB;IAClC,UAAU,CACR,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,WAAW,CACT,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnC,aAAa,CACX,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,YAAY,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAGrE,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AAED,qBACa,uBAAwB,YAAW,mBAAmB;IAG/D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAG7C,UAAU,CACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,wBAAwB,CAAC;IAS7B,WAAW,CAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,yBAAyB,CAAC;IAS9B,cAAc,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IAS3B,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAS1B,YAAY,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC;YASlB,IAAI;CA0CnB"}