@xemahq/authorization-nest 0.3.0 → 0.5.0

package/dist/authorization.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.module.d.ts","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAqBjC,qBACa,uBAAuB;WACpB,OAAO,CACnB,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAC1C,aAAa;CAkBjB"}
+{"version":3,"file":"authorization.module.d.ts","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AA0BjC,qBACa,uBAAuB;WACpB,OAAO,CACnB,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAC1C,aAAa;CA+BjB"}

package/dist/authorization.module.js

@@ -12,7 +12,9 @@ const common_1 = require("@nestjs/common");
 const authorization_options_1 = require("./authorization.options");
 const authorize_decorator_1 = require("./authorize.decorator");
 const authzen_transport_1 = require("./authzen.transport");
+const grant_version_reader_1 = require("./grant-version.reader");
 const policy_decisions_1 = require("./policy-decisions");
+const route_action_evaluator_1 = require("./route-action-evaluator");
 const xema_authz_service_1 = require("./xema-authz.service");
 let XemaAuthorizationModule = XemaAuthorizationModule_1 = class XemaAuthorizationModule {
     static forRoot(options) {
@@ -28,9 +30,22 @@ let XemaAuthorizationModule = XemaAuthorizationModule_1 = class XemaAuthorizatio
                 { provide: authzen_transport_1.AUTHZEN_PDP_TRANSPORT, useExisting: authzen_transport_1.HttpAuthzenPdpTransport },
                 xema_authz_service_1.XemaAuthz,
                 policy_decisions_1.XemaPolicyDecisions,
+                grant_version_reader_1.HttpAuthorizationGrantVersionReader,
+                {
+                    provide: grant_version_reader_1.AUTHORIZATION_GRANT_VERSION_READER,
+                    useExisting: grant_version_reader_1.HttpAuthorizationGrantVersionReader,
+                },
+                route_action_evaluator_1.XemaRouteActionEvaluator,
+                authorize_decorator_1.XemaAuthorizeGuard,
+            ],
+            exports: [
+                xema_authz_service_1.XemaAuthz,
+                policy_decisions_1.XemaPolicyDecisions,
+                route_action_evaluator_1.XemaRouteActionEvaluator,
                 authorize_decorator_1.XemaAuthorizeGuard,
+                authzen_transport_1.AUTHZEN_PDP_TRANSPORT,
+                grant_version_reader_1.AUTHORIZATION_GRANT_VERSION_READER,
             ],
-            exports: [xema_authz_service_1.XemaAuthz, policy_decisions_1.XemaPolicyDecisions, authorize_decorator_1.XemaAuthorizeGuard, authzen_transport_1.AUTHZEN_PDP_TRANSPORT],
         };
     }
 };

package/dist/authorization.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA4D;AAE5D,mEAIiC;AACjC,+DAA2D;AAC3D,2DAG6B;AAC7B,yDAAyD;AACzD,6DAAiD;AAe1C,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAC3B,MAAM,CAAC,OAAO,CACnB,OAA2C;QAE3C,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kDAA0B;oBACnC,QAAQ,EAAE,IAAA,uDAA+B,EAAC,OAAO,CAAC;iBACnD;gBACD,2CAAuB;gBACvB,EAAE,OAAO,EAAE,yCAAqB,EAAE,WAAW,EAAE,2CAAuB,EAAE;gBACxE,8BAAS;gBACT,sCAAmB;gBACnB,wCAAkB;aACnB;YACD,OAAO,EAAE,CAAC,8BAAS,EAAE,sCAAmB,EAAE,wCAAkB,EAAE,yCAAqB,CAAC;SACrF,CAAC;IACJ,CAAC;CACF,CAAA;AArBY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAqBnC"}
+{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA4D;AAE5D,mEAIiC;AACjC,+DAA2D;AAC3D,2DAG6B;AAC7B,iEAGgC;AAChC,yDAAyD;AACzD,qEAAoE;AACpE,6DAAiD;AAe1C,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAC3B,MAAM,CAAC,OAAO,CACnB,OAA2C;QAE3C,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kDAA0B;oBACnC,QAAQ,EAAE,IAAA,uDAA+B,EAAC,OAAO,CAAC;iBACnD;gBACD,2CAAuB;gBACvB,EAAE,OAAO,EAAE,yCAAqB,EAAE,WAAW,EAAE,2CAAuB,EAAE;gBACxE,8BAAS;gBACT,sCAAmB;gBACnB,0DAAmC;gBACnC;oBACE,OAAO,EAAE,yDAAkC;oBAC3C,WAAW,EAAE,0DAAmC;iBACjD;gBACD,iDAAwB;gBACxB,wCAAkB;aACnB;YACD,OAAO,EAAE;gBACP,8BAAS;gBACT,sCAAmB;gBACnB,iDAAwB;gBACxB,wCAAkB;gBAClB,yCAAqB;gBACrB,yDAAkC;aACnC;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAlCY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAkCnC"}

package/dist/authzen.transport.d.ts

@@ -1,10 +1,17 @@
 import { type AccessEvaluationRequest, type AccessEvaluationResponse, type AccessEvaluationsRequest, type AccessEvaluationsResponse, type ActionSearchRequest, type ActionSearchResponse, type ResourceSearchRequest, type ResourceSearchResponse, type SubjectSearchRequest, type SubjectSearchResponse } from '@xemahq/contracts/authzen';
 import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
 import { IdentityBootstrapService } from '@xemahq/identity-client';
+import { type ForwardedCallerContext } from '@xemahq/platform-common';
 import { type XemaAuthorizationOptions } from './authorization.options';
+export declare const AUTHZEN_POLICY_MODEL_HEADER = "X-Xema-Policy-Model";
+export interface AuthzenPdpCallOptions {
+    readonly forwardedCaller?: ForwardedCallerContext;
+    readonly signal?: AbortSignal;
+    readonly onPolicyModel?: (policyModel: string | undefined) => void;
+}
 export interface AuthzenPdpTransport {
     evaluation(orgId: string | null, request: AccessEvaluationRequest): Promise<AccessEvaluationResponse>;
-    evaluations(orgId: string, request: AccessEvaluationsRequest): Promise<AccessEvaluationsResponse>;
+    evaluations(orgId: string, request: AccessEvaluationsRequest, options?: AuthzenPdpCallOptions): Promise<AccessEvaluationsResponse>;
     searchResource(orgId: string, request: ResourceSearchRequest): Promise<ResourceSearchResponse>;
     searchSubject(orgId: string, request: SubjectSearchRequest): Promise<SubjectSearchResponse>;
     searchAction(orgId: string, request: ActionSearchRequest): Promise<ActionSearchResponse>;
@@ -21,7 +28,7 @@ export declare class HttpAuthzenPdpTransport implements AuthzenPdpTransport {
     private readonly options;
     constructor(registry: ServiceRegistry, identityBootstrap: IdentityBootstrapService, options: XemaAuthorizationOptions);
     evaluation(orgId: string | null, request: AccessEvaluationRequest): Promise<AccessEvaluationResponse>;
-    evaluations(orgId: string, request: AccessEvaluationsRequest): Promise<AccessEvaluationsResponse>;
+    evaluations(orgId: string, request: AccessEvaluationsRequest, options?: AuthzenPdpCallOptions): Promise<AccessEvaluationsResponse>;
     searchResource(orgId: string, request: ResourceSearchRequest): Promise<ResourceSearchResponse>;
     searchSubject(orgId: string, request: SubjectSearchRequest): Promise<SubjectSearchResponse>;
     searchAction(orgId: string, request: ActionSearchRequest): Promise<ActionSearchResponse>;

package/dist/authzen.transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authzen.transport.d.ts","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAMnE,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAajC,MAAM,WAAW,mBAAmB;IAClC,UAAU,CACR,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,WAAW,CACT,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnC,aAAa,CACX,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,YAAY,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAGrE,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AAED,qBACa,uBAAwB,YAAW,mBAAmB;IAG/D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAG7C,UAAU,CACf,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,wBAAwB,CAAC;IAS7B,WAAW,CAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,yBAAyB,CAAC;IAS9B,cAAc,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IAS3B,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAS1B,YAAY,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC;YASlB,IAAI;CA2CnB"}
+{"version":3,"file":"authzen.transport.d.ts","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAoBjC,eAAO,MAAM,2BAA2B,wBAAwB,CAAC;AAGjE,MAAM,WAAW,qBAAqB;IAQpC,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IAElD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAK9B,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;CACpE;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,CACR,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,WAAW,CACT,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnC,aAAa,CACX,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,YAAY,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAGrE,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AAED,qBACa,uBAAwB,YAAW,mBAAmB;IAG/D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAG7C,UAAU,CACf,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,wBAAwB,CAAC;IAS7B,WAAW,CAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,yBAAyB,CAAC;IAU9B,cAAc,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IAS3B,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAS1B,YAAY,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC;YASlB,IAAI;CAqDnB"}

package/dist/authzen.transport.js

@@ -12,13 +12,15 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HttpAuthzenPdpTransport = exports.AuthzenPdpError = exports.AUTHZEN_PDP_TRANSPORT = void 0;
+exports.HttpAuthzenPdpTransport = exports.AuthzenPdpError = exports.AUTHZEN_PDP_TRANSPORT = exports.AUTHZEN_POLICY_MODEL_HEADER = void 0;
 const common_1 = require("@nestjs/common");
 const authzen_1 = require("@xemahq/contracts/authzen");
 const service_registry_1 = require("@xemahq/contracts/service-registry");
 const identity_client_1 = require("@xemahq/identity-client");
+const platform_common_1 = require("@xemahq/platform-common");
 const service_registry_nest_1 = require("@xemahq/service-registry-nest");
 const authorization_options_1 = require("./authorization.options");
+exports.AUTHZEN_POLICY_MODEL_HEADER = 'X-Xema-Policy-Model';
 exports.AUTHZEN_PDP_TRANSPORT = Symbol('AUTHZEN_PDP_TRANSPORT');
 class AuthzenPdpError extends Error {
     status;
@@ -43,8 +45,8 @@ let HttpAuthzenPdpTransport = class HttpAuthzenPdpTransport {
     evaluation(orgId, request) {
         return this.post(orgId, authzen_1.AuthzenEndpointPath.Evaluation, request, authzen_1.AccessEvaluationResponseSchema);
     }
-    evaluations(orgId, request) {
-        return this.post(orgId, authzen_1.AuthzenEndpointPath.Evaluations, request, authzen_1.AccessEvaluationsResponseSchema);
+    evaluations(orgId, request, options) {
+        return this.post(orgId, authzen_1.AuthzenEndpointPath.Evaluations, request, authzen_1.AccessEvaluationsResponseSchema, options);
     }
     searchResource(orgId, request) {
         return this.post(orgId, authzen_1.AuthzenEndpointPath.SearchResource, request, authzen_1.ResourceSearchResponseSchema);
@@ -55,21 +57,27 @@ let HttpAuthzenPdpTransport = class HttpAuthzenPdpTransport {
     searchAction(orgId, request) {
         return this.post(orgId, authzen_1.AuthzenEndpointPath.SearchAction, request, authzen_1.ActionSearchResponseSchema);
     }
-    async post(orgId, path, body, schema) {
+    async post(orgId, path, body, schema, options = {}) {
         const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
-        const token = await this.identityBootstrap.getAccessToken();
+        const authorization = options.forwardedCaller === undefined
+            ? { Authorization: `Bearer ${await this.identityBootstrap.getAccessToken()}` }
+            : await (0, platform_common_1.forwardedCallerHeaders)(options.forwardedCaller, this.identityBootstrap);
+        const timeout = AbortSignal.timeout(this.options.requestTimeoutMs);
         const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, {
             method: 'POST',
             headers: {
-                Authorization: `Bearer ${token}`,
+                ...authorization,
                 'Content-Type': 'application/json',
                 ...(orgId === null ? {} : { 'X-Xema-Org-Id': orgId }),
             },
             body: JSON.stringify(body),
-            signal: AbortSignal.timeout(this.options.requestTimeoutMs),
+            signal: options.signal === undefined ? timeout : AbortSignal.any([options.signal, timeout]),
         });
         const text = await response.text();
         const parsed = parseJson(text);
+        if (response.ok) {
+            options.onPolicyModel?.(response.headers.get(exports.AUTHZEN_POLICY_MODEL_HEADER) ?? undefined);
+        }
         if (!response.ok) {
             throw new AuthzenPdpError(`authorization-api POST ${path} failed with HTTP ${response.status}: ${text.slice(0, 2000)}`, response.status, errorCode(parsed));
         }

package/dist/authzen.transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"authzen.transport.js","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,uDAiBmC;AACnC,yEAG4C;AAC5C,6DAAmE;AACnE,yEAGuC;AAEvC,mEAGiC;AAoCpB,QAAA,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAGrE,MAAa,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC;IACnC,CAAC;CACF;AATD,0CASC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAGf;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,UAAU,CACf,KAAoB,EACpB,OAAgC;QAEhC,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,UAAU,EAC9B,OAAO,EACP,wCAA8B,CAC/B,CAAC;IACJ,CAAC;IAEM,WAAW,CAChB,KAAa,EACb,OAAiC;QAEjC,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,WAAW,EAC/B,OAAO,EACP,yCAA+B,CAChC,CAAC;IACJ,CAAC;IAEM,cAAc,CACnB,KAAa,EACb,OAA8B;QAE9B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,cAAc,EAClC,OAAO,EACP,sCAA4B,CAC7B,CAAC;IACJ,CAAC;IAEM,aAAa,CAClB,KAAa,EACb,OAA6B;QAE7B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,aAAa,EACjC,OAAO,EACP,qCAA2B,CAC5B,CAAC;IACJ,CAAC;IAEM,YAAY,CACjB,KAAa,EACb,OAA4B;QAE5B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,YAAY,EAChC,OAAO,EACP,oCAA0B,CAC3B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,KAAoB,EACpB,IAAyB,EACzB,IAAY,EACZ,MAAS;QAET,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;gBAElC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;aACtD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC3D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC5F,QAAQ,CAAC,MAAM,EACf,SAAS,CAAC,MAAM,CAAC,CAClB,CAAC;QACJ,CAAC;QAGD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,mDAAmD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACvG,GAAG,EACH,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF,CAAA;AAhHY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GAJnD,uBAAuB,CAgHnC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACzB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"authzen.transport.js","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,uDAiBmC;AACnC,yEAG4C;AAC5C,6DAAmE;AACnE,6DAGiC;AACjC,yEAGuC;AAEvC,mEAGiC;AAoBpB,QAAA,2BAA2B,GAAG,qBAAqB,CAAC;AA6CpD,QAAA,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAGrE,MAAa,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC;IACnC,CAAC;CACF;AATD,0CASC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAGf;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,UAAU,CACf,KAAoB,EACpB,OAAgC;QAEhC,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,UAAU,EAC9B,OAAO,EACP,wCAA8B,CAC/B,CAAC;IACJ,CAAC;IAEM,WAAW,CAChB,KAAa,EACb,OAAiC,EACjC,OAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,WAAW,EAC/B,OAAO,EACP,yCAA+B,EAC/B,OAAO,CACR,CAAC;IACJ,CAAC;IAEM,cAAc,CACnB,KAAa,EACb,OAA8B;QAE9B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,cAAc,EAClC,OAAO,EACP,sCAA4B,CAC7B,CAAC;IACJ,CAAC;IAEM,aAAa,CAClB,KAAa,EACb,OAA6B;QAE7B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,aAAa,EACjC,OAAO,EACP,qCAA2B,CAC5B,CAAC;IACJ,CAAC;IAEM,YAAY,CACjB,KAAa,EACb,OAA4B;QAE5B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,YAAY,EAChC,OAAO,EACP,oCAA0B,CAC3B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,KAAoB,EACpB,IAAyB,EACzB,IAAY,EACZ,MAAS,EACT,UAAiC,EAAE;QAEnC,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QAGF,MAAM,aAAa,GACjB,OAAO,CAAC,eAAe,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE,EAAE;YAC9E,CAAC,CAAC,MAAM,IAAA,wCAAsB,EAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,aAAa;gBAChB,cAAc,EAAE,kBAAkB;gBAElC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;aACtD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAC5F,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mCAA2B,CAAC,IAAI,SAAS,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC5F,QAAQ,CAAC,MAAM,EACf,SAAS,CAAC,MAAM,CAAC,CAClB,CAAC;QACJ,CAAC;QAGD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,mDAAmD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACvG,GAAG,EACH,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF,CAAA;AA5HY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GAJnD,uBAAuB,CA4HnC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACzB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/grant-version.reader.d.ts

@@ -0,0 +1,19 @@
+import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
+import { IdentityBootstrapService } from '@xemahq/identity-client';
+import { type XemaAuthorizationOptions } from './authorization.options';
+export interface AuthorizationGrantVersionReader {
+    read(orgId: string): Promise<number>;
+}
+export declare const AUTHORIZATION_GRANT_VERSION_READER: unique symbol;
+export declare class HttpAuthorizationGrantVersionReader implements AuthorizationGrantVersionReader {
+    private readonly registry;
+    private readonly identityBootstrap;
+    private readonly options;
+    constructor(registry: ServiceRegistry, identityBootstrap: IdentityBootstrapService, options: XemaAuthorizationOptions);
+    read(orgId: string): Promise<number>;
+}
+export declare function assertGrantVersion(orgId: string, body: {
+    readonly orgId?: unknown;
+    readonly grantVersion?: unknown;
+}): number;
+//# sourceMappingURL=grant-version.reader.d.ts.map

package/dist/grant-version.reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-version.reader.d.ts","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAOnE,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAUjC,MAAM,WAAW,+BAA+B;IAC9C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,eAAO,MAAM,kCAAkC,eAE9C,CAAC;AAKF,qBACa,mCACX,YAAW,+BAA+B;IAIxC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAGvC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CA4BlD;AAGD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAClE,MAAM,CAaR"}

package/dist/grant-version.reader.js

@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpAuthorizationGrantVersionReader = exports.AUTHORIZATION_GRANT_VERSION_READER = void 0;
+exports.assertGrantVersion = assertGrantVersion;
+const common_1 = require("@nestjs/common");
+const service_registry_1 = require("@xemahq/contracts/service-registry");
+const identity_client_1 = require("@xemahq/identity-client");
+const platform_common_1 = require("@xemahq/platform-common");
+const service_registry_nest_1 = require("@xemahq/service-registry-nest");
+const authorization_options_1 = require("./authorization.options");
+const authzen_transport_1 = require("./authzen.transport");
+exports.AUTHORIZATION_GRANT_VERSION_READER = Symbol('AUTHORIZATION_GRANT_VERSION_READER');
+const GRANT_VERSION_PATH = '/authorization/grant-version/';
+let HttpAuthorizationGrantVersionReader = class HttpAuthorizationGrantVersionReader {
+    registry;
+    identityBootstrap;
+    options;
+    constructor(registry, identityBootstrap, options) {
+        this.registry = registry;
+        this.identityBootstrap = identityBootstrap;
+        this.options = options;
+    }
+    async read(orgId) {
+        const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
+        const path = `${GRANT_VERSION_PATH}${encodeURIComponent(orgId)}`;
+        const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, {
+            method: 'GET',
+            headers: {
+                Authorization: `Bearer ${await this.identityBootstrap.getAccessToken()}`,
+                'X-Xema-Org-Id': orgId,
+            },
+            signal: AbortSignal.timeout(this.options.requestTimeoutMs),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            throw new authzen_transport_1.AuthzenPdpError(`authorization-api GET ${path} failed with HTTP ${response.status}: ${text.slice(0, 2000)}`, response.status, undefined);
+        }
+        const body = (0, platform_common_1.unwrapPlatformResponseEnvelope)(await response.json(), `authorization-api GET ${path}`);
+        return assertGrantVersion(orgId, body);
+    }
+};
+exports.HttpAuthorizationGrantVersionReader = HttpAuthorizationGrantVersionReader;
+exports.HttpAuthorizationGrantVersionReader = HttpAuthorizationGrantVersionReader = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(service_registry_nest_1.SERVICE_REGISTRY_TOKEN)),
+    __param(2, (0, common_1.Inject)(authorization_options_1.XEMA_AUTHORIZATION_OPTIONS)),
+    __metadata("design:paramtypes", [Object, identity_client_1.IdentityBootstrapService, Object])
+], HttpAuthorizationGrantVersionReader);
+function assertGrantVersion(orgId, body) {
+    const version = body.grantVersion;
+    if (body.orgId !== orgId ||
+        typeof version !== 'number' ||
+        !Number.isSafeInteger(version) ||
+        version < 0) {
+        throw new Error(`authorization-api returned a malformed policy revision for org "${orgId}".`);
+    }
+    return version;
+}
+//# sourceMappingURL=grant-version.reader.js.map

package/dist/grant-version.reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-version.reader.js","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AA+EA,gDAgBC;AA/FD,2CAAoD;AACpD,yEAG4C;AAC5C,6DAAmE;AACnE,6DAAyE;AACzE,yEAGuC;AAEvC,mEAGiC;AACjC,2DAAsD;AAazC,QAAA,kCAAkC,GAAG,MAAM,CACtD,oCAAoC,CACrC,CAAC;AAGF,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAGpD,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAK3B;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,KAAK,CAAC,IAAI,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE;gBACxE,eAAe,EAAE,KAAK;aACvB;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC3D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAe,CACvB,yBAAyB,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC3F,QAAQ,CAAC,MAAM,EACf,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,gDAA8B,EAGxC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAvCY,kFAAmC;8CAAnC,mCAAmC;IAD/C,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GANnD,mCAAmC,CAuC/C;AAGD,SAAgB,kBAAkB,CAChC,KAAa,EACb,IAAmE;IAEnE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IACE,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC,EACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE,KAAK,IAAI,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -6,6 +6,9 @@ export * from './authzen.transport';
 export * from './subject-from-context';
 export * from './xema-authz.service';
 export * from './policy-decisions';
+export * from './grant-version.reader';
+export * from './route-action-evaluator';
 export * from './internal-caller-or-member-context.guard';
 export * from './organization-delegation-admission';
+export * from './relayable-caller';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -22,6 +22,9 @@ __exportStar(require("./authzen.transport"), exports);
 __exportStar(require("./subject-from-context"), exports);
 __exportStar(require("./xema-authz.service"), exports);
 __exportStar(require("./policy-decisions"), exports);
+__exportStar(require("./grant-version.reader"), exports);
+__exportStar(require("./route-action-evaluator"), exports);
 __exportStar(require("./internal-caller-or-member-context.guard"), exports);
 __exportStar(require("./organization-delegation-admission"), exports);
+__exportStar(require("./relayable-caller"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,4EAA0D;AAC1D,sEAAoD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,yDAAuC;AACvC,2DAAyC;AACzC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC"}

package/dist/policy-decisions.d.ts

@@ -1,6 +1,6 @@
 import { type AccessEvaluationRequest, type AuthzenDecision } from '@xemahq/contracts/authzen';
 import { type PolicyDecision, type PolicyRequest } from '@xemahq/contracts/policy';
-import { type AuthzenPdpTransport } from './authzen.transport';
+import { type AuthzenPdpCallOptions, type AuthzenPdpTransport } from './authzen.transport';
 export declare const POLICY_DECISIONS_CHUNK = 128;
 export declare class PolicyDecisionRequestError extends Error {
     readonly status: number;
@@ -16,7 +16,7 @@ export declare function policyDecisionOfAuthzen(decision: AuthzenDecision): Poli
 export declare class XemaPolicyDecisions {
     private readonly transport;
     constructor(transport: AuthzenPdpTransport);
-    decide(request: PolicyRequest): Promise<PolicyDecision>;
-    decideAll(requests: readonly PolicyRequest[]): Promise<PolicyDecision[]>;
+    decide(request: PolicyRequest, options?: AuthzenPdpCallOptions): Promise<PolicyDecision>;
+    decideAll(requests: readonly PolicyRequest[], options?: AuthzenPdpCallOptions): Promise<PolicyDecision[]>;
 }
 //# sourceMappingURL=policy-decisions.d.ts.map

package/dist/policy-decisions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-decisions.d.ts","sourceRoot":"","sources":["../src/policy-decisions.ts"],"names":[],"mappings":"AAMA,OAAO,EAML,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EAErB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAM7B,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAO1C,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAGD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/D;AAyCD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,aAAa,GAAG;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;CAC9C,CAiDA;AAiBD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,cAAc,CAuBjF;AAUD,qBACa,mBAAmB;IAEG,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,mBAAmB;IAGnE,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAKvD,SAAS,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;CA+BtF"}
+{"version":3,"file":"policy-decisions.d.ts","sourceRoot":"","sources":["../src/policy-decisions.ts"],"names":[],"mappings":"AAMA,OAAO,EAML,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EAErB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAM7B,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAO1C,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAGD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/D;AA8CD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,aAAa,GAAG;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;CAC9C,CAiDA;AAiBD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,cAAc,CAuBjF;AAUD,qBACa,mBAAmB;IAEG,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,mBAAmB;IAGnE,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,cAAc,CAAC;IAWb,SAAS,CACpB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,cAAc,EAAE,CAAC;CAmC7B"}

package/dist/policy-decisions.js

@@ -48,6 +48,9 @@ function invocationOfPolicyRequest(request, instance) {
         ...(request.actingAgent === undefined ? {} : { actingAgent: request.actingAgent }),
         ...(request.aperture === undefined ? {} : { aperture: request.aperture }),
         ...(request.constraints === undefined ? {} : { constraints: request.constraints }),
+        ...(request.capability.operationInstance === undefined
+            ? {}
+            : { operationInstance: request.capability.operationInstance }),
         ...(instance && request.resource?.classification !== undefined
             ? { resourceClassification: request.resource.classification }
             : {}),
@@ -122,11 +125,11 @@ let XemaPolicyDecisions = class XemaPolicyDecisions {
     constructor(transport) {
         this.transport = transport;
     }
-    async decide(request) {
-        const [decision] = await this.decideAll([request]);
+    async decide(request, options) {
+        const [decision] = await this.decideAll([request], options);
         return decision;
     }
-    async decideAll(requests) {
+    async decideAll(requests, options) {
         const out = new Array(requests.length);
         const byOrg = new Map();
         requests.forEach((request, index) => {
@@ -141,7 +144,7 @@ let XemaPolicyDecisions = class XemaPolicyDecisions {
                 const response = await this.transport.evaluations(orgId, {
                     evaluations: chunk.map((c) => ({ ...c.evaluation })),
                     options: { evaluations_semantic: authzen_1.AuthzenEvaluationsSemantic.ExecuteAll },
-                });
+                }, options);
                 const decisions = response.evaluations;
                 if (decisions === undefined || decisions.length !== chunk.length) {
                     throw new authzen_transport_1.AuthzenPdpError(`authorization-api answered ${decisions?.length ?? 0} of ${chunk.length} evaluations under execute_all.`, 502, undefined);

package/dist/policy-decisions.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-decisions.js","sourceRoot":"","sources":["../src/policy-decisions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAsDA,gEAIC;AAyCD,0EAoDC;AAiBD,0DAuBC;AA/LD,2CAAoD;AACpD,iFAIgD;AAChD,uDASmC;AACnC,qDAKkC;AAClC,yDAA8D;AAC9D,6BAAwB;AAExB,2DAI6B;AAMhB,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAO1C,MAAa,0BAA2B,SAAQ,KAAK;IAEjC;IACA;IAFlB,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAI5B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC;IAC9C,CAAC;CACF;AATD,gEASC;AAGD,SAAgB,0BAA0B,CAAC,IAAY;IACrD,OAAO,IAAA,mDAA4B,EAAC,IAAI,CAAC,KAAK,IAAI;QAChD,CAAC,CAAC,GAAG,8CAAuB,IAAI,IAAI,EAAE;QACtC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AASD,SAAS,yBAAyB,CAChC,OAAsB,EACtB,QAAiB;IAEjB,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,cAAc,KAAK,SAAS;YAC5D,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAiBD,SAAgB,+BAA+B,CAAC,OAAsB;IAIpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,kBAAkB,OAAO,CAAC,EAAE,0DAA0D,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;IAC9F,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO;YACL,KAAK;YACL,UAAU,EAAE;gBACV,OAAO;gBACP,MAAM,EAAE,EAAE,IAAI,EAAE,uCAA6B,EAAE;gBAC/C,QAAQ,EAAE;oBACR,IAAI,EAAE,uCAA6B;oBACnC,EAAE,EAAE,IAAA,8BAAoB,EAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;iBAClF;gBACD,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;aACzF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,2BAAgB,EAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAClC,GAAG,EACH,wBAAwB,EACxB,kBAAkB,OAAO,CAAC,EAAE,2DAA2D,MAAM,CAAC,KAAK,CAAC,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC3B,OAAO;QACL,KAAK;QACL,UAAU,EAAE;YACV,OAAO;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,yCAAkB,EAAE;YACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,0BAA0B,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAA,2BAAiB,EAAC,KAAK,EAAE,EAAE,CAAC,EAAE;YACtF,OAAO,EAAE;gBACP,KAAK;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;gBACrC,GAAG,UAAU;gBACb,UAAU,EAAE,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC;aACrD;SACF;KACF,CAAC;AACJ,CAAC;AAQD,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iCAAwB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAStF,SAAgB,uBAAuB,CAAC,QAAyB;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAqE,CAAC;IACnG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,0BAA0B,CAClC,KAAK,CAAC,MAAM,IAAI,GAAG,EACnB,KAAK,CAAC,IAAI,IAAI,oBAAoB,EAClC,KAAK,CAAC,OAAO,IAAI,sCAAsC,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAGhE,OAAO,QAAQ,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,2BAAkB,CAAC,KAAK;YAClE,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,EAAE,IAAI,EAAE,2BAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,2BAAkB,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,2BAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC/F,CAAC;AAWM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEoB;IADlD,YACkD,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAC7E,CAAC;IAEG,KAAK,CAAC,MAAM,CAAC,OAAsB;QACxC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,OAAO,QAA0B,CAAC;IACpC,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,QAAkC;QACvD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoE,CAAC;QAC1F,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAClC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,8BAAsB,EAAE,CAAC;gBAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,8BAAsB,CAAC,CAAC;gBACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE;oBACvD,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;oBACpD,OAAO,EAAE,EAAE,oBAAoB,EAAE,oCAA0B,CAAC,UAAU,EAAE;iBACzE,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC;gBACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjE,MAAM,IAAI,mCAAe,CACvB,8BAA8B,SAAS,EAAE,MAAM,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,iCAAiC,EACxG,GAAG,EACH,SAAS,CACV,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;oBACrB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAoB,CAAC,CAAC;gBAC1E,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AAzCY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,yCAAqB,CAAC,CAAA;;GAFrB,mBAAmB,CAyC/B"}
+{"version":3,"file":"policy-decisions.js","sourceRoot":"","sources":["../src/policy-decisions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAuDA,gEAIC;AA8CD,0EAoDC;AAiBD,0DAuBC;AArMD,2CAAoD;AACpD,iFAIgD;AAChD,uDASmC;AACnC,qDAKkC;AAClC,yDAA8D;AAC9D,6BAAwB;AAExB,2DAK6B;AAMhB,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAO1C,MAAa,0BAA2B,SAAQ,KAAK;IAEjC;IACA;IAFlB,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAI5B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC;IAC9C,CAAC;CACF;AATD,gEASC;AAGD,SAAgB,0BAA0B,CAAC,IAAY;IACrD,OAAO,IAAA,mDAA4B,EAAC,IAAI,CAAC,KAAK,IAAI;QAChD,CAAC,CAAC,GAAG,8CAAuB,IAAI,IAAI,EAAE;QACtC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AASD,SAAS,yBAAyB,CAChC,OAAsB,EACtB,QAAiB;IAEjB,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAGlF,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,KAAK,SAAS;YACpD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;QAChE,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,cAAc,KAAK,SAAS;YAC5D,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAiBD,SAAgB,+BAA+B,CAAC,OAAsB;IAIpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,kBAAkB,OAAO,CAAC,EAAE,0DAA0D,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;IAC9F,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO;YACL,KAAK;YACL,UAAU,EAAE;gBACV,OAAO;gBACP,MAAM,EAAE,EAAE,IAAI,EAAE,uCAA6B,EAAE;gBAC/C,QAAQ,EAAE;oBACR,IAAI,EAAE,uCAA6B;oBACnC,EAAE,EAAE,IAAA,8BAAoB,EAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;iBAClF;gBACD,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;aACzF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,2BAAgB,EAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAClC,GAAG,EACH,wBAAwB,EACxB,kBAAkB,OAAO,CAAC,EAAE,2DAA2D,MAAM,CAAC,KAAK,CAAC,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC3B,OAAO;QACL,KAAK;QACL,UAAU,EAAE;YACV,OAAO;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,yCAAkB,EAAE;YACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,0BAA0B,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAA,2BAAiB,EAAC,KAAK,EAAE,EAAE,CAAC,EAAE;YACtF,OAAO,EAAE;gBACP,KAAK;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;gBACrC,GAAG,UAAU;gBACb,UAAU,EAAE,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC;aACrD;SACF;KACF,CAAC;AACJ,CAAC;AAQD,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iCAAwB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAStF,SAAgB,uBAAuB,CAAC,QAAyB;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAqE,CAAC;IACnG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,0BAA0B,CAClC,KAAK,CAAC,MAAM,IAAI,GAAG,EACnB,KAAK,CAAC,IAAI,IAAI,oBAAoB,EAClC,KAAK,CAAC,OAAO,IAAI,sCAAsC,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAGhE,OAAO,QAAQ,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,2BAAkB,CAAC,KAAK;YAClE,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,EAAE,IAAI,EAAE,2BAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,2BAAkB,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,2BAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC/F,CAAC;AAWM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEoB;IADlD,YACkD,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAC7E,CAAC;IAEG,KAAK,CAAC,MAAM,CACjB,OAAsB,EACtB,OAA+B;QAE/B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,QAA0B,CAAC;IACpC,CAAC;IAQM,KAAK,CAAC,SAAS,CACpB,QAAkC,EAClC,OAA+B;QAE/B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoE,CAAC;QAC1F,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAClC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,8BAAsB,EAAE,CAAC;gBAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,8BAAsB,CAAC,CAAC;gBACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAC/C,KAAK,EACL;oBACE,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;oBACpD,OAAO,EAAE,EAAE,oBAAoB,EAAE,oCAA0B,CAAC,UAAU,EAAE;iBACzE,EACD,OAAO,CACR,CAAC;gBACF,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC;gBACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjE,MAAM,IAAI,mCAAe,CACvB,8BAA8B,SAAS,EAAE,MAAM,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,iCAAiC,EACxG,GAAG,EACH,SAAS,CACV,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;oBACrB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAoB,CAAC,CAAC;gBAC1E,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AAzDY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,yCAAqB,CAAC,CAAA;;GAFrB,mBAAmB,CAyD/B"}

package/dist/relayable-caller.d.ts

@@ -0,0 +1,3 @@
+import { type ForwardedCallerContext, type RequestContext } from '@xemahq/platform-common';
+export declare function relayableCallerContext(ctx: RequestContext, orgId: string | undefined): ForwardedCallerContext | undefined;
+//# sourceMappingURL=relayable-caller.d.ts.map

package/dist/relayable-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relayable-caller.d.ts","sourceRoot":"","sources":["../src/relayable-caller.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AAajC,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,sBAAsB,GAAG,SAAS,CAOpC"}

package/dist/relayable-caller.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.relayableCallerContext = relayableCallerContext;
+const platform_common_1 = require("@xemahq/platform-common");
+function relayableCallerContext(ctx, orgId) {
+    return ctx.orgAuthority !== undefined &&
+        orgId !== undefined &&
+        (0, platform_common_1.isOrgAuthorityProven)(ctx.orgAuthority) &&
+        ctx.orgAuthority.assertedOrgId === orgId
+        ? (0, platform_common_1.forwardCallerContext)(ctx)
+        : undefined;
+}
+//# sourceMappingURL=relayable-caller.js.map

package/dist/relayable-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relayable-caller.js","sourceRoot":"","sources":["../src/relayable-caller.ts"],"names":[],"mappings":";;AAkBA,wDAUC;AA5BD,6DAKiC;AAajC,SAAgB,sBAAsB,CACpC,GAAmB,EACnB,KAAyB;IAEzB,OAAO,GAAG,CAAC,YAAY,KAAK,SAAS;QACnC,KAAK,KAAK,SAAS;QACnB,IAAA,sCAAoB,EAAC,GAAG,CAAC,YAAY,CAAC;QACtC,GAAG,CAAC,YAAY,CAAC,aAAa,KAAK,KAAK;QACxC,CAAC,CAAC,IAAA,sCAAoB,EAAC,GAAG,CAAC;QAC3B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/route-action-evaluator.d.ts

@@ -0,0 +1,38 @@
+import { type CapabilityRef } from '@xemahq/contracts/capability';
+import { type AuthorizationGrantVersionReader } from './grant-version.reader';
+import { XemaPolicyDecisions } from './policy-decisions';
+import type { RequestContext } from '@xemahq/platform-common';
+export interface RouteActionCandidate<Action extends string> {
+    readonly key: string;
+    readonly action: Action;
+    readonly capabilityRef: CapabilityRef;
+}
+export type RouteActionScope = {
+    readonly kind: 'org';
+    readonly orgId: string;
+} | {
+    readonly kind: 'project';
+    readonly orgId: string;
+    readonly projectId: string;
+} | {
+    readonly kind: 'platform';
+    readonly orgId: string;
+};
+export interface RouteActionEvaluation<Action extends string> {
+    readonly allowed: ReadonlyMap<string, Action>;
+    readonly policyRevision: number;
+}
+export declare enum RouteActionPolicyErrorCode {
+    CrossOrg = "ROUTE_ACTION_POLICY_CROSS_ORG",
+    CrossProject = "ROUTE_ACTION_POLICY_CROSS_PROJECT",
+    Stale = "ROUTE_ACTION_POLICY_STALE",
+    RequestRejected = "ROUTE_ACTION_POLICY_REQUEST_REJECTED",
+    Unavailable = "ROUTE_ACTION_POLICY_UNAVAILABLE"
+}
+export declare class XemaRouteActionEvaluator {
+    private readonly decisions;
+    private readonly grantVersions;
+    constructor(decisions: XemaPolicyDecisions, grantVersions: AuthorizationGrantVersionReader);
+    evaluate<Action extends string>(context: RequestContext, scope: RouteActionScope, candidates: readonly RouteActionCandidate<Action>[]): Promise<RouteActionEvaluation<Action>>;
+}
+//# sourceMappingURL=route-action-evaluator.d.ts.map

package/dist/route-action-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-action-evaluator.d.ts","sourceRoot":"","sources":["../src/route-action-evaluator.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAUlE,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAA8B,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGrF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG9D,MAAM,WAAW,oBAAoB,CAAC,MAAM,SAAS,MAAM;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAGD,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAEhF;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,qBAAqB,CAAC,MAAM,SAAS,MAAM;IAE1D,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAGD,oBAAY,0BAA0B;IACpC,QAAQ,kCAAkC;IAC1C,YAAY,sCAAsC;IAClD,KAAK,8BAA8B;IACnC,eAAe,yCAAyC;IACxD,WAAW,oCAAoC;CAChD;AA6BD,qBACa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,SAAS,EAAE,mBAAmB,EAE9B,aAAa,EAAE,+BAA+B;IAGpD,QAAQ,CAAC,MAAM,SAAS,MAAM,EACzC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,gBAAgB,EACvB,UAAU,EAAE,SAAS,oBAAoB,CAAC,MAAM,CAAC,EAAE,GAClD,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;CAsD1C"}

package/dist/route-action-evaluator.js

@@ -0,0 +1,146 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaRouteActionEvaluator = exports.RouteActionPolicyErrorCode = void 0;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const execution_context_1 = require("@xemahq/contracts/execution-context");
+const execution_environment_1 = require("@xemahq/contracts/execution-environment");
+const policy_1 = require("@xemahq/contracts/policy");
+const space_1 = require("@xemahq/contracts/space");
+const authzen_transport_1 = require("./authzen.transport");
+const grant_version_reader_1 = require("./grant-version.reader");
+const policy_decisions_1 = require("./policy-decisions");
+const relayable_caller_1 = require("./relayable-caller");
+var RouteActionPolicyErrorCode;
+(function (RouteActionPolicyErrorCode) {
+    RouteActionPolicyErrorCode["CrossOrg"] = "ROUTE_ACTION_POLICY_CROSS_ORG";
+    RouteActionPolicyErrorCode["CrossProject"] = "ROUTE_ACTION_POLICY_CROSS_PROJECT";
+    RouteActionPolicyErrorCode["Stale"] = "ROUTE_ACTION_POLICY_STALE";
+    RouteActionPolicyErrorCode["RequestRejected"] = "ROUTE_ACTION_POLICY_REQUEST_REJECTED";
+    RouteActionPolicyErrorCode["Unavailable"] = "ROUTE_ACTION_POLICY_UNAVAILABLE";
+})(RouteActionPolicyErrorCode || (exports.RouteActionPolicyErrorCode = RouteActionPolicyErrorCode = {}));
+class PolicyRevisionChangedError extends Error {
+    constructor(before, after) {
+        super(`Authorization policy revision changed from ${before} to ${after}.`);
+        this.name = PolicyRevisionChangedError.name;
+    }
+}
+let XemaRouteActionEvaluator = class XemaRouteActionEvaluator {
+    decisions;
+    grantVersions;
+    constructor(decisions, grantVersions) {
+        this.decisions = decisions;
+        this.grantVersions = grantVersions;
+    }
+    async evaluate(context, scope, candidates) {
+        assertScope(context, scope);
+        assertUniqueKeys(candidates);
+        try {
+            const revisionBefore = await this.grantVersions.read(scope.orgId);
+            if (candidates.length === 0) {
+                return { allowed: new Map(), policyRevision: revisionBefore };
+            }
+            const forwardedCaller = (0, relayable_caller_1.relayableCallerContext)(context, scope.orgId);
+            const decisions = await this.decisions.decideAll(candidates.map((candidate) => toPolicyRequest(context, scope, candidate)), forwardedCaller === undefined ? undefined : { forwardedCaller });
+            const revisionAfter = await this.grantVersions.read(scope.orgId);
+            if (revisionAfter !== revisionBefore) {
+                throw new PolicyRevisionChangedError(revisionBefore, revisionAfter);
+            }
+            const allowed = new Map();
+            decisions.forEach((decision, index) => {
+                const candidate = candidates[index];
+                if (decision.kind === policy_1.PolicyDecisionKind.Allow && candidate !== undefined) {
+                    allowed.set(candidate.key, candidate.action);
+                }
+            });
+            return { allowed, policyRevision: revisionAfter };
+        }
+        catch (error) {
+            if (error instanceof PolicyRevisionChangedError) {
+                throw new common_1.ServiceUnavailableException({
+                    code: RouteActionPolicyErrorCode.Stale,
+                    message: 'Authorization policy changed during action evaluation; refresh and retry.',
+                });
+            }
+            const status = error instanceof policy_decisions_1.PolicyDecisionRequestError || error instanceof authzen_transport_1.AuthzenPdpError
+                ? error.status
+                : undefined;
+            if (status !== undefined && status >= 400 && status < 500 && status !== 408 && status !== 429) {
+                throw new common_1.InternalServerErrorException({
+                    code: RouteActionPolicyErrorCode.RequestRejected,
+                    message: `Authorization policy refused this service's evaluation request (HTTP ${status}); ` +
+                        `actions are denied fail-closed. This is a defect in the calling service, not a policy-plane outage: ` +
+                        error.message,
+                });
+            }
+            throw new common_1.ServiceUnavailableException({
+                code: RouteActionPolicyErrorCode.Unavailable,
+                message: 'Authorization policy is unavailable; actions are denied fail-closed.',
+            });
+        }
+    }
+};
+exports.XemaRouteActionEvaluator = XemaRouteActionEvaluator;
+exports.XemaRouteActionEvaluator = XemaRouteActionEvaluator = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(grant_version_reader_1.AUTHORIZATION_GRANT_VERSION_READER)),
+    __metadata("design:paramtypes", [policy_decisions_1.XemaPolicyDecisions, Object])
+], XemaRouteActionEvaluator);
+function assertScope(context, scope) {
+    if (scope.orgId !== context.orgId) {
+        throw new common_1.ForbiddenException({
+            code: RouteActionPolicyErrorCode.CrossOrg,
+            message: 'The action resource does not belong to the active organization.',
+        });
+    }
+    if (scope.kind === 'project' && context.projectId !== scope.projectId) {
+        throw new common_1.ForbiddenException({
+            code: RouteActionPolicyErrorCode.CrossProject,
+            message: 'The action resource does not belong to the active project.',
+        });
+    }
+}
+function assertUniqueKeys(candidates) {
+    const keys = new Set();
+    for (const candidate of candidates) {
+        if (candidate.key.length === 0 || keys.has(candidate.key)) {
+            throw new Error('Route action candidates require unique non-empty keys.');
+        }
+        keys.add(candidate.key);
+    }
+}
+function toPolicyRequest(context, scope, candidate) {
+    const environment = scope.kind === 'platform'
+        ? execution_environment_1.ExecutionEnvironmentKind.System
+        : scope.kind === 'project'
+            ? execution_environment_1.ExecutionEnvironmentKind.Project
+            : execution_environment_1.ExecutionEnvironmentKind.Org;
+    return {
+        id: (0, node_crypto_1.randomUUID)(),
+        requestId: context.correlationId,
+        traceId: context.correlationId,
+        subject: { kind: context.subject.kind, id: context.subject.id },
+        caller: { kind: execution_context_1.CallerKind.Web },
+        space: scope.kind === 'platform'
+            ? { tier: space_1.SpaceKind.System, orgId: scope.orgId }
+            : scope.kind === 'project'
+                ? { tier: space_1.SpaceKind.Project, orgId: scope.orgId, projectId: scope.projectId }
+                : { tier: space_1.SpaceKind.Org, orgId: scope.orgId },
+        environment: { id: (0, execution_environment_1.formatEnvironmentRef)(environment), kind: environment },
+        capability: { ref: candidate.capabilityRef },
+        ...(context.delegation === undefined ? {} : { delegation: context.delegation }),
+    };
+}
+//# sourceMappingURL=route-action-evaluator.js.map

package/dist/route-action-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-action-evaluator.js","sourceRoot":"","sources":["../src/route-action-evaluator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAAyC;AAEzC,2CAMwB;AAExB,2EAAiE;AACjE,mFAGiD;AACjD,qDAAkF;AAClF,mDAAoD;AAEpD,2DAAsD;AACtD,iEAGgC;AAChC,yDAAqF;AACrF,yDAA4D;AA0B5D,IAAY,0BAMX;AAND,WAAY,0BAA0B;IACpC,wEAA0C,CAAA;IAC1C,gFAAkD,CAAA;IAClD,iEAAmC,CAAA;IACnC,sFAAwD,CAAA;IACxD,6EAA+C,CAAA;AACjD,CAAC,EANW,0BAA0B,0CAA1B,0BAA0B,QAMrC;AAED,MAAM,0BAA2B,SAAQ,KAAK;IAC5C,YAAmB,MAAc,EAAE,KAAa;QAC9C,KAAK,CAAC,8CAA8C,MAAM,OAAO,KAAK,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC;IAC9C,CAAC;CACF;AAuBM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAEhB;IAEA;IAHnB,YACmB,SAA8B,EAE9B,aAA8C;QAF9C,cAAS,GAAT,SAAS,CAAqB;QAE9B,kBAAa,GAAb,aAAa,CAAiC;IAC9D,CAAC;IAEG,KAAK,CAAC,QAAQ,CACnB,OAAuB,EACvB,KAAuB,EACvB,UAAmD;QAEnD,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC;YAChE,CAAC;YACD,MAAM,eAAe,GAAG,IAAA,yCAAsB,EAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAC9C,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EACzE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAChE,CAAC;YACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,aAAa,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,0BAA0B,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;YAC1C,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;gBACpC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;gBACpC,IAAI,QAAQ,CAAC,IAAI,KAAK,2BAAkB,CAAC,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC1E,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAChD,MAAM,IAAI,oCAA2B,CAAC;oBACpC,IAAI,EAAE,0BAA0B,CAAC,KAAK;oBACtC,OAAO,EAAE,2EAA2E;iBACrF,CAAC,CAAC;YACL,CAAC;YAID,MAAM,MAAM,GACV,KAAK,YAAY,6CAA0B,IAAI,KAAK,YAAY,mCAAe;gBAC7E,CAAC,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9F,MAAM,IAAI,qCAA4B,CAAC;oBACrC,IAAI,EAAE,0BAA0B,CAAC,eAAe;oBAChD,OAAO,EACL,wEAAwE,MAAM,KAAK;wBACnF,sGAAsG;wBACrG,KAAe,CAAC,OAAO;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,oCAA2B,CAAC;gBACpC,IAAI,EAAE,0BAA0B,CAAC,WAAW;gBAC5C,OAAO,EAAE,sEAAsE;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AAjEY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,eAAM,EAAC,yDAAkC,CAAC,CAAA;qCADf,sCAAmB;GAFtC,wBAAwB,CAiEpC;AAED,SAAS,WAAW,CAAC,OAAuB,EAAE,KAAuB;IACnE,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAA0B,CAAC,QAAQ;YACzC,OAAO,EAAE,iEAAiE;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAA0B,CAAC,YAAY;YAC7C,OAAO,EAAE,4DAA4D;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAmD;IAEnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,OAAuB,EACvB,KAAuB,EACvB,SAAuC;IAEvC,MAAM,WAAW,GACf,KAAK,CAAC,IAAI,KAAK,UAAU;QACvB,CAAC,CAAC,gDAAwB,CAAC,MAAM;QACjC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;YACxB,CAAC,CAAC,gDAAwB,CAAC,OAAO;YAClC,CAAC,CAAC,gDAAwB,CAAC,GAAG,CAAC;IACrC,OAAO;QACL,EAAE,EAAE,IAAA,wBAAU,GAAE;QAChB,SAAS,EAAE,OAAO,CAAC,aAAa;QAChC,OAAO,EAAE,OAAO,CAAC,aAAa;QAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE;QAC/D,MAAM,EAAE,EAAE,IAAI,EAAE,8BAAU,CAAC,GAAG,EAAE;QAChC,KAAK,EACH,KAAK,CAAC,IAAI,KAAK,UAAU;YACvB,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAChD,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAS,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;gBAC7E,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAS,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;QACnD,WAAW,EAAE,EAAE,EAAE,EAAE,IAAA,4CAAoB,EAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;QACzE,UAAU,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE;QAC5C,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;KAChF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-nest",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "AuthZEN 1.0 PEP for Xema services: one Nest module, an AuthZEN client against authorization-api, and the @Authorize route guard.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -14,9 +14,9 @@
   "peerDependencies": {
     "@nestjs/common": ">=11.0.0",
     "@nestjs/core": ">=11.0.0",
-    "@xemahq/contracts": ">=0.36.1",
+    "@xemahq/contracts": ">=0.50.0",
     "@xemahq/identity-client": ">=0.9.0",
-    "@xemahq/platform-common": ">=0.43.0",
+    "@xemahq/platform-common": ">=0.59.0",
     "@xemahq/service-registry-nest": ">=0.8.0",
     "zod": ">=4.0.0"
   },
@@ -24,10 +24,10 @@
     "@nestjs/common": "11.1.18",
     "@nestjs/core": "11.1.18",
     "@nestjs/testing": "11.1.18",
-    "@xemahq/contracts": ">=0.48.0",
+    "@xemahq/contracts": ">=0.50.0",
     "@xemahq/eslint-config": "^0.5.0",
-    "@xemahq/identity-client": "^0.15.4",
-    "@xemahq/platform-common": "^0.58.0",
+    "@xemahq/identity-client": "^0.16.0",
+    "@xemahq/platform-common": "^0.60.0",
     "@xemahq/service-registry-nest": "^0.19.0",
     "@types/jest": "^30.0.0",
     "@types/node": "25.2.3",