@xemahq/authorization-nest 0.4.0 → 0.6.0

package/dist/authorization.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.module.d.ts","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAqBjC,qBACa,uBAAuB;WACpB,OAAO,CACnB,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAC1C,aAAa;CAkBjB"}
+{"version":3,"file":"authorization.module.d.ts","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AA0BjC,qBACa,uBAAuB;WACpB,OAAO,CACnB,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAC1C,aAAa;CA+BjB"}

package/dist/authorization.module.js

@@ -12,7 +12,9 @@ const common_1 = require("@nestjs/common");
 const authorization_options_1 = require("./authorization.options");
 const authorize_decorator_1 = require("./authorize.decorator");
 const authzen_transport_1 = require("./authzen.transport");
+const grant_version_reader_1 = require("./grant-version.reader");
 const policy_decisions_1 = require("./policy-decisions");
+const route_action_evaluator_1 = require("./route-action-evaluator");
 const xema_authz_service_1 = require("./xema-authz.service");
 let XemaAuthorizationModule = XemaAuthorizationModule_1 = class XemaAuthorizationModule {
     static forRoot(options) {
@@ -28,9 +30,22 @@ let XemaAuthorizationModule = XemaAuthorizationModule_1 = class XemaAuthorizatio
                 { provide: authzen_transport_1.AUTHZEN_PDP_TRANSPORT, useExisting: authzen_transport_1.HttpAuthzenPdpTransport },
                 xema_authz_service_1.XemaAuthz,
                 policy_decisions_1.XemaPolicyDecisions,
+                grant_version_reader_1.HttpAuthorizationGrantVersionReader,
+                {
+                    provide: grant_version_reader_1.AUTHORIZATION_GRANT_VERSION_READER,
+                    useExisting: grant_version_reader_1.HttpAuthorizationGrantVersionReader,
+                },
+                route_action_evaluator_1.XemaRouteActionEvaluator,
+                authorize_decorator_1.XemaAuthorizeGuard,
+            ],
+            exports: [
+                xema_authz_service_1.XemaAuthz,
+                policy_decisions_1.XemaPolicyDecisions,
+                route_action_evaluator_1.XemaRouteActionEvaluator,
                 authorize_decorator_1.XemaAuthorizeGuard,
+                authzen_transport_1.AUTHZEN_PDP_TRANSPORT,
+                grant_version_reader_1.AUTHORIZATION_GRANT_VERSION_READER,
             ],
-            exports: [xema_authz_service_1.XemaAuthz, policy_decisions_1.XemaPolicyDecisions, authorize_decorator_1.XemaAuthorizeGuard, authzen_transport_1.AUTHZEN_PDP_TRANSPORT],
         };
     }
 };

package/dist/authorization.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA4D;AAE5D,mEAIiC;AACjC,+DAA2D;AAC3D,2DAG6B;AAC7B,yDAAyD;AACzD,6DAAiD;AAe1C,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAC3B,MAAM,CAAC,OAAO,CACnB,OAA2C;QAE3C,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kDAA0B;oBACnC,QAAQ,EAAE,IAAA,uDAA+B,EAAC,OAAO,CAAC;iBACnD;gBACD,2CAAuB;gBACvB,EAAE,OAAO,EAAE,yCAAqB,EAAE,WAAW,EAAE,2CAAuB,EAAE;gBACxE,8BAAS;gBACT,sCAAmB;gBACnB,wCAAkB;aACnB;YACD,OAAO,EAAE,CAAC,8BAAS,EAAE,sCAAmB,EAAE,wCAAkB,EAAE,yCAAqB,CAAC;SACrF,CAAC;IACJ,CAAC;CACF,CAAA;AArBY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAqBnC"}
+{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA4D;AAE5D,mEAIiC;AACjC,+DAA2D;AAC3D,2DAG6B;AAC7B,iEAGgC;AAChC,yDAAyD;AACzD,qEAAoE;AACpE,6DAAiD;AAe1C,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAC3B,MAAM,CAAC,OAAO,CACnB,OAA2C;QAE3C,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kDAA0B;oBACnC,QAAQ,EAAE,IAAA,uDAA+B,EAAC,OAAO,CAAC;iBACnD;gBACD,2CAAuB;gBACvB,EAAE,OAAO,EAAE,yCAAqB,EAAE,WAAW,EAAE,2CAAuB,EAAE;gBACxE,8BAAS;gBACT,sCAAmB;gBACnB,0DAAmC;gBACnC;oBACE,OAAO,EAAE,yDAAkC;oBAC3C,WAAW,EAAE,0DAAmC;iBACjD;gBACD,iDAAwB;gBACxB,wCAAkB;aACnB;YACD,OAAO,EAAE;gBACP,8BAAS;gBACT,sCAAmB;gBACnB,iDAAwB;gBACxB,wCAAkB;gBAClB,yCAAqB;gBACrB,yDAAkC;aACnC;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAlCY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAkCnC"}

package/dist/durable-delegation/decision-codes.d.ts

@@ -0,0 +1,6 @@
+export declare enum DurableDelegationDecisionCode {
+    AuthorityUnavailable = "DURABLE_DELEGATION_AUTHORITY_UNAVAILABLE",
+    Ended = "DURABLE_DELEGATION_ENDED"
+}
+export declare function isDurableDelegationDecisionCode(reason: string | undefined): reason is DurableDelegationDecisionCode;
+//# sourceMappingURL=decision-codes.d.ts.map

package/dist/durable-delegation/decision-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-codes.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/decision-codes.ts"],"names":[],"mappings":"AAgBA,oBAAY,6BAA6B;IACvC,oBAAoB,6CAA6C;IACjE,KAAK,6BAA6B;CACnC;AAGD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,MAAM,IAAI,6BAA6B,CAKzC"}

package/dist/durable-delegation/decision-codes.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DurableDelegationDecisionCode = void 0;
+exports.isDurableDelegationDecisionCode = isDurableDelegationDecisionCode;
+var DurableDelegationDecisionCode;
+(function (DurableDelegationDecisionCode) {
+    DurableDelegationDecisionCode["AuthorityUnavailable"] = "DURABLE_DELEGATION_AUTHORITY_UNAVAILABLE";
+    DurableDelegationDecisionCode["Ended"] = "DURABLE_DELEGATION_ENDED";
+})(DurableDelegationDecisionCode || (exports.DurableDelegationDecisionCode = DurableDelegationDecisionCode = {}));
+function isDurableDelegationDecisionCode(reason) {
+    return (reason === DurableDelegationDecisionCode.AuthorityUnavailable ||
+        reason === DurableDelegationDecisionCode.Ended);
+}
+//# sourceMappingURL=decision-codes.js.map

package/dist/durable-delegation/decision-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-codes.js","sourceRoot":"","sources":["../../src/durable-delegation/decision-codes.ts"],"names":[],"mappings":";;;AAsBA,0EAOC;AAbD,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,kGAAiE,CAAA;IACjE,mEAAkC,CAAA;AACpC,CAAC,EAHW,6BAA6B,6CAA7B,6BAA6B,QAGxC;AAGD,SAAgB,+BAA+B,CAC7C,MAA0B;IAE1B,OAAO,CACL,MAAM,KAAK,6BAA6B,CAAC,oBAAoB;QAC7D,MAAM,KAAK,6BAA6B,CAAC,KAAK,CAC/C,CAAC;AACJ,CAAC"}

package/dist/durable-delegation/holder-client.d.ts

@@ -0,0 +1,65 @@
+import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
+import { IdentityBootstrapService } from '@xemahq/identity-client';
+import { type ForwardedCallerContext } from '@xemahq/platform-common';
+export declare enum DurableDelegationOwnerKind {
+    User = "USER",
+    Team = "TEAM",
+    Org = "ORG"
+}
+export declare enum DurableDelegationRecordState {
+    Provisioning = "PROVISIONING",
+    Active = "ACTIVE",
+    Revoked = "REVOKED",
+    Expired = "EXPIRED"
+}
+export interface DurableDelegationCreate {
+    readonly owner: {
+        readonly kind: DurableDelegationOwnerKind;
+        readonly id: string;
+    };
+    readonly scope: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly integrationId: string;
+    readonly environmentId: string;
+    readonly requestKey: string;
+    readonly holderMember?: string;
+    readonly expiresAt?: Date;
+}
+export interface DurableDelegationView {
+    readonly id: string;
+    readonly state: DurableDelegationRecordState;
+    readonly endReason?: string;
+    readonly owner: {
+        readonly kind: DurableDelegationOwnerKind;
+        readonly id: string;
+    };
+    readonly scope: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly integrationId: string;
+    readonly environmentId: string;
+    readonly holderWorkload: string;
+    readonly carrierId?: string;
+    readonly expiresAt?: string;
+    readonly lastDenial?: {
+        readonly at: string;
+        readonly check: string;
+        readonly right: string;
+        readonly scope: string;
+    };
+}
+export declare class DurableDelegationRequestError extends Error {
+    readonly status: number;
+    readonly code: string | undefined;
+    constructor(message: string, status: number, code: string | undefined);
+}
+export declare class DurableDelegationHolderClient {
+    private readonly registry;
+    private readonly identity;
+    constructor(registry: ServiceRegistry, identity: IdentityBootstrapService);
+    create(author: ForwardedCallerContext, request: DurableDelegationCreate): Promise<DurableDelegationView>;
+    read(orgId: string, delegationId: string): Promise<DurableDelegationView>;
+    revoke(orgId: string, delegationId: string): Promise<DurableDelegationView>;
+    mintContext(carrierId: string): Promise<string>;
+    private send;
+}
+//# sourceMappingURL=holder-client.d.ts.map

package/dist/durable-delegation/holder-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-client.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-client.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AAOjC,oBAAY,0BAA0B;IACpC,IAAI,SAAS;IACb,IAAI,SAAS;IACb,GAAG,QAAQ;CACZ;AAGD,oBAAY,4BAA4B;IACtC,YAAY,iBAAiB;IAC7B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAGpC,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AAmBD,qBACa,6BAA6B;IAEN,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADwB,QAAQ,EAAE,eAAe,EACzD,QAAQ,EAAE,wBAAwB;IAGxC,MAAM,CACjB,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IAepB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IASzE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAc3E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAQ9C,IAAI;CA8BnB"}

package/dist/durable-delegation/holder-client.js

@@ -0,0 +1,113 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DurableDelegationHolderClient = exports.DurableDelegationRequestError = exports.DurableDelegationRecordState = exports.DurableDelegationOwnerKind = void 0;
+const common_1 = require("@nestjs/common");
+const service_registry_1 = require("@xemahq/contracts/service-registry");
+const identity_client_1 = require("@xemahq/identity-client");
+const platform_common_1 = require("@xemahq/platform-common");
+const service_registry_nest_1 = require("@xemahq/service-registry-nest");
+var DurableDelegationOwnerKind;
+(function (DurableDelegationOwnerKind) {
+    DurableDelegationOwnerKind["User"] = "USER";
+    DurableDelegationOwnerKind["Team"] = "TEAM";
+    DurableDelegationOwnerKind["Org"] = "ORG";
+})(DurableDelegationOwnerKind || (exports.DurableDelegationOwnerKind = DurableDelegationOwnerKind = {}));
+var DurableDelegationRecordState;
+(function (DurableDelegationRecordState) {
+    DurableDelegationRecordState["Provisioning"] = "PROVISIONING";
+    DurableDelegationRecordState["Active"] = "ACTIVE";
+    DurableDelegationRecordState["Revoked"] = "REVOKED";
+    DurableDelegationRecordState["Expired"] = "EXPIRED";
+})(DurableDelegationRecordState || (exports.DurableDelegationRecordState = DurableDelegationRecordState = {}));
+class DurableDelegationRequestError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'DurableDelegationRequestError';
+    }
+}
+exports.DurableDelegationRequestError = DurableDelegationRequestError;
+const DELEGATED_CONTEXT_AUDIENCE = service_registry_1.ServiceName.XEMA_CAPABILITY_ROUTER;
+let DurableDelegationHolderClient = class DurableDelegationHolderClient {
+    registry;
+    identity;
+    constructor(registry, identity) {
+        this.registry = registry;
+        this.identity = identity;
+    }
+    async create(author, request) {
+        return this.send('POST', '/durable-delegations', author.orgId, {
+            ...(await (0, platform_common_1.forwardedCallerHeaders)(author, this.identity)),
+        }, {
+            owner: request.owner,
+            scope: [...request.scope],
+            capabilities: [...request.capabilities],
+            integrationId: request.integrationId,
+            environmentId: request.environmentId,
+            requestKey: request.requestKey,
+            ...(request.holderMember === undefined ? {} : { holderMember: request.holderMember }),
+            ...(request.expiresAt === undefined ? {} : { expiresAt: request.expiresAt.toISOString() }),
+        });
+    }
+    async read(orgId, delegationId) {
+        return this.send('GET', `/internal/durable-delegations/${encodeURIComponent(delegationId)}`, orgId, { Authorization: `Bearer ${await this.identity.getAccessToken()}` });
+    }
+    async revoke(orgId, delegationId) {
+        return this.send('POST', `/internal/durable-delegations/${encodeURIComponent(delegationId)}/revoke`, orgId, { Authorization: `Bearer ${await this.identity.getAccessToken()}` });
+    }
+    async mintContext(carrierId) {
+        const minted = await this.identity.mintDelegatedContext({
+            delegationId: carrierId,
+            audience: DELEGATED_CONTEXT_AUDIENCE,
+        });
+        return minted.accessToken;
+    }
+    async send(method, path, orgId, headers, body) {
+        const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
+        const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, {
+            method,
+            headers: {
+                ...headers,
+                'X-Xema-Org-Id': orgId,
+                ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+            },
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            throw new DurableDelegationRequestError(`authorization-api ${method} ${path} failed with HTTP ${response.status}: ${text.slice(0, 2000)}`, response.status, codeOf(text));
+        }
+        return (0, platform_common_1.unwrapPlatformResponseEnvelope)(await response.json(), `authorization-api ${method} ${path}`);
+    }
+};
+exports.DurableDelegationHolderClient = DurableDelegationHolderClient;
+exports.DurableDelegationHolderClient = DurableDelegationHolderClient = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(service_registry_nest_1.SERVICE_REGISTRY_TOKEN)),
+    __metadata("design:paramtypes", [Object, identity_client_1.IdentityBootstrapService])
+], DurableDelegationHolderClient);
+function codeOf(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed.code === 'string' ? parsed.code : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=holder-client.js.map

package/dist/durable-delegation/holder-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-client.js","sourceRoot":"","sources":["../../src/durable-delegation/holder-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,yEAG4C;AAC5C,6DAAmE;AACnE,6DAIiC;AACjC,yEAGuC;AAGvC,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,2CAAa,CAAA;IACb,2CAAa,CAAA;IACb,yCAAW,CAAA;AACb,CAAC,EAJW,0BAA0B,0CAA1B,0BAA0B,QAIrC;AAGD,IAAY,4BAKX;AALD,WAAY,4BAA4B;IACtC,6DAA6B,CAAA;IAC7B,iDAAiB,CAAA;IACjB,mDAAmB,CAAA;IACnB,mDAAmB,CAAA;AACrB,CAAC,EALW,4BAA4B,4CAA5B,4BAA4B,QAKvC;AAuCD,MAAa,6BAA8B,SAAQ,KAAK;IAGpC;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AATD,sEASC;AAGD,MAAM,0BAA0B,GAAG,8BAAW,CAAC,sBAAsB,CAAC;AAiB/D,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAEW;IAChC;IAFnB,YACmD,QAAyB,EACzD,QAAkC;QADF,aAAQ,GAAR,QAAQ,CAAiB;QACzD,aAAQ,GAAR,QAAQ,CAA0B;IAClD,CAAC;IAEG,KAAK,CAAC,MAAM,CACjB,MAA8B,EAC9B,OAAgC;QAEhC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,CAAC,KAAK,EAAE;YAC7D,GAAG,CAAC,MAAM,IAAA,wCAAsB,EAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;SACzD,EAAE;YACD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;YACzB,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;YACvC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,YAAoB;QACnD,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,EAAE,EACnE,KAAK,EACL,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,EAAE,CACpE,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,YAAoB;QACrD,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,EACN,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAC1E,KAAK,EACL,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,EAAE,CACpE,CAAC;IACJ,CAAC;IAOM,KAAK,CAAC,WAAW,CAAC,SAAiB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACtD,YAAY,EAAE,SAAS;YACvB,QAAQ,EAAE,0BAA0B;SACrC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,MAAsB,EACtB,IAAY,EACZ,KAAa,EACb,OAA+B,EAC/B,IAAc;QAEd,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAAC,IAAI,CAAC,QAAQ,EAAE,8BAAW,CAAC,iBAAiB,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM;YACN,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,eAAe,EAAE,KAAK;gBACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aACtE;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,6BAA6B,CACrC,qBAAqB,MAAM,IAAI,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EACjG,QAAQ,CAAC,MAAM,EACf,MAAM,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,gDAA8B,EACnC,MAAM,QAAQ,CAAC,IAAI,EAAE,EACrB,qBAAqB,MAAM,IAAI,IAAI,EAAE,CACtC,CAAC;IACJ,CAAC;CACF,CAAA;AArFY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;6CACJ,0CAAwB;GAH1C,6BAA6B,CAqFzC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;QACtD,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/durable-delegation/holder-errors.d.ts

@@ -0,0 +1,22 @@
+export declare enum DelegationRequiredReason {
+    NeverAuthorised = "never-authorised",
+    Unprovisioned = "unprovisioned",
+    Ended = "ended",
+    Stale = "stale"
+}
+export declare class DelegationRequiredError extends Error {
+    readonly reason: DelegationRequiredReason;
+    readonly subject: string;
+    constructor(reason: DelegationRequiredReason, subject: string);
+}
+export declare class DelegationUseDeniedError extends Error {
+    readonly delegationId: string;
+    readonly detail: string;
+    constructor(delegationId: string, detail: string);
+}
+export declare class DelegationEndedError extends Error {
+    readonly delegationId: string;
+    readonly endReason: string | undefined;
+    constructor(delegationId: string, endReason: string | undefined);
+}
+//# sourceMappingURL=holder-errors.d.ts.map

package/dist/durable-delegation/holder-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-errors.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-errors.ts"],"names":[],"mappings":"AAkBA,oBAAY,wBAAwB;IAElC,eAAe,qBAAqB;IAEpC,aAAa,kBAAkB;IAE/B,KAAK,UAAU;IAEf,KAAK,UAAU;CAChB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,MAAM,EAAE,wBAAwB;aAChC,OAAO,EAAE,MAAM;gBADf,MAAM,EAAE,wBAAwB,EAChC,OAAO,EAAE,MAAM;CAKlC;AAED,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,YAAY,EAAE,MAAM;aACpB,MAAM,EAAE,MAAM;gBADd,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM;CAKjC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;aAE3B,YAAY,EAAE,MAAM;aACpB,SAAS,EAAE,MAAM,GAAG,SAAS;gBAD7B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAAG,SAAS;CAKhD"}

package/dist/durable-delegation/holder-errors.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationEndedError = exports.DelegationUseDeniedError = exports.DelegationRequiredError = exports.DelegationRequiredReason = void 0;
+var DelegationRequiredReason;
+(function (DelegationRequiredReason) {
+    DelegationRequiredReason["NeverAuthorised"] = "never-authorised";
+    DelegationRequiredReason["Unprovisioned"] = "unprovisioned";
+    DelegationRequiredReason["Ended"] = "ended";
+    DelegationRequiredReason["Stale"] = "stale";
+})(DelegationRequiredReason || (exports.DelegationRequiredReason = DelegationRequiredReason = {}));
+class DelegationRequiredError extends Error {
+    reason;
+    subject;
+    constructor(reason, subject) {
+        super(`${subject} needs a person to authorise its durable work (${reason}).`);
+        this.reason = reason;
+        this.subject = subject;
+        this.name = 'DelegationRequiredError';
+    }
+}
+exports.DelegationRequiredError = DelegationRequiredError;
+class DelegationUseDeniedError extends Error {
+    delegationId;
+    detail;
+    constructor(delegationId, detail) {
+        super(`authority currently unavailable for durable delegation ${delegationId}: ${detail}`);
+        this.delegationId = delegationId;
+        this.detail = detail;
+        this.name = 'DelegationUseDeniedError';
+    }
+}
+exports.DelegationUseDeniedError = DelegationUseDeniedError;
+class DelegationEndedError extends Error {
+    delegationId;
+    endReason;
+    constructor(delegationId, endReason) {
+        super(`durable delegation ${delegationId} has ended${endReason === undefined ? '' : ` (${endReason})`}.`);
+        this.delegationId = delegationId;
+        this.endReason = endReason;
+        this.name = 'DelegationEndedError';
+    }
+}
+exports.DelegationEndedError = DelegationEndedError;
+//# sourceMappingURL=holder-errors.js.map

package/dist/durable-delegation/holder-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-errors.js","sourceRoot":"","sources":["../../src/durable-delegation/holder-errors.ts"],"names":[],"mappings":";;;AAkBA,IAAY,wBASX;AATD,WAAY,wBAAwB;IAElC,gEAAoC,CAAA;IAEpC,2DAA+B,CAAA;IAE/B,2CAAe,CAAA;IAEf,2CAAe,CAAA;AACjB,CAAC,EATW,wBAAwB,wCAAxB,wBAAwB,QASnC;AAED,MAAa,uBAAwB,SAAQ,KAAK;IAE9B;IACA;IAFlB,YACkB,MAAgC,EAChC,OAAe;QAE/B,KAAK,CAAC,GAAG,OAAO,kDAAkD,MAAM,IAAI,CAAC,CAAC;QAH9D,WAAM,GAAN,MAAM,CAA0B;QAChC,YAAO,GAAP,OAAO,CAAQ;QAG/B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AARD,0DAQC;AAED,MAAa,wBAAyB,SAAQ,KAAK;IAE/B;IACA;IAFlB,YACkB,YAAoB,EACpB,MAAc;QAE9B,KAAK,CAAC,0DAA0D,YAAY,KAAK,MAAM,EAAE,CAAC,CAAC;QAH3E,iBAAY,GAAZ,YAAY,CAAQ;QACpB,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AARD,4DAQC;AAED,MAAa,oBAAqB,SAAQ,KAAK;IAE3B;IACA;IAFlB,YACkB,YAAoB,EACpB,SAA6B;QAE7C,KAAK,CAAC,sBAAsB,YAAY,aAAa,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,GAAG,GAAG,CAAC,CAAC;QAH1F,iBAAY,GAAZ,YAAY,CAAQ;QACpB,cAAS,GAAT,SAAS,CAAoB;QAG7C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AARD,oDAQC"}

package/dist/durable-delegation/holder-lifecycle.d.ts

@@ -0,0 +1,43 @@
+import { type DurableDelegationCreate, DurableDelegationHolderClient, type DurableDelegationView } from './holder-client';
+import { DelegationEndedError, DelegationUseDeniedError } from './holder-errors';
+import type { ForwardedCallerContext } from '@xemahq/platform-common';
+export declare enum HolderDelegationState {
+    NotRequired = "not_required",
+    Required = "required",
+    Unprovisioned = "unprovisioned",
+    Held = "held",
+    Ended = "ended"
+}
+export interface HolderDelegationRow {
+    readonly state: HolderDelegationState;
+    readonly delegationId: string | null;
+    readonly carrierId: string | null;
+    readonly capabilities: readonly string[];
+}
+export interface HolderDelegationStore {
+    read(): Promise<HolderDelegationRow | null>;
+    writeIf(expected: Pick<HolderDelegationRow, 'state' | 'delegationId'>, next: HolderDelegationRow): Promise<boolean>;
+}
+export interface HolderDelegationNeed {
+    readonly capabilities: readonly string[];
+}
+export interface HeldAuthority {
+    readonly delegationId: string;
+    readonly orgId: string;
+    readonly authorization: string;
+}
+export declare class DurableDelegationHolder {
+    private readonly client;
+    private readonly logger;
+    constructor(client: DurableDelegationHolderClient);
+    reconcileNeed(store: HolderDelegationStore, orgId: string, need: HolderDelegationNeed | null): Promise<HolderDelegationRow>;
+    authorize(store: HolderDelegationStore, author: ForwardedCallerContext, request: DurableDelegationCreate): Promise<HolderDelegationRow>;
+    authority(row: HolderDelegationRow, orgId: string, subject: string): Promise<HeldAuthority>;
+    onDenied(store: HolderDelegationStore, row: HolderDelegationRow, reason: string | undefined, detail: string): Promise<DelegationUseDeniedError | DelegationEndedError | undefined>;
+    refresh(store: HolderDelegationStore, orgId: string): Promise<HolderDelegationRow | null>;
+    endFor(row: HolderDelegationRow, orgId: string): Promise<void>;
+    private revokeQuietly;
+}
+export declare function rowOf(view: DurableDelegationView): HolderDelegationRow;
+export declare function needTransition(row: HolderDelegationRow, need: HolderDelegationNeed | null): HolderDelegationRow | null;
+//# sourceMappingURL=holder-lifecycle.d.ts.map

package/dist/durable-delegation/holder-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-lifecycle.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-lifecycle.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,uBAAuB,EAC5B,6BAA6B,EAE7B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EAGpB,wBAAwB,EACzB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAWtE,oBAAY,qBAAqB;IAE/B,WAAW,iBAAiB;IAE5B,QAAQ,aAAa;IAErB,aAAa,kBAAkB;IAE/B,IAAI,SAAS;IAEb,KAAK,UAAU;CAChB;AAGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAElC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAQD,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC5C,OAAO,CACL,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,cAAc,CAAC,EAC7D,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAGD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAwBD,qBACa,uBAAuB;IAGf,OAAO,CAAC,QAAQ,CAAC,MAAM;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;gBAE/B,MAAM,EAAE,6BAA6B;IAE5D,aAAa,CACxB,KAAK,EAAE,qBAAqB,EAC5B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,oBAAoB,GAAG,IAAI,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAoBlB,SAAS,CACpB,KAAK,EAAE,qBAAqB,EAC5B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,mBAAmB,CAAC;IAuBlB,SAAS,CACpB,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC;IA2BZ,QAAQ,CACnB,KAAK,EAAE,qBAAqB,EAC5B,GAAG,EAAE,mBAAmB,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,GAAG,oBAAoB,GAAG,SAAS,CAAC;IAW1D,OAAO,CAAC,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAazF,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAM7D,aAAa;CAc5B;AAGD,wBAAgB,KAAK,CAAC,IAAI,EAAE,qBAAqB,GAAG,mBAAmB,CAetE;AAGD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,oBAAoB,GAAG,IAAI,GAChC,mBAAmB,GAAG,IAAI,CAgB5B"}

package/dist/durable-delegation/holder-lifecycle.js

@@ -0,0 +1,173 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var DurableDelegationHolder_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DurableDelegationHolder = exports.HolderDelegationState = void 0;
+exports.rowOf = rowOf;
+exports.needTransition = needTransition;
+const common_1 = require("@nestjs/common");
+const decision_codes_1 = require("./decision-codes");
+const holder_client_1 = require("./holder-client");
+const holder_errors_1 = require("./holder-errors");
+var HolderDelegationState;
+(function (HolderDelegationState) {
+    HolderDelegationState["NotRequired"] = "not_required";
+    HolderDelegationState["Required"] = "required";
+    HolderDelegationState["Unprovisioned"] = "unprovisioned";
+    HolderDelegationState["Held"] = "held";
+    HolderDelegationState["Ended"] = "ended";
+})(HolderDelegationState || (exports.HolderDelegationState = HolderDelegationState = {}));
+const MAX_CAS_ATTEMPTS = 3;
+let DurableDelegationHolder = DurableDelegationHolder_1 = class DurableDelegationHolder {
+    client;
+    logger = new common_1.Logger(DurableDelegationHolder_1.name);
+    constructor(client) {
+        this.client = client;
+    }
+    async reconcileNeed(store, orgId, need) {
+        for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt += 1) {
+            const row = await store.read();
+            if (row === null) {
+                throw new common_1.ConflictException('The holder row disappeared while its need was being stated.');
+            }
+            const next = needTransition(row, need);
+            if (next === null) {
+                return row;
+            }
+            if (await store.writeIf(row, next)) {
+                if (row.delegationId !== null && next.delegationId === null) {
+                    await this.revokeQuietly(orgId, row.delegationId);
+                }
+                return next;
+            }
+        }
+        throw new common_1.ConflictException('The holder row kept changing while its need was being stated.');
+    }
+    async authorize(store, author, request) {
+        const view = await this.client.create(author, request);
+        const next = rowOf(view);
+        for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt += 1) {
+            const row = await store.read();
+            if (row === null) {
+                await this.revokeQuietly(author.orgId, view.id);
+                throw new common_1.ConflictException('The holder row disappeared while it was being authorised.');
+            }
+            if (row.delegationId === view.id) {
+                return row;
+            }
+            if (await store.writeIf(row, next)) {
+                if (row.delegationId !== null) {
+                    await this.revokeQuietly(author.orgId, row.delegationId);
+                }
+                return next;
+            }
+        }
+        throw new common_1.ConflictException('The holder row kept changing while it was being authorised.');
+    }
+    async authority(row, orgId, subject) {
+        switch (row.state) {
+            case HolderDelegationState.Held:
+                break;
+            case HolderDelegationState.NotRequired:
+            case HolderDelegationState.Required:
+                throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.NeverAuthorised, subject);
+            case HolderDelegationState.Unprovisioned:
+                throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.Unprovisioned, subject);
+            case HolderDelegationState.Ended:
+                throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.Ended, subject);
+        }
+        if (row.delegationId === null || row.carrierId === null) {
+            throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.Unprovisioned, subject);
+        }
+        return {
+            delegationId: row.delegationId,
+            orgId,
+            authorization: `Bearer ${await this.client.mintContext(row.carrierId)}`,
+        };
+    }
+    async onDenied(store, row, reason, detail) {
+        if (!(0, decision_codes_1.isDurableDelegationDecisionCode)(reason) || row.delegationId === null) {
+            return undefined;
+        }
+        if (reason === decision_codes_1.DurableDelegationDecisionCode.AuthorityUnavailable) {
+            return new holder_errors_1.DelegationUseDeniedError(row.delegationId, detail);
+        }
+        await store.writeIf(row, { ...row, state: HolderDelegationState.Ended, carrierId: null });
+        return new holder_errors_1.DelegationEndedError(row.delegationId, undefined);
+    }
+    async refresh(store, orgId) {
+        const row = await store.read();
+        if (row === null || row.delegationId === null) {
+            return row;
+        }
+        const view = await this.client.read(orgId, row.delegationId);
+        const next = rowOf(view);
+        if (next.state === row.state && next.carrierId === row.carrierId) {
+            return row;
+        }
+        return (await store.writeIf(row, next)) ? next : store.read();
+    }
+    async endFor(row, orgId) {
+        if (row.delegationId !== null) {
+            await this.client.revoke(orgId, row.delegationId);
+        }
+    }
+    async revokeQuietly(orgId, delegationId) {
+        try {
+            await this.client.revoke(orgId, delegationId);
+        }
+        catch (error) {
+            this.logger.warn({
+                message: 'durable-delegation-superseded-revoke-failed',
+                delegationId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+};
+exports.DurableDelegationHolder = DurableDelegationHolder;
+exports.DurableDelegationHolder = DurableDelegationHolder = DurableDelegationHolder_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [holder_client_1.DurableDelegationHolderClient])
+], DurableDelegationHolder);
+function rowOf(view) {
+    switch (view.state) {
+        case holder_client_1.DurableDelegationRecordState.Active:
+            return {
+                state: view.carrierId === undefined ? HolderDelegationState.Unprovisioned : HolderDelegationState.Held,
+                delegationId: view.id,
+                carrierId: view.carrierId ?? null,
+                capabilities: [...view.capabilities],
+            };
+        case holder_client_1.DurableDelegationRecordState.Provisioning:
+            return { state: HolderDelegationState.Unprovisioned, delegationId: view.id, carrierId: null, capabilities: [...view.capabilities] };
+        case holder_client_1.DurableDelegationRecordState.Revoked:
+        case holder_client_1.DurableDelegationRecordState.Expired:
+            return { state: HolderDelegationState.Ended, delegationId: view.id, carrierId: null, capabilities: [...view.capabilities] };
+    }
+}
+function needTransition(row, need) {
+    if (need === null) {
+        return row.state === HolderDelegationState.NotRequired && row.delegationId === null
+            ? null
+            : { state: HolderDelegationState.NotRequired, delegationId: null, carrierId: null, capabilities: [] };
+    }
+    const lendsExactly = row.capabilities.length === need.capabilities.length &&
+        need.capabilities.every((c) => row.capabilities.includes(c));
+    if (row.delegationId !== null && lendsExactly) {
+        return null;
+    }
+    if (row.state === HolderDelegationState.Required && row.delegationId === null) {
+        return null;
+    }
+    return { state: HolderDelegationState.Required, delegationId: null, carrierId: null, capabilities: [] };
+}
+//# sourceMappingURL=holder-lifecycle.js.map

package/dist/durable-delegation/holder-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-lifecycle.js","sourceRoot":"","sources":["../../src/durable-delegation/holder-lifecycle.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAkPA,sBAeC;AAGD,wCAmBC;AAvRD,2CAAuE;AAGvE,qDAG0B;AAC1B,mDAKyB;AACzB,mDAKyB;AAazB,IAAY,qBAWX;AAXD,WAAY,qBAAqB;IAE/B,qDAA4B,CAAA;IAE5B,8CAAqB,CAAA;IAErB,wDAA+B,CAAA;IAE/B,sCAAa,CAAA;IAEb,wCAAe,CAAA;AACjB,CAAC,EAXW,qBAAqB,qCAArB,qBAAqB,QAWhC;AAsCD,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAuBpB,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAGE;IAFnB,MAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAEnE,YAAoC,MAAqC;QAArC,WAAM,GAAN,MAAM,CAA+B;IAAG,CAAC;IAEtE,KAAK,CAAC,aAAa,CACxB,KAA4B,EAC5B,KAAa,EACb,IAAiC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,0BAAiB,CAAC,6DAA6D,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,OAAO,GAAG,CAAC;YACb,CAAC;YACD,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBACnC,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;oBAC5D,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,0BAAiB,CAAC,+DAA+D,CAAC,CAAC;IAC/F,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,KAA4B,EAC5B,MAA8B,EAC9B,OAAgC;QAEhC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChD,MAAM,IAAI,0BAAiB,CAAC,2DAA2D,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBAEjC,OAAO,GAAG,CAAC;YACb,CAAC;YACD,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBACnC,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;oBAC9B,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3D,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,0BAAiB,CAAC,6DAA6D,CAAC,CAAC;IAC7F,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,GAAwB,EACxB,KAAa,EACb,OAAe;QAEf,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,qBAAqB,CAAC,IAAI;gBAC7B,MAAM;YACR,KAAK,qBAAqB,CAAC,WAAW,CAAC;YACvC,KAAK,qBAAqB,CAAC,QAAQ;gBACjC,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACvF,KAAK,qBAAqB,CAAC,aAAa;gBACtC,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACrF,KAAK,qBAAqB,CAAC,KAAK;gBAC9B,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACrF,CAAC;QACD,OAAO;YACL,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,KAAK;YACL,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;SACxE,CAAC;IACJ,CAAC;IAOM,KAAK,CAAC,QAAQ,CACnB,KAA4B,EAC5B,GAAwB,EACxB,MAA0B,EAC1B,MAAc;QAEd,IAAI,CAAC,IAAA,gDAA+B,EAAC,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,MAAM,KAAK,8CAA6B,CAAC,oBAAoB,EAAE,CAAC;YAClE,OAAO,IAAI,wCAAwB,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,OAAO,IAAI,oCAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,KAA4B,EAAE,KAAa;QAC9D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YACjE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,GAAwB,EAAE,KAAa;QACzD,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,YAAoB;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAIf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,6CAA6C;gBACtD,YAAY;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AAxIY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAIiC,6CAA6B;GAH9D,uBAAuB,CAwInC;AAGD,SAAgB,KAAK,CAAC,IAA2B;IAC/C,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,4CAA4B,CAAC,MAAM;YACtC,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI;gBACtG,YAAY,EAAE,IAAI,CAAC,EAAE;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;aACrC,CAAC;QACJ,KAAK,4CAA4B,CAAC,YAAY;YAC5C,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACtI,KAAK,4CAA4B,CAAC,OAAO,CAAC;QAC1C,KAAK,4CAA4B,CAAC,OAAO;YACvC,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;IAChI,CAAC;AACH,CAAC;AAGD,SAAgB,cAAc,CAC5B,GAAwB,EACxB,IAAiC;IAEjC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,GAAG,CAAC,KAAK,KAAK,qBAAqB,CAAC,WAAW,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI;YACjF,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,MAAM,YAAY,GAChB,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM;QACpD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,IAAI,YAAY,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,qBAAqB,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;AAC1G,CAAC"}

package/dist/grant-version.reader.d.ts

@@ -0,0 +1,19 @@
+import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
+import { IdentityBootstrapService } from '@xemahq/identity-client';
+import { type XemaAuthorizationOptions } from './authorization.options';
+export interface AuthorizationGrantVersionReader {
+    read(orgId: string): Promise<number>;
+}
+export declare const AUTHORIZATION_GRANT_VERSION_READER: unique symbol;
+export declare class HttpAuthorizationGrantVersionReader implements AuthorizationGrantVersionReader {
+    private readonly registry;
+    private readonly identityBootstrap;
+    private readonly options;
+    constructor(registry: ServiceRegistry, identityBootstrap: IdentityBootstrapService, options: XemaAuthorizationOptions);
+    read(orgId: string): Promise<number>;
+}
+export declare function assertGrantVersion(orgId: string, body: {
+    readonly orgId?: unknown;
+    readonly grantVersion?: unknown;
+}): number;
+//# sourceMappingURL=grant-version.reader.d.ts.map

package/dist/grant-version.reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-version.reader.d.ts","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAOnE,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAUjC,MAAM,WAAW,+BAA+B;IAC9C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,eAAO,MAAM,kCAAkC,eAE9C,CAAC;AAKF,qBACa,mCACX,YAAW,+BAA+B;IAIxC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAGvC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CA4BlD;AAGD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAClE,MAAM,CAaR"}

package/dist/grant-version.reader.js

@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpAuthorizationGrantVersionReader = exports.AUTHORIZATION_GRANT_VERSION_READER = void 0;
+exports.assertGrantVersion = assertGrantVersion;
+const common_1 = require("@nestjs/common");
+const service_registry_1 = require("@xemahq/contracts/service-registry");
+const identity_client_1 = require("@xemahq/identity-client");
+const platform_common_1 = require("@xemahq/platform-common");
+const service_registry_nest_1 = require("@xemahq/service-registry-nest");
+const authorization_options_1 = require("./authorization.options");
+const authzen_transport_1 = require("./authzen.transport");
+exports.AUTHORIZATION_GRANT_VERSION_READER = Symbol('AUTHORIZATION_GRANT_VERSION_READER');
+const GRANT_VERSION_PATH = '/authorization/grant-version/';
+let HttpAuthorizationGrantVersionReader = class HttpAuthorizationGrantVersionReader {
+    registry;
+    identityBootstrap;
+    options;
+    constructor(registry, identityBootstrap, options) {
+        this.registry = registry;
+        this.identityBootstrap = identityBootstrap;
+        this.options = options;
+    }
+    async read(orgId) {
+        const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
+        const path = `${GRANT_VERSION_PATH}${encodeURIComponent(orgId)}`;
+        const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, {
+            method: 'GET',
+            headers: {
+                Authorization: `Bearer ${await this.identityBootstrap.getAccessToken()}`,
+                'X-Xema-Org-Id': orgId,
+            },
+            signal: AbortSignal.timeout(this.options.requestTimeoutMs),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            throw new authzen_transport_1.AuthzenPdpError(`authorization-api GET ${path} failed with HTTP ${response.status}: ${text.slice(0, 2000)}`, response.status, undefined);
+        }
+        const body = (0, platform_common_1.unwrapPlatformResponseEnvelope)(await response.json(), `authorization-api GET ${path}`);
+        return assertGrantVersion(orgId, body);
+    }
+};
+exports.HttpAuthorizationGrantVersionReader = HttpAuthorizationGrantVersionReader;
+exports.HttpAuthorizationGrantVersionReader = HttpAuthorizationGrantVersionReader = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(service_registry_nest_1.SERVICE_REGISTRY_TOKEN)),
+    __param(2, (0, common_1.Inject)(authorization_options_1.XEMA_AUTHORIZATION_OPTIONS)),
+    __metadata("design:paramtypes", [Object, identity_client_1.IdentityBootstrapService, Object])
+], HttpAuthorizationGrantVersionReader);
+function assertGrantVersion(orgId, body) {
+    const version = body.grantVersion;
+    if (body.orgId !== orgId ||
+        typeof version !== 'number' ||
+        !Number.isSafeInteger(version) ||
+        version < 0) {
+        throw new Error(`authorization-api returned a malformed policy revision for org "${orgId}".`);
+    }
+    return version;
+}
+//# sourceMappingURL=grant-version.reader.js.map

package/dist/grant-version.reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-version.reader.js","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AA+EA,gDAgBC;AA/FD,2CAAoD;AACpD,yEAG4C;AAC5C,6DAAmE;AACnE,6DAAyE;AACzE,yEAGuC;AAEvC,mEAGiC;AACjC,2DAAsD;AAazC,QAAA,kCAAkC,GAAG,MAAM,CACtD,oCAAoC,CACrC,CAAC;AAGF,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAGpD,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAK3B;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,KAAK,CAAC,IAAI,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE;gBACxE,eAAe,EAAE,KAAK;aACvB;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC3D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAe,CACvB,yBAAyB,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC3F,QAAQ,CAAC,MAAM,EACf,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,gDAA8B,EAGxC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAvCY,kFAAmC;8CAAnC,mCAAmC;IAD/C,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GANnD,mCAAmC,CAuC/C;AAGD,SAAgB,kBAAkB,CAChC,KAAa,EACb,IAAmE;IAEnE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IACE,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC,EACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE,KAAK,IAAI,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -6,7 +6,13 @@ export * from './authzen.transport';
 export * from './subject-from-context';
 export * from './xema-authz.service';
 export * from './policy-decisions';
+export * from './grant-version.reader';
+export * from './route-action-evaluator';
 export * from './internal-caller-or-member-context.guard';
 export * from './organization-delegation-admission';
 export * from './relayable-caller';
+export * from './durable-delegation/decision-codes';
+export * from './durable-delegation/holder-client';
+export * from './durable-delegation/holder-errors';
+export * from './durable-delegation/holder-lifecycle';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC;AACnC,cAAc,qCAAqC,CAAC;AACpD,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC"}

package/dist/index.js

@@ -22,7 +22,13 @@ __exportStar(require("./authzen.transport"), exports);
 __exportStar(require("./subject-from-context"), exports);
 __exportStar(require("./xema-authz.service"), exports);
 __exportStar(require("./policy-decisions"), exports);
+__exportStar(require("./grant-version.reader"), exports);
+__exportStar(require("./route-action-evaluator"), exports);
 __exportStar(require("./internal-caller-or-member-context.guard"), exports);
 __exportStar(require("./organization-delegation-admission"), exports);
 __exportStar(require("./relayable-caller"), exports);
+__exportStar(require("./durable-delegation/decision-codes"), exports);
+__exportStar(require("./durable-delegation/holder-client"), exports);
+__exportStar(require("./durable-delegation/holder-errors"), exports);
+__exportStar(require("./durable-delegation/holder-lifecycle"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,yDAAuC;AACvC,2DAAyC;AACzC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC;AACnC,sEAAoD;AACpD,qEAAmD;AACnD,qEAAmD;AACnD,wEAAsD"}

package/dist/route-action-evaluator.d.ts

@@ -0,0 +1,38 @@
+import { type CapabilityRef } from '@xemahq/contracts/capability';
+import { type AuthorizationGrantVersionReader } from './grant-version.reader';
+import { XemaPolicyDecisions } from './policy-decisions';
+import type { RequestContext } from '@xemahq/platform-common';
+export interface RouteActionCandidate<Action extends string> {
+    readonly key: string;
+    readonly action: Action;
+    readonly capabilityRef: CapabilityRef;
+}
+export type RouteActionScope = {
+    readonly kind: 'org';
+    readonly orgId: string;
+} | {
+    readonly kind: 'project';
+    readonly orgId: string;
+    readonly projectId: string;
+} | {
+    readonly kind: 'platform';
+    readonly orgId: string;
+};
+export interface RouteActionEvaluation<Action extends string> {
+    readonly allowed: ReadonlyMap<string, Action>;
+    readonly policyRevision: number;
+}
+export declare enum RouteActionPolicyErrorCode {
+    CrossOrg = "ROUTE_ACTION_POLICY_CROSS_ORG",
+    CrossProject = "ROUTE_ACTION_POLICY_CROSS_PROJECT",
+    Stale = "ROUTE_ACTION_POLICY_STALE",
+    RequestRejected = "ROUTE_ACTION_POLICY_REQUEST_REJECTED",
+    Unavailable = "ROUTE_ACTION_POLICY_UNAVAILABLE"
+}
+export declare class XemaRouteActionEvaluator {
+    private readonly decisions;
+    private readonly grantVersions;
+    constructor(decisions: XemaPolicyDecisions, grantVersions: AuthorizationGrantVersionReader);
+    evaluate<Action extends string>(context: RequestContext, scope: RouteActionScope, candidates: readonly RouteActionCandidate<Action>[]): Promise<RouteActionEvaluation<Action>>;
+}
+//# sourceMappingURL=route-action-evaluator.d.ts.map

package/dist/route-action-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-action-evaluator.d.ts","sourceRoot":"","sources":["../src/route-action-evaluator.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAUlE,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAA8B,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGrF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG9D,MAAM,WAAW,oBAAoB,CAAC,MAAM,SAAS,MAAM;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAGD,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAEhF;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,qBAAqB,CAAC,MAAM,SAAS,MAAM;IAE1D,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAGD,oBAAY,0BAA0B;IACpC,QAAQ,kCAAkC;IAC1C,YAAY,sCAAsC;IAClD,KAAK,8BAA8B;IACnC,eAAe,yCAAyC;IACxD,WAAW,oCAAoC;CAChD;AA6BD,qBACa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,SAAS,EAAE,mBAAmB,EAE9B,aAAa,EAAE,+BAA+B;IAGpD,QAAQ,CAAC,MAAM,SAAS,MAAM,EACzC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,gBAAgB,EACvB,UAAU,EAAE,SAAS,oBAAoB,CAAC,MAAM,CAAC,EAAE,GAClD,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;CAsD1C"}

package/dist/route-action-evaluator.js

@@ -0,0 +1,146 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaRouteActionEvaluator = exports.RouteActionPolicyErrorCode = void 0;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const execution_context_1 = require("@xemahq/contracts/execution-context");
+const execution_environment_1 = require("@xemahq/contracts/execution-environment");
+const policy_1 = require("@xemahq/contracts/policy");
+const space_1 = require("@xemahq/contracts/space");
+const authzen_transport_1 = require("./authzen.transport");
+const grant_version_reader_1 = require("./grant-version.reader");
+const policy_decisions_1 = require("./policy-decisions");
+const relayable_caller_1 = require("./relayable-caller");
+var RouteActionPolicyErrorCode;
+(function (RouteActionPolicyErrorCode) {
+    RouteActionPolicyErrorCode["CrossOrg"] = "ROUTE_ACTION_POLICY_CROSS_ORG";
+    RouteActionPolicyErrorCode["CrossProject"] = "ROUTE_ACTION_POLICY_CROSS_PROJECT";
+    RouteActionPolicyErrorCode["Stale"] = "ROUTE_ACTION_POLICY_STALE";
+    RouteActionPolicyErrorCode["RequestRejected"] = "ROUTE_ACTION_POLICY_REQUEST_REJECTED";
+    RouteActionPolicyErrorCode["Unavailable"] = "ROUTE_ACTION_POLICY_UNAVAILABLE";
+})(RouteActionPolicyErrorCode || (exports.RouteActionPolicyErrorCode = RouteActionPolicyErrorCode = {}));
+class PolicyRevisionChangedError extends Error {
+    constructor(before, after) {
+        super(`Authorization policy revision changed from ${before} to ${after}.`);
+        this.name = PolicyRevisionChangedError.name;
+    }
+}
+let XemaRouteActionEvaluator = class XemaRouteActionEvaluator {
+    decisions;
+    grantVersions;
+    constructor(decisions, grantVersions) {
+        this.decisions = decisions;
+        this.grantVersions = grantVersions;
+    }
+    async evaluate(context, scope, candidates) {
+        assertScope(context, scope);
+        assertUniqueKeys(candidates);
+        try {
+            const revisionBefore = await this.grantVersions.read(scope.orgId);
+            if (candidates.length === 0) {
+                return { allowed: new Map(), policyRevision: revisionBefore };
+            }
+            const forwardedCaller = (0, relayable_caller_1.relayableCallerContext)(context, scope.orgId);
+            const decisions = await this.decisions.decideAll(candidates.map((candidate) => toPolicyRequest(context, scope, candidate)), forwardedCaller === undefined ? undefined : { forwardedCaller });
+            const revisionAfter = await this.grantVersions.read(scope.orgId);
+            if (revisionAfter !== revisionBefore) {
+                throw new PolicyRevisionChangedError(revisionBefore, revisionAfter);
+            }
+            const allowed = new Map();
+            decisions.forEach((decision, index) => {
+                const candidate = candidates[index];
+                if (decision.kind === policy_1.PolicyDecisionKind.Allow && candidate !== undefined) {
+                    allowed.set(candidate.key, candidate.action);
+                }
+            });
+            return { allowed, policyRevision: revisionAfter };
+        }
+        catch (error) {
+            if (error instanceof PolicyRevisionChangedError) {
+                throw new common_1.ServiceUnavailableException({
+                    code: RouteActionPolicyErrorCode.Stale,
+                    message: 'Authorization policy changed during action evaluation; refresh and retry.',
+                });
+            }
+            const status = error instanceof policy_decisions_1.PolicyDecisionRequestError || error instanceof authzen_transport_1.AuthzenPdpError
+                ? error.status
+                : undefined;
+            if (status !== undefined && status >= 400 && status < 500 && status !== 408 && status !== 429) {
+                throw new common_1.InternalServerErrorException({
+                    code: RouteActionPolicyErrorCode.RequestRejected,
+                    message: `Authorization policy refused this service's evaluation request (HTTP ${status}); ` +
+                        `actions are denied fail-closed. This is a defect in the calling service, not a policy-plane outage: ` +
+                        error.message,
+                });
+            }
+            throw new common_1.ServiceUnavailableException({
+                code: RouteActionPolicyErrorCode.Unavailable,
+                message: 'Authorization policy is unavailable; actions are denied fail-closed.',
+            });
+        }
+    }
+};
+exports.XemaRouteActionEvaluator = XemaRouteActionEvaluator;
+exports.XemaRouteActionEvaluator = XemaRouteActionEvaluator = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(grant_version_reader_1.AUTHORIZATION_GRANT_VERSION_READER)),
+    __metadata("design:paramtypes", [policy_decisions_1.XemaPolicyDecisions, Object])
+], XemaRouteActionEvaluator);
+function assertScope(context, scope) {
+    if (scope.orgId !== context.orgId) {
+        throw new common_1.ForbiddenException({
+            code: RouteActionPolicyErrorCode.CrossOrg,
+            message: 'The action resource does not belong to the active organization.',
+        });
+    }
+    if (scope.kind === 'project' && context.projectId !== scope.projectId) {
+        throw new common_1.ForbiddenException({
+            code: RouteActionPolicyErrorCode.CrossProject,
+            message: 'The action resource does not belong to the active project.',
+        });
+    }
+}
+function assertUniqueKeys(candidates) {
+    const keys = new Set();
+    for (const candidate of candidates) {
+        if (candidate.key.length === 0 || keys.has(candidate.key)) {
+            throw new Error('Route action candidates require unique non-empty keys.');
+        }
+        keys.add(candidate.key);
+    }
+}
+function toPolicyRequest(context, scope, candidate) {
+    const environment = scope.kind === 'platform'
+        ? execution_environment_1.ExecutionEnvironmentKind.System
+        : scope.kind === 'project'
+            ? execution_environment_1.ExecutionEnvironmentKind.Project
+            : execution_environment_1.ExecutionEnvironmentKind.Org;
+    return {
+        id: (0, node_crypto_1.randomUUID)(),
+        requestId: context.correlationId,
+        traceId: context.correlationId,
+        subject: { kind: context.subject.kind, id: context.subject.id },
+        caller: { kind: execution_context_1.CallerKind.Web },
+        space: scope.kind === 'platform'
+            ? { tier: space_1.SpaceKind.System, orgId: scope.orgId }
+            : scope.kind === 'project'
+                ? { tier: space_1.SpaceKind.Project, orgId: scope.orgId, projectId: scope.projectId }
+                : { tier: space_1.SpaceKind.Org, orgId: scope.orgId },
+        environment: { id: (0, execution_environment_1.formatEnvironmentRef)(environment), kind: environment },
+        capability: { ref: candidate.capabilityRef },
+        ...(context.delegation === undefined ? {} : { delegation: context.delegation }),
+    };
+}
+//# sourceMappingURL=route-action-evaluator.js.map

package/dist/route-action-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-action-evaluator.js","sourceRoot":"","sources":["../src/route-action-evaluator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAAyC;AAEzC,2CAMwB;AAExB,2EAAiE;AACjE,mFAGiD;AACjD,qDAAkF;AAClF,mDAAoD;AAEpD,2DAAsD;AACtD,iEAGgC;AAChC,yDAAqF;AACrF,yDAA4D;AA0B5D,IAAY,0BAMX;AAND,WAAY,0BAA0B;IACpC,wEAA0C,CAAA;IAC1C,gFAAkD,CAAA;IAClD,iEAAmC,CAAA;IACnC,sFAAwD,CAAA;IACxD,6EAA+C,CAAA;AACjD,CAAC,EANW,0BAA0B,0CAA1B,0BAA0B,QAMrC;AAED,MAAM,0BAA2B,SAAQ,KAAK;IAC5C,YAAmB,MAAc,EAAE,KAAa;QAC9C,KAAK,CAAC,8CAA8C,MAAM,OAAO,KAAK,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC;IAC9C,CAAC;CACF;AAuBM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAEhB;IAEA;IAHnB,YACmB,SAA8B,EAE9B,aAA8C;QAF9C,cAAS,GAAT,SAAS,CAAqB;QAE9B,kBAAa,GAAb,aAAa,CAAiC;IAC9D,CAAC;IAEG,KAAK,CAAC,QAAQ,CACnB,OAAuB,EACvB,KAAuB,EACvB,UAAmD;QAEnD,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC;YAChE,CAAC;YACD,MAAM,eAAe,GAAG,IAAA,yCAAsB,EAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAC9C,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EACzE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAChE,CAAC;YACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,aAAa,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,0BAA0B,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;YAC1C,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;gBACpC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;gBACpC,IAAI,QAAQ,CAAC,IAAI,KAAK,2BAAkB,CAAC,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC1E,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAChD,MAAM,IAAI,oCAA2B,CAAC;oBACpC,IAAI,EAAE,0BAA0B,CAAC,KAAK;oBACtC,OAAO,EAAE,2EAA2E;iBACrF,CAAC,CAAC;YACL,CAAC;YAID,MAAM,MAAM,GACV,KAAK,YAAY,6CAA0B,IAAI,KAAK,YAAY,mCAAe;gBAC7E,CAAC,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9F,MAAM,IAAI,qCAA4B,CAAC;oBACrC,IAAI,EAAE,0BAA0B,CAAC,eAAe;oBAChD,OAAO,EACL,wEAAwE,MAAM,KAAK;wBACnF,sGAAsG;wBACrG,KAAe,CAAC,OAAO;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,oCAA2B,CAAC;gBACpC,IAAI,EAAE,0BAA0B,CAAC,WAAW;gBAC5C,OAAO,EAAE,sEAAsE;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AAjEY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,eAAM,EAAC,yDAAkC,CAAC,CAAA;qCADf,sCAAmB;GAFtC,wBAAwB,CAiEpC;AAED,SAAS,WAAW,CAAC,OAAuB,EAAE,KAAuB;IACnE,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAA0B,CAAC,QAAQ;YACzC,OAAO,EAAE,iEAAiE;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAA0B,CAAC,YAAY;YAC7C,OAAO,EAAE,4DAA4D;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAmD;IAEnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,OAAuB,EACvB,KAAuB,EACvB,SAAuC;IAEvC,MAAM,WAAW,GACf,KAAK,CAAC,IAAI,KAAK,UAAU;QACvB,CAAC,CAAC,gDAAwB,CAAC,MAAM;QACjC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;YACxB,CAAC,CAAC,gDAAwB,CAAC,OAAO;YAClC,CAAC,CAAC,gDAAwB,CAAC,GAAG,CAAC;IACrC,OAAO;QACL,EAAE,EAAE,IAAA,wBAAU,GAAE;QAChB,SAAS,EAAE,OAAO,CAAC,aAAa;QAChC,OAAO,EAAE,OAAO,CAAC,aAAa;QAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE;QAC/D,MAAM,EAAE,EAAE,IAAI,EAAE,8BAAU,CAAC,GAAG,EAAE;QAChC,KAAK,EACH,KAAK,CAAC,IAAI,KAAK,UAAU;YACvB,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAChD,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAS,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;gBAC7E,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAS,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;QACnD,WAAW,EAAE,EAAE,EAAE,EAAE,IAAA,4CAAoB,EAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;QACzE,UAAU,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE;QAC5C,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;KAChF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-nest",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "AuthZEN 1.0 PEP for Xema services: one Nest module, an AuthZEN client against authorization-api, and the @Authorize route guard.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -24,11 +24,11 @@
     "@nestjs/common": "11.1.18",
     "@nestjs/core": "11.1.18",
     "@nestjs/testing": "11.1.18",
-    "@xemahq/contracts": ">=0.50.0",
-    "@xemahq/eslint-config": "^0.5.0",
-    "@xemahq/identity-client": "^0.15.5",
-    "@xemahq/platform-common": "^0.59.0",
-    "@xemahq/service-registry-nest": "^0.19.0",
+    "@xemahq/contracts": ">=0.59.0",
+    "@xemahq/eslint-config": "^0.12.0",
+    "@xemahq/identity-client": "^0.16.0",
+    "@xemahq/platform-common": "^0.64.0",
+    "@xemahq/service-registry-nest": "^0.20.0",
     "@types/jest": "^30.0.0",
     "@types/node": "25.2.3",
     "eslint": "^9.39.4",