@xemahq/authorization-nest 0.5.0 → 0.6.0

package/dist/durable-delegation/decision-codes.d.ts

@@ -0,0 +1,6 @@
+export declare enum DurableDelegationDecisionCode {
+    AuthorityUnavailable = "DURABLE_DELEGATION_AUTHORITY_UNAVAILABLE",
+    Ended = "DURABLE_DELEGATION_ENDED"
+}
+export declare function isDurableDelegationDecisionCode(reason: string | undefined): reason is DurableDelegationDecisionCode;
+//# sourceMappingURL=decision-codes.d.ts.map

package/dist/durable-delegation/decision-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-codes.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/decision-codes.ts"],"names":[],"mappings":"AAgBA,oBAAY,6BAA6B;IACvC,oBAAoB,6CAA6C;IACjE,KAAK,6BAA6B;CACnC;AAGD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,MAAM,IAAI,6BAA6B,CAKzC"}

package/dist/durable-delegation/decision-codes.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DurableDelegationDecisionCode = void 0;
+exports.isDurableDelegationDecisionCode = isDurableDelegationDecisionCode;
+var DurableDelegationDecisionCode;
+(function (DurableDelegationDecisionCode) {
+    DurableDelegationDecisionCode["AuthorityUnavailable"] = "DURABLE_DELEGATION_AUTHORITY_UNAVAILABLE";
+    DurableDelegationDecisionCode["Ended"] = "DURABLE_DELEGATION_ENDED";
+})(DurableDelegationDecisionCode || (exports.DurableDelegationDecisionCode = DurableDelegationDecisionCode = {}));
+function isDurableDelegationDecisionCode(reason) {
+    return (reason === DurableDelegationDecisionCode.AuthorityUnavailable ||
+        reason === DurableDelegationDecisionCode.Ended);
+}
+//# sourceMappingURL=decision-codes.js.map

package/dist/durable-delegation/decision-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-codes.js","sourceRoot":"","sources":["../../src/durable-delegation/decision-codes.ts"],"names":[],"mappings":";;;AAsBA,0EAOC;AAbD,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,kGAAiE,CAAA;IACjE,mEAAkC,CAAA;AACpC,CAAC,EAHW,6BAA6B,6CAA7B,6BAA6B,QAGxC;AAGD,SAAgB,+BAA+B,CAC7C,MAA0B;IAE1B,OAAO,CACL,MAAM,KAAK,6BAA6B,CAAC,oBAAoB;QAC7D,MAAM,KAAK,6BAA6B,CAAC,KAAK,CAC/C,CAAC;AACJ,CAAC"}

package/dist/durable-delegation/holder-client.d.ts

@@ -0,0 +1,65 @@
+import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
+import { IdentityBootstrapService } from '@xemahq/identity-client';
+import { type ForwardedCallerContext } from '@xemahq/platform-common';
+export declare enum DurableDelegationOwnerKind {
+    User = "USER",
+    Team = "TEAM",
+    Org = "ORG"
+}
+export declare enum DurableDelegationRecordState {
+    Provisioning = "PROVISIONING",
+    Active = "ACTIVE",
+    Revoked = "REVOKED",
+    Expired = "EXPIRED"
+}
+export interface DurableDelegationCreate {
+    readonly owner: {
+        readonly kind: DurableDelegationOwnerKind;
+        readonly id: string;
+    };
+    readonly scope: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly integrationId: string;
+    readonly environmentId: string;
+    readonly requestKey: string;
+    readonly holderMember?: string;
+    readonly expiresAt?: Date;
+}
+export interface DurableDelegationView {
+    readonly id: string;
+    readonly state: DurableDelegationRecordState;
+    readonly endReason?: string;
+    readonly owner: {
+        readonly kind: DurableDelegationOwnerKind;
+        readonly id: string;
+    };
+    readonly scope: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly integrationId: string;
+    readonly environmentId: string;
+    readonly holderWorkload: string;
+    readonly carrierId?: string;
+    readonly expiresAt?: string;
+    readonly lastDenial?: {
+        readonly at: string;
+        readonly check: string;
+        readonly right: string;
+        readonly scope: string;
+    };
+}
+export declare class DurableDelegationRequestError extends Error {
+    readonly status: number;
+    readonly code: string | undefined;
+    constructor(message: string, status: number, code: string | undefined);
+}
+export declare class DurableDelegationHolderClient {
+    private readonly registry;
+    private readonly identity;
+    constructor(registry: ServiceRegistry, identity: IdentityBootstrapService);
+    create(author: ForwardedCallerContext, request: DurableDelegationCreate): Promise<DurableDelegationView>;
+    read(orgId: string, delegationId: string): Promise<DurableDelegationView>;
+    revoke(orgId: string, delegationId: string): Promise<DurableDelegationView>;
+    mintContext(carrierId: string): Promise<string>;
+    private send;
+}
+//# sourceMappingURL=holder-client.d.ts.map

package/dist/durable-delegation/holder-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-client.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-client.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AAOjC,oBAAY,0BAA0B;IACpC,IAAI,SAAS;IACb,IAAI,SAAS;IACb,GAAG,QAAQ;CACZ;AAGD,oBAAY,4BAA4B;IACtC,YAAY,iBAAiB;IAC7B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAGpC,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AAmBD,qBACa,6BAA6B;IAEN,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADwB,QAAQ,EAAE,eAAe,EACzD,QAAQ,EAAE,wBAAwB;IAGxC,MAAM,CACjB,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IAepB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IASzE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAc3E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAQ9C,IAAI;CA8BnB"}

package/dist/durable-delegation/holder-client.js

@@ -0,0 +1,113 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DurableDelegationHolderClient = exports.DurableDelegationRequestError = exports.DurableDelegationRecordState = exports.DurableDelegationOwnerKind = void 0;
+const common_1 = require("@nestjs/common");
+const service_registry_1 = require("@xemahq/contracts/service-registry");
+const identity_client_1 = require("@xemahq/identity-client");
+const platform_common_1 = require("@xemahq/platform-common");
+const service_registry_nest_1 = require("@xemahq/service-registry-nest");
+var DurableDelegationOwnerKind;
+(function (DurableDelegationOwnerKind) {
+    DurableDelegationOwnerKind["User"] = "USER";
+    DurableDelegationOwnerKind["Team"] = "TEAM";
+    DurableDelegationOwnerKind["Org"] = "ORG";
+})(DurableDelegationOwnerKind || (exports.DurableDelegationOwnerKind = DurableDelegationOwnerKind = {}));
+var DurableDelegationRecordState;
+(function (DurableDelegationRecordState) {
+    DurableDelegationRecordState["Provisioning"] = "PROVISIONING";
+    DurableDelegationRecordState["Active"] = "ACTIVE";
+    DurableDelegationRecordState["Revoked"] = "REVOKED";
+    DurableDelegationRecordState["Expired"] = "EXPIRED";
+})(DurableDelegationRecordState || (exports.DurableDelegationRecordState = DurableDelegationRecordState = {}));
+class DurableDelegationRequestError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'DurableDelegationRequestError';
+    }
+}
+exports.DurableDelegationRequestError = DurableDelegationRequestError;
+const DELEGATED_CONTEXT_AUDIENCE = service_registry_1.ServiceName.XEMA_CAPABILITY_ROUTER;
+let DurableDelegationHolderClient = class DurableDelegationHolderClient {
+    registry;
+    identity;
+    constructor(registry, identity) {
+        this.registry = registry;
+        this.identity = identity;
+    }
+    async create(author, request) {
+        return this.send('POST', '/durable-delegations', author.orgId, {
+            ...(await (0, platform_common_1.forwardedCallerHeaders)(author, this.identity)),
+        }, {
+            owner: request.owner,
+            scope: [...request.scope],
+            capabilities: [...request.capabilities],
+            integrationId: request.integrationId,
+            environmentId: request.environmentId,
+            requestKey: request.requestKey,
+            ...(request.holderMember === undefined ? {} : { holderMember: request.holderMember }),
+            ...(request.expiresAt === undefined ? {} : { expiresAt: request.expiresAt.toISOString() }),
+        });
+    }
+    async read(orgId, delegationId) {
+        return this.send('GET', `/internal/durable-delegations/${encodeURIComponent(delegationId)}`, orgId, { Authorization: `Bearer ${await this.identity.getAccessToken()}` });
+    }
+    async revoke(orgId, delegationId) {
+        return this.send('POST', `/internal/durable-delegations/${encodeURIComponent(delegationId)}/revoke`, orgId, { Authorization: `Bearer ${await this.identity.getAccessToken()}` });
+    }
+    async mintContext(carrierId) {
+        const minted = await this.identity.mintDelegatedContext({
+            delegationId: carrierId,
+            audience: DELEGATED_CONTEXT_AUDIENCE,
+        });
+        return minted.accessToken;
+    }
+    async send(method, path, orgId, headers, body) {
+        const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
+        const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, {
+            method,
+            headers: {
+                ...headers,
+                'X-Xema-Org-Id': orgId,
+                ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+            },
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            throw new DurableDelegationRequestError(`authorization-api ${method} ${path} failed with HTTP ${response.status}: ${text.slice(0, 2000)}`, response.status, codeOf(text));
+        }
+        return (0, platform_common_1.unwrapPlatformResponseEnvelope)(await response.json(), `authorization-api ${method} ${path}`);
+    }
+};
+exports.DurableDelegationHolderClient = DurableDelegationHolderClient;
+exports.DurableDelegationHolderClient = DurableDelegationHolderClient = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(service_registry_nest_1.SERVICE_REGISTRY_TOKEN)),
+    __metadata("design:paramtypes", [Object, identity_client_1.IdentityBootstrapService])
+], DurableDelegationHolderClient);
+function codeOf(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed.code === 'string' ? parsed.code : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=holder-client.js.map

package/dist/durable-delegation/holder-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-client.js","sourceRoot":"","sources":["../../src/durable-delegation/holder-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,yEAG4C;AAC5C,6DAAmE;AACnE,6DAIiC;AACjC,yEAGuC;AAGvC,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,2CAAa,CAAA;IACb,2CAAa,CAAA;IACb,yCAAW,CAAA;AACb,CAAC,EAJW,0BAA0B,0CAA1B,0BAA0B,QAIrC;AAGD,IAAY,4BAKX;AALD,WAAY,4BAA4B;IACtC,6DAA6B,CAAA;IAC7B,iDAAiB,CAAA;IACjB,mDAAmB,CAAA;IACnB,mDAAmB,CAAA;AACrB,CAAC,EALW,4BAA4B,4CAA5B,4BAA4B,QAKvC;AAuCD,MAAa,6BAA8B,SAAQ,KAAK;IAGpC;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AATD,sEASC;AAGD,MAAM,0BAA0B,GAAG,8BAAW,CAAC,sBAAsB,CAAC;AAiB/D,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAEW;IAChC;IAFnB,YACmD,QAAyB,EACzD,QAAkC;QADF,aAAQ,GAAR,QAAQ,CAAiB;QACzD,aAAQ,GAAR,QAAQ,CAA0B;IAClD,CAAC;IAEG,KAAK,CAAC,MAAM,CACjB,MAA8B,EAC9B,OAAgC;QAEhC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,CAAC,KAAK,EAAE;YAC7D,GAAG,CAAC,MAAM,IAAA,wCAAsB,EAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;SACzD,EAAE;YACD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;YACzB,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;YACvC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,YAAoB;QACnD,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,EAAE,EACnE,KAAK,EACL,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,EAAE,CACpE,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,YAAoB;QACrD,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,EACN,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAC1E,KAAK,EACL,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,EAAE,CACpE,CAAC;IACJ,CAAC;IAOM,KAAK,CAAC,WAAW,CAAC,SAAiB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACtD,YAAY,EAAE,SAAS;YACvB,QAAQ,EAAE,0BAA0B;SACrC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,MAAsB,EACtB,IAAY,EACZ,KAAa,EACb,OAA+B,EAC/B,IAAc;QAEd,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAAC,IAAI,CAAC,QAAQ,EAAE,8BAAW,CAAC,iBAAiB,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM;YACN,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,eAAe,EAAE,KAAK;gBACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aACtE;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,6BAA6B,CACrC,qBAAqB,MAAM,IAAI,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EACjG,QAAQ,CAAC,MAAM,EACf,MAAM,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,gDAA8B,EACnC,MAAM,QAAQ,CAAC,IAAI,EAAE,EACrB,qBAAqB,MAAM,IAAI,IAAI,EAAE,CACtC,CAAC;IACJ,CAAC;CACF,CAAA;AArFY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;6CACJ,0CAAwB;GAH1C,6BAA6B,CAqFzC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;QACtD,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/durable-delegation/holder-errors.d.ts

@@ -0,0 +1,22 @@
+export declare enum DelegationRequiredReason {
+    NeverAuthorised = "never-authorised",
+    Unprovisioned = "unprovisioned",
+    Ended = "ended",
+    Stale = "stale"
+}
+export declare class DelegationRequiredError extends Error {
+    readonly reason: DelegationRequiredReason;
+    readonly subject: string;
+    constructor(reason: DelegationRequiredReason, subject: string);
+}
+export declare class DelegationUseDeniedError extends Error {
+    readonly delegationId: string;
+    readonly detail: string;
+    constructor(delegationId: string, detail: string);
+}
+export declare class DelegationEndedError extends Error {
+    readonly delegationId: string;
+    readonly endReason: string | undefined;
+    constructor(delegationId: string, endReason: string | undefined);
+}
+//# sourceMappingURL=holder-errors.d.ts.map

package/dist/durable-delegation/holder-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-errors.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-errors.ts"],"names":[],"mappings":"AAkBA,oBAAY,wBAAwB;IAElC,eAAe,qBAAqB;IAEpC,aAAa,kBAAkB;IAE/B,KAAK,UAAU;IAEf,KAAK,UAAU;CAChB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,MAAM,EAAE,wBAAwB;aAChC,OAAO,EAAE,MAAM;gBADf,MAAM,EAAE,wBAAwB,EAChC,OAAO,EAAE,MAAM;CAKlC;AAED,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,YAAY,EAAE,MAAM;aACpB,MAAM,EAAE,MAAM;gBADd,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM;CAKjC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;aAE3B,YAAY,EAAE,MAAM;aACpB,SAAS,EAAE,MAAM,GAAG,SAAS;gBAD7B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAAG,SAAS;CAKhD"}

package/dist/durable-delegation/holder-errors.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationEndedError = exports.DelegationUseDeniedError = exports.DelegationRequiredError = exports.DelegationRequiredReason = void 0;
+var DelegationRequiredReason;
+(function (DelegationRequiredReason) {
+    DelegationRequiredReason["NeverAuthorised"] = "never-authorised";
+    DelegationRequiredReason["Unprovisioned"] = "unprovisioned";
+    DelegationRequiredReason["Ended"] = "ended";
+    DelegationRequiredReason["Stale"] = "stale";
+})(DelegationRequiredReason || (exports.DelegationRequiredReason = DelegationRequiredReason = {}));
+class DelegationRequiredError extends Error {
+    reason;
+    subject;
+    constructor(reason, subject) {
+        super(`${subject} needs a person to authorise its durable work (${reason}).`);
+        this.reason = reason;
+        this.subject = subject;
+        this.name = 'DelegationRequiredError';
+    }
+}
+exports.DelegationRequiredError = DelegationRequiredError;
+class DelegationUseDeniedError extends Error {
+    delegationId;
+    detail;
+    constructor(delegationId, detail) {
+        super(`authority currently unavailable for durable delegation ${delegationId}: ${detail}`);
+        this.delegationId = delegationId;
+        this.detail = detail;
+        this.name = 'DelegationUseDeniedError';
+    }
+}
+exports.DelegationUseDeniedError = DelegationUseDeniedError;
+class DelegationEndedError extends Error {
+    delegationId;
+    endReason;
+    constructor(delegationId, endReason) {
+        super(`durable delegation ${delegationId} has ended${endReason === undefined ? '' : ` (${endReason})`}.`);
+        this.delegationId = delegationId;
+        this.endReason = endReason;
+        this.name = 'DelegationEndedError';
+    }
+}
+exports.DelegationEndedError = DelegationEndedError;
+//# sourceMappingURL=holder-errors.js.map

package/dist/durable-delegation/holder-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-errors.js","sourceRoot":"","sources":["../../src/durable-delegation/holder-errors.ts"],"names":[],"mappings":";;;AAkBA,IAAY,wBASX;AATD,WAAY,wBAAwB;IAElC,gEAAoC,CAAA;IAEpC,2DAA+B,CAAA;IAE/B,2CAAe,CAAA;IAEf,2CAAe,CAAA;AACjB,CAAC,EATW,wBAAwB,wCAAxB,wBAAwB,QASnC;AAED,MAAa,uBAAwB,SAAQ,KAAK;IAE9B;IACA;IAFlB,YACkB,MAAgC,EAChC,OAAe;QAE/B,KAAK,CAAC,GAAG,OAAO,kDAAkD,MAAM,IAAI,CAAC,CAAC;QAH9D,WAAM,GAAN,MAAM,CAA0B;QAChC,YAAO,GAAP,OAAO,CAAQ;QAG/B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AARD,0DAQC;AAED,MAAa,wBAAyB,SAAQ,KAAK;IAE/B;IACA;IAFlB,YACkB,YAAoB,EACpB,MAAc;QAE9B,KAAK,CAAC,0DAA0D,YAAY,KAAK,MAAM,EAAE,CAAC,CAAC;QAH3E,iBAAY,GAAZ,YAAY,CAAQ;QACpB,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AARD,4DAQC;AAED,MAAa,oBAAqB,SAAQ,KAAK;IAE3B;IACA;IAFlB,YACkB,YAAoB,EACpB,SAA6B;QAE7C,KAAK,CAAC,sBAAsB,YAAY,aAAa,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,GAAG,GAAG,CAAC,CAAC;QAH1F,iBAAY,GAAZ,YAAY,CAAQ;QACpB,cAAS,GAAT,SAAS,CAAoB;QAG7C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AARD,oDAQC"}

package/dist/durable-delegation/holder-lifecycle.d.ts

@@ -0,0 +1,43 @@
+import { type DurableDelegationCreate, DurableDelegationHolderClient, type DurableDelegationView } from './holder-client';
+import { DelegationEndedError, DelegationUseDeniedError } from './holder-errors';
+import type { ForwardedCallerContext } from '@xemahq/platform-common';
+export declare enum HolderDelegationState {
+    NotRequired = "not_required",
+    Required = "required",
+    Unprovisioned = "unprovisioned",
+    Held = "held",
+    Ended = "ended"
+}
+export interface HolderDelegationRow {
+    readonly state: HolderDelegationState;
+    readonly delegationId: string | null;
+    readonly carrierId: string | null;
+    readonly capabilities: readonly string[];
+}
+export interface HolderDelegationStore {
+    read(): Promise<HolderDelegationRow | null>;
+    writeIf(expected: Pick<HolderDelegationRow, 'state' | 'delegationId'>, next: HolderDelegationRow): Promise<boolean>;
+}
+export interface HolderDelegationNeed {
+    readonly capabilities: readonly string[];
+}
+export interface HeldAuthority {
+    readonly delegationId: string;
+    readonly orgId: string;
+    readonly authorization: string;
+}
+export declare class DurableDelegationHolder {
+    private readonly client;
+    private readonly logger;
+    constructor(client: DurableDelegationHolderClient);
+    reconcileNeed(store: HolderDelegationStore, orgId: string, need: HolderDelegationNeed | null): Promise<HolderDelegationRow>;
+    authorize(store: HolderDelegationStore, author: ForwardedCallerContext, request: DurableDelegationCreate): Promise<HolderDelegationRow>;
+    authority(row: HolderDelegationRow, orgId: string, subject: string): Promise<HeldAuthority>;
+    onDenied(store: HolderDelegationStore, row: HolderDelegationRow, reason: string | undefined, detail: string): Promise<DelegationUseDeniedError | DelegationEndedError | undefined>;
+    refresh(store: HolderDelegationStore, orgId: string): Promise<HolderDelegationRow | null>;
+    endFor(row: HolderDelegationRow, orgId: string): Promise<void>;
+    private revokeQuietly;
+}
+export declare function rowOf(view: DurableDelegationView): HolderDelegationRow;
+export declare function needTransition(row: HolderDelegationRow, need: HolderDelegationNeed | null): HolderDelegationRow | null;
+//# sourceMappingURL=holder-lifecycle.d.ts.map

package/dist/durable-delegation/holder-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-lifecycle.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-lifecycle.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,uBAAuB,EAC5B,6BAA6B,EAE7B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EAGpB,wBAAwB,EACzB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAWtE,oBAAY,qBAAqB;IAE/B,WAAW,iBAAiB;IAE5B,QAAQ,aAAa;IAErB,aAAa,kBAAkB;IAE/B,IAAI,SAAS;IAEb,KAAK,UAAU;CAChB;AAGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAElC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAQD,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC5C,OAAO,CACL,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,cAAc,CAAC,EAC7D,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAGD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAwBD,qBACa,uBAAuB;IAGf,OAAO,CAAC,QAAQ,CAAC,MAAM;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;gBAE/B,MAAM,EAAE,6BAA6B;IAE5D,aAAa,CACxB,KAAK,EAAE,qBAAqB,EAC5B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,oBAAoB,GAAG,IAAI,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAoBlB,SAAS,CACpB,KAAK,EAAE,qBAAqB,EAC5B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,mBAAmB,CAAC;IAuBlB,SAAS,CACpB,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC;IA2BZ,QAAQ,CACnB,KAAK,EAAE,qBAAqB,EAC5B,GAAG,EAAE,mBAAmB,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,GAAG,oBAAoB,GAAG,SAAS,CAAC;IAW1D,OAAO,CAAC,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAazF,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAM7D,aAAa;CAc5B;AAGD,wBAAgB,KAAK,CAAC,IAAI,EAAE,qBAAqB,GAAG,mBAAmB,CAetE;AAGD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,oBAAoB,GAAG,IAAI,GAChC,mBAAmB,GAAG,IAAI,CAgB5B"}

package/dist/durable-delegation/holder-lifecycle.js

@@ -0,0 +1,173 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var DurableDelegationHolder_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DurableDelegationHolder = exports.HolderDelegationState = void 0;
+exports.rowOf = rowOf;
+exports.needTransition = needTransition;
+const common_1 = require("@nestjs/common");
+const decision_codes_1 = require("./decision-codes");
+const holder_client_1 = require("./holder-client");
+const holder_errors_1 = require("./holder-errors");
+var HolderDelegationState;
+(function (HolderDelegationState) {
+    HolderDelegationState["NotRequired"] = "not_required";
+    HolderDelegationState["Required"] = "required";
+    HolderDelegationState["Unprovisioned"] = "unprovisioned";
+    HolderDelegationState["Held"] = "held";
+    HolderDelegationState["Ended"] = "ended";
+})(HolderDelegationState || (exports.HolderDelegationState = HolderDelegationState = {}));
+const MAX_CAS_ATTEMPTS = 3;
+let DurableDelegationHolder = DurableDelegationHolder_1 = class DurableDelegationHolder {
+    client;
+    logger = new common_1.Logger(DurableDelegationHolder_1.name);
+    constructor(client) {
+        this.client = client;
+    }
+    async reconcileNeed(store, orgId, need) {
+        for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt += 1) {
+            const row = await store.read();
+            if (row === null) {
+                throw new common_1.ConflictException('The holder row disappeared while its need was being stated.');
+            }
+            const next = needTransition(row, need);
+            if (next === null) {
+                return row;
+            }
+            if (await store.writeIf(row, next)) {
+                if (row.delegationId !== null && next.delegationId === null) {
+                    await this.revokeQuietly(orgId, row.delegationId);
+                }
+                return next;
+            }
+        }
+        throw new common_1.ConflictException('The holder row kept changing while its need was being stated.');
+    }
+    async authorize(store, author, request) {
+        const view = await this.client.create(author, request);
+        const next = rowOf(view);
+        for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt += 1) {
+            const row = await store.read();
+            if (row === null) {
+                await this.revokeQuietly(author.orgId, view.id);
+                throw new common_1.ConflictException('The holder row disappeared while it was being authorised.');
+            }
+            if (row.delegationId === view.id) {
+                return row;
+            }
+            if (await store.writeIf(row, next)) {
+                if (row.delegationId !== null) {
+                    await this.revokeQuietly(author.orgId, row.delegationId);
+                }
+                return next;
+            }
+        }
+        throw new common_1.ConflictException('The holder row kept changing while it was being authorised.');
+    }
+    async authority(row, orgId, subject) {
+        switch (row.state) {
+            case HolderDelegationState.Held:
+                break;
+            case HolderDelegationState.NotRequired:
+            case HolderDelegationState.Required:
+                throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.NeverAuthorised, subject);
+            case HolderDelegationState.Unprovisioned:
+                throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.Unprovisioned, subject);
+            case HolderDelegationState.Ended:
+                throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.Ended, subject);
+        }
+        if (row.delegationId === null || row.carrierId === null) {
+            throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.Unprovisioned, subject);
+        }
+        return {
+            delegationId: row.delegationId,
+            orgId,
+            authorization: `Bearer ${await this.client.mintContext(row.carrierId)}`,
+        };
+    }
+    async onDenied(store, row, reason, detail) {
+        if (!(0, decision_codes_1.isDurableDelegationDecisionCode)(reason) || row.delegationId === null) {
+            return undefined;
+        }
+        if (reason === decision_codes_1.DurableDelegationDecisionCode.AuthorityUnavailable) {
+            return new holder_errors_1.DelegationUseDeniedError(row.delegationId, detail);
+        }
+        await store.writeIf(row, { ...row, state: HolderDelegationState.Ended, carrierId: null });
+        return new holder_errors_1.DelegationEndedError(row.delegationId, undefined);
+    }
+    async refresh(store, orgId) {
+        const row = await store.read();
+        if (row === null || row.delegationId === null) {
+            return row;
+        }
+        const view = await this.client.read(orgId, row.delegationId);
+        const next = rowOf(view);
+        if (next.state === row.state && next.carrierId === row.carrierId) {
+            return row;
+        }
+        return (await store.writeIf(row, next)) ? next : store.read();
+    }
+    async endFor(row, orgId) {
+        if (row.delegationId !== null) {
+            await this.client.revoke(orgId, row.delegationId);
+        }
+    }
+    async revokeQuietly(orgId, delegationId) {
+        try {
+            await this.client.revoke(orgId, delegationId);
+        }
+        catch (error) {
+            this.logger.warn({
+                message: 'durable-delegation-superseded-revoke-failed',
+                delegationId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+};
+exports.DurableDelegationHolder = DurableDelegationHolder;
+exports.DurableDelegationHolder = DurableDelegationHolder = DurableDelegationHolder_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [holder_client_1.DurableDelegationHolderClient])
+], DurableDelegationHolder);
+function rowOf(view) {
+    switch (view.state) {
+        case holder_client_1.DurableDelegationRecordState.Active:
+            return {
+                state: view.carrierId === undefined ? HolderDelegationState.Unprovisioned : HolderDelegationState.Held,
+                delegationId: view.id,
+                carrierId: view.carrierId ?? null,
+                capabilities: [...view.capabilities],
+            };
+        case holder_client_1.DurableDelegationRecordState.Provisioning:
+            return { state: HolderDelegationState.Unprovisioned, delegationId: view.id, carrierId: null, capabilities: [...view.capabilities] };
+        case holder_client_1.DurableDelegationRecordState.Revoked:
+        case holder_client_1.DurableDelegationRecordState.Expired:
+            return { state: HolderDelegationState.Ended, delegationId: view.id, carrierId: null, capabilities: [...view.capabilities] };
+    }
+}
+function needTransition(row, need) {
+    if (need === null) {
+        return row.state === HolderDelegationState.NotRequired && row.delegationId === null
+            ? null
+            : { state: HolderDelegationState.NotRequired, delegationId: null, carrierId: null, capabilities: [] };
+    }
+    const lendsExactly = row.capabilities.length === need.capabilities.length &&
+        need.capabilities.every((c) => row.capabilities.includes(c));
+    if (row.delegationId !== null && lendsExactly) {
+        return null;
+    }
+    if (row.state === HolderDelegationState.Required && row.delegationId === null) {
+        return null;
+    }
+    return { state: HolderDelegationState.Required, delegationId: null, carrierId: null, capabilities: [] };
+}
+//# sourceMappingURL=holder-lifecycle.js.map

package/dist/durable-delegation/holder-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-lifecycle.js","sourceRoot":"","sources":["../../src/durable-delegation/holder-lifecycle.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAkPA,sBAeC;AAGD,wCAmBC;AAvRD,2CAAuE;AAGvE,qDAG0B;AAC1B,mDAKyB;AACzB,mDAKyB;AAazB,IAAY,qBAWX;AAXD,WAAY,qBAAqB;IAE/B,qDAA4B,CAAA;IAE5B,8CAAqB,CAAA;IAErB,wDAA+B,CAAA;IAE/B,sCAAa,CAAA;IAEb,wCAAe,CAAA;AACjB,CAAC,EAXW,qBAAqB,qCAArB,qBAAqB,QAWhC;AAsCD,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAuBpB,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAGE;IAFnB,MAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAEnE,YAAoC,MAAqC;QAArC,WAAM,GAAN,MAAM,CAA+B;IAAG,CAAC;IAEtE,KAAK,CAAC,aAAa,CACxB,KAA4B,EAC5B,KAAa,EACb,IAAiC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,0BAAiB,CAAC,6DAA6D,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,OAAO,GAAG,CAAC;YACb,CAAC;YACD,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBACnC,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;oBAC5D,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,0BAAiB,CAAC,+DAA+D,CAAC,CAAC;IAC/F,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,KAA4B,EAC5B,MAA8B,EAC9B,OAAgC;QAEhC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChD,MAAM,IAAI,0BAAiB,CAAC,2DAA2D,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBAEjC,OAAO,GAAG,CAAC;YACb,CAAC;YACD,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBACnC,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;oBAC9B,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3D,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,0BAAiB,CAAC,6DAA6D,CAAC,CAAC;IAC7F,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,GAAwB,EACxB,KAAa,EACb,OAAe;QAEf,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,qBAAqB,CAAC,IAAI;gBAC7B,MAAM;YACR,KAAK,qBAAqB,CAAC,WAAW,CAAC;YACvC,KAAK,qBAAqB,CAAC,QAAQ;gBACjC,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACvF,KAAK,qBAAqB,CAAC,aAAa;gBACtC,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACrF,KAAK,qBAAqB,CAAC,KAAK;gBAC9B,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACrF,CAAC;QACD,OAAO;YACL,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,KAAK;YACL,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;SACxE,CAAC;IACJ,CAAC;IAOM,KAAK,CAAC,QAAQ,CACnB,KAA4B,EAC5B,GAAwB,EACxB,MAA0B,EAC1B,MAAc;QAEd,IAAI,CAAC,IAAA,gDAA+B,EAAC,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,MAAM,KAAK,8CAA6B,CAAC,oBAAoB,EAAE,CAAC;YAClE,OAAO,IAAI,wCAAwB,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,OAAO,IAAI,oCAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,KAA4B,EAAE,KAAa;QAC9D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YACjE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,GAAwB,EAAE,KAAa;QACzD,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,YAAoB;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAIf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,6CAA6C;gBACtD,YAAY;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AAxIY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAIiC,6CAA6B;GAH9D,uBAAuB,CAwInC;AAGD,SAAgB,KAAK,CAAC,IAA2B;IAC/C,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,4CAA4B,CAAC,MAAM;YACtC,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI;gBACtG,YAAY,EAAE,IAAI,CAAC,EAAE;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;aACrC,CAAC;QACJ,KAAK,4CAA4B,CAAC,YAAY;YAC5C,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACtI,KAAK,4CAA4B,CAAC,OAAO,CAAC;QAC1C,KAAK,4CAA4B,CAAC,OAAO;YACvC,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;IAChI,CAAC;AACH,CAAC;AAGD,SAAgB,cAAc,CAC5B,GAAwB,EACxB,IAAiC;IAEjC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,GAAG,CAAC,KAAK,KAAK,qBAAqB,CAAC,WAAW,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI;YACjF,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,MAAM,YAAY,GAChB,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM;QACpD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,IAAI,YAAY,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,qBAAqB,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;AAC1G,CAAC"}

package/dist/index.d.ts

@@ -11,4 +11,8 @@ export * from './route-action-evaluator';
 export * from './internal-caller-or-member-context.guard';
 export * from './organization-delegation-admission';
 export * from './relayable-caller';
+export * from './durable-delegation/decision-codes';
+export * from './durable-delegation/holder-client';
+export * from './durable-delegation/holder-errors';
+export * from './durable-delegation/holder-lifecycle';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC;AACnC,cAAc,qCAAqC,CAAC;AACpD,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC"}

package/dist/index.js

@@ -27,4 +27,8 @@ __exportStar(require("./route-action-evaluator"), exports);
 __exportStar(require("./internal-caller-or-member-context.guard"), exports);
 __exportStar(require("./organization-delegation-admission"), exports);
 __exportStar(require("./relayable-caller"), exports);
+__exportStar(require("./durable-delegation/decision-codes"), exports);
+__exportStar(require("./durable-delegation/holder-client"), exports);
+__exportStar(require("./durable-delegation/holder-errors"), exports);
+__exportStar(require("./durable-delegation/holder-lifecycle"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,yDAAuC;AACvC,2DAAyC;AACzC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,yDAAuC;AACvC,2DAAyC;AACzC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC;AACnC,sEAAoD;AACpD,qEAAmD;AACnD,qEAAmD;AACnD,wEAAsD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-nest",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "AuthZEN 1.0 PEP for Xema services: one Nest module, an AuthZEN client against authorization-api, and the @Authorize route guard.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -24,11 +24,11 @@
     "@nestjs/common": "11.1.18",
     "@nestjs/core": "11.1.18",
     "@nestjs/testing": "11.1.18",
-    "@xemahq/contracts": ">=0.50.0",
-    "@xemahq/eslint-config": "^0.5.0",
+    "@xemahq/contracts": ">=0.59.0",
+    "@xemahq/eslint-config": "^0.12.0",
     "@xemahq/identity-client": "^0.16.0",
-    "@xemahq/platform-common": "^0.60.0",
-    "@xemahq/service-registry-nest": "^0.19.0",
+    "@xemahq/platform-common": "^0.64.0",
+    "@xemahq/service-registry-nest": "^0.20.0",
     "@types/jest": "^30.0.0",
     "@types/node": "25.2.3",
     "eslint": "^9.39.4",