@xemahq/authorization-nest 0.5.0 → 0.7.0

package/dist/durable-delegation/holder-client.js

@@ -0,0 +1,274 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var DurableDelegationHolderClient_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DurableDelegationHolderClient = exports.DurableDelegationRequestError = exports.DurableDelegationErrorCode = exports.DurableDelegationEndReason = exports.DurableDelegationRecordState = exports.DurableDelegationOwnerKind = void 0;
+const common_1 = require("@nestjs/common");
+const service_registry_1 = require("@xemahq/contracts/service-registry");
+const identity_client_1 = require("@xemahq/identity-client");
+const platform_common_1 = require("@xemahq/platform-common");
+const service_registry_nest_1 = require("@xemahq/service-registry-nest");
+const carrier_shape_1 = require("./carrier-shape");
+const carrier_window_1 = require("./carrier-window");
+const holder_errors_1 = require("./holder-errors");
+var DurableDelegationOwnerKind;
+(function (DurableDelegationOwnerKind) {
+    DurableDelegationOwnerKind["User"] = "USER";
+    DurableDelegationOwnerKind["Org"] = "ORG";
+})(DurableDelegationOwnerKind || (exports.DurableDelegationOwnerKind = DurableDelegationOwnerKind = {}));
+var DurableDelegationRecordState;
+(function (DurableDelegationRecordState) {
+    DurableDelegationRecordState["Provisioning"] = "PROVISIONING";
+    DurableDelegationRecordState["Active"] = "ACTIVE";
+    DurableDelegationRecordState["Revoked"] = "REVOKED";
+    DurableDelegationRecordState["Expired"] = "EXPIRED";
+})(DurableDelegationRecordState || (exports.DurableDelegationRecordState = DurableDelegationRecordState = {}));
+var DurableDelegationEndReason;
+(function (DurableDelegationEndReason) {
+    DurableDelegationEndReason["Explicit"] = "EXPLICIT";
+    DurableDelegationEndReason["AnchorInactive"] = "ANCHOR_INACTIVE";
+    DurableDelegationEndReason["AnchorDeleted"] = "ANCHOR_DELETED";
+    DurableDelegationEndReason["OwnerDeleted"] = "OWNER_DELETED";
+    DurableDelegationEndReason["Expired"] = "EXPIRED";
+    DurableDelegationEndReason["ParentEnded"] = "PARENT_ENDED";
+})(DurableDelegationEndReason || (exports.DurableDelegationEndReason = DurableDelegationEndReason = {}));
+var DurableDelegationErrorCode;
+(function (DurableDelegationErrorCode) {
+    DurableDelegationErrorCode["CreationRefused"] = "DURABLE_DELEGATION_CREATION_REFUSED";
+    DurableDelegationErrorCode["NotFound"] = "DURABLE_DELEGATION_NOT_FOUND";
+    DurableDelegationErrorCode["NotActive"] = "DURABLE_DELEGATION_NOT_ACTIVE";
+    DurableDelegationErrorCode["CarrierUnavailable"] = "DURABLE_DELEGATION_CARRIER_UNAVAILABLE";
+    DurableDelegationErrorCode["RevocationNotPermitted"] = "DURABLE_DELEGATION_REVOCATION_NOT_PERMITTED";
+    DurableDelegationErrorCode["HolderMismatch"] = "DURABLE_DELEGATION_HOLDER_IS_NOT_PRESENTER";
+    DurableDelegationErrorCode["RequestKeyConflict"] = "DURABLE_DELEGATION_REQUEST_KEY_CONFLICT";
+    DurableDelegationErrorCode["CarrierAlreadyBound"] = "DURABLE_DELEGATION_CARRIER_ALREADY_BOUND";
+    DurableDelegationErrorCode["AnchorTypeNotDeclared"] = "DELEGATION_ANCHOR_TYPE_NOT_DECLARED";
+    DurableDelegationErrorCode["AnchorOriginationNotDeclared"] = "DELEGATION_ANCHOR_ORIGINATION_NOT_DECLARED";
+    DurableDelegationErrorCode["ChainTooDeep"] = "DELEGATION_CHAIN_TOO_DEEP";
+    DurableDelegationErrorCode["Ended"] = "DURABLE_DELEGATION_ENDED";
+    DurableDelegationErrorCode["MemberBoundParent"] = "DURABLE_DELEGATION_MEMBER_BOUND_PARENT";
+    DurableDelegationErrorCode["RootCarrierNotPresenterRenewed"] = "DURABLE_DELEGATION_ROOT_CARRIER_NOT_PRESENTER_RENEWED";
+    DurableDelegationErrorCode["BeyondHolderDeclarations"] = "DELEGATION_BEYOND_HOLDER_DECLARATIONS";
+    DurableDelegationErrorCode["HolderDeclarationsUnstamped"] = "DELEGATION_HOLDER_DECLARATIONS_UNSTAMPED";
+})(DurableDelegationErrorCode || (exports.DurableDelegationErrorCode = DurableDelegationErrorCode = {}));
+class DurableDelegationRequestError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'DurableDelegationRequestError';
+    }
+}
+exports.DurableDelegationRequestError = DurableDelegationRequestError;
+const DELEGATED_CONTEXT_AUDIENCE = service_registry_1.ServiceName.XEMA_CAPABILITY_ROUTER;
+let DurableDelegationHolderClient = DurableDelegationHolderClient_1 = class DurableDelegationHolderClient {
+    registry;
+    identity;
+    logger = new common_1.Logger(DurableDelegationHolderClient_1.name);
+    constructor(registry, identity) {
+        this.registry = registry;
+        this.identity = identity;
+    }
+    async originate(author, input) {
+        return this.send('POST', '/durable-delegations/originate', author.orgId, {
+            ...(await (0, platform_common_1.forwardedCallerHeaders)(author, this.identity)),
+        }, {
+            anchorType: input.anchorType,
+            anchorId: input.anchorId,
+            requestKey: input.requestKey,
+            environmentId: input.environmentId,
+            ...(input.capabilities === undefined ? {} : { capabilities: [...input.capabilities] }),
+            ...(input.redelegable === undefined ? {} : { redelegable: [...input.redelegable] }),
+        });
+    }
+    async createChild(orgId, parentId, request) {
+        const child = await this.postChild(orgId, parentId, request);
+        if (child.carrierId !== undefined) {
+            return child;
+        }
+        const parent = await this.read(orgId, parentId);
+        if (parent.state !== DurableDelegationRecordState.Active) {
+            throw new holder_errors_1.DelegationEndedError(parent.id, parent.endReason);
+        }
+        if (parent.carrierId === undefined) {
+            throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.Unprovisioned, `durable delegation ${parent.id}`);
+        }
+        const carrier = await this.identity.createDelegation({
+            parentId: parent.carrierId,
+            organizationId: orgId,
+            delegateWorkload: child.holderWorkload,
+            ...(request.holderMember === undefined ? {} : { delegateMember: request.holderMember }),
+            capabilities: [...child.capabilities],
+            redelegableCapabilities: [...child.redelegable],
+            resourceScope: [...child.scope, (0, carrier_shape_1.durableDelegationRootMarker)(child.rootId)],
+            basis: (0, carrier_shape_1.durableDelegationBasis)(child.id),
+            authorizingAction: carrier_shape_1.DURABLE_DELEGATION_CARRY_ACTION,
+            renewable: true,
+            ...(child.expiresAt === undefined ? {} : { expiresAt: child.expiresAt }),
+        });
+        return this.bindOrResume(orgId, parentId, request, child.id, carrier.id);
+    }
+    async read(orgId, delegationId) {
+        return this.send('GET', `/internal/durable-delegations/${encodeURIComponent(delegationId)}`, orgId, await this.serviceHeaders());
+    }
+    async revoke(orgId, delegationId) {
+        return this.send('POST', `/internal/durable-delegations/${encodeURIComponent(delegationId)}/revoke`, orgId, await this.serviceHeaders());
+    }
+    async supersede(orgId, delegationId, original) {
+        try {
+            return await this.send('POST', `/internal/durable-delegations/${encodeURIComponent(delegationId)}/supersede`, orgId, await this.serviceHeaders());
+        }
+        catch (error) {
+            throw new holder_errors_1.DelegationSupersedeFailedError(delegationId, original, error);
+        }
+    }
+    async renewCarrier(orgId, delegationId) {
+        const view = await this.read(orgId, delegationId);
+        if (view.state === DurableDelegationRecordState.Revoked || view.state === DurableDelegationRecordState.Expired) {
+            throw new holder_errors_1.DelegationEndedError(view.id, view.endReason);
+        }
+        if (view.state !== DurableDelegationRecordState.Active || view.carrierId === undefined) {
+            throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.Unprovisioned, `durable delegation ${view.id}`);
+        }
+        if (view.parentId === undefined) {
+            return carrier_window_1.CarrierRenewalOutcome.RenewedByAuthorizationApi;
+        }
+        const carrierId = view.carrierId;
+        const carrier = await this.identity.getDelegation(carrierId);
+        if (carrier.status !== identity_client_1.DelegationStatus.Active) {
+            throw new holder_errors_1.DelegationUseDeniedError(view.id, `its carrier ${carrierId} is ${carrier.status}`);
+        }
+        if (carrier.expiresAt === null) {
+            return carrier_window_1.CarrierRenewalOutcome.NotDue;
+        }
+        const window = await this.reportCarrierWindow(orgId, view.id, carrierId, carrier.expiresAt);
+        const plan = (0, carrier_window_1.planChildCarrierRenewal)(new Date(), new Date(carrier.expiresAt), window.renewalCeiling === undefined ? undefined : new Date(window.renewalCeiling));
+        if (plan.outcome !== carrier_window_1.CarrierRenewalOutcome.Renewed) {
+            return plan.outcome;
+        }
+        const renewed = await this.identity.renewDelegation(carrierId, plan.expiresAt.toISOString());
+        await this.reportCarrierWindow(orgId, view.id, carrierId, renewed.expiresAt ?? plan.expiresAt.toISOString());
+        return carrier_window_1.CarrierRenewalOutcome.Renewed;
+    }
+    async mintContext(carrierId) {
+        const minted = await this.mintDelegatedContext({
+            delegationId: carrierId,
+            audience: DELEGATED_CONTEXT_AUDIENCE,
+        });
+        return minted.accessToken;
+    }
+    mintDelegatedContext(params) {
+        return this.identity.mintDelegatedContext(params);
+    }
+    async bindOrResume(orgId, parentId, request, childId, carrierId) {
+        try {
+            return await this.send('POST', `/internal/durable-delegations/${encodeURIComponent(childId)}/carrier`, orgId, await this.serviceHeaders(), { carrierId });
+        }
+        catch (bindError) {
+            if (bindError instanceof DurableDelegationRequestError && bindError.code === DurableDelegationErrorCode.CarrierAlreadyBound) {
+                throw bindError;
+            }
+            let current;
+            try {
+                current = await this.postChild(orgId, parentId, request);
+            }
+            catch (rereadError) {
+                if (rereadError instanceof DurableDelegationRequestError && rereadError.code === DurableDelegationErrorCode.Ended) {
+                    await this.revokeUnboundCarrier(childId, carrierId);
+                    throw rereadError;
+                }
+                this.logger.error({
+                    message: 'durable-delegation-child-carrier-unconfirmed',
+                    childId,
+                    carrierId,
+                    error: bindError instanceof Error ? bindError.message : String(bindError),
+                });
+                throw bindError;
+            }
+            if (current.carrierId === carrierId) {
+                return current;
+            }
+            await this.revokeUnboundCarrier(childId, carrierId);
+            if (current.carrierId !== undefined) {
+                return current;
+            }
+            throw bindError;
+        }
+    }
+    async revokeUnboundCarrier(childId, carrierId) {
+        try {
+            await this.identity.revokeDelegation(carrierId);
+        }
+        catch (error) {
+            this.logger.error({
+                message: 'durable-delegation-child-carrier-revoke-failed',
+                childId,
+                carrierId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    async postChild(orgId, parentId, request) {
+        return this.send('POST', `/internal/durable-delegations/${encodeURIComponent(parentId)}/children`, orgId, await this.serviceHeaders(), {
+            scope: [...request.scope],
+            capabilities: [...request.capabilities],
+            ...(request.redelegable === undefined ? {} : { redelegable: [...request.redelegable] }),
+            holderWorkload: request.holderWorkload,
+            ...(request.holderMember === undefined ? {} : { holderMember: request.holderMember }),
+            requestKey: request.requestKey,
+            ...(request.expiresAt === undefined ? {} : { expiresAt: request.expiresAt.toISOString() }),
+        });
+    }
+    async reportCarrierWindow(orgId, delegationId, carrierId, expiresAt) {
+        return this.send('POST', `/internal/durable-delegations/${encodeURIComponent(delegationId)}/carrier/window`, orgId, await this.serviceHeaders(), { carrierId, expiresAt });
+    }
+    async serviceHeaders() {
+        return { Authorization: `Bearer ${await this.identity.getAccessToken()}` };
+    }
+    async send(method, path, orgId, headers, body) {
+        const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
+        const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, {
+            method,
+            headers: {
+                ...headers,
+                'X-Xema-Org-Id': orgId,
+                ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+            },
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            throw new DurableDelegationRequestError(`authorization-api ${method} ${path} failed with HTTP ${response.status}: ${text.slice(0, 2000)}`, response.status, codeOf(text));
+        }
+        return (0, platform_common_1.unwrapPlatformResponseEnvelope)(await response.json(), `authorization-api ${method} ${path}`);
+    }
+};
+exports.DurableDelegationHolderClient = DurableDelegationHolderClient;
+exports.DurableDelegationHolderClient = DurableDelegationHolderClient = DurableDelegationHolderClient_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(service_registry_nest_1.SERVICE_REGISTRY_TOKEN)),
+    __metadata("design:paramtypes", [Object, identity_client_1.IdentityBootstrapService])
+], DurableDelegationHolderClient);
+function codeOf(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed.code === 'string' ? parsed.code : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=holder-client.js.map

package/dist/durable-delegation/holder-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-client.js","sourceRoot":"","sources":["../../src/durable-delegation/holder-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,yEAG4C;AAC5C,6DAA6G;AAC7G,6DAIiC;AACjC,yEAGuC;AAEvC,mDAIyB;AACzB,qDAAkF;AAClF,mDAMyB;AAOzB,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,2CAAa,CAAA;IACb,yCAAW,CAAA;AACb,CAAC,EAHW,0BAA0B,0CAA1B,0BAA0B,QAGrC;AAGD,IAAY,4BAKX;AALD,WAAY,4BAA4B;IACtC,6DAA6B,CAAA;IAC7B,iDAAiB,CAAA;IACjB,mDAAmB,CAAA;IACnB,mDAAmB,CAAA;AACrB,CAAC,EALW,4BAA4B,4CAA5B,4BAA4B,QAKvC;AAGD,IAAY,0BAQX;AARD,WAAY,0BAA0B;IACpC,mDAAqB,CAAA;IACrB,gEAAkC,CAAA;IAClC,8DAAgC,CAAA;IAChC,4DAA8B,CAAA;IAC9B,iDAAmB,CAAA;IAEnB,0DAA4B,CAAA;AAC9B,CAAC,EARW,0BAA0B,0CAA1B,0BAA0B,QAQrC;AAGD,IAAY,0BAwBX;AAxBD,WAAY,0BAA0B;IACpC,qFAAuD,CAAA;IACvD,uEAAyC,CAAA;IACzC,yEAA2C,CAAA;IAC3C,2FAA6D,CAAA;IAC7D,oGAAsE,CAAA;IACtE,2FAA6D,CAAA;IAC7D,4FAA8D,CAAA;IAE9D,8FAAgE,CAAA;IAChE,2FAA6D,CAAA;IAE7D,yGAA2E,CAAA;IAC3E,wEAA0C,CAAA;IAE1C,gEAAkC,CAAA;IAElC,0FAA4D,CAAA;IAE5D,sHAAwF,CAAA;IAExF,gGAAkE,CAAA;IAElE,sGAAwE,CAAA;AAC1E,CAAC,EAxBW,0BAA0B,0CAA1B,0BAA0B,QAwBrC;AAkGD,MAAa,6BAA8B,SAAQ,KAAK;IAGpC;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AATD,sEASC;AAGD,MAAM,0BAA0B,GAAG,8BAAW,CAAC,sBAAsB,CAAC;AAmB/D,IAAM,6BAA6B,qCAAnC,MAAM,6BAA6B;IAIW;IAChC;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,+BAA6B,CAAC,IAAI,CAAC,CAAC;IAEzE,YACmD,QAAyB,EACzD,QAAkC;QADF,aAAQ,GAAR,QAAQ,CAAiB;QACzD,aAAQ,GAAR,QAAQ,CAA0B;IAClD,CAAC;IAEG,KAAK,CAAC,SAAS,CACpB,MAA8B,EAC9B,KAAsC;QAEtC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gCAAgC,EAAE,MAAM,CAAC,KAAK,EAAE;YACvE,GAAG,CAAC,MAAM,IAAA,wCAAsB,EAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;SACzD,EAAE;YACD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;IACL,CAAC;IAiCM,KAAK,CAAC,WAAW,CACtB,KAAa,EACb,QAAgB,EAChB,OAAqC;QAErC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,KAAK,KAAK,4BAA4B,CAAC,MAAM,EAAE,CAAC;YACzD,MAAM,IAAI,oCAAoB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAGnC,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,aAAa,EAAE,sBAAsB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnD,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,KAAK,CAAC,cAAc;YACtC,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YACvF,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;YACrC,uBAAuB,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;YAC/C,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,IAAA,2CAA2B,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1E,KAAK,EAAE,IAAA,sCAAsB,EAAC,KAAK,CAAC,EAAE,CAAC;YACvC,iBAAiB,EAAE,+CAA+B;YAElD,SAAS,EAAE,IAAI;YACf,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SACzE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,YAAoB;QACnD,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,EAAE,EACnE,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,CAC5B,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,YAAoB;QACrD,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,EACN,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAC1E,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,CAC5B,CAAC;IACJ,CAAC;IAWM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,YAAoB,EAAE,QAAkB;QAC5E,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CACpB,MAAM,EACN,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,YAAY,EAC7E,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,CAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,8CAA8B,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAwBM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,YAAoB;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,OAAO,EAAE,CAAC;YAC/G,MAAM,IAAI,oCAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvF,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,aAAa,EAAE,sBAAsB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,sCAAqB,CAAC,yBAAyB,CAAC;QACzD,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,kCAAgB,CAAC,MAAM,EAAE,CAAC;YAC/C,MAAM,IAAI,wCAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,SAAS,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,sCAAqB,CAAC,MAAM,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,IAAA,wCAAuB,EAClC,IAAI,IAAI,EAAE,EACV,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAC3B,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAClF,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,KAAK,sCAAqB,CAAC,OAAO,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7G,OAAO,sCAAqB,CAAC,OAAO,CAAC;IACvC,CAAC;IAOM,KAAK,CAAC,WAAW,CAAC,SAAiB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC7C,YAAY,EAAE,SAAS;YACvB,QAAQ,EAAE,0BAA0B;SACrC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAOM,oBAAoB,CAAC,MAI3B;QACC,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,KAAa,EACb,QAAgB,EAChB,OAAqC,EACrC,OAAe,EACf,SAAiB;QAEjB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CACpB,MAAM,EACN,iCAAiC,kBAAkB,CAAC,OAAO,CAAC,UAAU,EACtE,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,EAC3B,EAAE,SAAS,EAAE,CACd,CAAC;QACJ,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,IAAI,SAAS,YAAY,6BAA6B,IAAI,SAAS,CAAC,IAAI,KAAK,0BAA0B,CAAC,mBAAmB,EAAE,CAAC;gBAE5H,MAAM,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,OAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,IAAI,WAAW,YAAY,6BAA6B,IAAI,WAAW,CAAC,IAAI,KAAK,0BAA0B,CAAC,KAAK,EAAE,CAAC;oBAClH,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;oBACpD,MAAM,WAAW,CAAC;gBACpB,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAChB,OAAO,EAAE,8CAA8C;oBACvD,OAAO;oBACP,SAAS;oBACT,KAAK,EAAE,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;iBAC1E,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,SAAS,CAAC;QAClB,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,SAAiB;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,gDAAgD;gBACzD,OAAO;gBACP,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,KAAa,EACb,QAAgB,EAChB,OAAqC;QAErC,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,EACN,iCAAiC,kBAAkB,CAAC,QAAQ,CAAC,WAAW,EACxE,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,EAC3B;YACE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;YACzB,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACvF,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YACrF,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;SAC3F,CACF,CAAC;IACJ,CAAC;IAOO,KAAK,CAAC,mBAAmB,CAC/B,KAAa,EACb,YAAoB,EACpB,SAAiB,EACjB,SAAiB;QAEjB,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,EACN,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,iBAAiB,EAClF,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,EAC3B,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,MAAsB,EACtB,IAAY,EACZ,KAAa,EACb,OAA+B,EAC/B,IAAc;QAEd,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAAC,IAAI,CAAC,QAAQ,EAAE,8BAAW,CAAC,iBAAiB,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM;YACN,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,eAAe,EAAE,KAAK;gBACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aACtE;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,6BAA6B,CACrC,qBAAqB,MAAM,IAAI,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EACjG,QAAQ,CAAC,MAAM,EACf,MAAM,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,gDAA8B,EACnC,MAAM,QAAQ,CAAC,IAAI,EAAE,EACrB,qBAAqB,MAAM,IAAI,IAAI,EAAE,CACtC,CAAC;IACJ,CAAC;CACF,CAAA;AAjWY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;6CACJ,0CAAwB;GAL1C,6BAA6B,CAiWzC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;QACtD,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/durable-delegation/holder-errors.d.ts

@@ -0,0 +1,28 @@
+export declare enum DelegationRequiredReason {
+    NeverAuthorised = "never-authorised",
+    Unprovisioned = "unprovisioned",
+    Ended = "ended",
+    Stale = "stale"
+}
+export declare class DelegationRequiredError extends Error {
+    readonly reason: DelegationRequiredReason;
+    readonly subject: string;
+    constructor(reason: DelegationRequiredReason, subject: string);
+}
+export declare class DelegationUseDeniedError extends Error {
+    readonly delegationId: string;
+    readonly detail: string;
+    constructor(delegationId: string, detail: string);
+}
+export declare class DelegationEndedError extends Error {
+    readonly delegationId: string;
+    readonly endReason: string | undefined;
+    constructor(delegationId: string, endReason: string | undefined);
+}
+export declare class DelegationSupersedeFailedError extends Error {
+    readonly delegationId: string;
+    readonly original: unknown;
+    readonly cause: unknown;
+    constructor(delegationId: string, original: unknown, cause: unknown);
+}
+//# sourceMappingURL=holder-errors.d.ts.map

package/dist/durable-delegation/holder-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-errors.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-errors.ts"],"names":[],"mappings":"AAkBA,oBAAY,wBAAwB;IAElC,eAAe,qBAAqB;IAEpC,aAAa,kBAAkB;IAE/B,KAAK,UAAU;IAEf,KAAK,UAAU;CAChB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,MAAM,EAAE,wBAAwB;aAChC,OAAO,EAAE,MAAM;gBADf,MAAM,EAAE,wBAAwB,EAChC,OAAO,EAAE,MAAM;CAKlC;AAED,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,YAAY,EAAE,MAAM;aACpB,MAAM,EAAE,MAAM;gBADd,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM;CAKjC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;aAE3B,YAAY,EAAE,MAAM;aACpB,SAAS,EAAE,MAAM,GAAG,SAAS;gBAD7B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAAG,SAAS;CAKhD;AAUD,qBAAa,8BAA+B,SAAQ,KAAK;aAErC,YAAY,EAAE,MAAM;aACpB,QAAQ,EAAE,OAAO;aACR,KAAK,EAAE,OAAO;gBAFvB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,OAAO,EACR,KAAK,EAAE,OAAO;CAO1C"}

package/dist/durable-delegation/holder-errors.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationSupersedeFailedError = exports.DelegationEndedError = exports.DelegationUseDeniedError = exports.DelegationRequiredError = exports.DelegationRequiredReason = void 0;
+var DelegationRequiredReason;
+(function (DelegationRequiredReason) {
+    DelegationRequiredReason["NeverAuthorised"] = "never-authorised";
+    DelegationRequiredReason["Unprovisioned"] = "unprovisioned";
+    DelegationRequiredReason["Ended"] = "ended";
+    DelegationRequiredReason["Stale"] = "stale";
+})(DelegationRequiredReason || (exports.DelegationRequiredReason = DelegationRequiredReason = {}));
+class DelegationRequiredError extends Error {
+    reason;
+    subject;
+    constructor(reason, subject) {
+        super(`${subject} needs a person to authorise its durable work (${reason}).`);
+        this.reason = reason;
+        this.subject = subject;
+        this.name = 'DelegationRequiredError';
+    }
+}
+exports.DelegationRequiredError = DelegationRequiredError;
+class DelegationUseDeniedError extends Error {
+    delegationId;
+    detail;
+    constructor(delegationId, detail) {
+        super(`authority currently unavailable for durable delegation ${delegationId}: ${detail}`);
+        this.delegationId = delegationId;
+        this.detail = detail;
+        this.name = 'DelegationUseDeniedError';
+    }
+}
+exports.DelegationUseDeniedError = DelegationUseDeniedError;
+class DelegationEndedError extends Error {
+    delegationId;
+    endReason;
+    constructor(delegationId, endReason) {
+        super(`durable delegation ${delegationId} has ended${endReason === undefined ? '' : ` (${endReason})`}.`);
+        this.delegationId = delegationId;
+        this.endReason = endReason;
+        this.name = 'DelegationEndedError';
+    }
+}
+exports.DelegationEndedError = DelegationEndedError;
+class DelegationSupersedeFailedError extends Error {
+    delegationId;
+    original;
+    cause;
+    constructor(delegationId, original, cause) {
+        super(`durable delegation ${delegationId} could not be superseded: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.delegationId = delegationId;
+        this.original = original;
+        this.cause = cause;
+        this.name = 'DelegationSupersedeFailedError';
+    }
+}
+exports.DelegationSupersedeFailedError = DelegationSupersedeFailedError;
+//# sourceMappingURL=holder-errors.js.map

package/dist/durable-delegation/holder-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-errors.js","sourceRoot":"","sources":["../../src/durable-delegation/holder-errors.ts"],"names":[],"mappings":";;;AAkBA,IAAY,wBASX;AATD,WAAY,wBAAwB;IAElC,gEAAoC,CAAA;IAEpC,2DAA+B,CAAA;IAE/B,2CAAe,CAAA;IAEf,2CAAe,CAAA;AACjB,CAAC,EATW,wBAAwB,wCAAxB,wBAAwB,QASnC;AAED,MAAa,uBAAwB,SAAQ,KAAK;IAE9B;IACA;IAFlB,YACkB,MAAgC,EAChC,OAAe;QAE/B,KAAK,CAAC,GAAG,OAAO,kDAAkD,MAAM,IAAI,CAAC,CAAC;QAH9D,WAAM,GAAN,MAAM,CAA0B;QAChC,YAAO,GAAP,OAAO,CAAQ;QAG/B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AARD,0DAQC;AAED,MAAa,wBAAyB,SAAQ,KAAK;IAE/B;IACA;IAFlB,YACkB,YAAoB,EACpB,MAAc;QAE9B,KAAK,CAAC,0DAA0D,YAAY,KAAK,MAAM,EAAE,CAAC,CAAC;QAH3E,iBAAY,GAAZ,YAAY,CAAQ;QACpB,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AARD,4DAQC;AAED,MAAa,oBAAqB,SAAQ,KAAK;IAE3B;IACA;IAFlB,YACkB,YAAoB,EACpB,SAA6B;QAE7C,KAAK,CAAC,sBAAsB,YAAY,aAAa,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,GAAG,GAAG,CAAC,CAAC;QAH1F,iBAAY,GAAZ,YAAY,CAAQ;QACpB,cAAS,GAAT,SAAS,CAAoB;QAG7C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AARD,oDAQC;AAUD,MAAa,8BAA+B,SAAQ,KAAK;IAErC;IACA;IACS;IAH3B,YACkB,YAAoB,EACpB,QAAiB,EACR,KAAc;QAEvC,KAAK,CACH,sBAAsB,YAAY,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxH,CAAC;QANc,iBAAY,GAAZ,YAAY,CAAQ;QACpB,aAAQ,GAAR,QAAQ,CAAS;QACR,UAAK,GAAL,KAAK,CAAS;QAKvC,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAXD,wEAWC"}

package/dist/durable-delegation/holder-lifecycle.d.ts

@@ -0,0 +1,50 @@
+import { type DurableDelegationCarrierRef } from './carrier-mint';
+import { CarrierRenewalOutcome } from './carrier-window';
+import { type OriginateDurableDelegationInput, DurableDelegationHolderClient, type DurableDelegationView } from './holder-client';
+import { DelegationEndedError, DelegationUseDeniedError } from './holder-errors';
+import type { ForwardedCallerContext } from '@xemahq/platform-common';
+import type { HeldDurableDelegation } from '@xemahq/xema-service-nest';
+export declare enum HolderDelegationState {
+    NotRequired = "not_required",
+    Required = "required",
+    Unprovisioned = "unprovisioned",
+    Held = "held",
+    Ended = "ended"
+}
+export declare enum HolderRenewal {
+    NotHeld = "not-held"
+}
+export interface HolderDelegationRow {
+    readonly state: HolderDelegationState;
+    readonly delegationId: string | null;
+    readonly carrierId: string | null;
+    readonly capabilities: readonly string[];
+}
+export interface HolderDelegationStore {
+    read(): Promise<HolderDelegationRow | null>;
+    writeIf(expected: Pick<HolderDelegationRow, 'state' | 'delegationId'>, next: HolderDelegationRow): Promise<boolean>;
+}
+export interface HolderDelegationNeed {
+    readonly capabilities: readonly string[];
+}
+export interface HeldAuthority {
+    readonly delegationId: string;
+    readonly orgId: string;
+    readonly authorization: string;
+}
+export declare class DurableDelegationHolder {
+    private readonly client;
+    constructor(client: DurableDelegationHolderClient);
+    reconcileNeed(store: HolderDelegationStore, orgId: string, need: HolderDelegationNeed | null): Promise<HolderDelegationRow>;
+    authorize(store: HolderDelegationStore, author: ForwardedCallerContext, input: OriginateDurableDelegationInput): Promise<HolderDelegationRow>;
+    authority(row: HolderDelegationRow, orgId: string, subject: string): Promise<HeldAuthority>;
+    carrierRef(row: HolderDelegationRow, orgId: string, subject: string): DurableDelegationCarrierRef;
+    held(row: HolderDelegationRow, orgId: string, subject: string): HeldDurableDelegation;
+    onDenied(store: HolderDelegationStore, row: HolderDelegationRow, reason: string | undefined, detail: string): Promise<DelegationUseDeniedError | DelegationEndedError | undefined>;
+    refresh(store: HolderDelegationStore, orgId: string): Promise<HolderDelegationRow | null>;
+    renewCarrier(store: HolderDelegationStore, orgId: string): Promise<CarrierRenewalOutcome | HolderRenewal>;
+    endFor(row: HolderDelegationRow, orgId: string): Promise<void>;
+}
+export declare function rowOf(view: DurableDelegationView): HolderDelegationRow;
+export declare function needTransition(row: HolderDelegationRow, need: HolderDelegationNeed | null): HolderDelegationRow | null;
+//# sourceMappingURL=holder-lifecycle.d.ts.map

package/dist/durable-delegation/holder-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-lifecycle.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-lifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,2BAA2B,EAAyB,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAKzD,OAAO,EACL,KAAK,+BAA+B,EACpC,6BAA6B,EAE7B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EAGpB,wBAAwB,EACzB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAWvE,oBAAY,qBAAqB;IAE/B,WAAW,iBAAiB;IAE5B,QAAQ,aAAa;IAErB,aAAa,kBAAkB;IAE/B,IAAI,SAAS;IAEb,KAAK,UAAU;CAChB;AAGD,oBAAY,aAAa;IAEvB,OAAO,aAAa;CACrB;AAGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAElC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAQD,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC5C,OAAO,CACL,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,cAAc,CAAC,EAC7D,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAGD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAiCD,qBACa,uBAAuB;IACf,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,6BAA6B;IAE5D,aAAa,CACxB,KAAK,EAAE,qBAAqB,EAC5B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,oBAAoB,GAAG,IAAI,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAoBlB,SAAS,CACpB,KAAK,EAAE,qBAAqB,EAC5B,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,mBAAmB,CAAC;IAwBlB,SAAS,CACpB,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC;IAclB,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,2BAA2B;IAuBjG,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,qBAAqB;IAS/E,QAAQ,CACnB,KAAK,EAAE,qBAAqB,EAC5B,GAAG,EAAE,mBAAmB,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,GAAG,oBAAoB,GAAG,SAAS,CAAC;IAW1D,OAAO,CAAC,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAqBzF,YAAY,CAAC,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,aAAa,CAAC;IAezG,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAK5E;AAGD,wBAAgB,KAAK,CAAC,IAAI,EAAE,qBAAqB,GAAG,mBAAmB,CAetE;AAGD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,oBAAoB,GAAG,IAAI,GAChC,mBAAmB,GAAG,IAAI,CAgB5B"}

package/dist/durable-delegation/holder-lifecycle.js

@@ -0,0 +1,187 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DurableDelegationHolder = exports.HolderRenewal = exports.HolderDelegationState = void 0;
+exports.rowOf = rowOf;
+exports.needTransition = needTransition;
+const common_1 = require("@nestjs/common");
+const carrier_mint_1 = require("./carrier-mint");
+const decision_codes_1 = require("./decision-codes");
+const holder_client_1 = require("./holder-client");
+const holder_errors_1 = require("./holder-errors");
+var HolderDelegationState;
+(function (HolderDelegationState) {
+    HolderDelegationState["NotRequired"] = "not_required";
+    HolderDelegationState["Required"] = "required";
+    HolderDelegationState["Unprovisioned"] = "unprovisioned";
+    HolderDelegationState["Held"] = "held";
+    HolderDelegationState["Ended"] = "ended";
+})(HolderDelegationState || (exports.HolderDelegationState = HolderDelegationState = {}));
+var HolderRenewal;
+(function (HolderRenewal) {
+    HolderRenewal["NotHeld"] = "not-held";
+})(HolderRenewal || (exports.HolderRenewal = HolderRenewal = {}));
+const MAX_CAS_ATTEMPTS = 3;
+let DurableDelegationHolder = class DurableDelegationHolder {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async reconcileNeed(store, orgId, need) {
+        for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt += 1) {
+            const row = await store.read();
+            if (row === null) {
+                throw new common_1.ConflictException('The holder row disappeared while its need was being stated.');
+            }
+            const next = needTransition(row, need);
+            if (next === null) {
+                return row;
+            }
+            if (await store.writeIf(row, next)) {
+                if (row.delegationId !== null && next.delegationId === null) {
+                    await this.client.supersede(orgId, row.delegationId);
+                }
+                return next;
+            }
+        }
+        throw new common_1.ConflictException('The holder row kept changing while its need was being stated.');
+    }
+    async authorize(store, author, input) {
+        const view = await this.client.originate(author, input);
+        const next = rowOf(view);
+        for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt += 1) {
+            const row = await store.read();
+            if (row === null) {
+                const conflict = new common_1.ConflictException('The holder row disappeared while it was being authorised.');
+                await this.client.supersede(author.orgId, view.id, conflict);
+                throw conflict;
+            }
+            if (row.delegationId === view.id) {
+                return row;
+            }
+            if (await store.writeIf(row, next)) {
+                if (row.delegationId !== null) {
+                    await this.client.supersede(author.orgId, row.delegationId);
+                }
+                return next;
+            }
+        }
+        throw new common_1.ConflictException('The holder row kept changing while it was being authorised.');
+    }
+    async authority(row, orgId, subject) {
+        const ref = this.carrierRef(row, orgId, subject);
+        return {
+            delegationId: ref.delegationId,
+            orgId,
+            authorization: `Bearer ${await this.client.mintContext(ref.carrierId)}`,
+        };
+    }
+    carrierRef(row, orgId, subject) {
+        switch (row.state) {
+            case HolderDelegationState.Held:
+                break;
+            case HolderDelegationState.NotRequired:
+            case HolderDelegationState.Required:
+                throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.NeverAuthorised, subject);
+            case HolderDelegationState.Unprovisioned:
+                throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.Unprovisioned, subject);
+            case HolderDelegationState.Ended:
+                throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.Ended, subject);
+        }
+        if (row.delegationId === null || row.carrierId === null) {
+            throw new holder_errors_1.DelegationRequiredError(holder_errors_1.DelegationRequiredReason.Unprovisioned, subject);
+        }
+        return { delegationId: row.delegationId, organizationId: orgId, carrierId: row.carrierId };
+    }
+    held(row, orgId, subject) {
+        return (0, carrier_mint_1.heldDurableDelegation)(this.client, this.carrierRef(row, orgId, subject));
+    }
+    async onDenied(store, row, reason, detail) {
+        if (!(0, decision_codes_1.isDurableDelegationDecisionCode)(reason) || row.delegationId === null) {
+            return undefined;
+        }
+        if (reason === decision_codes_1.DurableDelegationDecisionCode.AuthorityUnavailable) {
+            return new holder_errors_1.DelegationUseDeniedError(row.delegationId, detail);
+        }
+        await store.writeIf(row, { ...row, state: HolderDelegationState.Ended, carrierId: null });
+        return new holder_errors_1.DelegationEndedError(row.delegationId, undefined);
+    }
+    async refresh(store, orgId) {
+        const row = await store.read();
+        if (row === null || row.delegationId === null) {
+            return row;
+        }
+        const view = await this.client.read(orgId, row.delegationId);
+        const next = rowOf(view);
+        if (next.state === row.state && next.carrierId === row.carrierId) {
+            return row;
+        }
+        return (await store.writeIf(row, next)) ? next : store.read();
+    }
+    async renewCarrier(store, orgId) {
+        const row = await store.read();
+        if (row === null || row.state !== HolderDelegationState.Held || row.delegationId === null) {
+            return HolderRenewal.NotHeld;
+        }
+        try {
+            return await this.client.renewCarrier(orgId, row.delegationId);
+        }
+        catch (error) {
+            if (error instanceof holder_errors_1.DelegationEndedError) {
+                await store.writeIf(row, { ...row, state: HolderDelegationState.Ended, carrierId: null });
+            }
+            throw error;
+        }
+    }
+    async endFor(row, orgId) {
+        if (row.delegationId !== null) {
+            await this.client.revoke(orgId, row.delegationId);
+        }
+    }
+};
+exports.DurableDelegationHolder = DurableDelegationHolder;
+exports.DurableDelegationHolder = DurableDelegationHolder = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [holder_client_1.DurableDelegationHolderClient])
+], DurableDelegationHolder);
+function rowOf(view) {
+    switch (view.state) {
+        case holder_client_1.DurableDelegationRecordState.Active:
+            return {
+                state: view.carrierId === undefined ? HolderDelegationState.Unprovisioned : HolderDelegationState.Held,
+                delegationId: view.id,
+                carrierId: view.carrierId ?? null,
+                capabilities: [...view.capabilities],
+            };
+        case holder_client_1.DurableDelegationRecordState.Provisioning:
+            return { state: HolderDelegationState.Unprovisioned, delegationId: view.id, carrierId: null, capabilities: [...view.capabilities] };
+        case holder_client_1.DurableDelegationRecordState.Revoked:
+        case holder_client_1.DurableDelegationRecordState.Expired:
+            return { state: HolderDelegationState.Ended, delegationId: view.id, carrierId: null, capabilities: [...view.capabilities] };
+    }
+}
+function needTransition(row, need) {
+    if (need === null) {
+        return row.state === HolderDelegationState.NotRequired && row.delegationId === null
+            ? null
+            : { state: HolderDelegationState.NotRequired, delegationId: null, carrierId: null, capabilities: [] };
+    }
+    const lendsExactly = row.capabilities.length === need.capabilities.length &&
+        need.capabilities.every((c) => row.capabilities.includes(c));
+    if (row.delegationId !== null && lendsExactly) {
+        return null;
+    }
+    if (row.state === HolderDelegationState.Required && row.delegationId === null) {
+        return null;
+    }
+    return { state: HolderDelegationState.Required, delegationId: null, carrierId: null, capabilities: [] };
+}
+//# sourceMappingURL=holder-lifecycle.js.map