@xemahq/authorization-nest 0.6.0 → 0.7.1

package/dist/authzen.transport.d.ts

@@ -10,11 +10,11 @@ export interface AuthzenPdpCallOptions {
     readonly onPolicyModel?: (policyModel: string | undefined) => void;
 }
 export interface AuthzenPdpTransport {
-    evaluation(orgId: string | null, request: AccessEvaluationRequest): Promise<AccessEvaluationResponse>;
+    evaluation(orgId: string | null, request: AccessEvaluationRequest, options?: AuthzenPdpCallOptions): Promise<AccessEvaluationResponse>;
     evaluations(orgId: string, request: AccessEvaluationsRequest, options?: AuthzenPdpCallOptions): Promise<AccessEvaluationsResponse>;
-    searchResource(orgId: string, request: ResourceSearchRequest): Promise<ResourceSearchResponse>;
-    searchSubject(orgId: string, request: SubjectSearchRequest): Promise<SubjectSearchResponse>;
-    searchAction(orgId: string, request: ActionSearchRequest): Promise<ActionSearchResponse>;
+    searchResource(orgId: string, request: ResourceSearchRequest, options?: AuthzenPdpCallOptions): Promise<ResourceSearchResponse>;
+    searchSubject(orgId: string, request: SubjectSearchRequest, options?: AuthzenPdpCallOptions): Promise<SubjectSearchResponse>;
+    searchAction(orgId: string, request: ActionSearchRequest, options?: AuthzenPdpCallOptions): Promise<ActionSearchResponse>;
 }
 export declare const AUTHZEN_PDP_TRANSPORT: unique symbol;
 export declare class AuthzenPdpError extends Error {
@@ -22,16 +22,19 @@ export declare class AuthzenPdpError extends Error {
     readonly code: string | undefined;
     constructor(message: string, status: number, code: string | undefined);
 }
+export declare class AuthzenCallerContextRequiredError extends AuthzenPdpError {
+    constructor(path: string);
+}
 export declare class HttpAuthzenPdpTransport implements AuthzenPdpTransport {
     private readonly registry;
     private readonly identityBootstrap;
     private readonly options;
     constructor(registry: ServiceRegistry, identityBootstrap: IdentityBootstrapService, options: XemaAuthorizationOptions);
-    evaluation(orgId: string | null, request: AccessEvaluationRequest): Promise<AccessEvaluationResponse>;
+    evaluation(orgId: string | null, request: AccessEvaluationRequest, options?: AuthzenPdpCallOptions): Promise<AccessEvaluationResponse>;
     evaluations(orgId: string, request: AccessEvaluationsRequest, options?: AuthzenPdpCallOptions): Promise<AccessEvaluationsResponse>;
-    searchResource(orgId: string, request: ResourceSearchRequest): Promise<ResourceSearchResponse>;
-    searchSubject(orgId: string, request: SubjectSearchRequest): Promise<SubjectSearchResponse>;
-    searchAction(orgId: string, request: ActionSearchRequest): Promise<ActionSearchResponse>;
+    searchResource(orgId: string, request: ResourceSearchRequest, options?: AuthzenPdpCallOptions): Promise<ResourceSearchResponse>;
+    searchSubject(orgId: string, request: SubjectSearchRequest, options?: AuthzenPdpCallOptions): Promise<SubjectSearchResponse>;
+    searchAction(orgId: string, request: ActionSearchRequest, options?: AuthzenPdpCallOptions): Promise<ActionSearchResponse>;
     private post;
 }
 //# sourceMappingURL=authzen.transport.d.ts.map

package/dist/authzen.transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authzen.transport.d.ts","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAoBjC,eAAO,MAAM,2BAA2B,wBAAwB,CAAC;AAGjE,MAAM,WAAW,qBAAqB;IAQpC,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IAElD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAK9B,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;CACpE;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,CACR,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,WAAW,CACT,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnC,aAAa,CACX,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,YAAY,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAGrE,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AAED,qBACa,uBAAwB,YAAW,mBAAmB;IAG/D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAG7C,UAAU,CACf,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,wBAAwB,CAAC;IAS7B,WAAW,CAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,yBAAyB,CAAC;IAU9B,cAAc,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IAS3B,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAS1B,YAAY,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC;YASlB,IAAI;CAqDnB"}
+{"version":3,"file":"authzen.transport.d.ts","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAoBjC,eAAO,MAAM,2BAA2B,wBAAwB,CAAC;AAGjE,MAAM,WAAW,qBAAqB;IAOpC,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IAElD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAK9B,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;CACpE;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,CACR,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,WAAW,CACT,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnC,aAAa,CACX,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,YAAY,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAGrE,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AAOD,qBAAa,iCAAkC,SAAQ,eAAe;gBACjD,IAAI,EAAE,MAAM;CAQhC;AAED,qBACa,uBAAwB,YAAW,mBAAmB;IAG/D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAG7C,UAAU,CACf,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,wBAAwB,CAAC;IAU7B,WAAW,CAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,yBAAyB,CAAC;IAU9B,cAAc,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,sBAAsB,CAAC;IAU3B,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,qBAAqB,CAAC;IAU1B,YAAY,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,oBAAoB,CAAC;YAUlB,IAAI;CA0DnB"}

package/dist/authzen.transport.js

@@ -12,7 +12,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HttpAuthzenPdpTransport = exports.AuthzenPdpError = exports.AUTHZEN_PDP_TRANSPORT = exports.AUTHZEN_POLICY_MODEL_HEADER = void 0;
+exports.HttpAuthzenPdpTransport = exports.AuthzenCallerContextRequiredError = exports.AuthzenPdpError = exports.AUTHZEN_PDP_TRANSPORT = exports.AUTHZEN_POLICY_MODEL_HEADER = void 0;
 const common_1 = require("@nestjs/common");
 const authzen_1 = require("@xemahq/contracts/authzen");
 const service_registry_1 = require("@xemahq/contracts/service-registry");
@@ -33,6 +33,13 @@ class AuthzenPdpError extends Error {
     }
 }
 exports.AuthzenPdpError = AuthzenPdpError;
+class AuthzenCallerContextRequiredError extends AuthzenPdpError {
+    constructor(path) {
+        super(`authorization-api POST ${path} requires the caller's own verified context; none is held.`, 403, 'caller_context_required');
+        this.name = AuthzenCallerContextRequiredError.name;
+    }
+}
+exports.AuthzenCallerContextRequiredError = AuthzenCallerContextRequiredError;
 let HttpAuthzenPdpTransport = class HttpAuthzenPdpTransport {
     registry;
     identityBootstrap;
@@ -42,26 +49,27 @@ let HttpAuthzenPdpTransport = class HttpAuthzenPdpTransport {
         this.identityBootstrap = identityBootstrap;
         this.options = options;
     }
-    evaluation(orgId, request) {
-        return this.post(orgId, authzen_1.AuthzenEndpointPath.Evaluation, request, authzen_1.AccessEvaluationResponseSchema);
+    evaluation(orgId, request, options) {
+        return this.post(orgId, authzen_1.AuthzenEndpointPath.Evaluation, request, authzen_1.AccessEvaluationResponseSchema, options);
     }
     evaluations(orgId, request, options) {
         return this.post(orgId, authzen_1.AuthzenEndpointPath.Evaluations, request, authzen_1.AccessEvaluationsResponseSchema, options);
     }
-    searchResource(orgId, request) {
-        return this.post(orgId, authzen_1.AuthzenEndpointPath.SearchResource, request, authzen_1.ResourceSearchResponseSchema);
+    searchResource(orgId, request, options) {
+        return this.post(orgId, authzen_1.AuthzenEndpointPath.SearchResource, request, authzen_1.ResourceSearchResponseSchema, options);
     }
-    searchSubject(orgId, request) {
-        return this.post(orgId, authzen_1.AuthzenEndpointPath.SearchSubject, request, authzen_1.SubjectSearchResponseSchema);
+    searchSubject(orgId, request, options) {
+        return this.post(orgId, authzen_1.AuthzenEndpointPath.SearchSubject, request, authzen_1.SubjectSearchResponseSchema, options);
     }
-    searchAction(orgId, request) {
-        return this.post(orgId, authzen_1.AuthzenEndpointPath.SearchAction, request, authzen_1.ActionSearchResponseSchema);
+    searchAction(orgId, request, options) {
+        return this.post(orgId, authzen_1.AuthzenEndpointPath.SearchAction, request, authzen_1.ActionSearchResponseSchema, options);
     }
     async post(orgId, path, body, schema, options = {}) {
         const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
-        const authorization = options.forwardedCaller === undefined
-            ? { Authorization: `Bearer ${await this.identityBootstrap.getAccessToken()}` }
-            : await (0, platform_common_1.forwardedCallerHeaders)(options.forwardedCaller, this.identityBootstrap);
+        if (options.forwardedCaller === undefined) {
+            throw new AuthzenCallerContextRequiredError(path);
+        }
+        const authorization = await (0, platform_common_1.forwardedCallerHeaders)(options.forwardedCaller, this.identityBootstrap);
         const timeout = AbortSignal.timeout(this.options.requestTimeoutMs);
         const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, {
             method: 'POST',

package/dist/authzen.transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"authzen.transport.js","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,uDAiBmC;AACnC,yEAG4C;AAC5C,6DAAmE;AACnE,6DAGiC;AACjC,yEAGuC;AAEvC,mEAGiC;AAoBpB,QAAA,2BAA2B,GAAG,qBAAqB,CAAC;AA6CpD,QAAA,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAGrE,MAAa,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC;IACnC,CAAC;CACF;AATD,0CASC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAGf;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,UAAU,CACf,KAAoB,EACpB,OAAgC;QAEhC,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,UAAU,EAC9B,OAAO,EACP,wCAA8B,CAC/B,CAAC;IACJ,CAAC;IAEM,WAAW,CAChB,KAAa,EACb,OAAiC,EACjC,OAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,WAAW,EAC/B,OAAO,EACP,yCAA+B,EAC/B,OAAO,CACR,CAAC;IACJ,CAAC;IAEM,cAAc,CACnB,KAAa,EACb,OAA8B;QAE9B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,cAAc,EAClC,OAAO,EACP,sCAA4B,CAC7B,CAAC;IACJ,CAAC;IAEM,aAAa,CAClB,KAAa,EACb,OAA6B;QAE7B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,aAAa,EACjC,OAAO,EACP,qCAA2B,CAC5B,CAAC;IACJ,CAAC;IAEM,YAAY,CACjB,KAAa,EACb,OAA4B;QAE5B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,YAAY,EAChC,OAAO,EACP,oCAA0B,CAC3B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,KAAoB,EACpB,IAAyB,EACzB,IAAY,EACZ,MAAS,EACT,UAAiC,EAAE;QAEnC,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QAGF,MAAM,aAAa,GACjB,OAAO,CAAC,eAAe,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE,EAAE;YAC9E,CAAC,CAAC,MAAM,IAAA,wCAAsB,EAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,aAAa;gBAChB,cAAc,EAAE,kBAAkB;gBAElC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;aACtD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAC5F,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mCAA2B,CAAC,IAAI,SAAS,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC5F,QAAQ,CAAC,MAAM,EACf,SAAS,CAAC,MAAM,CAAC,CAClB,CAAC;QACJ,CAAC;QAGD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,mDAAmD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACvG,GAAG,EACH,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF,CAAA;AA5HY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GAJnD,uBAAuB,CA4HnC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACzB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"authzen.transport.js","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,uDAiBmC;AACnC,yEAG4C;AAC5C,6DAAmE;AACnE,6DAGiC;AACjC,yEAGuC;AAEvC,mEAGiC;AAoBpB,QAAA,2BAA2B,GAAG,qBAAqB,CAAC;AAgDpD,QAAA,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAGrE,MAAa,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC;IACnC,CAAC;CACF;AATD,0CASC;AAOD,MAAa,iCAAkC,SAAQ,eAAe;IACpE,YAAmB,IAAY;QAC7B,KAAK,CACH,0BAA0B,IAAI,4DAA4D,EAC1F,GAAG,EACH,yBAAyB,CAC1B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC,IAAI,CAAC;IACrD,CAAC;CACF;AATD,8EASC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAGf;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,UAAU,CACf,KAAoB,EACpB,OAAgC,EAChC,OAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,UAAU,EAC9B,OAAO,EACP,wCAA8B,EAC9B,OAAO,CACR,CAAC;IACJ,CAAC;IAEM,WAAW,CAChB,KAAa,EACb,OAAiC,EACjC,OAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,WAAW,EAC/B,OAAO,EACP,yCAA+B,EAC/B,OAAO,CACR,CAAC;IACJ,CAAC;IAEM,cAAc,CACnB,KAAa,EACb,OAA8B,EAC9B,OAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,cAAc,EAClC,OAAO,EACP,sCAA4B,EAC5B,OAAO,CACR,CAAC;IACJ,CAAC;IAEM,aAAa,CAClB,KAAa,EACb,OAA6B,EAC7B,OAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,aAAa,EACjC,OAAO,EACP,qCAA2B,EAC3B,OAAO,CACR,CAAC;IACJ,CAAC;IAEM,YAAY,CACjB,KAAa,EACb,OAA4B,EAC5B,OAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,YAAY,EAChC,OAAO,EACP,oCAA0B,EAC1B,OAAO,CACR,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,KAAoB,EACpB,IAAyB,EACzB,IAAY,EACZ,MAAS,EACT,UAAiC,EAAE;QAEnC,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QAKF,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAA,wCAAsB,EAChD,OAAO,CAAC,eAAe,EACvB,IAAI,CAAC,iBAAiB,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,aAAa;gBAChB,cAAc,EAAE,kBAAkB;gBAElC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;aACtD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAC5F,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mCAA2B,CAAC,IAAI,SAAS,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC5F,QAAQ,CAAC,MAAM,EACf,SAAS,CAAC,MAAM,CAAC,CAClB,CAAC;QACJ,CAAC;QAGD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,mDAAmD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACvG,GAAG,EACH,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF,CAAA;AAzIY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GAJnD,uBAAuB,CAyInC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACzB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/durable-delegation/carrier-mint.d.ts

@@ -0,0 +1,20 @@
+import { type HeldDurableDelegation } from '@xemahq/xema-service-nest';
+import type { ScopedAccessToken } from '@xemahq/identity-client';
+import type { ReceiverAudience } from '@xemahq/platform-common';
+export interface DurableDelegationCarrierRef {
+    readonly delegationId: string;
+    readonly organizationId: string;
+    readonly carrierId: string;
+}
+export interface DurableDelegationMinter {
+    mintDelegatedContext(params: {
+        delegationId: string;
+        audience?: string;
+        realm?: string;
+    }): Promise<ScopedAccessToken>;
+}
+export declare function mintDurableDelegatedToken(minter: DurableDelegationMinter, ref: DurableDelegationCarrierRef, options: {
+    readonly audience: ReceiverAudience;
+}): Promise<ScopedAccessToken>;
+export declare function heldDurableDelegation(minter: DurableDelegationMinter, ref: DurableDelegationCarrierRef): HeldDurableDelegation;
+//# sourceMappingURL=carrier-mint.d.ts.map

package/dist/durable-delegation/carrier-mint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"carrier-mint.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/carrier-mint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEtG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAQhE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAGD,MAAM,WAAW,uBAAuB;IACtC,oBAAoB,CAAC,MAAM,EAAE;QAC3B,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChC;AASD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,uBAAuB,EAC/B,GAAG,EAAE,2BAA2B,EAChC,OAAO,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAC/C,OAAO,CAAC,iBAAiB,CAAC,CAK5B;AAOD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,uBAAuB,EAC/B,GAAG,EAAE,2BAA2B,GAC/B,qBAAqB,CAMvB"}

package/dist/durable-delegation/carrier-mint.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mintDurableDelegatedToken = mintDurableDelegatedToken;
+exports.heldDurableDelegation = heldDurableDelegation;
+const xema_service_nest_1 = require("@xemahq/xema-service-nest");
+function mintDurableDelegatedToken(minter, ref, options) {
+    return minter.mintDelegatedContext({
+        delegationId: ref.carrierId,
+        audience: options.audience,
+    });
+}
+function heldDurableDelegation(minter, ref) {
+    return {
+        brand: xema_service_nest_1.HELD_DURABLE_DELEGATION_BRAND,
+        organizationId: ref.organizationId,
+        mintDelegatedContext: ({ audience }) => mintDurableDelegatedToken(minter, ref, { audience }),
+    };
+}
+//# sourceMappingURL=carrier-mint.js.map

package/dist/durable-delegation/carrier-mint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"carrier-mint.js","sourceRoot":"","sources":["../../src/durable-delegation/carrier-mint.ts"],"names":[],"mappings":";;AAiCA,8DASC;AAOD,sDASC;AA1DD,iEAAsG;AAiCtG,SAAgB,yBAAyB,CACvC,MAA+B,EAC/B,GAAgC,EAChC,OAAgD;IAEhD,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACjC,YAAY,EAAE,GAAG,CAAC,SAAS;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;AACL,CAAC;AAOD,SAAgB,qBAAqB,CACnC,MAA+B,EAC/B,GAAgC;IAEhC,OAAO;QACL,KAAK,EAAE,iDAA6B;QACpC,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,yBAAyB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC;KAC7F,CAAC;AACJ,CAAC"}

package/dist/durable-delegation/carrier-shape.d.ts

@@ -0,0 +1,8 @@
+export declare const DURABLE_DELEGATION_SCOPE_PREFIX = "durable-delegation:";
+export declare const DURABLE_DELEGATION_BASIS_PREFIX = "durable-delegation:";
+export declare const DURABLE_DELEGATION_CARRY_ACTION = "xema_durable_delegation#carry";
+export declare function durableDelegationRootMarker(rootId: string): string;
+export declare function durableDelegationBasis(recordId: string): string;
+export declare function recordIdOfDurableBasis(basis: string | null): string | undefined;
+export declare function durableDelegationIdOfScope(scope: readonly string[] | undefined): string | undefined;
+//# sourceMappingURL=carrier-shape.d.ts.map

package/dist/durable-delegation/carrier-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"carrier-shape.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/carrier-shape.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,+BAA+B,wBAAwB,CAAC;AAGrE,eAAO,MAAM,+BAA+B,wBAAwB,CAAC;AAMrE,eAAO,MAAM,+BAA+B,kCAAkC,CAAC;AAG/E,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElE;AAGD,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/D;AAGD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAI/E;AAQD,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACnC,MAAM,GAAG,SAAS,CASpB"}

package/dist/durable-delegation/carrier-shape.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DURABLE_DELEGATION_CARRY_ACTION = exports.DURABLE_DELEGATION_BASIS_PREFIX = exports.DURABLE_DELEGATION_SCOPE_PREFIX = void 0;
+exports.durableDelegationRootMarker = durableDelegationRootMarker;
+exports.durableDelegationBasis = durableDelegationBasis;
+exports.recordIdOfDurableBasis = recordIdOfDurableBasis;
+exports.durableDelegationIdOfScope = durableDelegationIdOfScope;
+exports.DURABLE_DELEGATION_SCOPE_PREFIX = 'durable-delegation:';
+exports.DURABLE_DELEGATION_BASIS_PREFIX = 'durable-delegation:';
+exports.DURABLE_DELEGATION_CARRY_ACTION = 'xema_durable_delegation#carry';
+function durableDelegationRootMarker(rootId) {
+    return `${exports.DURABLE_DELEGATION_SCOPE_PREFIX}${rootId}`;
+}
+function durableDelegationBasis(recordId) {
+    return `${exports.DURABLE_DELEGATION_BASIS_PREFIX}${recordId}`;
+}
+function recordIdOfDurableBasis(basis) {
+    return basis !== null && basis.startsWith(exports.DURABLE_DELEGATION_BASIS_PREFIX)
+        ? basis.slice(exports.DURABLE_DELEGATION_BASIS_PREFIX.length)
+        : undefined;
+}
+function durableDelegationIdOfScope(scope) {
+    if (scope === undefined) {
+        return undefined;
+    }
+    const entries = scope.filter((entry) => entry.startsWith(exports.DURABLE_DELEGATION_SCOPE_PREFIX));
+    if (entries.length !== 1) {
+        return entries.length === 0 ? undefined : '';
+    }
+    return entries[0].slice(exports.DURABLE_DELEGATION_SCOPE_PREFIX.length);
+}
+//# sourceMappingURL=carrier-shape.js.map

package/dist/durable-delegation/carrier-shape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"carrier-shape.js","sourceRoot":"","sources":["../../src/durable-delegation/carrier-shape.ts"],"names":[],"mappings":";;;AA2BA,kEAEC;AAGD,wDAEC;AAGD,wDAIC;AAQD,gEAWC;AA7CY,QAAA,+BAA+B,GAAG,qBAAqB,CAAC;AAGxD,QAAA,+BAA+B,GAAG,qBAAqB,CAAC;AAMxD,QAAA,+BAA+B,GAAG,+BAA+B,CAAC;AAG/E,SAAgB,2BAA2B,CAAC,MAAc;IACxD,OAAO,GAAG,uCAA+B,GAAG,MAAM,EAAE,CAAC;AACvD,CAAC;AAGD,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,OAAO,GAAG,uCAA+B,GAAG,QAAQ,EAAE,CAAC;AACzD,CAAC;AAGD,SAAgB,sBAAsB,CAAC,KAAoB;IACzD,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,uCAA+B,CAAC;QACxE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,uCAA+B,CAAC,MAAM,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAQD,SAAgB,0BAA0B,CACxC,KAAoC;IAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,uCAA+B,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,CAAC;IACD,OAAQ,OAAO,CAAC,CAAC,CAAY,CAAC,KAAK,CAAC,uCAA+B,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC"}

package/dist/durable-delegation/carrier-window.d.ts

@@ -0,0 +1,21 @@
+export declare const CARRIER_BOUND_LIFETIME_MS: number;
+export declare const CARRIER_RENEWAL_WINDOW_MS: number;
+export declare enum CarrierRenewalOutcome {
+    Renewed = "renewed",
+    NotDue = "not-due",
+    CeilingUnknown = "ceiling-unknown",
+    AtCeiling = "at-ceiling",
+    RenewedByAuthorizationApi = "renewed-by-authorization-api"
+}
+export type ChildCarrierRenewalPlan = {
+    readonly outcome: CarrierRenewalOutcome.NotDue;
+} | {
+    readonly outcome: CarrierRenewalOutcome.CeilingUnknown;
+} | {
+    readonly outcome: CarrierRenewalOutcome.AtCeiling;
+} | {
+    readonly outcome: CarrierRenewalOutcome.Renewed;
+    readonly expiresAt: Date;
+};
+export declare function planChildCarrierRenewal(now: Date, carrierExpiresAt: Date, ceiling: Date | undefined): ChildCarrierRenewalPlan;
+//# sourceMappingURL=carrier-window.d.ts.map

package/dist/durable-delegation/carrier-window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"carrier-window.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/carrier-window.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,yBAAyB,QAA2B,CAAC;AAGlE,eAAO,MAAM,yBAAyB,QAA0B,CAAC;AAGjE,oBAAY,qBAAqB;IAE/B,OAAO,YAAY;IAEnB,MAAM,YAAY;IAKlB,cAAc,oBAAoB;IAMlC,SAAS,eAAe;IAExB,yBAAyB,iCAAiC;CAC3D;AAGD,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,cAAc,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC;AASlF,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,IAAI,EACT,gBAAgB,EAAE,IAAI,EACtB,OAAO,EAAE,IAAI,GAAG,SAAS,GACxB,uBAAuB,CAYzB"}

package/dist/durable-delegation/carrier-window.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarrierRenewalOutcome = exports.CARRIER_RENEWAL_WINDOW_MS = exports.CARRIER_BOUND_LIFETIME_MS = void 0;
+exports.planChildCarrierRenewal = planChildCarrierRenewal;
+exports.CARRIER_BOUND_LIFETIME_MS = 30 * 24 * 60 * 60 * 1000;
+exports.CARRIER_RENEWAL_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;
+var CarrierRenewalOutcome;
+(function (CarrierRenewalOutcome) {
+    CarrierRenewalOutcome["Renewed"] = "renewed";
+    CarrierRenewalOutcome["NotDue"] = "not-due";
+    CarrierRenewalOutcome["CeilingUnknown"] = "ceiling-unknown";
+    CarrierRenewalOutcome["AtCeiling"] = "at-ceiling";
+    CarrierRenewalOutcome["RenewedByAuthorizationApi"] = "renewed-by-authorization-api";
+})(CarrierRenewalOutcome || (exports.CarrierRenewalOutcome = CarrierRenewalOutcome = {}));
+function planChildCarrierRenewal(now, carrierExpiresAt, ceiling) {
+    if (carrierExpiresAt.getTime() - now.getTime() >= exports.CARRIER_RENEWAL_WINDOW_MS) {
+        return { outcome: CarrierRenewalOutcome.NotDue };
+    }
+    if (ceiling === undefined) {
+        return { outcome: CarrierRenewalOutcome.CeilingUnknown };
+    }
+    const target = Math.min(ceiling.getTime(), now.getTime() + exports.CARRIER_BOUND_LIFETIME_MS);
+    if (target <= carrierExpiresAt.getTime()) {
+        return { outcome: CarrierRenewalOutcome.AtCeiling };
+    }
+    return { outcome: CarrierRenewalOutcome.Renewed, expiresAt: new Date(target) };
+}
+//# sourceMappingURL=carrier-window.js.map

package/dist/durable-delegation/carrier-window.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"carrier-window.js","sourceRoot":"","sources":["../../src/durable-delegation/carrier-window.ts"],"names":[],"mappings":";;;AAyDA,0DAgBC;AAxDY,QAAA,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAGrD,QAAA,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAGjE,IAAY,qBAkBX;AAlBD,WAAY,qBAAqB;IAE/B,4CAAmB,CAAA;IAEnB,2CAAkB,CAAA;IAKlB,2DAAkC,CAAA;IAMlC,iDAAwB,CAAA;IAExB,mFAA0D,CAAA;AAC5D,CAAC,EAlBW,qBAAqB,qCAArB,qBAAqB,QAkBhC;AAgBD,SAAgB,uBAAuB,CACrC,GAAS,EACT,gBAAsB,EACtB,OAAyB;IAEzB,IAAI,gBAAgB,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,iCAAyB,EAAE,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,MAAM,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,cAAc,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,iCAAyB,CAAC,CAAC;IACtF,IAAI,MAAM,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,SAAS,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AACjF,CAAC"}

package/dist/durable-delegation/holder-client.d.ts

@@ -1,9 +1,9 @@
 import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
-import { IdentityBootstrapService } from '@xemahq/identity-client';
+import { IdentityBootstrapService, type ScopedAccessToken } from '@xemahq/identity-client';
 import { type ForwardedCallerContext } from '@xemahq/platform-common';
+import { CarrierRenewalOutcome } from './carrier-window';
 export declare enum DurableDelegationOwnerKind {
     User = "USER",
-    Team = "TEAM",
     Org = "ORG"
 }
 export declare enum DurableDelegationRecordState {
@@ -12,32 +12,68 @@ export declare enum DurableDelegationRecordState {
     Revoked = "REVOKED",
     Expired = "EXPIRED"
 }
-export interface DurableDelegationCreate {
-    readonly owner: {
-        readonly kind: DurableDelegationOwnerKind;
-        readonly id: string;
-    };
+export declare enum DurableDelegationEndReason {
+    Explicit = "EXPLICIT",
+    AnchorInactive = "ANCHOR_INACTIVE",
+    AnchorDeleted = "ANCHOR_DELETED",
+    OwnerDeleted = "OWNER_DELETED",
+    Expired = "EXPIRED",
+    ParentEnded = "PARENT_ENDED"
+}
+export declare enum DurableDelegationErrorCode {
+    CreationRefused = "DURABLE_DELEGATION_CREATION_REFUSED",
+    NotFound = "DURABLE_DELEGATION_NOT_FOUND",
+    NotActive = "DURABLE_DELEGATION_NOT_ACTIVE",
+    CarrierUnavailable = "DURABLE_DELEGATION_CARRIER_UNAVAILABLE",
+    RevocationNotPermitted = "DURABLE_DELEGATION_REVOCATION_NOT_PERMITTED",
+    HolderMismatch = "DURABLE_DELEGATION_HOLDER_IS_NOT_PRESENTER",
+    RequestKeyConflict = "DURABLE_DELEGATION_REQUEST_KEY_CONFLICT",
+    CarrierAlreadyBound = "DURABLE_DELEGATION_CARRIER_ALREADY_BOUND",
+    AnchorTypeNotDeclared = "DELEGATION_ANCHOR_TYPE_NOT_DECLARED",
+    AnchorOriginationNotDeclared = "DELEGATION_ANCHOR_ORIGINATION_NOT_DECLARED",
+    ChainTooDeep = "DELEGATION_CHAIN_TOO_DEEP",
+    Ended = "DURABLE_DELEGATION_ENDED",
+    MemberBoundParent = "DURABLE_DELEGATION_MEMBER_BOUND_PARENT",
+    RootCarrierNotPresenterRenewed = "DURABLE_DELEGATION_ROOT_CARRIER_NOT_PRESENTER_RENEWED",
+    BeyondHolderDeclarations = "DELEGATION_BEYOND_HOLDER_DECLARATIONS",
+    HolderDeclarationsUnstamped = "DELEGATION_HOLDER_DECLARATIONS_UNSTAMPED"
+}
+export interface OriginateDurableDelegationInput {
+    readonly anchorType: string;
+    readonly anchorId: string;
+    readonly requestKey: string;
+    readonly environmentId: string;
+    readonly capabilities?: readonly string[];
+    readonly redelegable?: readonly string[];
+}
+export interface DurableDelegationChildCreate {
     readonly scope: readonly string[];
     readonly capabilities: readonly string[];
-    readonly integrationId: string;
-    readonly environmentId: string;
-    readonly requestKey: string;
+    readonly redelegable?: readonly string[];
+    readonly holderWorkload: string;
     readonly holderMember?: string;
+    readonly requestKey: string;
     readonly expiresAt?: Date;
 }
 export interface DurableDelegationView {
     readonly id: string;
     readonly state: DurableDelegationRecordState;
-    readonly endReason?: string;
+    readonly endReason?: DurableDelegationEndReason;
     readonly owner: {
         readonly kind: DurableDelegationOwnerKind;
         readonly id: string;
     };
     readonly scope: readonly string[];
     readonly capabilities: readonly string[];
-    readonly integrationId: string;
+    readonly anchorType: string;
+    readonly anchorId: string;
+    readonly parentId?: string;
+    readonly rootId: string;
+    readonly depth: number;
+    readonly redelegable: readonly string[];
     readonly environmentId: string;
     readonly holderWorkload: string;
+    readonly createdByWorkload?: string;
     readonly carrierId?: string;
     readonly expiresAt?: string;
     readonly lastDenial?: {
@@ -47,6 +83,12 @@ export interface DurableDelegationView {
         readonly scope: string;
     };
 }
+export interface DurableDelegationCarrierWindow {
+    readonly delegationId: string;
+    readonly carrierId: string;
+    readonly carrierExpiresAt: string;
+    readonly renewalCeiling?: string;
+}
 export declare class DurableDelegationRequestError extends Error {
     readonly status: number;
     readonly code: string | undefined;
@@ -55,11 +97,25 @@ export declare class DurableDelegationRequestError extends Error {
 export declare class DurableDelegationHolderClient {
     private readonly registry;
     private readonly identity;
+    private readonly logger;
     constructor(registry: ServiceRegistry, identity: IdentityBootstrapService);
-    create(author: ForwardedCallerContext, request: DurableDelegationCreate): Promise<DurableDelegationView>;
+    originate(author: ForwardedCallerContext, input: OriginateDurableDelegationInput): Promise<DurableDelegationView>;
+    createChild(orgId: string, parentId: string, request: DurableDelegationChildCreate): Promise<DurableDelegationView>;
     read(orgId: string, delegationId: string): Promise<DurableDelegationView>;
     revoke(orgId: string, delegationId: string): Promise<DurableDelegationView>;
+    supersede(orgId: string, delegationId: string, original?: unknown): Promise<DurableDelegationView>;
+    renewCarrier(orgId: string, delegationId: string): Promise<CarrierRenewalOutcome>;
     mintContext(carrierId: string): Promise<string>;
+    mintDelegatedContext(params: {
+        delegationId: string;
+        audience?: string;
+        realm?: string;
+    }): Promise<ScopedAccessToken>;
+    private bindOrResume;
+    private revokeUnboundCarrier;
+    private postChild;
+    private reportCarrierWindow;
+    private serviceHeaders;
     private send;
 }
 //# sourceMappingURL=holder-client.d.ts.map

package/dist/durable-delegation/holder-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"holder-client.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-client.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AAOjC,oBAAY,0BAA0B;IACpC,IAAI,SAAS;IACb,IAAI,SAAS;IACb,GAAG,QAAQ;CACZ;AAGD,oBAAY,4BAA4B;IACtC,YAAY,iBAAiB;IAC7B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAGpC,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AAmBD,qBACa,6BAA6B;IAEN,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADwB,QAAQ,EAAE,eAAe,EACzD,QAAQ,EAAE,wBAAwB;IAGxC,MAAM,CACjB,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IAepB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IASzE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAc3E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAQ9C,IAAI;CA8BnB"}
+{"version":3,"file":"holder-client.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-client.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAoB,wBAAwB,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AAWjC,OAAO,EAAE,qBAAqB,EAA2B,MAAM,kBAAkB,CAAC;AAclF,oBAAY,0BAA0B;IACpC,IAAI,SAAS;IACb,GAAG,QAAQ;CACZ;AAGD,oBAAY,4BAA4B;IACtC,YAAY,iBAAiB;IAC7B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,0BAA0B;IACpC,QAAQ,aAAa;IACrB,cAAc,oBAAoB;IAClC,aAAa,mBAAmB;IAChC,YAAY,kBAAkB;IAC9B,OAAO,YAAY;IAEnB,WAAW,iBAAiB;CAC7B;AAGD,oBAAY,0BAA0B;IACpC,eAAe,wCAAwC;IACvD,QAAQ,iCAAiC;IACzC,SAAS,kCAAkC;IAC3C,kBAAkB,2CAA2C;IAC7D,sBAAsB,gDAAgD;IACtE,cAAc,+CAA+C;IAC7D,kBAAkB,4CAA4C;IAE9D,mBAAmB,6CAA6C;IAChE,qBAAqB,wCAAwC;IAE7D,4BAA4B,+CAA+C;IAC3E,YAAY,8BAA8B;IAE1C,KAAK,6BAA6B;IAElC,iBAAiB,2CAA2C;IAE5D,8BAA8B,0DAA0D;IAExF,wBAAwB,0CAA0C;IAElE,2BAA2B,6CAA6C;CACzE;AASD,MAAM,WAAW,+BAA+B;IAE9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAO/B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAMD,MAAM,WAAW,4BAA4B;IAE3C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAMD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAKlC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAGpC,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AAqBD,qBACa,6BAA6B;IAIN,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkD;gBAGtB,QAAQ,EAAE,eAAe,EACzD,QAAQ,EAAE,wBAAwB;IAGxC,SAAS,CACpB,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,qBAAqB,CAAC;IA4CpB,WAAW,CACtB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,qBAAqB,CAAC;IA+BpB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IASzE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAkB3E,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAmClG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAsCjF,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAarD,oBAAoB,CAAC,MAAM,EAAE;QAClC,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,iBAAiB,CAAC;YAIhB,YAAY;YAqDZ,oBAAoB;YAapB,SAAS;YA2BT,mBAAmB;YAenB,cAAc;YAId,IAAI;CA8BnB"}