@xemahq/authorization-nest 0.9.0 → 0.10.0

package/dist/authorization.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.module.d.ts","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AA0BjC,qBACa,uBAAuB;WACpB,OAAO,CACnB,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAC1C,aAAa;CA+BjB"}
+{"version":3,"file":"authorization.module.d.ts","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AA2BjC,qBACa,uBAAuB;WACpB,OAAO,CACnB,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAC1C,aAAa;CAiCjB"}

package/dist/authorization.module.js

@@ -13,6 +13,7 @@ const authorization_options_1 = require("./authorization.options");
 const authorize_decorator_1 = require("./authorize.decorator");
 const authzen_transport_1 = require("./authzen.transport");
 const grant_version_reader_1 = require("./grant-version.reader");
+const installed_workload_grant_resolver_1 = require("./installed-workload-grant.resolver");
 const policy_decisions_1 = require("./policy-decisions");
 const route_action_evaluator_1 = require("./route-action-evaluator");
 const xema_authz_service_1 = require("./xema-authz.service");
@@ -37,6 +38,7 @@ let XemaAuthorizationModule = XemaAuthorizationModule_1 = class XemaAuthorizatio
                 },
                 route_action_evaluator_1.XemaRouteActionEvaluator,
                 authorize_decorator_1.XemaAuthorizeGuard,
+                installed_workload_grant_resolver_1.InstalledWorkloadGrantResolver,
             ],
             exports: [
                 xema_authz_service_1.XemaAuthz,
@@ -45,6 +47,7 @@ let XemaAuthorizationModule = XemaAuthorizationModule_1 = class XemaAuthorizatio
                 authorize_decorator_1.XemaAuthorizeGuard,
                 authzen_transport_1.AUTHZEN_PDP_TRANSPORT,
                 grant_version_reader_1.AUTHORIZATION_GRANT_VERSION_READER,
+                installed_workload_grant_resolver_1.InstalledWorkloadGrantResolver,
             ],
         };
     }

package/dist/authorization.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA4D;AAE5D,mEAIiC;AACjC,+DAA2D;AAC3D,2DAG6B;AAC7B,iEAGgC;AAChC,yDAAyD;AACzD,qEAAoE;AACpE,6DAAiD;AAe1C,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAC3B,MAAM,CAAC,OAAO,CACnB,OAA2C;QAE3C,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kDAA0B;oBACnC,QAAQ,EAAE,IAAA,uDAA+B,EAAC,OAAO,CAAC;iBACnD;gBACD,2CAAuB;gBACvB,EAAE,OAAO,EAAE,yCAAqB,EAAE,WAAW,EAAE,2CAAuB,EAAE;gBACxE,8BAAS;gBACT,sCAAmB;gBACnB,0DAAmC;gBACnC;oBACE,OAAO,EAAE,yDAAkC;oBAC3C,WAAW,EAAE,0DAAmC;iBACjD;gBACD,iDAAwB;gBACxB,wCAAkB;aACnB;YACD,OAAO,EAAE;gBACP,8BAAS;gBACT,sCAAmB;gBACnB,iDAAwB;gBACxB,wCAAkB;gBAClB,yCAAqB;gBACrB,yDAAkC;aACnC;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAlCY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAkCnC"}
+{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA4D;AAE5D,mEAIiC;AACjC,+DAA2D;AAC3D,2DAG6B;AAC7B,iEAGgC;AAChC,2FAAqF;AACrF,yDAAyD;AACzD,qEAAoE;AACpE,6DAAiD;AAe1C,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAC3B,MAAM,CAAC,OAAO,CACnB,OAA2C;QAE3C,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kDAA0B;oBACnC,QAAQ,EAAE,IAAA,uDAA+B,EAAC,OAAO,CAAC;iBACnD;gBACD,2CAAuB;gBACvB,EAAE,OAAO,EAAE,yCAAqB,EAAE,WAAW,EAAE,2CAAuB,EAAE;gBACxE,8BAAS;gBACT,sCAAmB;gBACnB,0DAAmC;gBACnC;oBACE,OAAO,EAAE,yDAAkC;oBAC3C,WAAW,EAAE,0DAAmC;iBACjD;gBACD,iDAAwB;gBACxB,wCAAkB;gBAClB,kEAA8B;aAC/B;YACD,OAAO,EAAE;gBACP,8BAAS;gBACT,sCAAmB;gBACnB,iDAAwB;gBACxB,wCAAkB;gBAClB,yCAAqB;gBACrB,yDAAkC;gBAClC,kEAA8B;aAC/B;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AApCY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAoCnC"}

package/dist/durable-delegation/holder-client.d.ts

@@ -115,7 +115,7 @@ export declare class DurableDelegationHolderClient {
     private revokeUnboundCarrier;
     private postChild;
     private reportCarrierWindow;
-    private serviceHeaders;
+    private holderAuthority;
     private send;
 }
 //# sourceMappingURL=holder-client.d.ts.map

package/dist/durable-delegation/holder-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"holder-client.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-client.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAoB,wBAAwB,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAgB7G,OAAO,EAAE,qBAAqB,EAA2B,MAAM,kBAAkB,CAAC;AAclF,oBAAY,0BAA0B;IACpC,IAAI,SAAS;IACb,GAAG,QAAQ;CACZ;AAGD,oBAAY,4BAA4B;IACtC,YAAY,iBAAiB;IAC7B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,0BAA0B;IACpC,QAAQ,aAAa;IACrB,cAAc,oBAAoB;IAClC,aAAa,mBAAmB;IAChC,YAAY,kBAAkB;IAC9B,OAAO,YAAY;IAEnB,WAAW,iBAAiB;CAC7B;AAGD,oBAAY,0BAA0B;IACpC,eAAe,wCAAwC;IACvD,QAAQ,iCAAiC;IACzC,SAAS,kCAAkC;IAC3C,kBAAkB,2CAA2C;IAC7D,sBAAsB,gDAAgD;IACtE,cAAc,+CAA+C;IAC7D,kBAAkB,4CAA4C;IAE9D,mBAAmB,6CAA6C;IAChE,qBAAqB,wCAAwC;IAE7D,4BAA4B,+CAA+C;IAC3E,YAAY,8BAA8B;IAE1C,KAAK,6BAA6B;IAElC,iBAAiB,2CAA2C;IAE5D,8BAA8B,0DAA0D;IAExF,wBAAwB,0CAA0C;IAElE,2BAA2B,6CAA6C;CACzE;AASD,MAAM,WAAW,+BAA+B;IAE9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAO/B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAMD,MAAM,WAAW,4BAA4B;IAE3C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAMD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAKlC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAGpC,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AAkBD,qBACa,6BAA6B;IAIN,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkD;gBAGtB,QAAQ,EAAE,eAAe,EACzD,QAAQ,EAAE,wBAAwB;IAGxC,SAAS,CACpB,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,qBAAqB,CAAC;IAyDpB,WAAW,CACtB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,qBAAqB,CAAC;IA+BpB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IASzE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAkB3E,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAmClG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAwCjF,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa1E,oBAAoB,CAAC,MAAM,EAAE;QAClC,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,iBAAiB,CAAC;YAIhB,YAAY;YAqDZ,oBAAoB;YAapB,SAAS;YA2BT,mBAAmB;YAenB,cAAc;YAId,IAAI;CA8BnB"}
+{"version":3,"file":"holder-client.d.ts","sourceRoot":"","sources":["../../src/durable-delegation/holder-client.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAoB,wBAAwB,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAkB7G,OAAO,EAAE,qBAAqB,EAA2B,MAAM,kBAAkB,CAAC;AAclF,oBAAY,0BAA0B;IACpC,IAAI,SAAS;IACb,GAAG,QAAQ;CACZ;AAGD,oBAAY,4BAA4B;IACtC,YAAY,iBAAiB;IAC7B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,0BAA0B;IACpC,QAAQ,aAAa;IACrB,cAAc,oBAAoB;IAClC,aAAa,mBAAmB;IAChC,YAAY,kBAAkB;IAC9B,OAAO,YAAY;IAEnB,WAAW,iBAAiB;CAC7B;AAGD,oBAAY,0BAA0B;IACpC,eAAe,wCAAwC;IACvD,QAAQ,iCAAiC;IACzC,SAAS,kCAAkC;IAC3C,kBAAkB,2CAA2C;IAC7D,sBAAsB,gDAAgD;IACtE,cAAc,+CAA+C;IAC7D,kBAAkB,4CAA4C;IAE9D,mBAAmB,6CAA6C;IAChE,qBAAqB,wCAAwC;IAE7D,4BAA4B,+CAA+C;IAC3E,YAAY,8BAA8B;IAE1C,KAAK,6BAA6B;IAElC,iBAAiB,2CAA2C;IAE5D,8BAA8B,0DAA0D;IAExF,wBAAwB,0CAA0C;IAElE,2BAA2B,6CAA6C;CACzE;AASD,MAAM,WAAW,+BAA+B;IAE9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAO/B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAMD,MAAM,WAAW,4BAA4B;IAE3C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAMD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAKlC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAGpC,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFxC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAK3C;AA6BD,qBACa,6BAA6B;IAIN,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkD;gBAGtB,QAAQ,EAAE,eAAe,EACzD,QAAQ,EAAE,wBAAwB;IAGxC,SAAS,CACpB,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,qBAAqB,CAAC;IA6CpB,WAAW,CACtB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,qBAAqB,CAAC;IA+BpB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQzE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAiB3E,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAkClG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAwCjF,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa1E,oBAAoB,CAAC,MAAM,EAAE;QAClC,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,iBAAiB,CAAC;YAIhB,YAAY;YAoDZ,oBAAoB;YAapB,SAAS;YA0BT,mBAAmB;IAsBjC,OAAO,CAAC,eAAe;YAIT,IAAI;CAyBnB"}

package/dist/durable-delegation/holder-client.js

@@ -75,6 +75,11 @@ class DurableDelegationRequestError extends Error {
     }
 }
 exports.DurableDelegationRequestError = DurableDelegationRequestError;
+const HOLDER_OPERATION = {
+    read: 'authorization:durable-delegation-holder.read@1',
+    write: 'authorization:durable-delegation-holder.write@1',
+    supersede: 'authorization:durable-delegation.supersede.write@1',
+};
 let DurableDelegationHolderClient = DurableDelegationHolderClient_1 = class DurableDelegationHolderClient {
     registry;
     identity;
@@ -84,15 +89,7 @@ let DurableDelegationHolderClient = DurableDelegationHolderClient_1 = class Dura
         this.identity = identity;
     }
     async originate(author, input) {
-        const relay = new Headers((await (0, xema_service_nest_1.peerCallInit)((0, xema_service_nest_1.peerAuthorityForCaller)(author, (0, xema_service_nest_1.ownTokenSourceFor)(this.identity)), service_registry_1.ServiceName.AUTHORIZATION_API)).headers);
-        const relayed = {};
-        for (const name of ['Authorization', 'X-Xema-Presenter-Context']) {
-            const value = relay.get(name);
-            if (value !== null) {
-                relayed[name] = value;
-            }
-        }
-        return this.send('POST', '/durable-delegations/originate', author.orgId, relayed, {
+        return this.send('POST', '/durable-delegations/originate', (0, xema_service_nest_1.peerAuthorityForCaller)(author, (0, xema_service_nest_1.ownTokenSourceFor)(this.identity)), {
             anchorType: input.anchorType,
             anchorId: input.anchorId,
             requestKey: input.requestKey,
@@ -129,14 +126,14 @@ let DurableDelegationHolderClient = DurableDelegationHolderClient_1 = class Dura
         return this.bindOrResume(orgId, parentId, request, child.id, carrier.id);
     }
     async read(orgId, delegationId) {
-        return this.send('GET', `/internal/durable-delegations/${encodeURIComponent(delegationId)}`, orgId, await this.serviceHeaders());
+        return this.send('GET', `/internal/durable-delegations/${encodeURIComponent(delegationId)}`, this.holderAuthority(orgId, 'read'));
     }
     async revoke(orgId, delegationId) {
-        return this.send('POST', `/internal/durable-delegations/${encodeURIComponent(delegationId)}/revoke`, orgId, await this.serviceHeaders());
+        return this.send('POST', `/internal/durable-delegations/${encodeURIComponent(delegationId)}/revoke`, this.holderAuthority(orgId, 'write'));
     }
     async supersede(orgId, delegationId, original) {
         try {
-            return await this.send('POST', `/internal/durable-delegations/${encodeURIComponent(delegationId)}/supersede`, orgId, await this.serviceHeaders());
+            return await this.send('POST', `/internal/durable-delegations/${encodeURIComponent(delegationId)}/supersede`, this.holderAuthority(orgId, 'supersede'));
         }
         catch (error) {
             throw new holder_errors_1.DelegationSupersedeFailedError(delegationId, original, error);
@@ -182,7 +179,7 @@ let DurableDelegationHolderClient = DurableDelegationHolderClient_1 = class Dura
     }
     async bindOrResume(orgId, parentId, request, childId, carrierId) {
         try {
-            return await this.send('POST', `/internal/durable-delegations/${encodeURIComponent(childId)}/carrier`, orgId, await this.serviceHeaders(), { carrierId });
+            return await this.send('POST', `/internal/durable-delegations/${encodeURIComponent(childId)}/carrier`, this.holderAuthority(orgId, 'write'), { carrierId });
         }
         catch (bindError) {
             if (bindError instanceof DurableDelegationRequestError && bindError.code === DurableDelegationErrorCode.CarrierAlreadyBound) {
@@ -229,7 +226,7 @@ let DurableDelegationHolderClient = DurableDelegationHolderClient_1 = class Dura
         }
     }
     async postChild(orgId, parentId, request) {
-        return this.send('POST', `/internal/durable-delegations/${encodeURIComponent(parentId)}/children`, orgId, await this.serviceHeaders(), {
+        return this.send('POST', `/internal/durable-delegations/${encodeURIComponent(parentId)}/children`, this.holderAuthority(orgId, 'write'), {
             scope: [...request.scope],
             capabilities: [...request.capabilities],
             ...(request.redelegable === undefined ? {} : { redelegable: [...request.redelegable] }),
@@ -240,22 +237,18 @@ let DurableDelegationHolderClient = DurableDelegationHolderClient_1 = class Dura
         });
     }
     async reportCarrierWindow(orgId, delegationId, carrierId, expiresAt) {
-        return this.send('POST', `/internal/durable-delegations/${encodeURIComponent(delegationId)}/carrier/window`, orgId, await this.serviceHeaders(), { carrierId, expiresAt });
+        return this.send('POST', `/internal/durable-delegations/${encodeURIComponent(delegationId)}/carrier/window`, this.holderAuthority(orgId, 'write'), { carrierId, expiresAt });
     }
-    async serviceHeaders() {
-        return { Authorization: `Bearer ${await this.identity.getAccessToken()}` };
+    holderAuthority(orgId, access) {
+        return (0, xema_service_nest_1.peerAuthorityOwnGrantInOrg)((0, xema_service_nest_1.ownTokenSourceFor)(this.identity), orgId, HOLDER_OPERATION[access]);
     }
-    async send(method, path, orgId, headers, body) {
+    async send(method, path, authority, body) {
         const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
-        const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, {
+        const init = await (0, xema_service_nest_1.peerCallInit)(authority, service_registry_1.ServiceName.AUTHORIZATION_API, {
             method,
-            headers: {
-                ...headers,
-                'X-Xema-Org-Id': orgId,
-                ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
-            },
-            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            ...(body === undefined ? {} : { headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) }),
         });
+        const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, init);
         if (!response.ok) {
             const text = await response.text();
             throw new DurableDelegationRequestError(`authorization-api ${method} ${path} failed with HTTP ${response.status}: ${text.slice(0, 2000)}`, response.status, codeOf(text));

package/dist/durable-delegation/holder-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"holder-client.js","sourceRoot":"","sources":["../../src/durable-delegation/holder-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,qEAG0C;AAC1C,iDAAwE;AACxE,yEAG4C;AAC5C,6DAA6G;AAC7G,yEAGuC;AACvC,iEAImC;AAEnC,mDAIyB;AACzB,qDAAkF;AAClF,mDAMyB;AAOzB,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,2CAAa,CAAA;IACb,yCAAW,CAAA;AACb,CAAC,EAHW,0BAA0B,0CAA1B,0BAA0B,QAGrC;AAGD,IAAY,4BAKX;AALD,WAAY,4BAA4B;IACtC,6DAA6B,CAAA;IAC7B,iDAAiB,CAAA;IACjB,mDAAmB,CAAA;IACnB,mDAAmB,CAAA;AACrB,CAAC,EALW,4BAA4B,4CAA5B,4BAA4B,QAKvC;AAGD,IAAY,0BAQX;AARD,WAAY,0BAA0B;IACpC,mDAAqB,CAAA;IACrB,gEAAkC,CAAA;IAClC,8DAAgC,CAAA;IAChC,4DAA8B,CAAA;IAC9B,iDAAmB,CAAA;IAEnB,0DAA4B,CAAA;AAC9B,CAAC,EARW,0BAA0B,0CAA1B,0BAA0B,QAQrC;AAGD,IAAY,0BAwBX;AAxBD,WAAY,0BAA0B;IACpC,qFAAuD,CAAA;IACvD,uEAAyC,CAAA;IACzC,yEAA2C,CAAA;IAC3C,2FAA6D,CAAA;IAC7D,oGAAsE,CAAA;IACtE,2FAA6D,CAAA;IAC7D,4FAA8D,CAAA;IAE9D,8FAAgE,CAAA;IAChE,2FAA6D,CAAA;IAE7D,yGAA2E,CAAA;IAC3E,wEAA0C,CAAA;IAE1C,gEAAkC,CAAA;IAElC,0FAA4D,CAAA;IAE5D,sHAAwF,CAAA;IAExF,gGAAkE,CAAA;IAElE,sGAAwE,CAAA;AAC1E,CAAC,EAxBW,0BAA0B,0CAA1B,0BAA0B,QAwBrC;AAkGD,MAAa,6BAA8B,SAAQ,KAAK;IAGpC;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AATD,sEASC;AAmBM,IAAM,6BAA6B,qCAAnC,MAAM,6BAA6B;IAIW;IAChC;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,+BAA6B,CAAC,IAAI,CAAC,CAAC;IAEzE,YACmD,QAAyB,EACzD,QAAkC;QADF,aAAQ,GAAR,QAAQ,CAAiB;QACzD,aAAQ,GAAR,QAAQ,CAA0B;IAClD,CAAC;IAEG,KAAK,CAAC,SAAS,CACpB,MAA8B,EAC9B,KAAsC;QAItC,MAAM,KAAK,GAAG,IAAI,OAAO,CACvB,CACE,MAAM,IAAA,gCAAY,EAChB,IAAA,0CAAsB,EAAC,MAAM,EAAE,IAAA,qCAAiB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAChE,8BAAW,CAAC,iBAAiB,CAC9B,CACF,CAAC,OAAO,CACV,CAAC;QACF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,0BAA0B,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAAA,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAAA,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gCAAgC,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE;YAChF,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;IACL,CAAC;IAiCM,KAAK,CAAC,WAAW,CACtB,KAAa,EACb,QAAgB,EAChB,OAAqC;QAErC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,KAAK,KAAK,4BAA4B,CAAC,MAAM,EAAE,CAAC;YACzD,MAAM,IAAI,oCAAoB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAGnC,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,aAAa,EAAE,sBAAsB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnD,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,KAAK,CAAC,cAAc;YACtC,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YACvF,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;YACrC,uBAAuB,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;YAC/C,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,IAAA,2CAA2B,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1E,KAAK,EAAE,IAAA,sCAAsB,EAAC,KAAK,CAAC,EAAE,CAAC;YACvC,iBAAiB,EAAE,+CAA+B;YAElD,SAAS,EAAE,IAAI;YACf,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SACzE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,YAAoB;QACnD,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,EAAE,EACnE,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,CAC5B,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,YAAoB;QACrD,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,EACN,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAC1E,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,CAC5B,CAAC;IACJ,CAAC;IAWM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,YAAoB,EAAE,QAAkB;QAC5E,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CACpB,MAAM,EACN,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,YAAY,EAC7E,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,CAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,8CAA8B,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAwBM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,YAAoB;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,OAAO,EAAE,CAAC;YAC/G,MAAM,IAAI,oCAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvF,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,aAAa,EAAE,sBAAsB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,sCAAqB,CAAC,yBAAyB,CAAC;QACzD,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,kCAAgB,CAAC,MAAM,EAAE,CAAC;YAC/C,MAAM,IAAI,wCAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,SAAS,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,sCAAqB,CAAC,MAAM,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,IAAA,wCAAuB,EAClC,IAAI,IAAI,EAAE,EACV,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAC3B,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAClF,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,KAAK,sCAAqB,CAAC,OAAO,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7G,OAAO,sCAAqB,CAAC,OAAO,CAAC;IACvC,CAAC;IASM,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,QAAgB;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC7C,YAAY,EAAE,SAAS;YACvB,QAAQ,EAAE,IAAA,mCAAkB,EAAC,QAAQ,CAAC;SACvC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAOM,oBAAoB,CAAC,MAI3B;QACC,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,KAAa,EACb,QAAgB,EAChB,OAAqC,EACrC,OAAe,EACf,SAAiB;QAEjB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CACpB,MAAM,EACN,iCAAiC,kBAAkB,CAAC,OAAO,CAAC,UAAU,EACtE,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,EAC3B,EAAE,SAAS,EAAE,CACd,CAAC;QACJ,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,IAAI,SAAS,YAAY,6BAA6B,IAAI,SAAS,CAAC,IAAI,KAAK,0BAA0B,CAAC,mBAAmB,EAAE,CAAC;gBAE5H,MAAM,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,OAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,IAAI,WAAW,YAAY,6BAA6B,IAAI,WAAW,CAAC,IAAI,KAAK,0BAA0B,CAAC,KAAK,EAAE,CAAC;oBAClH,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;oBACpD,MAAM,WAAW,CAAC;gBACpB,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAChB,OAAO,EAAE,8CAA8C;oBACvD,OAAO;oBACP,SAAS;oBACT,KAAK,EAAE,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;iBAC1E,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,SAAS,CAAC;QAClB,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,SAAiB;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,gDAAgD;gBACzD,OAAO;gBACP,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,KAAa,EACb,QAAgB,EAChB,OAAqC;QAErC,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,EACN,iCAAiC,kBAAkB,CAAC,QAAQ,CAAC,WAAW,EACxE,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,EAC3B;YACE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;YACzB,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACvF,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YACrF,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;SAC3F,CACF,CAAC;IACJ,CAAC;IAOO,KAAK,CAAC,mBAAmB,CAC/B,KAAa,EACb,YAAoB,EACpB,SAAiB,EACjB,SAAiB;QAEjB,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,EACN,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,iBAAiB,EAClF,KAAK,EACL,MAAM,IAAI,CAAC,cAAc,EAAE,EAC3B,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,MAAsB,EACtB,IAAY,EACZ,KAAa,EACb,OAA+B,EAC/B,IAAc;QAEd,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAAC,IAAI,CAAC,QAAQ,EAAE,8BAAW,CAAC,iBAAiB,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM;YACN,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,eAAe,EAAE,KAAK;gBACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aACtE;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,6BAA6B,CACrC,qBAAqB,MAAM,IAAI,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EACjG,QAAQ,CAAC,MAAM,EACf,MAAM,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,qCAA8B,EACnC,MAAM,QAAQ,CAAC,IAAI,EAAE,EACrB,qBAAqB,MAAM,IAAI,IAAI,EAAE,CACtC,CAAC;IACJ,CAAC;CACF,CAAA;AAhXY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;6CACJ,0CAAwB;GAL1C,6BAA6B,CAgXzC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;QACtD,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"holder-client.js","sourceRoot":"","sources":["../../src/durable-delegation/holder-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,qEAG0C;AAC1C,iDAAwE;AACxE,yEAG4C;AAC5C,6DAA6G;AAC7G,yEAGuC;AACvC,iEAMmC;AAEnC,mDAIyB;AACzB,qDAAkF;AAClF,mDAMyB;AAOzB,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,2CAAa,CAAA;IACb,yCAAW,CAAA;AACb,CAAC,EAHW,0BAA0B,0CAA1B,0BAA0B,QAGrC;AAGD,IAAY,4BAKX;AALD,WAAY,4BAA4B;IACtC,6DAA6B,CAAA;IAC7B,iDAAiB,CAAA;IACjB,mDAAmB,CAAA;IACnB,mDAAmB,CAAA;AACrB,CAAC,EALW,4BAA4B,4CAA5B,4BAA4B,QAKvC;AAGD,IAAY,0BAQX;AARD,WAAY,0BAA0B;IACpC,mDAAqB,CAAA;IACrB,gEAAkC,CAAA;IAClC,8DAAgC,CAAA;IAChC,4DAA8B,CAAA;IAC9B,iDAAmB,CAAA;IAEnB,0DAA4B,CAAA;AAC9B,CAAC,EARW,0BAA0B,0CAA1B,0BAA0B,QAQrC;AAGD,IAAY,0BAwBX;AAxBD,WAAY,0BAA0B;IACpC,qFAAuD,CAAA;IACvD,uEAAyC,CAAA;IACzC,yEAA2C,CAAA;IAC3C,2FAA6D,CAAA;IAC7D,oGAAsE,CAAA;IACtE,2FAA6D,CAAA;IAC7D,4FAA8D,CAAA;IAE9D,8FAAgE,CAAA;IAChE,2FAA6D,CAAA;IAE7D,yGAA2E,CAAA;IAC3E,wEAA0C,CAAA;IAE1C,gEAAkC,CAAA;IAElC,0FAA4D,CAAA;IAE5D,sHAAwF,CAAA;IAExF,gGAAkE,CAAA;IAElE,sGAAwE,CAAA;AAC1E,CAAC,EAxBW,0BAA0B,0CAA1B,0BAA0B,QAwBrC;AAkGD,MAAa,6BAA8B,SAAQ,KAAK;IAGpC;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AATD,sEASC;AAGD,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,gDAAgD;IACtD,KAAK,EAAE,iDAAiD;IACxD,SAAS,EAAE,oDAAoD;CACvD,CAAC;AAuBJ,IAAM,6BAA6B,qCAAnC,MAAM,6BAA6B;IAIW;IAChC;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,+BAA6B,CAAC,IAAI,CAAC,CAAC;IAEzE,YACmD,QAAyB,EACzD,QAAkC;QADF,aAAQ,GAAR,QAAQ,CAAiB;QACzD,aAAQ,GAAR,QAAQ,CAA0B;IAClD,CAAC;IAEG,KAAK,CAAC,SAAS,CACpB,MAA8B,EAC9B,KAAsC;QAKtC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gCAAgC,EAAE,IAAA,0CAAsB,EAAC,MAAM,EAAE,IAAA,qCAAiB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE;YAC3H,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;IACL,CAAC;IAiCM,KAAK,CAAC,WAAW,CACtB,KAAa,EACb,QAAgB,EAChB,OAAqC;QAErC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,KAAK,KAAK,4BAA4B,CAAC,MAAM,EAAE,CAAC;YACzD,MAAM,IAAI,oCAAoB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAGnC,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,aAAa,EAAE,sBAAsB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnD,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,KAAK,CAAC,cAAc;YACtC,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YACvF,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;YACrC,uBAAuB,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;YAC/C,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,IAAA,2CAA2B,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1E,KAAK,EAAE,IAAA,sCAAsB,EAAC,KAAK,CAAC,EAAE,CAAC;YACvC,iBAAiB,EAAE,+CAA+B;YAElD,SAAS,EAAE,IAAI;YACf,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SACzE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,YAAoB;QACnD,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,EAAE,EACnE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CACpC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,YAAoB;QACrD,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,EACN,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAC1E,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CACrC,CAAC;IACJ,CAAC;IAWM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,YAAoB,EAAE,QAAkB;QAC5E,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CACpB,MAAM,EACN,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,YAAY,EAC7E,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CACzC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,8CAA8B,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAwBM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,YAAoB;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,OAAO,EAAE,CAAC;YAC/G,MAAM,IAAI,oCAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvF,MAAM,IAAI,uCAAuB,CAAC,wCAAwB,CAAC,aAAa,EAAE,sBAAsB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,sCAAqB,CAAC,yBAAyB,CAAC;QACzD,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,kCAAgB,CAAC,MAAM,EAAE,CAAC;YAC/C,MAAM,IAAI,wCAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,SAAS,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,sCAAqB,CAAC,MAAM,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,IAAA,wCAAuB,EAClC,IAAI,IAAI,EAAE,EACV,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAC3B,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAClF,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,KAAK,sCAAqB,CAAC,OAAO,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7G,OAAO,sCAAqB,CAAC,OAAO,CAAC;IACvC,CAAC;IASM,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,QAAgB;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC7C,YAAY,EAAE,SAAS;YACvB,QAAQ,EAAE,IAAA,mCAAkB,EAAC,QAAQ,CAAC;SACvC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAOM,oBAAoB,CAAC,MAI3B;QACC,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,KAAa,EACb,QAAgB,EAChB,OAAqC,EACrC,OAAe,EACf,SAAiB;QAEjB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CACpB,MAAM,EACN,iCAAiC,kBAAkB,CAAC,OAAO,CAAC,UAAU,EACtE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EACpC,EAAE,SAAS,EAAE,CACd,CAAC;QACJ,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,IAAI,SAAS,YAAY,6BAA6B,IAAI,SAAS,CAAC,IAAI,KAAK,0BAA0B,CAAC,mBAAmB,EAAE,CAAC;gBAE5H,MAAM,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,OAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,IAAI,WAAW,YAAY,6BAA6B,IAAI,WAAW,CAAC,IAAI,KAAK,0BAA0B,CAAC,KAAK,EAAE,CAAC;oBAClH,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;oBACpD,MAAM,WAAW,CAAC;gBACpB,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAChB,OAAO,EAAE,8CAA8C;oBACvD,OAAO;oBACP,SAAS;oBACT,KAAK,EAAE,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;iBAC1E,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,SAAS,CAAC;QAClB,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,SAAiB;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,gDAAgD;gBACzD,OAAO;gBACP,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,KAAa,EACb,QAAgB,EAChB,OAAqC;QAErC,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,EACN,iCAAiC,kBAAkB,CAAC,QAAQ,CAAC,WAAW,EACxE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EACpC;YACE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;YACzB,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACvF,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YACrF,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;SAC3F,CACF,CAAC;IACJ,CAAC;IAOO,KAAK,CAAC,mBAAmB,CAC/B,KAAa,EACb,YAAoB,EACpB,SAAiB,EACjB,SAAiB;QAEjB,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,EACN,iCAAiC,kBAAkB,CAAC,YAAY,CAAC,iBAAiB,EAClF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EACpC,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;IACJ,CAAC;IAUO,eAAe,CAAC,KAAa,EAAE,MAAsC;QAC3E,OAAO,IAAA,8CAA0B,EAAC,IAAA,qCAAiB,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvG,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,MAAsB,EACtB,IAAY,EACZ,SAA4B,EAC5B,IAAc;QAEd,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAAC,IAAI,CAAC,QAAQ,EAAE,8BAAW,CAAC,iBAAiB,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAY,EAAC,SAAS,EAAE,8BAAW,CAAC,iBAAiB,EAAE;YACxE,MAAM;YACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SAC/G,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,6BAA6B,CACrC,qBAAqB,MAAM,IAAI,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EACjG,QAAQ,CAAC,MAAM,EACf,MAAM,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,qCAA8B,EACnC,MAAM,QAAQ,CAAC,IAAI,EAAE,EACrB,qBAAqB,MAAM,IAAI,IAAI,EAAE,CACtC,CAAC;IACJ,CAAC;CACF,CAAA;AAjWY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;6CACJ,0CAAwB;GAL1C,6BAA6B,CAiWzC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;QACtD,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -7,6 +7,9 @@ export * from './subject-from-context';
 export * from './xema-authz.service';
 export * from './policy-decisions';
 export * from './grant-version.reader';
+export * from './installed-workload-grant-operations';
+export * from './installed-workload-grant-wire';
+export * from './installed-workload-grant.resolver';
 export * from './route-action-evaluator';
 export * from './internal-caller-or-member-context.guard';
 export * from './organization-delegation-admission';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,0BAA0B,CAAC;AACzC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC"}

package/dist/index.js

@@ -23,6 +23,9 @@ __exportStar(require("./subject-from-context"), exports);
 __exportStar(require("./xema-authz.service"), exports);
 __exportStar(require("./policy-decisions"), exports);
 __exportStar(require("./grant-version.reader"), exports);
+__exportStar(require("./installed-workload-grant-operations"), exports);
+__exportStar(require("./installed-workload-grant-wire"), exports);
+__exportStar(require("./installed-workload-grant.resolver"), exports);
 __exportStar(require("./route-action-evaluator"), exports);
 __exportStar(require("./internal-caller-or-member-context.guard"), exports);
 __exportStar(require("./organization-delegation-admission"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,yDAAuC;AACvC,2DAAyC;AACzC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC;AACnC,oEAAkD;AAClD,qEAAmD;AACnD,sEAAoD;AACpD,sEAAoD;AACpD,qEAAmD;AACnD,qEAAmD;AACnD,wEAAsD;AACtD,qEAAmD;AACnD,8EAA4D;AAC5D,mFAAiE"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,yDAAuC;AACvC,wEAAsD;AACtD,kEAAgD;AAChD,sEAAoD;AACpD,2DAAyC;AACzC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC;AACnC,oEAAkD;AAClD,qEAAmD;AACnD,sEAAoD;AACpD,sEAAoD;AACpD,qEAAmD;AACnD,qEAAmD;AACnD,wEAAsD;AACtD,qEAAmD;AACnD,8EAA4D;AAC5D,mFAAiE"}

package/dist/installed-workload-grant-operations.d.ts

@@ -0,0 +1,3 @@
+export declare const INSTALLED_WORKLOAD_GRANT_CHECK_OPERATION: string & import("zod").$brand<"OperationId">;
+export declare const INSTALLED_WORKLOAD_GRANT_CHECK_PATH = "/internal/installed-workload-grants/check";
+//# sourceMappingURL=installed-workload-grant-operations.d.ts.map

package/dist/installed-workload-grant-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-workload-grant-operations.d.ts","sourceRoot":"","sources":["../src/installed-workload-grant-operations.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,wCAAwC,8CAEpD,CAAC;AAGF,eAAO,MAAM,mCAAmC,8CAA8C,CAAC"}

package/dist/installed-workload-grant-operations.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INSTALLED_WORKLOAD_GRANT_CHECK_PATH = exports.INSTALLED_WORKLOAD_GRANT_CHECK_OPERATION = void 0;
+const deployment_1 = require("@xemahq/contracts/deployment");
+exports.INSTALLED_WORKLOAD_GRANT_CHECK_OPERATION = deployment_1.OperationIdSchema.parse('authorization:installed-workload-grants.check@1');
+exports.INSTALLED_WORKLOAD_GRANT_CHECK_PATH = '/internal/installed-workload-grants/check';
+//# sourceMappingURL=installed-workload-grant-operations.js.map

package/dist/installed-workload-grant-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-workload-grant-operations.js","sourceRoot":"","sources":["../src/installed-workload-grant-operations.ts"],"names":[],"mappings":";;;AAAA,6DAAiE;AAQpD,QAAA,wCAAwC,GAAG,8BAAiB,CAAC,KAAK,CAC7E,iDAAiD,CAClD,CAAC;AAGW,QAAA,mCAAmC,GAAG,2CAA2C,CAAC"}

package/dist/installed-workload-grant-wire.d.ts

@@ -0,0 +1,66 @@
+import { z } from 'zod';
+export declare enum InstalledWorkloadGrantRefusalCode {
+    NotGranted = "not-granted",
+    Revoked = "revoked",
+    TargetOutsideOrg = "target-outside-org",
+    OwnerNarrowerThanOrg = "owner-narrower-than-org",
+    OwnerNotGrantable = "owner-not-grantable"
+}
+export declare const InstalledWorkloadGrantCheckRequestSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    workload: z.ZodString;
+    operation: z.core.$ZodBranded<z.ZodString, "OperationId", "out">;
+    targetSpaceUri: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type InstalledWorkloadGrantCheckRequest = z.infer<typeof InstalledWorkloadGrantCheckRequestSchema>;
+export declare const InstalledWorkloadGrantCheckResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    admitted: z.ZodLiteral<true>;
+    installationId: z.ZodString;
+    biome: z.ZodString;
+    component: z.ZodString;
+    receiver: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.Biome>;
+        biome: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.PlatformService>;
+        service: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    ownerSpaceUri: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    admitted: z.ZodLiteral<false>;
+    code: z.ZodEnum<typeof InstalledWorkloadGrantRefusalCode>;
+}, z.core.$strict>], "admitted">;
+export type InstalledWorkloadGrantCheckResult = z.infer<typeof InstalledWorkloadGrantCheckResultSchema>;
+export declare const HeldInstalledWorkloadGrantSchema: z.ZodObject<{
+    installationId: z.ZodString;
+    biome: z.ZodString;
+    component: z.ZodString;
+    operation: z.core.$ZodBranded<z.ZodString, "OperationId", "out">;
+    receiver: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.Biome>;
+        biome: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.PlatformService>;
+        service: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    ownerSpaceUri: z.ZodString;
+}, z.core.$strict>;
+export type HeldInstalledWorkloadGrantWire = z.infer<typeof HeldInstalledWorkloadGrantSchema>;
+export declare const ListHeldInstalledWorkloadGrantsResultSchema: z.ZodObject<{
+    grants: z.ZodArray<z.ZodObject<{
+        installationId: z.ZodString;
+        biome: z.ZodString;
+        component: z.ZodString;
+        operation: z.core.$ZodBranded<z.ZodString, "OperationId", "out">;
+        receiver: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.Biome>;
+            biome: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.PlatformService>;
+            service: z.ZodString;
+        }, z.core.$strict>], "kind">;
+        ownerSpaceUri: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ListHeldInstalledWorkloadGrantsResultWire = z.infer<typeof ListHeldInstalledWorkloadGrantsResultSchema>;
+//# sourceMappingURL=installed-workload-grant-wire.d.ts.map

package/dist/installed-workload-grant-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-workload-grant-wire.d.ts","sourceRoot":"","sources":["../src/installed-workload-grant-wire.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,oBAAY,iCAAiC;IAE3C,UAAU,gBAAgB;IAE1B,OAAO,YAAY;IAEnB,gBAAgB,uBAAuB;IAEvC,oBAAoB,4BAA4B;IAEhD,iBAAiB,wBAAwB;CAC1C;AAGD,eAAO,MAAM,wCAAwC;;;;;kBAQ1C,CAAC;AACZ,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;gCAalD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAGxG,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;kBASlC,CAAC;AACZ,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAG9F,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;kBAE7C,CAAC;AACZ,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC"}

package/dist/installed-workload-grant-wire.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ListHeldInstalledWorkloadGrantsResultSchema = exports.HeldInstalledWorkloadGrantSchema = exports.InstalledWorkloadGrantCheckResultSchema = exports.InstalledWorkloadGrantCheckRequestSchema = exports.InstalledWorkloadGrantRefusalCode = void 0;
+const deployment_1 = require("@xemahq/contracts/deployment");
+const zod_1 = require("zod");
+const OperationGrantReceiverSchema = deployment_1.OperationGrantSchema.shape.receiver;
+var InstalledWorkloadGrantRefusalCode;
+(function (InstalledWorkloadGrantRefusalCode) {
+    InstalledWorkloadGrantRefusalCode["NotGranted"] = "not-granted";
+    InstalledWorkloadGrantRefusalCode["Revoked"] = "revoked";
+    InstalledWorkloadGrantRefusalCode["TargetOutsideOrg"] = "target-outside-org";
+    InstalledWorkloadGrantRefusalCode["OwnerNarrowerThanOrg"] = "owner-narrower-than-org";
+    InstalledWorkloadGrantRefusalCode["OwnerNotGrantable"] = "owner-not-grantable";
+})(InstalledWorkloadGrantRefusalCode || (exports.InstalledWorkloadGrantRefusalCode = InstalledWorkloadGrantRefusalCode = {}));
+exports.InstalledWorkloadGrantCheckRequestSchema = zod_1.z
+    .object({
+    orgId: zod_1.z.string().min(1),
+    workload: zod_1.z.string().min(1),
+    operation: deployment_1.OperationIdSchema,
+    targetSpaceUri: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+exports.InstalledWorkloadGrantCheckResultSchema = zod_1.z.discriminatedUnion('admitted', [
+    zod_1.z
+        .object({
+        admitted: zod_1.z.literal(true),
+        installationId: zod_1.z.string().min(1),
+        biome: zod_1.z.string().min(1),
+        component: zod_1.z.string().min(1),
+        receiver: OperationGrantReceiverSchema,
+        ownerSpaceUri: zod_1.z.string().min(1),
+    })
+        .strict(),
+    zod_1.z.object({ admitted: zod_1.z.literal(false), code: zod_1.z.nativeEnum(InstalledWorkloadGrantRefusalCode) }).strict(),
+]);
+exports.HeldInstalledWorkloadGrantSchema = zod_1.z
+    .object({
+    installationId: zod_1.z.string().min(1),
+    biome: zod_1.z.string().min(1),
+    component: zod_1.z.string().min(1),
+    operation: deployment_1.OperationIdSchema,
+    receiver: OperationGrantReceiverSchema,
+    ownerSpaceUri: zod_1.z.string().min(1),
+})
+    .strict();
+exports.ListHeldInstalledWorkloadGrantsResultSchema = zod_1.z
+    .object({ grants: zod_1.z.array(exports.HeldInstalledWorkloadGrantSchema) })
+    .strict();
+//# sourceMappingURL=installed-workload-grant-wire.js.map

package/dist/installed-workload-grant-wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-workload-grant-wire.js","sourceRoot":"","sources":["../src/installed-workload-grant-wire.ts"],"names":[],"mappings":";;;AAAA,6DAAuF;AACvF,6BAAwB;AAGxB,MAAM,4BAA4B,GAAG,iCAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC;AAGzE,IAAY,iCAWX;AAXD,WAAY,iCAAiC;IAE3C,+DAA0B,CAAA;IAE1B,wDAAmB,CAAA;IAEnB,4EAAuC,CAAA;IAEvC,qFAAgD,CAAA;IAEhD,8EAAyC,CAAA;AAC3C,CAAC,EAXW,iCAAiC,iDAAjC,iCAAiC,QAW5C;AAGY,QAAA,wCAAwC,GAAG,OAAC;KACtD,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,8BAAiB;IAE5B,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAGC,QAAA,uCAAuC,GAAG,OAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACtF,OAAC;SACE,MAAM,CAAC;QACN,QAAQ,EAAE,OAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,QAAQ,EAAE,4BAA4B;QAEtC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACzG,CAAC,CAAC;AAIU,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,8BAAiB;IAC5B,QAAQ,EAAE,4BAA4B;IACtC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,2CAA2C,GAAG,OAAC;KACzD,MAAM,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,wCAAgC,CAAC,EAAE,CAAC;KAC7D,MAAM,EAAE,CAAC"}

package/dist/installed-workload-grant.resolver.d.ts

@@ -0,0 +1,20 @@
+import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
+import { IdentityBootstrapService } from '@xemahq/identity-client';
+import { type WorkloadGrantQuestion, type WorkloadGrantResolver, type WorkloadGrantVerdict } from '@xemahq/platform-common';
+import { type XemaAuthorizationOptions } from './authorization.options';
+export declare enum InstalledWorkloadGrantResolverRefusalCode {
+    UnknownKind = "installed-workload-unknown-kind",
+    OrgNotNamed = "installed-workload-org-not-named",
+    NotAdmitted = "installed-workload-not-admitted",
+    OwnerMismatch = "installed-workload-owner-mismatch",
+    OwnerNarrowerThanOrg = "installed-workload-owner-narrower-than-org"
+}
+export declare class InstalledWorkloadGrantResolver implements WorkloadGrantResolver {
+    private readonly registry;
+    private readonly identityBootstrap;
+    private readonly options;
+    constructor(registry: ServiceRegistry, identityBootstrap: IdentityBootstrapService, options: XemaAuthorizationOptions);
+    admitWorkload(question: WorkloadGrantQuestion): Promise<WorkloadGrantVerdict>;
+    private check;
+}
+//# sourceMappingURL=installed-workload-grant.resolver.d.ts.map

package/dist/installed-workload-grant.resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-workload-grant.resolver.d.ts","sourceRoot":"","sources":["../src/installed-workload-grant.resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAC1B,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAUjC,oBAAY,yCAAyC;IACnD,WAAW,oCAAoC;IAC/C,WAAW,qCAAqC;IAChD,WAAW,oCAAoC;IAE/C,aAAa,sCAAsC;IAEnD,oBAAoB,+CAA+C;CACpE;AAgBD,qBACa,8BAA+B,YAAW,qBAAqB;IAGxE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAGvC,aAAa,CACxB,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,oBAAoB,CAAC;YA0ClB,KAAK;CAkCpB"}

package/dist/installed-workload-grant.resolver.js

@@ -0,0 +1,111 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstalledWorkloadGrantResolver = exports.InstalledWorkloadGrantResolverRefusalCode = void 0;
+const common_1 = require("@nestjs/common");
+const http_1 = require("@xemahq/contracts/http");
+const service_registry_1 = require("@xemahq/contracts/service-registry");
+const space_1 = require("@xemahq/contracts/space");
+const identity_client_1 = require("@xemahq/identity-client");
+const platform_common_1 = require("@xemahq/platform-common");
+const service_registry_nest_1 = require("@xemahq/service-registry-nest");
+const authorization_options_1 = require("./authorization.options");
+const installed_workload_grant_operations_1 = require("./installed-workload-grant-operations");
+const installed_workload_grant_wire_1 = require("./installed-workload-grant-wire");
+const SOURCE = 'installed-workload-grant-resolver';
+var InstalledWorkloadGrantResolverRefusalCode;
+(function (InstalledWorkloadGrantResolverRefusalCode) {
+    InstalledWorkloadGrantResolverRefusalCode["UnknownKind"] = "installed-workload-unknown-kind";
+    InstalledWorkloadGrantResolverRefusalCode["OrgNotNamed"] = "installed-workload-org-not-named";
+    InstalledWorkloadGrantResolverRefusalCode["NotAdmitted"] = "installed-workload-not-admitted";
+    InstalledWorkloadGrantResolverRefusalCode["OwnerMismatch"] = "installed-workload-owner-mismatch";
+    InstalledWorkloadGrantResolverRefusalCode["OwnerNarrowerThanOrg"] = "installed-workload-owner-narrower-than-org";
+})(InstalledWorkloadGrantResolverRefusalCode || (exports.InstalledWorkloadGrantResolverRefusalCode = InstalledWorkloadGrantResolverRefusalCode = {}));
+let InstalledWorkloadGrantResolver = class InstalledWorkloadGrantResolver {
+    registry;
+    identityBootstrap;
+    options;
+    constructor(registry, identityBootstrap, options) {
+        this.registry = registry;
+        this.identityBootstrap = identityBootstrap;
+        this.options = options;
+    }
+    async admitWorkload(question) {
+        if (question.kind !== platform_common_1.INSTALLED_WORKLOAD_GRANT_KIND) {
+            return refuse(InstalledWorkloadGrantResolverRefusalCode.UnknownKind, 'This resolver decides only installed workload grants.');
+        }
+        const { orgId } = question;
+        if (orgId === undefined || orgId === '') {
+            return refuse(InstalledWorkloadGrantResolverRefusalCode.OrgNotNamed, 'An installed workload grant is decided for a named organization.');
+        }
+        const check = await this.check({
+            orgId,
+            workload: question.callerService,
+            operation: question.operation,
+            ...(question.targetSpace === undefined ? {} : { targetSpaceUri: (0, space_1.formatSpaceRef)(question.targetSpace) }),
+        });
+        if (!check.admitted) {
+            return refuse(InstalledWorkloadGrantResolverRefusalCode.NotAdmitted, `The workload holds no installed grant for the operation (${check.code}).`);
+        }
+        if (!ownerInOrganization(orgId, check.ownerSpaceUri)) {
+            return refuse(InstalledWorkloadGrantResolverRefusalCode.OwnerMismatch, 'The admitting grant is owned by a Space outside the organization the workload was proven for.');
+        }
+        if (question.targetSpace === undefined && check.ownerSpaceUri !== (0, space_1.formatSpaceRef)({ tier: space_1.SpaceKind.Org, orgId })) {
+            return refuse(InstalledWorkloadGrantResolverRefusalCode.OwnerNarrowerThanOrg, 'No target Space was named, and the admitting grant is owned by a Space narrower than the organization.');
+        }
+        return { admitted: true };
+    }
+    async check(request) {
+        try {
+            const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
+            const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${installed_workload_grant_operations_1.INSTALLED_WORKLOAD_GRANT_CHECK_PATH}`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${await this.identityBootstrap.getAccessToken()}`,
+                    'Content-Type': 'application/json',
+                    'X-Xema-Org-Id': request.orgId,
+                },
+                body: JSON.stringify(request),
+                signal: AbortSignal.timeout(this.options.requestTimeoutMs),
+            });
+            if (!response.ok) {
+                throw new Error(`authorization-api POST ${installed_workload_grant_operations_1.INSTALLED_WORKLOAD_GRANT_CHECK_PATH} failed with HTTP ${response.status}`);
+            }
+            return installed_workload_grant_wire_1.InstalledWorkloadGrantCheckResultSchema.parse((0, http_1.unwrapPlatformResponseEnvelope)(await response.json(), `authorization-api POST ${installed_workload_grant_operations_1.INSTALLED_WORKLOAD_GRANT_CHECK_PATH}`));
+        }
+        catch (cause) {
+            throw new platform_common_1.WorkloadGrantResolverUnavailableError(SOURCE, cause);
+        }
+    }
+};
+exports.InstalledWorkloadGrantResolver = InstalledWorkloadGrantResolver;
+exports.InstalledWorkloadGrantResolver = InstalledWorkloadGrantResolver = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(service_registry_nest_1.SERVICE_REGISTRY_TOKEN)),
+    __param(2, (0, common_1.Inject)(authorization_options_1.XEMA_AUTHORIZATION_OPTIONS)),
+    __metadata("design:paramtypes", [Object, identity_client_1.IdentityBootstrapService, Object])
+], InstalledWorkloadGrantResolver);
+function ownerInOrganization(orgId, ownerSpaceUri) {
+    try {
+        (0, space_1.parseOwnerSpaceRef)({ fence: space_1.OwnerSpaceFence.Tenant, orgId, space: (0, space_1.parseSpaceRef)(ownerSpaceUri) });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function refuse(code, message) {
+    return { admitted: false, code, message };
+}
+//# sourceMappingURL=installed-workload-grant.resolver.js.map

package/dist/installed-workload-grant.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-workload-grant.resolver.js","sourceRoot":"","sources":["../src/installed-workload-grant.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,iDAAwE;AACxE,yEAG4C;AAC5C,mDAAwH;AACxH,6DAAmE;AACnE,6DAMiC;AACjC,yEAGuC;AAEvC,mEAGiC;AACjC,+FAA4F;AAC5F,mFAGyC;AAEzC,MAAM,MAAM,GAAG,mCAAmC,CAAC;AAGnD,IAAY,yCAQX;AARD,WAAY,yCAAyC;IACnD,4FAA+C,CAAA;IAC/C,6FAAgD,CAAA;IAChD,4FAA+C,CAAA;IAE/C,gGAAmD,CAAA;IAEnD,gHAAmE,CAAA;AACrE,CAAC,EARW,yCAAyC,yDAAzC,yCAAyC,QAQpD;AAiBM,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAGtB;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,KAAK,CAAC,aAAa,CACxB,QAA+B;QAE/B,IAAI,QAAQ,CAAC,IAAI,KAAK,+CAA6B,EAAE,CAAC;YACpD,OAAO,MAAM,CACX,yCAAyC,CAAC,WAAW,EACrD,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,OAAO,MAAM,CACX,yCAAyC,CAAC,WAAW,EACrD,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YAC7B,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,aAAa;YAChC,SAAS,EAAE,QAAQ,CAAC,SAA4D;YAEhF,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAA,sBAAc,EAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;SACxG,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,MAAM,CACX,yCAAyC,CAAC,WAAW,EACrD,4DAA4D,KAAK,CAAC,IAAI,IAAI,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,MAAM,CACX,yCAAyC,CAAC,aAAa,EACvD,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,IAAA,sBAAc,EAAC,EAAE,IAAI,EAAE,iBAAS,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACjH,OAAO,MAAM,CACX,yCAAyC,CAAC,oBAAoB,EAC9D,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAA2C;QAC7D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,yEAAmC,EAAE,EACtE;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE;oBACxE,cAAc,EAAE,kBAAkB;oBAClC,eAAe,EAAE,OAAO,CAAC,KAAK;iBAC/B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC3D,CACF,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,0BAA0B,yEAAmC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CACpG,CAAC;YACJ,CAAC;YACD,OAAO,uEAAuC,CAAC,KAAK,CAClD,IAAA,qCAA8B,EAC5B,MAAM,QAAQ,CAAC,IAAI,EAAE,EACrB,0BAA0B,yEAAmC,EAAE,CAChE,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uDAAqC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF,CAAA;AAvFY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GAJnD,8BAA8B,CAuF1C;AAGD,SAAS,mBAAmB,CAAC,KAAa,EAAE,aAAqB;IAC/D,IAAI,CAAC;QACH,IAAA,0BAAkB,EAAC,EAAE,KAAK,EAAE,uBAAe,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAA,qBAAa,EAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CACb,IAA+C,EAC/C,OAAe;IAEf,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-nest",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "AuthZEN 1.0 PEP for Xema services: one Nest module, an AuthZEN client against authorization-api, and the @Authorize route guard.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -18,19 +18,19 @@
     "@xemahq/identity-client": ">=0.28.0",
     "@xemahq/platform-common": ">=0.83.1",
     "@xemahq/service-registry-nest": "^1.1.0",
-    "@xemahq/xema-service-nest": "^13.0.0",
+    "@xemahq/xema-service-nest": "^14.1.0 || ^15.0.0 || ^16.0.0",
     "zod": "^4.6.1"
   },
   "devDependencies": {
     "@nestjs/common": "11.1.18",
     "@nestjs/core": "11.1.18",
     "@nestjs/testing": "11.1.18",
-    "@xemahq/contracts": "^0.91.0",
+    "@xemahq/contracts": "^0.110.2",
     "@xemahq/eslint-config": "^0.14.1",
-    "@xemahq/identity-client": "^0.28.0",
-    "@xemahq/platform-common": "^0.83.1",
+    "@xemahq/identity-client": "^0.33.0",
+    "@xemahq/platform-common": "^0.85.1",
     "@xemahq/service-registry-nest": "^1.1.0",
-    "@xemahq/xema-service-nest": "^14.1.1",
+    "@xemahq/xema-service-nest": "^16.0.0",
     "@types/jest": "^30.0.0",
     "@types/node": "25.2.3",
     "eslint": "^9.39.4",
@@ -64,6 +64,6 @@
     "test": "jest --config jest.config.ts"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:bc1b1600484372049b3ee88307ea83e6bc0ca710e7e971a23d02531ae6fa0baa"
+    "sourceDigest": "sha256:c3341c96c6f41ad7a1b1a6e0c174db5570882d0012ca7040df6a9f4d56b9fe18"
   }
 }