@xemahq/identity-client 0.9.7 → 0.10.0

package/dist/nestjs/token-acquisition.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityTokenRequestTimeoutError = exports.IdentityTokenWaitAbortedError = exports.IdentityTokenOperation = exports.DEFAULT_TOKEN_REQUEST_TIMEOUT_MS = void 0;
+exports.resolveTokenRequestTimeoutMs = resolveTokenRequestTimeoutMs;
+exports.withTokenRequestDeadline = withTokenRequestDeadline;
+exports.awaitWithCallerSignal = awaitWithCallerSignal;
+exports.DEFAULT_TOKEN_REQUEST_TIMEOUT_MS = 10_000;
+var IdentityTokenOperation;
+(function (IdentityTokenOperation) {
+    IdentityTokenOperation["ServiceTokenRefresh"] = "service-token-refresh";
+    IdentityTokenOperation["ScopedTokenMint"] = "scoped-token-mint";
+    IdentityTokenOperation["ExactAudienceTokenMint"] = "exact-audience-token-mint";
+    IdentityTokenOperation["CredentialRecoveryCoordination"] = "credential-recovery-coordination";
+})(IdentityTokenOperation || (exports.IdentityTokenOperation = IdentityTokenOperation = {}));
+class IdentityTokenWaitAbortedError extends Error {
+    operation;
+    reason;
+    name = 'IdentityTokenWaitAbortedError';
+    retryable = false;
+    constructor(operation, reason) {
+        super(`Wait for ${operation} token aborted by the caller's signal`);
+        this.operation = operation;
+        this.reason = reason;
+    }
+}
+exports.IdentityTokenWaitAbortedError = IdentityTokenWaitAbortedError;
+class IdentityTokenRequestTimeoutError extends Error {
+    operation;
+    timeoutMs;
+    endpoint;
+    name = 'IdentityTokenRequestTimeoutError';
+    constructor(operation, timeoutMs, endpoint) {
+        super(`${operation} request to ${endpoint} did not complete within ${timeoutMs}ms`);
+        this.operation = operation;
+        this.timeoutMs = timeoutMs;
+        this.endpoint = endpoint;
+    }
+}
+exports.IdentityTokenRequestTimeoutError = IdentityTokenRequestTimeoutError;
+function resolveTokenRequestTimeoutMs(configured) {
+    if (configured === undefined) {
+        return exports.DEFAULT_TOKEN_REQUEST_TIMEOUT_MS;
+    }
+    if (typeof configured !== 'number' ||
+        !Number.isInteger(configured) ||
+        configured <= 0) {
+        throw new Error(`[IdentityBootstrapService] Invalid IdentityBootstrapConfig: ` +
+            `'tokenRequestTimeoutMs' must be a positive integer number of ` +
+            `milliseconds, got ${JSON.stringify(configured)}.`);
+    }
+    return configured;
+}
+function describeEndpoint(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.origin}${parsed.pathname}`;
+    }
+    catch {
+        return '<unparseable endpoint>';
+    }
+}
+async function withTokenRequestDeadline(operation, endpoint, timeoutMs, work) {
+    const deadline = AbortSignal.timeout(timeoutMs);
+    try {
+        return await work(deadline);
+    }
+    catch (error) {
+        if (deadline.aborted) {
+            throw new IdentityTokenRequestTimeoutError(operation, timeoutMs, describeEndpoint(endpoint));
+        }
+        throw error;
+    }
+}
+function awaitWithCallerSignal(shared, operation, signal) {
+    if (!signal) {
+        return shared;
+    }
+    if (signal.aborted) {
+        shared.catch(() => undefined);
+        return Promise.reject(new IdentityTokenWaitAbortedError(operation, signal.reason));
+    }
+    return new Promise((resolve, reject) => {
+        const onAbort = () => {
+            reject(new IdentityTokenWaitAbortedError(operation, signal.reason));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        shared.then((value) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(error);
+        });
+    });
+}
+//# sourceMappingURL=token-acquisition.js.map

package/dist/nestjs/token-acquisition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-acquisition.js","sourceRoot":"","sources":["../../src/nestjs/token-acquisition.ts"],"names":[],"mappings":";;;AAyFA,oEAgBC;AAsBD,4DAmBC;AAcD,sDAkCC;AAtKY,QAAA,gCAAgC,GAAG,MAAM,CAAC;AAGvD,IAAY,sBASX;AATD,WAAY,sBAAsB;IAEhC,uEAA6C,CAAA;IAE7C,+DAAqC,CAAA;IAErC,8EAAoD,CAAA;IAEpD,6FAAmE,CAAA;AACrE,CAAC,EATW,sBAAsB,sCAAtB,sBAAsB,QASjC;AASD,MAAa,6BAA8B,SAAQ,KAAK;IAM3C;IAEA;IAPO,IAAI,GAAG,+BAA+B,CAAC;IAEhD,SAAS,GAAG,KAAK,CAAC;IAE3B,YACW,SAAiC,EAEjC,MAAe;QAExB,KAAK,CAAC,YAAY,SAAS,uCAAuC,CAAC,CAAC;QAJ3D,cAAS,GAAT,SAAS,CAAwB;QAEjC,WAAM,GAAN,MAAM,CAAS;IAG1B,CAAC;CACF;AAZD,sEAYC;AAQD,MAAa,gCAAiC,SAAQ,KAAK;IAI9C;IACA;IAEA;IANO,IAAI,GAAG,kCAAkC,CAAC;IAE5D,YACW,SAAiC,EACjC,SAAiB,EAEjB,QAAgB;QAEzB,KAAK,CACH,GAAG,SAAS,eAAe,QAAQ,4BAA4B,SAAS,IAAI,CAC7E,CAAC;QAPO,cAAS,GAAT,SAAS,CAAwB;QACjC,cAAS,GAAT,SAAS,CAAQ;QAEjB,aAAQ,GAAR,QAAQ,CAAQ;IAK3B,CAAC;CACF;AAbD,4EAaC;AAOD,SAAgB,4BAA4B,CAAC,UAAmB;IAC9D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,wCAAgC,CAAC;IAC1C,CAAC;IACD,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAC7B,UAAU,IAAI,CAAC,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC5D,+DAA+D;YAC/D,qBAAqB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAGD,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,CAAC;IAClC,CAAC;AACH,CAAC;AAYM,KAAK,UAAU,wBAAwB,CAC5C,SAAiC,EACjC,QAAgB,EAChB,SAAiB,EACjB,IAAyC;IAEzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,gCAAgC,CACxC,SAAS,EACT,SAAS,EACT,gBAAgB,CAAC,QAAQ,CAAC,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAcD,SAAgB,qBAAqB,CACnC,MAAkB,EAClB,SAAiC,EACjC,MAA+B;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAKnB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,6BAA6B,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,MAAM,CAAC,IAAI,6BAA6B,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CACT,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/types.d.ts

@@ -187,6 +187,34 @@ export interface ScopedClaimTokenResponse extends ScopedClaimTokenRequest {
     expiresIn: number;
     tokenType: 'Bearer';
 }
+export declare enum DelegationActorKind {
+    Agent = "agent",
+    Workload = "workload"
+}
+export interface CreateDelegationRequest {
+    subjectContext?: string;
+    parentId?: string;
+    actor: {
+        id: string;
+        kind: DelegationActorKind;
+    };
+    presenterPrincipalId: string;
+    organizationId?: string;
+    expiresAt: string;
+    realm?: string;
+}
+export interface DelegationRecordResponse {
+    id: string;
+    subjectPrincipalId: string;
+    organizationId: string | null;
+    expiresAt: string;
+    parentId: string | null;
+}
+export interface DelegatedContextResponse {
+    context: string;
+    expiresIn: number;
+    expiresAt: string;
+}
 export interface ApiEnvelope<T> {
     data: T;
 }

package/dist/types.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ORG_ADMIN_ROLES = exports.OrgRole = exports.SystemOrgEnsureOutcome = exports.InternalTokenScope = void 0;
+exports.DelegationActorKind = exports.ORG_ADMIN_ROLES = exports.OrgRole = exports.SystemOrgEnsureOutcome = exports.InternalTokenScope = void 0;
 var InternalTokenScope;
 (function (InternalTokenScope) {
     InternalTokenScope["SINGLE_REALM"] = "SINGLE_REALM";
@@ -23,4 +23,9 @@ exports.ORG_ADMIN_ROLES = new Set([
     OrgRole.ORG_OWNER,
     OrgRole.ORG_ADMIN,
 ]);
+var DelegationActorKind;
+(function (DelegationActorKind) {
+    DelegationActorKind["Agent"] = "agent";
+    DelegationActorKind["Workload"] = "workload";
+})(DelegationActorKind || (exports.DelegationActorKind = DelegationActorKind = {}));
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AAiBA,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,iDAA2B,CAAA;IAC3B,mEAA6C,CAAA;AAC/C,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAqHD,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAEhC,6CAAmB,CAAA;IAEnB,4DAAkC,CAAA;IAElC,iDAAuB,CAAA;AACzB,CAAC,EAPW,sBAAsB,sCAAtB,sBAAsB,QAOjC;AA8HD,IAAY,OAIX;AAJD,WAAY,OAAO;IACjB,kCAAuB,CAAA;IACvB,kCAAuB,CAAA;IACvB,oCAAyB,CAAA;AAC3B,CAAC,EAJW,OAAO,uBAAP,OAAO,QAIlB;AAGY,QAAA,eAAe,GAAyB,IAAI,GAAG,CAAC;IAC3D,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,SAAS;CAClB,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AAiBA,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,iDAA2B,CAAA;IAC3B,mEAA6C,CAAA;AAC/C,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAqHD,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAEhC,6CAAmB,CAAA;IAEnB,4DAAkC,CAAA;IAElC,iDAAuB,CAAA;AACzB,CAAC,EAPW,sBAAsB,sCAAtB,sBAAsB,QAOjC;AA8HD,IAAY,OAIX;AAJD,WAAY,OAAO;IACjB,kCAAuB,CAAA;IACvB,kCAAuB,CAAA;IACvB,oCAAyB,CAAA;AAC3B,CAAC,EAJW,OAAO,uBAAP,OAAO,QAIlB;AAGY,QAAA,eAAe,GAAyB,IAAI,GAAG,CAAC;IAC3D,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,SAAS;CAClB,CAAC,CAAC;AA6KH,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,sCAAe,CAAA;IACf,4CAAqB,CAAA;AACvB,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B"}

package/dist/workload-context.d.ts

@@ -0,0 +1,27 @@
+export interface WorkloadContextConfig {
+    readonly identityApiUrl: string;
+    readonly realm: string;
+    readonly audience: string;
+    readonly organizationId?: string;
+    readonly readCredential: () => Promise<string>;
+    readonly refreshBeforeExpirySeconds?: number;
+    readonly fetch?: typeof fetch;
+    readonly now?: () => number;
+}
+export declare class WorkloadContextError extends Error {
+    readonly code?: string | undefined;
+    readonly status?: number | undefined;
+    constructor(message: string, code?: string | undefined, status?: number | undefined);
+}
+export declare function fileCredentialReader(path: string, read?: (path: string) => Promise<string>): () => Promise<string>;
+export declare class WorkloadContextSource {
+    private readonly config;
+    private cached;
+    private inflight;
+    private readonly refreshBeforeMs;
+    private readonly fetchImpl;
+    private readonly now;
+    constructor(config: WorkloadContextConfig);
+    getContext(): Promise<string>;
+    private fetchContext;
+}

package/dist/workload-context.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadContextSource = exports.WorkloadContextError = void 0;
+exports.fileCredentialReader = fileCredentialReader;
+const promises_1 = require("node:fs/promises");
+class WorkloadContextError extends Error {
+    code;
+    status;
+    constructor(message, code, status) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.name = 'WorkloadContextError';
+    }
+}
+exports.WorkloadContextError = WorkloadContextError;
+function fileCredentialReader(path, read = (p) => (0, promises_1.readFile)(p, 'utf8')) {
+    return async () => {
+        const content = (await read(path)).trim();
+        if (content === '') {
+            throw new WorkloadContextError(`The attestation file '${path}' is empty.`);
+        }
+        return content;
+    };
+}
+const DEFAULT_REFRESH_BEFORE_EXPIRY_SECONDS = 60;
+class WorkloadContextSource {
+    config;
+    cached = null;
+    inflight = null;
+    refreshBeforeMs;
+    fetchImpl;
+    now;
+    constructor(config) {
+        this.config = config;
+        for (const field of ['identityApiUrl', 'realm', 'audience']) {
+            const value = config[field];
+            if (typeof value !== 'string' || value.trim() === '') {
+                throw new WorkloadContextError(`WorkloadContextConfig.${field} must be a non-empty string.`);
+            }
+        }
+        if (typeof config.readCredential !== 'function') {
+            throw new WorkloadContextError('WorkloadContextConfig.readCredential must be a function.');
+        }
+        const refresh = config.refreshBeforeExpirySeconds ?? DEFAULT_REFRESH_BEFORE_EXPIRY_SECONDS;
+        if (!Number.isInteger(refresh) || refresh < 0) {
+            throw new WorkloadContextError('WorkloadContextConfig.refreshBeforeExpirySeconds must be a non-negative integer.');
+        }
+        this.refreshBeforeMs = refresh * 1000;
+        this.fetchImpl = config.fetch ?? fetch;
+        this.now = config.now ?? Date.now;
+    }
+    async getContext() {
+        if (this.cached !== null &&
+            this.now() < this.cached.expiresAtMs - this.refreshBeforeMs) {
+            return this.cached.context;
+        }
+        if (this.inflight === null) {
+            const started = this.fetchContext().finally(() => {
+                if (this.inflight === started) {
+                    this.inflight = null;
+                }
+            });
+            this.inflight = started;
+        }
+        return this.inflight;
+    }
+    async fetchContext() {
+        let credential;
+        try {
+            credential = await this.config.readCredential();
+        }
+        catch (error) {
+            throw error instanceof WorkloadContextError
+                ? error
+                : new WorkloadContextError(`The workload attestation could not be read: ${String(error)}`);
+        }
+        const url = `${this.config.identityApiUrl.replace(/\/+$/, '')}/internal/workload-context`;
+        let response;
+        try {
+            response = await this.fetchImpl(url, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({
+                    credential,
+                    audience: this.config.audience,
+                    realm: this.config.realm,
+                    ...(this.config.organizationId !== undefined
+                        ? { organizationId: this.config.organizationId }
+                        : {}),
+                }),
+            });
+        }
+        catch (error) {
+            throw new WorkloadContextError(`The identity boundary could not be reached: ${String(error)}`);
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            body = undefined;
+        }
+        if (!response.ok) {
+            const refusal = body
+                ?.error;
+            throw new WorkloadContextError(`The identity boundary refused the workload context (HTTP ${response.status})` +
+                (typeof refusal?.message === 'string' ? `: ${refusal.message}` : '.'), typeof refusal?.code === 'string' ? refusal.code : undefined, response.status);
+        }
+        const answer = body?.data;
+        const expiresAtMs = typeof answer?.expiresAt === 'string' ? Date.parse(answer.expiresAt) : NaN;
+        if (typeof answer?.context !== 'string' ||
+            answer.context === '' ||
+            Number.isNaN(expiresAtMs)) {
+            throw new WorkloadContextError('The identity boundary answered without a context and its expiry.');
+        }
+        this.cached = { context: answer.context, expiresAtMs };
+        return answer.context;
+    }
+}
+exports.WorkloadContextSource = WorkloadContextSource;
+//# sourceMappingURL=workload-context.js.map

package/dist/workload-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-context.js","sourceRoot":"","sources":["../src/workload-context.ts"],"names":[],"mappings":";;;AA8DA,oDAWC;AAzED,+CAA4C;AA6C5C,MAAa,oBAAqB,SAAQ,KAAK;IAIlC;IACA;IAJX,YACE,OAAe,EAEN,IAAa,EACb,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAS;QACb,WAAM,GAAN,MAAM,CAAS;QAGxB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAVD,oDAUC;AAOD,SAAgB,oBAAoB,CAClC,IAAY,EACZ,OAA0C,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,CAAC,EAAE,MAAM,CAAC;IAEpE,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,IAAI,aAAa,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAQjD,MAAa,qBAAqB;IAOH;IANrB,MAAM,GAAoD,IAAI,CAAC;IAC/D,QAAQ,GAA2B,IAAI,CAAC;IAC/B,eAAe,CAAS;IACxB,SAAS,CAAe;IACxB,GAAG,CAAe;IAEnC,YAA6B,MAA6B;QAA7B,WAAM,GAAN,MAAM,CAAuB;QACxD,KAAK,MAAM,KAAK,IAAI,CAAC,gBAAgB,EAAE,OAAO,EAAE,UAAU,CAAU,EAAE,CAAC;YACrE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,oBAAoB,CAC5B,yBAAyB,KAAK,8BAA8B,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,IAAI,oBAAoB,CAC5B,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,MAAM,CAAC,0BAA0B,IAAI,qCAAqC,CAAC;QAC7E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,oBAAoB,CAC5B,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,OAAO,GAAG,IAAI,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,CAAC;IAMD,KAAK,CAAC,UAAU;QACd,IACE,IAAI,CAAC,MAAM,KAAK,IAAI;YACpB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,eAAe,EAC3D,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC/C,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,YAAY,oBAAoB;gBACzC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,oBAAoB,CACtB,+CAA+C,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/D,CAAC;QACR,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC;QAC1F,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACnC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU;oBACV,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAC9B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;oBACxB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;wBAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE;wBAChD,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oBAAoB,CAC5B,+CAA+C,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAEjB,MAAM,OAAO,GAAI,IAAsE;gBACrF,EAAE,KAAK,CAAC;YACV,MAAM,IAAI,oBAAoB,CAC5B,4DAA4D,QAAQ,CAAC,MAAM,GAAG;gBAC5E,CAAC,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EACvE,OAAO,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAC5D,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAI,IAAuC,EAAE,IAE5C,CAAC;QACd,MAAM,WAAW,GACf,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7E,IACE,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ;YACnC,MAAM,CAAC,OAAO,KAAK,EAAE;YACrB,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EACzB,CAAC;YACD,MAAM,IAAI,oBAAoB,CAC5B,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;CACF;AA3HD,sDA2HC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/identity-client",
-  "version": "0.9.7",
+  "version": "0.10.0",
   "description": "NestJS client library and standalone HTTP client for Identity API - service registration, credential management, and JWT token lifecycle",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
   "license": "LicenseRef-Xema-BSL-1.1",