@xemahq/platform-common 0.1.3

package/dist/nestjs/auth/auth.module.js

@@ -0,0 +1,69 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var AuthModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthModule = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const jwt_verification_guard_1 = require("../jwt-verification.guard");
+const roles_guard_1 = require("../roles.guard");
+const auth_module_options_1 = require("./auth-module-options");
+let AuthModule = AuthModule_1 = class AuthModule {
+    static forRoot(options) {
+        const providers = [
+            {
+                provide: auth_module_options_1.AUTH_MODULE_OPTIONS,
+                useValue: options ?? {},
+            },
+            {
+                provide: core_1.APP_GUARD,
+                useClass: jwt_verification_guard_1.JwtVerificationGuard,
+            },
+        ];
+        if (options?.enableRolesGuard !== false) {
+            providers.push({
+                provide: core_1.APP_GUARD,
+                useClass: roles_guard_1.RolesGuard,
+            });
+        }
+        return {
+            module: AuthModule_1,
+            global: true,
+            providers,
+            exports: [auth_module_options_1.AUTH_MODULE_OPTIONS],
+        };
+    }
+    static forRootAsync(asyncOptions) {
+        return {
+            module: AuthModule_1,
+            global: true,
+            imports: asyncOptions.imports ?? [],
+            providers: [
+                {
+                    provide: auth_module_options_1.AUTH_MODULE_OPTIONS,
+                    useFactory: asyncOptions.useFactory,
+                    inject: asyncOptions.inject ?? [],
+                },
+                {
+                    provide: core_1.APP_GUARD,
+                    useClass: jwt_verification_guard_1.JwtVerificationGuard,
+                },
+                {
+                    provide: core_1.APP_GUARD,
+                    useClass: roles_guard_1.RolesGuard,
+                },
+            ],
+            exports: [auth_module_options_1.AUTH_MODULE_OPTIONS],
+        };
+    }
+};
+exports.AuthModule = AuthModule;
+exports.AuthModule = AuthModule = AuthModule_1 = __decorate([
+    (0, common_1.Module)({})
+], AuthModule);
+//# sourceMappingURL=auth.module.js.map

package/dist/nestjs/auth/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../../src/nestjs/auth/auth.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAuD;AACvD,uCAAyC;AACzC,sEAAiE;AACjE,gDAA4C;AAC5C,+DAI+B;AAkDxB,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB,MAAM,CAAC,OAAO,CAAC,OAA2B;QACxC,MAAM,SAAS,GAAU;YACvB;gBACE,OAAO,EAAE,yCAAmB;gBAC5B,QAAQ,EAAE,OAAO,IAAI,EAAE;aACxB;YACD;gBACE,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,6CAAoB;aAC/B;SACF,CAAC;QAEF,IAAI,OAAO,EAAE,gBAAgB,KAAK,KAAK,EAAE,CAAC;YACxC,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,wBAAU;aACrB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,SAAS;YACT,OAAO,EAAE,CAAC,yCAAmB,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,YAAoC;QACtD,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,EAAE;YACnC,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,yCAAmB;oBAC5B,UAAU,EAAE,YAAY,CAAC,UAAU;oBACnC,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,EAAE;iBAClC;gBACD;oBACE,OAAO,EAAE,gBAAS;oBAClB,QAAQ,EAAE,6CAAoB;iBAC/B;gBACD;oBACE,OAAO,EAAE,gBAAS;oBAClB,QAAQ,EAAE,wBAAU;iBACrB;aACF;YACD,OAAO,EAAE,CAAC,yCAAmB,CAAC;SAC/B,CAAC;IACJ,CAAC;CACF,CAAA;AAnDY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAmDtB"}

package/dist/nestjs/auth/configure-auth-middleware.d.ts

@@ -0,0 +1,7 @@
+import type { MiddlewareConsumer, Type } from '@nestjs/common';
+export interface ConfigureAuthMiddlewareOptions {
+    readonly extraExcludes?: readonly string[];
+    readonly additionalControllers?: readonly Type<unknown>[];
+}
+export declare function configureAuthMiddleware(consumer: MiddlewareConsumer, options?: ConfigureAuthMiddlewareOptions): void;
+//# sourceMappingURL=configure-auth-middleware.d.ts.map

package/dist/nestjs/auth/configure-auth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-auth-middleware.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/configure-auth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AA4C/D,MAAM,WAAW,8BAA8B;IAM7C,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAgB3C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D;AA6BD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,8BAAmC,GAC3C,IAAI,CAgBN"}

package/dist/nestjs/auth/configure-auth-middleware.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureAuthMiddleware = configureAuthMiddleware;
+const request_context_middleware_1 = require("../request-context.middleware");
+const DEFAULT_EXCLUDED_ROUTES = [
+    'health',
+    'health/*path',
+    'api/docs',
+    'api/docs/*path',
+    'api/openapi.json',
+    'webhooks/*path',
+    'internal',
+    'internal/*path',
+];
+function configureAuthMiddleware(consumer, options = {}) {
+    const excludes = [
+        ...DEFAULT_EXCLUDED_ROUTES,
+        ...(options.extraExcludes ?? []),
+    ];
+    consumer
+        .apply(request_context_middleware_1.RequestContextMiddleware)
+        .exclude(...excludes)
+        .forRoutes('*');
+    if (options.additionalControllers && options.additionalControllers.length > 0) {
+        consumer
+            .apply(request_context_middleware_1.RequestContextMiddleware)
+            .forRoutes(...options.additionalControllers);
+    }
+}
+//# sourceMappingURL=configure-auth-middleware.js.map

package/dist/nestjs/auth/configure-auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-auth-middleware.js","sourceRoot":"","sources":["../../../src/nestjs/auth/configure-auth-middleware.ts"],"names":[],"mappings":";;AAgGA,0DAmBC;AAlHD,8EAAyE;AAgCzE,MAAM,uBAAuB,GAAG;IAC9B,QAAQ;IACR,cAAc;IACd,UAAU;IACV,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,UAAU;IACV,gBAAgB;CACR,CAAC;AAsDX,SAAgB,uBAAuB,CACrC,QAA4B,EAC5B,UAA0C,EAAE;IAE5C,MAAM,QAAQ,GAAa;QACzB,GAAG,uBAAuB;QAC1B,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;KACjC,CAAC;IAEF,QAAQ;SACL,KAAK,CAAC,qDAAwB,CAAC;SAC/B,OAAO,CAAC,GAAG,QAAQ,CAAC;SACpB,SAAS,CAAC,GAAG,CAAC,CAAC;IAElB,IAAI,OAAO,CAAC,qBAAqB,IAAI,OAAO,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,QAAQ;aACL,KAAK,CAAC,qDAAwB,CAAC;aAC/B,SAAS,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/nestjs/auth/index.d.ts

@@ -0,0 +1,11 @@
+export { AuthModule } from './auth.module';
+export { AUTH_MODULE_OPTIONS, type AuthModuleOptions, type AuthModuleAsyncOptions, } from './auth-module-options';
+export { ServiceTokenGuard } from './service-token.guard';
+export { InternalCallerGuard } from './internal-caller.guard';
+export { ServiceActorGuard } from './service-actor.guard';
+export { TokenClassGuard, RequireTokenClass, REQUIRE_TOKEN_CLASS, } from './token-class.guard';
+export { OrgRoleGuard, RequireOrgRole, REQUIRE_ORG_ROLE, } from './org-role.guard';
+export { OrgRole, OrgRolesClaimKey, ORG_ROLES_CLAIM_KEYS, resolveOrgRoles, resolveOrgRoleForOrg, orgRoleSatisfies, } from './org-role';
+export { configureAuthMiddleware } from './configure-auth-middleware';
+export { OrgClaimKey, OrgHeaderName, ORG_CLAIM_KEYS, resolveOrgClaim, } from './org-claim';
+//# sourceMappingURL=index.d.ts.map

package/dist/nestjs/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,aAAa,CAAC"}

package/dist/nestjs/auth/index.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.OrgRole = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = void 0;
+var auth_module_1 = require("./auth.module");
+Object.defineProperty(exports, "AuthModule", { enumerable: true, get: function () { return auth_module_1.AuthModule; } });
+var auth_module_options_1 = require("./auth-module-options");
+Object.defineProperty(exports, "AUTH_MODULE_OPTIONS", { enumerable: true, get: function () { return auth_module_options_1.AUTH_MODULE_OPTIONS; } });
+var service_token_guard_1 = require("./service-token.guard");
+Object.defineProperty(exports, "ServiceTokenGuard", { enumerable: true, get: function () { return service_token_guard_1.ServiceTokenGuard; } });
+var internal_caller_guard_1 = require("./internal-caller.guard");
+Object.defineProperty(exports, "InternalCallerGuard", { enumerable: true, get: function () { return internal_caller_guard_1.InternalCallerGuard; } });
+var service_actor_guard_1 = require("./service-actor.guard");
+Object.defineProperty(exports, "ServiceActorGuard", { enumerable: true, get: function () { return service_actor_guard_1.ServiceActorGuard; } });
+var token_class_guard_1 = require("./token-class.guard");
+Object.defineProperty(exports, "TokenClassGuard", { enumerable: true, get: function () { return token_class_guard_1.TokenClassGuard; } });
+Object.defineProperty(exports, "RequireTokenClass", { enumerable: true, get: function () { return token_class_guard_1.RequireTokenClass; } });
+Object.defineProperty(exports, "REQUIRE_TOKEN_CLASS", { enumerable: true, get: function () { return token_class_guard_1.REQUIRE_TOKEN_CLASS; } });
+var org_role_guard_1 = require("./org-role.guard");
+Object.defineProperty(exports, "OrgRoleGuard", { enumerable: true, get: function () { return org_role_guard_1.OrgRoleGuard; } });
+Object.defineProperty(exports, "RequireOrgRole", { enumerable: true, get: function () { return org_role_guard_1.RequireOrgRole; } });
+Object.defineProperty(exports, "REQUIRE_ORG_ROLE", { enumerable: true, get: function () { return org_role_guard_1.REQUIRE_ORG_ROLE; } });
+var org_role_1 = require("./org-role");
+Object.defineProperty(exports, "OrgRole", { enumerable: true, get: function () { return org_role_1.OrgRole; } });
+Object.defineProperty(exports, "OrgRolesClaimKey", { enumerable: true, get: function () { return org_role_1.OrgRolesClaimKey; } });
+Object.defineProperty(exports, "ORG_ROLES_CLAIM_KEYS", { enumerable: true, get: function () { return org_role_1.ORG_ROLES_CLAIM_KEYS; } });
+Object.defineProperty(exports, "resolveOrgRoles", { enumerable: true, get: function () { return org_role_1.resolveOrgRoles; } });
+Object.defineProperty(exports, "resolveOrgRoleForOrg", { enumerable: true, get: function () { return org_role_1.resolveOrgRoleForOrg; } });
+Object.defineProperty(exports, "orgRoleSatisfies", { enumerable: true, get: function () { return org_role_1.orgRoleSatisfies; } });
+var configure_auth_middleware_1 = require("./configure-auth-middleware");
+Object.defineProperty(exports, "configureAuthMiddleware", { enumerable: true, get: function () { return configure_auth_middleware_1.configureAuthMiddleware; } });
+var org_claim_1 = require("./org-claim");
+Object.defineProperty(exports, "OrgClaimKey", { enumerable: true, get: function () { return org_claim_1.OrgClaimKey; } });
+Object.defineProperty(exports, "OrgHeaderName", { enumerable: true, get: function () { return org_claim_1.OrgHeaderName; } });
+Object.defineProperty(exports, "ORG_CLAIM_KEYS", { enumerable: true, get: function () { return org_claim_1.ORG_CLAIM_KEYS; } });
+Object.defineProperty(exports, "resolveOrgClaim", { enumerable: true, get: function () { return org_claim_1.resolveOrgClaim; } });
+//# sourceMappingURL=index.js.map

package/dist/nestjs/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":";;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAI+B;AAH7B,0HAAA,mBAAmB,OAAA;AAIrB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,yDAI6B;AAH3B,oHAAA,eAAe,OAAA;AACf,sHAAA,iBAAiB,OAAA;AACjB,wHAAA,mBAAmB,OAAA;AAErB,mDAI0B;AAHxB,8GAAA,YAAY,OAAA;AACZ,gHAAA,cAAc,OAAA;AACd,kHAAA,gBAAgB,OAAA;AAElB,uCAOoB;AANlB,mGAAA,OAAO,OAAA;AACP,4GAAA,gBAAgB,OAAA;AAChB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AACpB,4GAAA,gBAAgB,OAAA;AAElB,yEAAsE;AAA7D,oIAAA,uBAAuB,OAAA;AAChC,yCAKqB;AAJnB,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AACb,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA"}

package/dist/nestjs/auth/internal-caller.guard.d.ts

@@ -0,0 +1,6 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+export declare class InternalCallerGuard implements CanActivate {
+    private readonly logger;
+    canActivate(context: ExecutionContext): boolean;
+}
+//# sourceMappingURL=internal-caller.guard.d.ts.map

package/dist/nestjs/auth/internal-caller.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-caller.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/internal-caller.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAiCxB,qBACa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CA8BhD"}

package/dist/nestjs/auth/internal-caller.guard.js

@@ -0,0 +1,38 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var InternalCallerGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InternalCallerGuard = void 0;
+const common_1 = require("@nestjs/common");
+const subject_contracts_1 = require("@xemahq/subject-contracts");
+const request_context_1 = require("../../lib/request-context");
+let InternalCallerGuard = InternalCallerGuard_1 = class InternalCallerGuard {
+    logger = new common_1.Logger(InternalCallerGuard_1.name);
+    canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const ctx = request[request_context_1.REQUEST_CONTEXT];
+        if (!ctx) {
+            this.logger.error('RequestContext missing — InternalCallerGuard requires ' +
+                'RequestContextMiddleware (configureAuthMiddleware additionalControllers).');
+            throw new common_1.InternalServerErrorException('Internal route misconfigured: missing request context.');
+        }
+        const isService = ctx.tokenClass === subject_contracts_1.TokenClass.ServiceJwt;
+        const isDelegated = ctx.actorChain.length > 0;
+        if (!isService && !isDelegated) {
+            this.logger.warn(`Internal endpoint denied for actor ${ctx.actorId} ` +
+                `(tokenClass=${ctx.tokenClass}, delegated=false).`);
+            throw new common_1.ForbiddenException('This endpoint is restricted to platform service callers.');
+        }
+        return true;
+    }
+};
+exports.InternalCallerGuard = InternalCallerGuard;
+exports.InternalCallerGuard = InternalCallerGuard = InternalCallerGuard_1 = __decorate([
+    (0, common_1.Injectable)()
+], InternalCallerGuard);
+//# sourceMappingURL=internal-caller.guard.js.map

package/dist/nestjs/auth/internal-caller.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-caller.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/internal-caller.guard.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAOwB;AAExB,iEAAuD;AACvD,+DAA4D;AA+BrD,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IACb,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;IAE/D,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wDAAwD;gBACtD,2EAA2E,CAC9E,CAAC;YACF,MAAM,IAAI,qCAA4B,CACpC,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,KAAK,8BAAU,CAAC,UAAU,CAAC;QAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sCAAsC,GAAG,CAAC,OAAO,GAAG;gBAClD,eAAe,GAAG,CAAC,UAAU,qBAAqB,CACrD,CAAC;YACF,MAAM,IAAI,2BAAkB,CAC1B,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAjCY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;GACA,mBAAmB,CAiC/B"}

package/dist/nestjs/auth/org-claim.d.ts

@@ -0,0 +1,13 @@
+export declare enum OrgClaimKey {
+    Canonical = "xema_org_id"
+}
+export declare const ORG_CLAIM_KEYS: readonly OrgClaimKey[];
+export declare enum OrgHeaderName {
+    Canonical = "X-Xema-Org-Id",
+    Legacy = "X-Org-Id"
+}
+export declare function resolveOrgClaim(claims: Record<string, unknown>): {
+    key: OrgClaimKey;
+    value: string;
+} | null;
+//# sourceMappingURL=org-claim.d.ts.map

package/dist/nestjs/auth/org-claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-claim.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-claim.ts"],"names":[],"mappings":"AA+BA,oBAAY,WAAW;IAErB,SAAS,gBAAgB;CAC1B;AAOD,eAAO,MAAM,cAAc,EAAE,SAAS,WAAW,EAEvC,CAAC;AAMX,oBAAY,aAAa;IAEvB,SAAS,kBAAkB;IAE3B,MAAM,aAAa;CACpB;AAUD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ5C"}

package/dist/nestjs/auth/org-claim.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgHeaderName = exports.ORG_CLAIM_KEYS = exports.OrgClaimKey = void 0;
+exports.resolveOrgClaim = resolveOrgClaim;
+var OrgClaimKey;
+(function (OrgClaimKey) {
+    OrgClaimKey["Canonical"] = "xema_org_id";
+})(OrgClaimKey || (exports.OrgClaimKey = OrgClaimKey = {}));
+exports.ORG_CLAIM_KEYS = [
+    OrgClaimKey.Canonical,
+];
+var OrgHeaderName;
+(function (OrgHeaderName) {
+    OrgHeaderName["Canonical"] = "X-Xema-Org-Id";
+    OrgHeaderName["Legacy"] = "X-Org-Id";
+})(OrgHeaderName || (exports.OrgHeaderName = OrgHeaderName = {}));
+function resolveOrgClaim(claims) {
+    for (const key of exports.ORG_CLAIM_KEYS) {
+        const raw = claims[key];
+        if (typeof raw === 'string' && raw.length > 0) {
+            return { key, value: raw };
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=org-claim.js.map

package/dist/nestjs/auth/org-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-claim.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-claim.ts"],"names":[],"mappings":";;;AAgEA,0CAUC;AA3CD,IAAY,WAGX;AAHD,WAAY,WAAW;IAErB,wCAAyB,CAAA;AAC3B,CAAC,EAHW,WAAW,2BAAX,WAAW,QAGtB;AAOY,QAAA,cAAc,GAA2B;IACpD,WAAW,CAAC,SAAS;CACb,CAAC;AAMX,IAAY,aAKX;AALD,WAAY,aAAa;IAEvB,4CAA2B,CAAA;IAE3B,oCAAmB,CAAA;AACrB,CAAC,EALW,aAAa,6BAAb,aAAa,QAKxB;AAUD,SAAgB,eAAe,CAC7B,MAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,sBAAc,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/nestjs/auth/org-role.d.ts

@@ -0,0 +1,13 @@
+export declare enum OrgRolesClaimKey {
+    Canonical = "org_roles"
+}
+export declare const ORG_ROLES_CLAIM_KEYS: readonly OrgRolesClaimKey[];
+export declare enum OrgRole {
+    Owner = "org_owner",
+    Admin = "org_admin",
+    Member = "org_member"
+}
+export declare function resolveOrgRoles(claims: Record<string, unknown>): Record<string, OrgRole>;
+export declare function resolveOrgRoleForOrg(claims: Record<string, unknown>, orgId: string): OrgRole | null;
+export declare function orgRoleSatisfies(actual: OrgRole | null | undefined, required: OrgRole): boolean;
+//# sourceMappingURL=org-role.d.ts.map

package/dist/nestjs/auth/org-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-role.ts"],"names":[],"mappings":"AAoCA,oBAAY,gBAAgB;IAE1B,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,gBAAgB,EAElD,CAAC;AASX,oBAAY,OAAO;IACjB,KAAK,cAAc;IACnB,KAAK,cAAc;IACnB,MAAM,eAAe;CACtB;AA2BD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazB;AAMD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,MAAM,GACZ,OAAO,GAAG,IAAI,CAGhB;AAOD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EAClC,QAAQ,EAAE,OAAO,GAChB,OAAO,CAGT"}

package/dist/nestjs/auth/org-role.guard.d.ts

@@ -0,0 +1,9 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { OrgRole } from './org-role';
+export declare const REQUIRE_ORG_ROLE = "xema:require-org-role";
+export declare const RequireOrgRole: (role: OrgRole) => MethodDecorator & ClassDecorator;
+export declare class OrgRoleGuard implements CanActivate {
+    private readonly logger;
+    canActivate(context: ExecutionContext): boolean;
+}
+//# sourceMappingURL=org-role.guard.d.ts.map

package/dist/nestjs/auth/org-role.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-role.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EAAE,OAAO,EAAoB,MAAM,YAAY,CAAC;AAGvD,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AAqBxD,eAAO,MAAM,cAAc,GACzB,MAAM,OAAO,KACZ,eAAe,GAAG,cAAqD,CAAC;AAY3E,qBACa,YAAa,YAAW,WAAW;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IAExD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CA0ChD"}

package/dist/nestjs/auth/org-role.guard.js

@@ -0,0 +1,59 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var OrgRoleGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgRoleGuard = exports.RequireOrgRole = exports.REQUIRE_ORG_ROLE = void 0;
+const common_1 = require("@nestjs/common");
+const decorator_metadata_1 = require("../decorator-metadata");
+const request_context_1 = require("../../lib/request-context");
+const org_role_1 = require("./org-role");
+exports.REQUIRE_ORG_ROLE = 'xema:require-org-role';
+const RequireOrgRole = (role) => (0, common_1.SetMetadata)(exports.REQUIRE_ORG_ROLE, role);
+exports.RequireOrgRole = RequireOrgRole;
+let OrgRoleGuard = OrgRoleGuard_1 = class OrgRoleGuard {
+    logger = new common_1.Logger(OrgRoleGuard_1.name);
+    canActivate(context) {
+        const required = (0, decorator_metadata_1.readDecoratorOverride)(exports.REQUIRE_ORG_ROLE, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (!required) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const ctx = request[request_context_1.REQUEST_CONTEXT];
+        if (!ctx) {
+            this.logger.error('RequestContext missing — OrgRoleGuard requires ' +
+                'RequestContextMiddleware (configureAuthMiddleware).');
+            throw new common_1.InternalServerErrorException({
+                code: 'REQUEST_CONTEXT_MISSING',
+                message: 'Internal route misconfigured: missing request context.',
+            });
+        }
+        if (!(0, org_role_1.orgRoleSatisfies)(ctx.orgRole, required)) {
+            this.logger.warn({
+                message: 'org-role-denied',
+                route: `${request.method} ${request.originalUrl}`,
+                orgId: ctx.orgId,
+                actorId: ctx.actorId,
+                orgRole: ctx.orgRole ?? null,
+                requiredOrgRole: required,
+            });
+            throw new common_1.ForbiddenException({
+                code: 'ORG_ROLE_NOT_PERMITTED',
+                message: `This endpoint requires org role '${required}' or higher.`,
+            });
+        }
+        return true;
+    }
+};
+exports.OrgRoleGuard = OrgRoleGuard;
+exports.OrgRoleGuard = OrgRoleGuard = OrgRoleGuard_1 = __decorate([
+    (0, common_1.Injectable)()
+], OrgRoleGuard);
+//# sourceMappingURL=org-role.guard.js.map

package/dist/nestjs/auth/org-role.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-role.guard.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAQwB;AAExB,8DAA8D;AAC9D,+DAA4D;AAE5D,yCAAuD;AAG1C,QAAA,gBAAgB,GAAG,uBAAuB,CAAC;AAqBjD,MAAM,cAAc,GAAG,CAC5B,IAAa,EACqB,EAAE,CAAC,IAAA,oBAAW,EAAC,wBAAgB,EAAE,IAAI,CAAC,CAAC;AAF9D,QAAA,cAAc,kBAEgD;AAapE,IAAM,YAAY,oBAAlB,MAAM,YAAY;IACN,MAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAExD,WAAW,CAAC,OAAyB;QACnC,MAAM,QAAQ,GAAG,IAAA,0CAAqB,EAAU,wBAAgB,EAAE;YAChE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,iDAAiD;gBAC/C,qDAAqD,CACxD,CAAC;YACF,MAAM,IAAI,qCAA4B,CAAC;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAA,2BAAgB,EAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,iBAAiB;gBAC1B,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE;gBACjD,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;gBAC5B,eAAe,EAAE,QAAQ;aAC1B,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,oCAAoC,QAAQ,cAAc;aACpE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7CY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CA6CxB"}

package/dist/nestjs/auth/org-role.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgRole = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = void 0;
+exports.resolveOrgRoles = resolveOrgRoles;
+exports.resolveOrgRoleForOrg = resolveOrgRoleForOrg;
+exports.orgRoleSatisfies = orgRoleSatisfies;
+var OrgRolesClaimKey;
+(function (OrgRolesClaimKey) {
+    OrgRolesClaimKey["Canonical"] = "org_roles";
+})(OrgRolesClaimKey || (exports.OrgRolesClaimKey = OrgRolesClaimKey = {}));
+exports.ORG_ROLES_CLAIM_KEYS = [
+    OrgRolesClaimKey.Canonical,
+];
+var OrgRole;
+(function (OrgRole) {
+    OrgRole["Owner"] = "org_owner";
+    OrgRole["Admin"] = "org_admin";
+    OrgRole["Member"] = "org_member";
+})(OrgRole || (exports.OrgRole = OrgRole = {}));
+const ORG_ROLE_RANK = {
+    [OrgRole.Owner]: 3,
+    [OrgRole.Admin]: 2,
+    [OrgRole.Member]: 1,
+};
+function isOrgRole(value) {
+    return (typeof value === 'string' &&
+        Object.values(OrgRole).includes(value));
+}
+function resolveOrgRoles(claims) {
+    for (const key of exports.ORG_ROLES_CLAIM_KEYS) {
+        const parsed = coerceClaimObject(claims[key]);
+        if (!parsed)
+            continue;
+        const out = {};
+        for (const [orgId, role] of Object.entries(parsed)) {
+            if (orgId.length > 0 && isOrgRole(role)) {
+                out[orgId] = role;
+            }
+        }
+        return out;
+    }
+    return {};
+}
+function resolveOrgRoleForOrg(claims, orgId) {
+    if (!orgId)
+        return null;
+    return resolveOrgRoles(claims)[orgId] ?? null;
+}
+function orgRoleSatisfies(actual, required) {
+    if (!actual)
+        return false;
+    return ORG_ROLE_RANK[actual] >= ORG_ROLE_RANK[required];
+}
+function coerceClaimObject(raw) {
+    let value = raw;
+    if (Array.isArray(value)) {
+        value = value.length === 1 ? value[0] : undefined;
+    }
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        if (trimmed.length === 0)
+            return null;
+        try {
+            value = JSON.parse(trimmed);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+//# sourceMappingURL=org-role.js.map

package/dist/nestjs/auth/org-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-role.ts"],"names":[],"mappings":";;;AAmFA,0CAeC;AAMD,oDAMC;AAOD,4CAMC;AAvFD,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAE1B,2CAAuB,CAAA;AACzB,CAAC,EAHW,gBAAgB,gCAAhB,gBAAgB,QAG3B;AAEY,QAAA,oBAAoB,GAAgC;IAC/D,gBAAgB,CAAC,SAAS;CAClB,CAAC;AASX,IAAY,OAIX;AAJD,WAAY,OAAO;IACjB,8BAAmB,CAAA;IACnB,8BAAmB,CAAA;IACnB,gCAAqB,CAAA;AACvB,CAAC,EAJW,OAAO,uBAAP,OAAO,QAIlB;AAOD,MAAM,aAAa,GAA4B;IAC7C,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;CACpB,CAAC;AAEF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;AACJ,CAAC;AASD,SAAgB,eAAe,CAC7B,MAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,4BAAoB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAMD,SAAgB,oBAAoB,CAClC,MAA+B,EAC/B,KAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAOD,SAAgB,gBAAgB,CAC9B,MAAkC,EAClC,QAAiB;IAEjB,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAQD,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAgC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/nestjs/auth/service-actor.guard.d.ts

@@ -0,0 +1,6 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+export declare class ServiceActorGuard implements CanActivate {
+    private readonly logger;
+    canActivate(context: ExecutionContext): boolean;
+}
+//# sourceMappingURL=service-actor.guard.d.ts.map

package/dist/nestjs/auth/service-actor.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-actor.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-actor.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAkCxB,qBACa,iBAAkB,YAAW,WAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAE7D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAoChD"}

package/dist/nestjs/auth/service-actor.guard.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var ServiceActorGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceActorGuard = void 0;
+const common_1 = require("@nestjs/common");
+const subject_contracts_1 = require("@xemahq/subject-contracts");
+const request_context_1 = require("../../lib/request-context");
+let ServiceActorGuard = ServiceActorGuard_1 = class ServiceActorGuard {
+    logger = new common_1.Logger(ServiceActorGuard_1.name);
+    canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const ctx = request[request_context_1.REQUEST_CONTEXT];
+        if (!ctx) {
+            this.logger.error('RequestContext missing — ServiceActorGuard requires ' +
+                'RequestContextMiddleware (the default applied by configureAuthMiddleware).');
+            throw new common_1.InternalServerErrorException({
+                code: 'REQUEST_CONTEXT_MISSING',
+                message: 'Internal route misconfigured: missing request context.',
+            });
+        }
+        if (ctx.tokenClass !== subject_contracts_1.TokenClass.ServiceJwt) {
+            this.logger.warn({
+                message: 'service-actor-required',
+                route: `${request.method} ${request.originalUrl}`,
+                actorId: ctx.actorId,
+                tokenClass: ctx.tokenClass,
+                subjectKind: ctx.subject.kind,
+                delegated: ctx.actorChain.length > 0,
+            });
+            throw new common_1.ForbiddenException({
+                code: 'ACTOR_NOT_SERVICE',
+                message: 'This endpoint is restricted to service-account callers. ' +
+                    'Mint a token via IdentityBootstrapService.getAccessToken().',
+            });
+        }
+        return true;
+    }
+};
+exports.ServiceActorGuard = ServiceActorGuard;
+exports.ServiceActorGuard = ServiceActorGuard = ServiceActorGuard_1 = __decorate([
+    (0, common_1.Injectable)()
+], ServiceActorGuard);
+//# sourceMappingURL=service-actor.guard.js.map

package/dist/nestjs/auth/service-actor.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-actor.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-actor.guard.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAOwB;AAExB,iEAAuD;AACvD,+DAA4D;AAgCrD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAE7D,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sDAAsD;gBACpD,4EAA4E,CAC/E,CAAC;YACF,MAAM,IAAI,qCAA4B,CAAC;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,KAAK,8BAAU,CAAC,UAAU,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,wBAAwB;gBACjC,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE;gBACjD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;gBAC7B,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,0DAA0D;oBAC1D,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAvCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CAuC7B"}

package/dist/nestjs/auth/service-token.guard.d.ts

@@ -0,0 +1,16 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { EventHubClient } from '@xemahq/event-hub-client';
+export declare class ServiceTokenGuard implements CanActivate {
+    private readonly eventHubClient;
+    private readonly logger;
+    private jwksClient;
+    private expectedIssuer;
+    constructor(eventHubClient: EventHubClient);
+    private initJwksClient;
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private assertServiceTokenClass;
+    private verifyToken;
+    private headerValue;
+    private assertOrgClaimMatchesHeader;
+}
+//# sourceMappingURL=service-token.guard.d.ts.map

package/dist/nestjs/auth/service-token.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-token.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAsB1D,qBACa,iBAAkB,YAAW,WAAW;IAKvC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAJ3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,OAAO,CAAC,UAAU,CAAmC;IACrD,OAAO,CAAC,cAAc,CAAuB;gBAEhB,cAAc,EAAE,cAAc;IAE3D,OAAO,CAAC,cAAc;IAuBhB,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IA2D9D,OAAO,CAAC,uBAAuB;YAiBjB,WAAW;IAmEzB,OAAO,CAAC,WAAW;IA2BnB,OAAO,CAAC,2BAA2B;CAgCpC"}