@xemahq/platform-common 0.1.3

package/dist/nestjs/auth/service-token.guard.js

@@ -0,0 +1,209 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var ServiceTokenGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceTokenGuard = void 0;
+const common_1 = require("@nestjs/common");
+const event_hub_client_1 = require("@xemahq/event-hub-client");
+const subject_contracts_1 = require("@xemahq/subject-contracts");
+const jwksRsa = __importStar(require("jwks-rsa"));
+const org_claim_1 = require("./org-claim");
+let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
+    eventHubClient;
+    logger = new common_1.Logger(ServiceTokenGuard_1.name);
+    jwksClient = null;
+    expectedIssuer = null;
+    constructor(eventHubClient) {
+        this.eventHubClient = eventHubClient;
+    }
+    initJwksClient() {
+        const authInfo = this.eventHubClient.getAuthInfo();
+        if (!authInfo) {
+            throw new common_1.UnauthorizedException('Event Hub not registered yet — cannot validate service tokens. ' +
+                'Ensure EventHubBootstrapService has completed registration.');
+        }
+        this.jwksClient = jwksRsa.default({
+            jwksUri: authInfo.jwksUrl,
+            cache: true,
+            cacheMaxAge: 600_000,
+            rateLimit: true,
+            jwksRequestsPerMinute: 10,
+        });
+        this.expectedIssuer = authInfo.issuer;
+        this.logger.log(`Service token JWKS client initialized: ${authInfo.jwksUrl}`);
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const authHeader = request.headers.authorization;
+        if (!authHeader?.startsWith('Bearer ')) {
+            throw new common_1.UnauthorizedException('Missing or invalid Authorization header');
+        }
+        const token = authHeader.substring(7);
+        try {
+            if (!this.jwksClient) {
+                this.initJwksClient();
+            }
+            const payload = await this.verifyToken(token);
+            this.assertOrgClaimMatchesHeader(payload, request);
+            this.assertServiceTokenClass(payload);
+            request.serviceAuth = payload;
+            return true;
+        }
+        catch (error) {
+            if (error instanceof common_1.UnauthorizedException) {
+                throw error;
+            }
+            const msg = error instanceof Error ? error.message : String(error);
+            this.logger.error({
+                message: 'Service token verification failed',
+                error: msg,
+            });
+            throw new common_1.UnauthorizedException('Invalid service token');
+        }
+    }
+    assertServiceTokenClass(payload) {
+        const tokenClass = payload['token_class'];
+        if (typeof tokenClass === 'string' &&
+            tokenClass !== subject_contracts_1.TokenClass.ServiceJwt) {
+            this.logger.warn({
+                message: 'service-token-class-mismatch',
+                tokenClass,
+            });
+            throw new common_1.ForbiddenException({
+                code: 'TOKEN_CLASS_NOT_SERVICE',
+                message: 'This service endpoint requires a service_jwt token class.',
+            });
+        }
+    }
+    async verifyToken(token) {
+        if (!this.jwksClient) {
+            throw new Error('JWKS client not initialized');
+        }
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            throw new Error('Invalid token format');
+        }
+        const [headerB64, payloadB64, signature] = parts;
+        if (!headerB64 || !payloadB64 || !signature) {
+            throw new Error('Invalid token format');
+        }
+        const header = JSON.parse(Buffer.from(headerB64, 'base64url').toString('utf8'));
+        const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf8'));
+        if (payload.exp && Date.now() >= payload.exp * 1000) {
+            throw new Error('Token expired');
+        }
+        if (this.expectedIssuer && payload.iss !== this.expectedIssuer) {
+            throw new Error(`Invalid issuer: ${payload.iss}`);
+        }
+        if (!header.kid) {
+            throw new Error('Token missing kid in header');
+        }
+        const key = await this.jwksClient.getSigningKey(header.kid);
+        const publicKey = key.getPublicKey();
+        const crypto = await import('node:crypto');
+        const data = `${headerB64}.${payloadB64}`;
+        const signatureBuffer = Buffer.from(signature, 'base64url');
+        const algMap = {
+            RS256: 'RSA-SHA256',
+            RS384: 'RSA-SHA384',
+            RS512: 'RSA-SHA512',
+        };
+        const algorithm = algMap[header.alg];
+        if (!algorithm) {
+            throw new Error(`Unsupported algorithm: ${header.alg}`);
+        }
+        const isValid = crypto
+            .createVerify(algorithm)
+            .update(data)
+            .verify(publicKey, signatureBuffer);
+        if (!isValid) {
+            throw new Error('Invalid signature');
+        }
+        return payload;
+    }
+    headerValue(request, name) {
+        const headers = request.headers ?? {};
+        const lower = headers[name];
+        const exact = headers[name.replace(/(^|-)([a-z])/g, (_m, sep, ch) => `${sep}${ch.toUpperCase()}`)];
+        const raw = lower ?? exact;
+        if (typeof raw === 'string') {
+            return raw;
+        }
+        if (Array.isArray(raw) && typeof raw[0] === 'string') {
+            return raw[0];
+        }
+        return '';
+    }
+    assertOrgClaimMatchesHeader(claims, request) {
+        const resolved = (0, org_claim_1.resolveOrgClaim)(claims);
+        if (!resolved) {
+            return;
+        }
+        const canonicalHeader = this.headerValue(request, 'x-xema-org-id');
+        const legacyHeader = this.headerValue(request, 'x-org-id');
+        const headerName = canonicalHeader
+            ? org_claim_1.OrgHeaderName.Canonical
+            : org_claim_1.OrgHeaderName.Legacy;
+        const headerValue = canonicalHeader || legacyHeader;
+        if (!headerValue) {
+            return;
+        }
+        if (resolved.value.toLowerCase() !== headerValue.toLowerCase()) {
+            this.logger.warn({
+                message: 'service-token-tenant-claim-mismatch',
+                claim: resolved.key,
+                claimValue: resolved.value,
+                header: headerName,
+                headerValue,
+            });
+            throw new common_1.ForbiddenException(`${headerName} (${headerValue}) does not match the ${resolved.key} claim on the service token.`);
+        }
+    }
+};
+exports.ServiceTokenGuard = ServiceTokenGuard;
+exports.ServiceTokenGuard = ServiceTokenGuard = ServiceTokenGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [event_hub_client_1.EventHubClient])
+], ServiceTokenGuard);
+//# sourceMappingURL=service-token.guard.js.map

package/dist/nestjs/auth/service-token.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-token.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,2CAOwB;AACxB,+DAA0D;AAC1D,iEAAuD;AACvD,kDAAoC;AAEpC,2CAA6D;AAmBtD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAKC;IAJZ,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IACrD,UAAU,GAA8B,IAAI,CAAC;IAC7C,cAAc,GAAkB,IAAI,CAAC;IAE7C,YAA6B,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAAG,CAAC;IAEvD,cAAc;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAC7B,iEAAiE;gBAC/D,6DAA6D,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,OAAO;YACpB,SAAS,EAAE,IAAI;YACf,qBAAqB,EAAE,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;QAEtC,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,0CAA0C,QAAQ,CAAC,OAAO,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAmC,CAAC;QAEvE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAc9C,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAGrC,OAAmC,CAAC,WAAW,GAAG,OAAO,CAAC;YAE3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,mCAAmC;gBAC5C,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;YACH,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAUO,uBAAuB,CAAC,OAAmB;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1C,IACE,OAAO,UAAU,KAAK,QAAQ;YAC9B,UAAU,KAAK,8BAAU,CAAC,UAAU,EACpC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,8BAA8B;gBACvC,UAAU;aACX,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAAa;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QACjD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,MAAM,GAAc,IAAI,CAAC,KAAK,CAClC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrD,CAAC;QACF,MAAM,OAAO,GAAe,IAAI,CAAC,KAAK,CACpC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACtD,CAAC;QAEF,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAC1C,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAE5D,MAAM,MAAM,GAA2B;YACrC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,YAAY;SACpB,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM;aACnB,YAAY,CAAC,SAAS,CAAC;aACvB,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAEtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAOO,WAAW,CACjB,OAA8C,EAC9C,IAAY;QAEZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAU,EAAE,EAAE,CAC1E,GAAG,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAUO,2BAA2B,CACjC,MAAkB,EAClB,OAA8C;QAE9C,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,eAAe;YAChC,CAAC,CAAC,yBAAa,CAAC,SAAS;YACzB,CAAC,CAAC,yBAAa,CAAC,MAAM,CAAC;QACzB,MAAM,WAAW,GAAG,eAAe,IAAI,YAAY,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,qCAAqC;gBAC9C,KAAK,EAAE,QAAQ,CAAC,GAAG;gBACnB,UAAU,EAAE,QAAQ,CAAC,KAAK;gBAC1B,MAAM,EAAE,UAAU;gBAClB,WAAW;aACZ,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAC1B,GAAG,UAAU,KAAK,WAAW,wBAAwB,QAAQ,CAAC,GAAG,8BAA8B,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAxOY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAMkC,iCAAc;GALhD,iBAAiB,CAwO7B"}

package/dist/nestjs/auth/token-class.guard.d.ts

@@ -0,0 +1,9 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { TokenClass } from '@xemahq/subject-contracts';
+export declare const REQUIRE_TOKEN_CLASS = "xema:require-token-class";
+export declare const RequireTokenClass: (...classes: TokenClass[]) => MethodDecorator & ClassDecorator;
+export declare class TokenClassGuard implements CanActivate {
+    private readonly logger;
+    canActivate(context: ExecutionContext): boolean;
+}
+//# sourceMappingURL=token-class.guard.d.ts.map

package/dist/nestjs/auth/token-class.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-class.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/token-class.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAMvD,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAgB9D,eAAO,MAAM,iBAAiB,GAC5B,GAAG,SAAS,UAAU,EAAE,KACvB,eAAe,GAAG,cAA2D,CAAC;AAOjF,qBACa,eAAgB,YAAW,WAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAyChD"}

package/dist/nestjs/auth/token-class.guard.js

@@ -0,0 +1,57 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var TokenClassGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenClassGuard = exports.RequireTokenClass = exports.REQUIRE_TOKEN_CLASS = void 0;
+const common_1 = require("@nestjs/common");
+const decorator_metadata_1 = require("../decorator-metadata");
+const request_context_1 = require("../../lib/request-context");
+exports.REQUIRE_TOKEN_CLASS = 'xema:require-token-class';
+const RequireTokenClass = (...classes) => (0, common_1.SetMetadata)(exports.REQUIRE_TOKEN_CLASS, classes);
+exports.RequireTokenClass = RequireTokenClass;
+let TokenClassGuard = TokenClassGuard_1 = class TokenClassGuard {
+    logger = new common_1.Logger(TokenClassGuard_1.name);
+    canActivate(context) {
+        const allowed = (0, decorator_metadata_1.readDecoratorOverride)(exports.REQUIRE_TOKEN_CLASS, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (!allowed || allowed.length === 0) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const ctx = request[request_context_1.REQUEST_CONTEXT];
+        if (!ctx) {
+            this.logger.error('RequestContext missing — TokenClassGuard requires ' +
+                'RequestContextMiddleware (configureAuthMiddleware).');
+            throw new common_1.InternalServerErrorException({
+                code: 'REQUEST_CONTEXT_MISSING',
+                message: 'Internal route misconfigured: missing request context.',
+            });
+        }
+        if (!allowed.includes(ctx.tokenClass)) {
+            this.logger.warn({
+                message: 'token-class-denied',
+                route: `${request.method} ${request.originalUrl}`,
+                actorId: ctx.actorId,
+                tokenClass: ctx.tokenClass,
+                allowed,
+            });
+            throw new common_1.ForbiddenException({
+                code: 'TOKEN_CLASS_NOT_PERMITTED',
+                message: `This endpoint admits only token classes: ${allowed.join(', ')}.`,
+            });
+        }
+        return true;
+    }
+};
+exports.TokenClassGuard = TokenClassGuard;
+exports.TokenClassGuard = TokenClassGuard = TokenClassGuard_1 = __decorate([
+    (0, common_1.Injectable)()
+], TokenClassGuard);
+//# sourceMappingURL=token-class.guard.js.map

package/dist/nestjs/auth/token-class.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-class.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/token-class.guard.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAQwB;AAGxB,8DAA8D;AAC9D,+DAA4D;AAI/C,QAAA,mBAAmB,GAAG,0BAA0B,CAAC;AAgBvD,MAAM,iBAAiB,GAAG,CAC/B,GAAG,OAAqB,EACU,EAAE,CAAC,IAAA,oBAAW,EAAC,2BAAmB,EAAE,OAAO,CAAC,CAAC;AAFpE,QAAA,iBAAiB,qBAEmD;AAQ1E,IAAM,eAAe,uBAArB,MAAM,eAAe;IACT,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAE3D,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,IAAA,0CAAqB,EAAe,2BAAmB,EAAE;YACvE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,oDAAoD;gBAClD,qDAAqD,CACxD,CAAC;YACF,MAAM,IAAI,qCAA4B,CAAC;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE;gBACjD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO;aACR,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,4CAA4C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC3E,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA5CY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;GACA,eAAe,CA4C3B"}

package/dist/nestjs/body-parsers.d.ts

@@ -0,0 +1,7 @@
+import type { NestExpressApplication } from '@nestjs/platform-express';
+export interface StandardBodyParserOptions {
+    readonly jsonLimit?: string;
+    readonly urlencodedLimit?: string;
+}
+export declare function applyStandardBodyParsers(app: NestExpressApplication, options?: StandardBodyParserOptions): void;
+//# sourceMappingURL=body-parsers.d.ts.map

package/dist/nestjs/body-parsers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-parsers.d.ts","sourceRoot":"","sources":["../../src/nestjs/body-parsers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAIvE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAiBD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,sBAAsB,EAC3B,OAAO,GAAE,yBAA8B,GACtC,IAAI,CAQN"}

package/dist/nestjs/body-parsers.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyStandardBodyParsers = applyStandardBodyParsers;
+const DEFAULT_BODY_LIMIT = '10mb';
+function applyStandardBodyParsers(app, options = {}) {
+    app.useBodyParser('json', {
+        limit: options.jsonLimit ?? DEFAULT_BODY_LIMIT,
+    });
+    app.useBodyParser('urlencoded', {
+        extended: true,
+        limit: options.urlencodedLimit ?? DEFAULT_BODY_LIMIT,
+    });
+}
+//# sourceMappingURL=body-parsers.js.map

package/dist/nestjs/body-parsers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-parsers.js","sourceRoot":"","sources":["../../src/nestjs/body-parsers.ts"],"names":[],"mappings":";;AAwBA,4DAWC;AAjCD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAsBlC,SAAgB,wBAAwB,CACtC,GAA2B,EAC3B,UAAqC,EAAE;IAEvC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE;QACxB,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;KAC/C,CAAC,CAAC;IACH,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE;QAC9B,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,OAAO,CAAC,eAAe,IAAI,kBAAkB;KACrD,CAAC,CAAC;AACL,CAAC"}

package/dist/nestjs/cors.config.d.ts

@@ -0,0 +1,4 @@
+import type { CorsOptions } from '@nestjs/common/interfaces/external/cors-options.interface';
+export declare function isOriginAllowed(origin: string, allowedOrigins?: string): boolean;
+export declare function getCorsConfig(allowedOrigins?: string): CorsOptions;
+//# sourceMappingURL=cors.config.d.ts.map

package/dist/nestjs/cors.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.config.d.ts","sourceRoot":"","sources":["../../src/nestjs/cors.config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2DAA2D,CAAC;AA2B7F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAShF;AASD,wBAAgB,aAAa,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,WAAW,CAgDlE"}

package/dist/nestjs/cors.config.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isOriginAllowed = isOriginAllowed;
+exports.getCorsConfig = getCorsConfig;
+const common_1 = require("@nestjs/common");
+const logger = new common_1.Logger('CORS');
+function originMatchesPattern(origin, pattern) {
+    const trimmedPattern = pattern.trim();
+    if (trimmedPattern.includes('*')) {
+        const regexPattern = trimmedPattern
+            .replace(/[.+?^${}()|[\]\\]/g, '\\$&')
+            .replace(/\*/g, '.*');
+        const regex = new RegExp(`^https?://${regexPattern}$`);
+        return regex.test(origin);
+    }
+    return (origin === `http://${trimmedPattern}` ||
+        origin === `https://${trimmedPattern}` ||
+        origin === trimmedPattern);
+}
+function isOriginAllowed(origin, allowedOrigins) {
+    if (!allowedOrigins) {
+        return false;
+    }
+    return allowedOrigins
+        .split(',')
+        .map((pattern) => pattern.trim())
+        .some((pattern) => originMatchesPattern(origin, pattern));
+}
+function getCorsConfig(allowedOrigins) {
+    if (!allowedOrigins) {
+        throw new Error('CORS_ALLOWED_ORIGINS environment variable is required. ' +
+            'Set it to a comma-separated list of allowed origins (e.g., "example.com,*.example.com")');
+    }
+    return {
+        origin: (origin, callback) => {
+            if (!origin) {
+                callback(null, true);
+                return;
+            }
+            const isAllowed = isOriginAllowed(origin, allowedOrigins);
+            if (isAllowed) {
+                callback(null, true);
+            }
+            else {
+                logger.warn(`CORS blocked origin: ${origin}`);
+                callback(new Error('Not allowed by CORS'));
+            }
+        },
+        credentials: true,
+        methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+        allowedHeaders: [
+            'Content-Type',
+            'Authorization',
+            'X-Requested-With',
+            'Accept',
+            'Origin',
+            'X-Org-Id',
+            'X-Project-Id',
+            'X-Correlation-Id',
+            'X-Request-Id',
+            'X-Last-Seen-Sequence',
+            'Last-Event-ID',
+            'Idempotency-Key',
+            'x-api-key',
+            'x-internal-token',
+        ],
+        exposedHeaders: [
+            'X-RateLimit-Limit',
+            'X-RateLimit-Remaining',
+            'X-RateLimit-Reset',
+        ],
+    };
+}
+//# sourceMappingURL=cors.config.js.map

package/dist/nestjs/cors.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.config.js","sourceRoot":"","sources":["../../src/nestjs/cors.config.ts"],"names":[],"mappings":";;AA6BA,0CASC;AASD,sCAgDC;AA/FD,2CAAwC;AAIxC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,MAAM,CAAC,CAAC;AAOlC,SAAS,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAEtC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,cAAc;aAChC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC;aACrC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,aAAa,YAAY,GAAG,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,CACL,MAAM,KAAK,UAAU,cAAc,EAAE;QACrC,MAAM,KAAK,WAAW,cAAc,EAAE;QACtC,MAAM,KAAK,cAAc,CAC1B,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc,EAAE,cAAuB;IACrE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,cAAc;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;SAChC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9D,CAAC;AASD,SAAgB,aAAa,CAAC,cAAuB;IACnD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,yDAAyD;YACvD,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;YAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YAE1D,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC7D,cAAc,EAAE;YACd,cAAc;YACd,eAAe;YACf,kBAAkB;YAClB,QAAQ;YACR,QAAQ;YACR,UAAU;YACV,cAAc;YACd,kBAAkB;YAClB,cAAc;YACd,sBAAsB;YACtB,eAAe;YACf,iBAAiB;YACjB,WAAW;YACX,kBAAkB;SACnB;QACD,cAAc,EAAE;YACd,mBAAmB;YACnB,uBAAuB;YACvB,mBAAmB;SACpB;KACF,CAAC;AACJ,CAAC"}

package/dist/nestjs/ctx.decorator.d.ts

@@ -0,0 +1,3 @@
+import type { RequestContext } from '../lib/request-context';
+export declare const Ctx: (...dataOrPipes: (keyof RequestContext | import("@nestjs/common").PipeTransform<any, any> | import("@nestjs/common").Type<import("@nestjs/common").PipeTransform<any, any>> | undefined)[]) => ParameterDecorator;
+//# sourceMappingURL=ctx.decorator.d.ts.map

package/dist/nestjs/ctx.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctx.decorator.d.ts","sourceRoot":"","sources":["../../src/nestjs/ctx.decorator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAyB7D,eAAO,MAAM,GAAG,mNAgBf,CAAC"}

package/dist/nestjs/ctx.decorator.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Ctx = void 0;
+const common_1 = require("@nestjs/common");
+const request_context_1 = require("../lib/request-context");
+exports.Ctx = (0, common_1.createParamDecorator)((data, executionContext) => {
+    const request = executionContext.switchToHttp().getRequest();
+    const ctx = request[request_context_1.REQUEST_CONTEXT];
+    if (!ctx) {
+        throw new common_1.InternalServerErrorException('RequestContext not found on request. Ensure RequestContextMiddleware is applied.');
+    }
+    return data ? ctx[data] : ctx;
+});
+//# sourceMappingURL=ctx.decorator.js.map

package/dist/nestjs/ctx.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctx.decorator.js","sourceRoot":"","sources":["../../src/nestjs/ctx.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAIwB;AAExB,4DAAyD;AA0B5C,QAAA,GAAG,GAAG,IAAA,6BAAoB,EACrC,CACE,IAAsC,EACtC,gBAAkC,EACqB,EAAE;IACzD,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;IACtE,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,qCAA4B,CACpC,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAChC,CAAC,CACF,CAAC"}

package/dist/nestjs/decorator-metadata.d.ts

@@ -0,0 +1,6 @@
+import 'reflect-metadata';
+export interface DecoratorWithKey {
+    KEY: string;
+}
+export declare function readDecoratorOverride<T>(keyOrDecorator: string | DecoratorWithKey, targets: ReadonlyArray<unknown>): T | undefined;
+//# sourceMappingURL=decorator-metadata.d.ts.map

package/dist/nestjs/decorator-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorator-metadata.d.ts","sourceRoot":"","sources":["../../src/nestjs/decorator-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAmB1B,MAAM,WAAW,gBAAgB;IAE/B,GAAG,EAAE,MAAM,CAAC;CACb;AAMD,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,cAAc,EAAE,MAAM,GAAG,gBAAgB,EACzC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,GAC9B,CAAC,GAAG,SAAS,CAWf"}

package/dist/nestjs/decorator-metadata.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readDecoratorOverride = readDecoratorOverride;
+require("reflect-metadata");
+function readDecoratorOverride(keyOrDecorator, targets) {
+    const key = typeof keyOrDecorator === 'string' ? keyOrDecorator : keyOrDecorator.KEY;
+    for (const target of targets) {
+        if (target === null || target === undefined) {
+            continue;
+        }
+        const value = Reflect.getMetadata(key, target);
+        if (value !== undefined) {
+            return value;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=decorator-metadata.js.map

package/dist/nestjs/decorator-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorator-metadata.js","sourceRoot":"","sources":["../../src/nestjs/decorator-metadata.ts"],"names":[],"mappings":";;AA4BA,sDAcC;AA1CD,4BAA0B;AA4B1B,SAAgB,qBAAqB,CACnC,cAAyC,EACzC,OAA+B;IAE/B,MAAM,GAAG,GACP,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC;IAC3E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,MAAgB,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,KAAU,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/nestjs/error-response.dto.d.ts

@@ -0,0 +1,10 @@
+declare class ErrorPayloadDto {
+    code: string;
+    message: string;
+    details: unknown;
+}
+export declare class ErrorResponseDto {
+    error: ErrorPayloadDto;
+}
+export {};
+//# sourceMappingURL=error-response.dto.d.ts.map

package/dist/nestjs/error-response.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-response.dto.d.ts","sourceRoot":"","sources":["../../src/nestjs/error-response.dto.ts"],"names":[],"mappings":"AAOA,cAAM,eAAe;IAEnB,IAAI,EAAG,MAAM,CAAC;IAGd,OAAO,EAAG,MAAM,CAAC;IAGjB,OAAO,EAAG,OAAO,CAAC;CACnB;AAED,qBAAa,gBAAgB;IAE3B,KAAK,EAAG,eAAe,CAAC;CACzB"}

package/dist/nestjs/error-response.dto.js

@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ErrorResponseDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+class ErrorDetailsDto {
+    details;
+}
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: null, nullable: true }),
+    __metadata("design:type", Object)
+], ErrorDetailsDto.prototype, "details", void 0);
+class ErrorPayloadDto {
+    code;
+    message;
+    details;
+}
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'NOT_FOUND' }),
+    __metadata("design:type", String)
+], ErrorPayloadDto.prototype, "code", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'Resource not found' }),
+    __metadata("design:type", String)
+], ErrorPayloadDto.prototype, "message", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: ErrorDetailsDto, nullable: true }),
+    __metadata("design:type", Object)
+], ErrorPayloadDto.prototype, "details", void 0);
+class ErrorResponseDto {
+    error;
+}
+exports.ErrorResponseDto = ErrorResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: ErrorPayloadDto }),
+    __metadata("design:type", ErrorPayloadDto)
+], ErrorResponseDto.prototype, "error", void 0);
+//# sourceMappingURL=error-response.dto.js.map

package/dist/nestjs/error-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-response.dto.js","sourceRoot":"","sources":["../../src/nestjs/error-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAE9C,MAAM,eAAe;IAEnB,OAAO,CAAW;CACnB;AADC;IADC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDAC7B;AAGpB,MAAM,eAAe;IAEnB,IAAI,CAAU;IAGd,OAAO,CAAU;IAGjB,OAAO,CAAW;CACnB;AAPC;IADC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;;6CACxB;AAGd;IADC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;;gDAC9B;AAGjB;IADC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDACrC;AAGpB,MAAa,gBAAgB;IAE3B,KAAK,CAAmB;CACzB;AAHD,4CAGC;AADC;IADC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;8BAC/B,eAAe;+CAAC"}

package/dist/nestjs/fetch-envelope.d.ts

@@ -0,0 +1,5 @@
+import { type RetryOptions } from './fetch-with-retry';
+export declare function fetchEnvelope<T>(url: string, init: RequestInit, action: string, retryOptions?: RetryOptions): Promise<T>;
+export declare function fetchEnvelopeOptional<T>(url: string, init: RequestInit, action: string, retryOptions?: RetryOptions): Promise<T | null>;
+export declare function fetchJson<T>(url: string, init: RequestInit, action: string, retryOptions?: RetryOptions): Promise<T>;
+//# sourceMappingURL=fetch-envelope.d.ts.map

package/dist/nestjs/fetch-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-envelope.d.ts","sourceRoot":"","sources":["../../src/nestjs/fetch-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAwBvE,wBAAsB,aAAa,CAAC,CAAC,EACnC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAMD,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAcnB;AAMD,wBAAsB,SAAS,CAAC,CAAC,EAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,CAAC,CAAC,CAWZ"}

package/dist/nestjs/fetch-envelope.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchEnvelope = fetchEnvelope;
+exports.fetchEnvelopeOptional = fetchEnvelopeOptional;
+exports.fetchJson = fetchJson;
+const fetch_with_retry_1 = require("./fetch-with-retry");
+async function fetchEnvelope(url, init, action, retryOptions) {
+    const response = await (0, fetch_with_retry_1.fetchWithRetry)(url, init, retryOptions);
+    if (!response.ok) {
+        const body = await response.text().catch(() => 'unreadable');
+        throw new Error(`${action}: HTTP ${response.status} ${response.statusText} — ${body.slice(0, 500)}`);
+    }
+    const envelope = (await response.json());
+    if (envelope.data === undefined) {
+        throw new Error(`${action}: response missing 'data' field`);
+    }
+    return envelope.data;
+}
+async function fetchEnvelopeOptional(url, init, action, retryOptions) {
+    const response = await (0, fetch_with_retry_1.fetchWithRetry)(url, init, retryOptions);
+    if (response.status === 404)
+        return null;
+    if (!response.ok) {
+        const body = await response.text().catch(() => 'unreadable');
+        throw new Error(`${action}: HTTP ${response.status} ${response.statusText} — ${body.slice(0, 500)}`);
+    }
+    const envelope = (await response.json());
+    return envelope.data ?? null;
+}
+async function fetchJson(url, init, action, retryOptions) {
+    const response = await (0, fetch_with_retry_1.fetchWithRetry)(url, init, retryOptions);
+    if (!response.ok) {
+        const body = await response.text().catch(() => 'unreadable');
+        throw new Error(`${action}: HTTP ${response.status} ${response.statusText} — ${body.slice(0, 500)}`);
+    }
+    return (await response.json());
+}
+//# sourceMappingURL=fetch-envelope.js.map

package/dist/nestjs/fetch-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-envelope.js","sourceRoot":"","sources":["../../src/nestjs/fetch-envelope.ts"],"names":[],"mappings":";;AAwBA,sCAsBC;AAMD,sDAmBC;AAMD,8BAgBC;AA7FD,yDAAuE;AAwBhE,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,IAAiB,EACjB,MAAc,EACd,YAA2B;IAE3B,MAAM,QAAQ,GAAG,MAAM,IAAA,iCAAc,EAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAE/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,UAAU,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;IAEzD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,iCAAiC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAMM,KAAK,UAAU,qBAAqB,CACzC,GAAW,EACX,IAAiB,EACjB,MAAc,EACd,YAA2B;IAE3B,MAAM,QAAQ,GAAG,MAAM,IAAA,iCAAc,EAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAE/D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAEzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,UAAU,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;IACzD,OAAO,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC;AAC/B,CAAC;AAMM,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,IAAiB,EACjB,MAAc,EACd,YAA2B;IAE3B,MAAM,QAAQ,GAAG,MAAM,IAAA,iCAAc,EAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAE/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,UAAU,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;AACtC,CAAC"}

package/dist/nestjs/fetch-with-retry.d.ts

@@ -0,0 +1,11 @@
+export interface RetryOptions {
+    maxRetries?: number;
+    retryableStatuses?: number[];
+    initialDelay?: number;
+    backoffMultiplier?: number;
+    maxDelay?: number;
+    signal?: AbortSignal;
+    perAttemptTimeoutMs?: number;
+}
+export declare function fetchWithRetry(url: string | URL, init?: RequestInit, options?: RetryOptions): Promise<Response>;
+//# sourceMappingURL=fetch-with-retry.d.ts.map

package/dist/nestjs/fetch-with-retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-with-retry.d.ts","sourceRoot":"","sources":["../../src/nestjs/fetch-with-retry.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAE3B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAQlB,MAAM,CAAC,EAAE,WAAW,CAAC;IAQrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AA6BD,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,IAAI,CAAC,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,QAAQ,CAAC,CAwEnB"}