@xemahq/platform-common 0.1.5 → 0.1.7

package/dist/index.d.ts

@@ -4,6 +4,8 @@ export * as Briefcase from './lib/briefcase/index';
 export * from './lib/deliverable-output-contract';
 export * from './lib/derive-required-workspace-slots';
 export * from './lib/encryption';
+export * from './lib/envelope-encryption';
+export * from './lib/blind-index';
 export * from './lib/errors/pipeline-errors';
 export * from './lib/escape-for-prompt';
 export * from './lib/to-prisma-json';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AAIpC,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oCAAoC,CAAC;AACnD,cAAc,yBAAyB,CAAC;AAGxC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAG1C,cAAc,wBAAwB,CAAC;AAGvC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AAIpC,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oCAAoC,CAAC;AACnD,cAAc,yBAAyB,CAAC;AAGxC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAG1C,cAAc,wBAAwB,CAAC;AAGvC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,gBAAgB,CAAC"}

package/dist/index.js

@@ -43,6 +43,8 @@ exports.Briefcase = __importStar(require("./lib/briefcase/index"));
 __exportStar(require("./lib/deliverable-output-contract"), exports);
 __exportStar(require("./lib/derive-required-workspace-slots"), exports);
 __exportStar(require("./lib/encryption"), exports);
+__exportStar(require("./lib/envelope-encryption"), exports);
+__exportStar(require("./lib/blind-index"), exports);
 __exportStar(require("./lib/errors/pipeline-errors"), exports);
 __exportStar(require("./lib/escape-for-prompt"), exports);
 __exportStar(require("./lib/to-prisma-json"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,sDAAoC;AACpC,sDAAoC;AAIpC,mEAAmD;AACnD,oEAAkD;AAClD,wEAAsD;AACtD,mDAAiC;AACjC,+DAA6C;AAC7C,0DAAwC;AACxC,uDAAqC;AACrC,oDAAkC;AAClC,yDAAuC;AACvC,mEAAiD;AACjD,wDAAsC;AACtC,4DAA0C;AAC1C,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,sDAAoC;AACpC,2DAAyC;AACzC,uDAAqC;AACrC,wDAAsC;AACtC,4DAA0C;AAC1C,wDAAsC;AACtC,sDAAoC;AACpC,qDAAmC;AACnC,qEAAmD;AACnD,0DAAwC;AAGxC,kEAAgD;AAChD,uDAAqC;AACrC,2DAAyC;AACzC,4DAA0C;AAG1C,yDAAuC;AAGvC,uDAAqC;AAGrC,iDAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,sDAAoC;AACpC,sDAAoC;AAIpC,mEAAmD;AACnD,oEAAkD;AAClD,wEAAsD;AACtD,mDAAiC;AACjC,4DAA0C;AAC1C,oDAAkC;AAClC,+DAA6C;AAC7C,0DAAwC;AACxC,uDAAqC;AACrC,oDAAkC;AAClC,yDAAuC;AACvC,mEAAiD;AACjD,wDAAsC;AACtC,4DAA0C;AAC1C,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,sDAAoC;AACpC,2DAAyC;AACzC,uDAAqC;AACrC,wDAAsC;AACtC,4DAA0C;AAC1C,wDAAsC;AACtC,sDAAoC;AACpC,qDAAmC;AACnC,qEAAmD;AACnD,0DAAwC;AAGxC,kEAAgD;AAChD,uDAAqC;AACrC,2DAAyC;AACzC,4DAA0C;AAG1C,yDAAuC;AAGvC,uDAAqC;AAGrC,iDAA+B"}

package/dist/lib/blind-index.d.ts

@@ -0,0 +1,7 @@
+export declare function computeBlindIndex(args: {
+    readonly kek: Buffer;
+    readonly orgId: string;
+    readonly purpose: string;
+    readonly value: string;
+}): string;
+//# sourceMappingURL=blind-index.d.ts.map

package/dist/lib/blind-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blind-index.d.ts","sourceRoot":"","sources":["../../src/lib/blind-index.ts"],"names":[],"mappings":"AA0EA,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GAAG,MAAM,CAGT"}

package/dist/lib/blind-index.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeBlindIndex = computeBlindIndex;
+const node_crypto_1 = require("node:crypto");
+const BLIND_INDEX_KEY_LENGTH = 32;
+function deriveBlindIndexKey(kek, orgId, purpose) {
+    if (!Buffer.isBuffer(kek) || kek.byteLength !== BLIND_INDEX_KEY_LENGTH) {
+        throw new Error('Blind-index KEK must be a 32-byte Buffer.');
+    }
+    if (typeof orgId !== 'string' || orgId.length === 0) {
+        throw new Error('computeBlindIndex: orgId must be a non-empty string.');
+    }
+    if (typeof purpose !== 'string' || purpose.length === 0) {
+        throw new Error('computeBlindIndex: purpose must be a non-empty string.');
+    }
+    const info = Buffer.from(`xema:blind-index:v1:${orgId}:${purpose}`, 'utf8');
+    const derived = (0, node_crypto_1.hkdfSync)('sha256', kek, Buffer.alloc(0), info, BLIND_INDEX_KEY_LENGTH);
+    return Buffer.from(derived);
+}
+function computeBlindIndex(args) {
+    const key = deriveBlindIndexKey(args.kek, args.orgId, args.purpose);
+    return (0, node_crypto_1.createHmac)('sha256', key).update(args.value, 'utf8').digest('hex');
+}
+//# sourceMappingURL=blind-index.js.map

package/dist/lib/blind-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blind-index.js","sourceRoot":"","sources":["../../src/lib/blind-index.ts"],"names":[],"mappings":";;AA0EA,8CAQC;AAlFD,6CAAmD;AAiCnD,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAOlC,SAAS,mBAAmB,CAC1B,GAAW,EACX,KAAa,EACb,OAAe;IAEf,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,sBAAsB,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,IAAI,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAA,sBAAQ,EACtB,QAAQ,EACR,GAAG,EACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EACf,IAAI,EACJ,sBAAsB,CACvB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAWD,SAAgB,iBAAiB,CAAC,IAKjC;IACC,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC"}

package/dist/lib/envelope-encryption.d.ts

@@ -0,0 +1,29 @@
+export declare const ENVELOPE_KEY_VERSION_V1: 1;
+export interface EncryptedEnvelope {
+    readonly keyVersion: number;
+    readonly wrappedKey: Buffer;
+    readonly wrapIv: Buffer;
+    readonly wrapAuthTag: Buffer;
+    readonly contentIv: Buffer;
+    readonly contentAuthTag: Buffer;
+    readonly ciphertext: Buffer;
+}
+export declare enum EnvelopeEncryptionErrorCode {
+    MalformedKey = "MALFORMED_KEY",
+    MalformedEnvelope = "MALFORMED_ENVELOPE",
+    AuthenticationFailed = "AUTHENTICATION_FAILED"
+}
+export declare class EnvelopeEncryptionError extends Error {
+    readonly code: EnvelopeEncryptionErrorCode;
+    constructor(code: EnvelopeEncryptionErrorCode, message: string);
+}
+export declare function deriveOrgDataKey(kek: Buffer, orgId: string): Buffer;
+export declare function kekFromHex(keyHex: string): Buffer;
+export declare function sealEnvelope(dek: Buffer, plaintext: Buffer): EncryptedEnvelope;
+export declare function openEnvelope(dek: Buffer, envelope: EncryptedEnvelope): Buffer;
+export declare function serializeEnvelope(envelope: EncryptedEnvelope): Buffer;
+export declare function isSerializedEnvelope(bytes: Buffer): boolean;
+export declare function deserializeEnvelope(bytes: Buffer): EncryptedEnvelope;
+export declare function encryptForOrg(kek: Buffer, orgId: string, plaintext: Buffer): Buffer;
+export declare function decryptForOrg(kek: Buffer, orgId: string, bytes: Buffer): Buffer;
+//# sourceMappingURL=envelope-encryption.d.ts.map

package/dist/lib/envelope-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope-encryption.d.ts","sourceRoot":"","sources":["../../src/lib/envelope-encryption.ts"],"names":[],"mappings":"AAoDA,eAAO,MAAM,uBAAuB,EAAG,CAAU,CAAC;AAOlD,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAGD,oBAAY,2BAA2B;IAErC,YAAY,kBAAkB;IAE9B,iBAAiB,uBAAuB;IAExC,oBAAoB,0BAA0B;CAC/C;AAMD,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;gBAE/B,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM;CAK/D;AAoCD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAcnE;AAQD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQjD;AAQD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,CAoC9E;AASD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,iBAAiB,GAC1B,MAAM,CAmDR;AAuBD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAgCrE;AAGD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM3D;AAMD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAwCpE;AAMD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,MAAM,CAGR;AAMD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,MAAM,CAGR"}

package/dist/lib/envelope-encryption.js

@@ -0,0 +1,187 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnvelopeEncryptionError = exports.EnvelopeEncryptionErrorCode = exports.ENVELOPE_KEY_VERSION_V1 = void 0;
+exports.deriveOrgDataKey = deriveOrgDataKey;
+exports.kekFromHex = kekFromHex;
+exports.sealEnvelope = sealEnvelope;
+exports.openEnvelope = openEnvelope;
+exports.serializeEnvelope = serializeEnvelope;
+exports.isSerializedEnvelope = isSerializedEnvelope;
+exports.deserializeEnvelope = deserializeEnvelope;
+exports.encryptForOrg = encryptForOrg;
+exports.decryptForOrg = decryptForOrg;
+const node_crypto_1 = require("node:crypto");
+const CONTENT_ALGORITHM = 'aes-256-gcm';
+const KEY_WRAP_ALGORITHM = 'aes-256-gcm';
+const GCM_IV_LENGTH = 12;
+const KEY_LENGTH = 32;
+const AUTH_TAG_LENGTH = 16;
+exports.ENVELOPE_KEY_VERSION_V1 = 1;
+var EnvelopeEncryptionErrorCode;
+(function (EnvelopeEncryptionErrorCode) {
+    EnvelopeEncryptionErrorCode["MalformedKey"] = "MALFORMED_KEY";
+    EnvelopeEncryptionErrorCode["MalformedEnvelope"] = "MALFORMED_ENVELOPE";
+    EnvelopeEncryptionErrorCode["AuthenticationFailed"] = "AUTHENTICATION_FAILED";
+})(EnvelopeEncryptionErrorCode || (exports.EnvelopeEncryptionErrorCode = EnvelopeEncryptionErrorCode = {}));
+class EnvelopeEncryptionError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'EnvelopeEncryptionError';
+        this.code = code;
+    }
+}
+exports.EnvelopeEncryptionError = EnvelopeEncryptionError;
+function assertKey(key, label) {
+    if (!Buffer.isBuffer(key) || key.byteLength !== KEY_LENGTH) {
+        throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.MalformedKey, `${label} must be a 32-byte Buffer (got ${Buffer.isBuffer(key) ? `${key.byteLength} bytes` : typeof key}).`);
+    }
+}
+function deriveOrgDataKey(kek, orgId) {
+    assertKey(kek, 'KEK');
+    if (typeof orgId !== 'string' || orgId.length === 0) {
+        throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.MalformedKey, 'deriveOrgDataKey: orgId must be a non-empty string.');
+    }
+    const info = Buffer.from(`xema:org-dek:v1:${orgId}`, 'utf8');
+    const derived = (0, node_crypto_1.hkdfSync)('sha256', kek, Buffer.alloc(0), info, KEY_LENGTH);
+    return Buffer.from(derived);
+}
+function kekFromHex(keyHex) {
+    if (typeof keyHex !== 'string' || !/^[0-9a-fA-F]{64}$/.test(keyHex)) {
+        throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.MalformedKey, 'KEK must be a 64-character hex string (32 bytes).');
+    }
+    return Buffer.from(keyHex, 'hex');
+}
+function sealEnvelope(dek, plaintext) {
+    assertKey(dek, 'DEK');
+    if (!Buffer.isBuffer(plaintext)) {
+        throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.MalformedEnvelope, 'sealEnvelope: plaintext must be a Buffer.');
+    }
+    const cek = (0, node_crypto_1.randomBytes)(KEY_LENGTH);
+    const contentIv = (0, node_crypto_1.randomBytes)(GCM_IV_LENGTH);
+    const contentCipher = (0, node_crypto_1.createCipheriv)(CONTENT_ALGORITHM, cek, contentIv);
+    const ciphertext = Buffer.concat([
+        contentCipher.update(plaintext),
+        contentCipher.final(),
+    ]);
+    const contentAuthTag = contentCipher.getAuthTag();
+    const wrapIv = (0, node_crypto_1.randomBytes)(GCM_IV_LENGTH);
+    const wrapCipher = (0, node_crypto_1.createCipheriv)(KEY_WRAP_ALGORITHM, dek, wrapIv);
+    const wrappedKey = Buffer.concat([
+        wrapCipher.update(cek),
+        wrapCipher.final(),
+    ]);
+    const wrapAuthTag = wrapCipher.getAuthTag();
+    return {
+        keyVersion: exports.ENVELOPE_KEY_VERSION_V1,
+        wrappedKey,
+        wrapIv,
+        wrapAuthTag,
+        contentIv,
+        contentAuthTag,
+        ciphertext,
+    };
+}
+function openEnvelope(dek, envelope) {
+    assertKey(dek, 'DEK');
+    if (envelope.keyVersion !== exports.ENVELOPE_KEY_VERSION_V1) {
+        throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.MalformedEnvelope, `Unknown envelope keyVersion ${envelope.keyVersion}.`);
+    }
+    let cek;
+    try {
+        const wrapDecipher = (0, node_crypto_1.createDecipheriv)(KEY_WRAP_ALGORITHM, dek, envelope.wrapIv);
+        wrapDecipher.setAuthTag(envelope.wrapAuthTag);
+        cek = Buffer.concat([
+            wrapDecipher.update(envelope.wrappedKey),
+            wrapDecipher.final(),
+        ]);
+    }
+    catch {
+        throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.AuthenticationFailed, 'Failed to unwrap content key — wrong DEK or tampered envelope.');
+    }
+    if (cek.byteLength !== KEY_LENGTH) {
+        throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.MalformedEnvelope, 'Unwrapped content key has an invalid length.');
+    }
+    try {
+        const contentDecipher = (0, node_crypto_1.createDecipheriv)(CONTENT_ALGORITHM, cek, envelope.contentIv);
+        contentDecipher.setAuthTag(envelope.contentAuthTag);
+        return Buffer.concat([
+            contentDecipher.update(envelope.ciphertext),
+            contentDecipher.final(),
+        ]);
+    }
+    catch {
+        throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.AuthenticationFailed, 'Failed to decrypt ciphertext — wrong content key or tampered envelope.');
+    }
+}
+const ENVELOPE_MAGIC = Buffer.from('XEV1', 'ascii');
+function serializeEnvelope(envelope) {
+    if (envelope.wrapIv.byteLength !== GCM_IV_LENGTH ||
+        envelope.contentIv.byteLength !== GCM_IV_LENGTH ||
+        envelope.wrapAuthTag.byteLength !== AUTH_TAG_LENGTH ||
+        envelope.contentAuthTag.byteLength !== AUTH_TAG_LENGTH) {
+        throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.MalformedEnvelope, 'serializeEnvelope: IV/authTag fields have unexpected lengths.');
+    }
+    if (envelope.wrappedKey.byteLength > 0xffff) {
+        throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.MalformedEnvelope, 'serializeEnvelope: wrappedKey exceeds 65535 bytes.');
+    }
+    const keyVersionByte = Buffer.from([envelope.keyVersion & 0xff]);
+    const wrappedKeyLen = Buffer.alloc(2);
+    wrappedKeyLen.writeUInt16BE(envelope.wrappedKey.byteLength, 0);
+    return Buffer.concat([
+        ENVELOPE_MAGIC,
+        keyVersionByte,
+        envelope.wrapIv,
+        envelope.wrapAuthTag,
+        wrappedKeyLen,
+        envelope.wrappedKey,
+        envelope.contentIv,
+        envelope.contentAuthTag,
+        envelope.ciphertext,
+    ]);
+}
+function isSerializedEnvelope(bytes) {
+    return (Buffer.isBuffer(bytes) &&
+        bytes.byteLength >= ENVELOPE_MAGIC.byteLength &&
+        bytes.subarray(0, ENVELOPE_MAGIC.byteLength).equals(ENVELOPE_MAGIC));
+}
+function deserializeEnvelope(bytes) {
+    if (!isSerializedEnvelope(bytes)) {
+        throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.MalformedEnvelope, 'deserializeEnvelope: missing envelope magic prefix.');
+    }
+    let offset = ENVELOPE_MAGIC.byteLength;
+    const read = (length, label) => {
+        if (offset + length > bytes.byteLength) {
+            throw new EnvelopeEncryptionError(EnvelopeEncryptionErrorCode.MalformedEnvelope, `deserializeEnvelope: truncated before ${label}.`);
+        }
+        const slice = bytes.subarray(offset, offset + length);
+        offset += length;
+        return slice;
+    };
+    const keyVersion = read(1, 'keyVersion').readUInt8(0);
+    const wrapIv = read(GCM_IV_LENGTH, 'wrapIv');
+    const wrapAuthTag = read(AUTH_TAG_LENGTH, 'wrapAuthTag');
+    const wrappedKeyLen = read(2, 'wrappedKeyLen').readUInt16BE(0);
+    const wrappedKey = read(wrappedKeyLen, 'wrappedKey');
+    const contentIv = read(GCM_IV_LENGTH, 'contentIv');
+    const contentAuthTag = read(AUTH_TAG_LENGTH, 'contentAuthTag');
+    const ciphertext = bytes.subarray(offset);
+    return {
+        keyVersion,
+        wrappedKey: Buffer.from(wrappedKey),
+        wrapIv: Buffer.from(wrapIv),
+        wrapAuthTag: Buffer.from(wrapAuthTag),
+        contentIv: Buffer.from(contentIv),
+        contentAuthTag: Buffer.from(contentAuthTag),
+        ciphertext: Buffer.from(ciphertext),
+    };
+}
+function encryptForOrg(kek, orgId, plaintext) {
+    const dek = deriveOrgDataKey(kek, orgId);
+    return serializeEnvelope(sealEnvelope(dek, plaintext));
+}
+function decryptForOrg(kek, orgId, bytes) {
+    const dek = deriveOrgDataKey(kek, orgId);
+    return openEnvelope(dek, deserializeEnvelope(bytes));
+}
+//# sourceMappingURL=envelope-encryption.js.map

package/dist/lib/envelope-encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope-encryption.js","sourceRoot":"","sources":["../../src/lib/envelope-encryption.ts"],"names":[],"mappings":";;;AAsIA,4CAcC;AAQD,gCAQC;AAQD,oCAoCC;AASD,oCAsDC;AAuBD,8CAgCC;AAGD,oDAMC;AAMD,kDAwCC;AAMD,sCAOC;AAMD,sCAOC;AAvZD,6CAKqB;AAmCrB,MAAM,iBAAiB,GAAG,aAAa,CAAC;AACxC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AACzC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,eAAe,GAAG,EAAE,CAAC;AAQd,QAAA,uBAAuB,GAAG,CAAU,CAAC;AAyBlD,IAAY,2BAOX;AAPD,WAAY,2BAA2B;IAErC,6DAA8B,CAAA;IAE9B,uEAAwC,CAAA;IAExC,6EAA8C,CAAA;AAChD,CAAC,EAPW,2BAA2B,2CAA3B,2BAA2B,QAOtC;AAMD,MAAa,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAA8B;IAE3C,YAAY,IAAiC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AARD,0DAQC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,KAAa;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,YAAY,EACxC,GAAG,KAAK,kCACN,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,OAAO,GAC5D,IAAI,CACL,CAAC;IACJ,CAAC;AACH,CAAC;AAyBD,SAAgB,gBAAgB,CAAC,GAAW,EAAE,KAAa;IACzD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,YAAY,EACxC,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAI7D,MAAM,OAAO,GAAG,IAAA,sBAAQ,EAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAQD,SAAgB,UAAU,CAAC,MAAc;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,YAAY,EACxC,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAQD,SAAgB,YAAY,CAAC,GAAW,EAAE,SAAiB;IACzD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,iBAAiB,EAC7C,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,UAAU,CAAC,CAAC;IAEpC,MAAM,SAAS,GAAG,IAAA,yBAAW,EAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAA,4BAAc,EAAC,iBAAiB,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;QAC/B,aAAa,CAAC,KAAK,EAAE;KACtB,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,EAAE,CAAC;IAElD,MAAM,MAAM,GAAG,IAAA,yBAAW,EAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAA,4BAAc,EAAC,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;QACtB,UAAU,CAAC,KAAK,EAAE;KACnB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,EAAE,CAAC;IAE5C,OAAO;QACL,UAAU,EAAE,+BAAuB;QACnC,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,cAAc;QACd,UAAU;KACX,CAAC;AACJ,CAAC;AASD,SAAgB,YAAY,CAC1B,GAAW,EACX,QAA2B;IAE3B,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,IAAI,QAAQ,CAAC,UAAU,KAAK,+BAAuB,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,iBAAiB,EAC7C,+BAA+B,QAAQ,CAAC,UAAU,GAAG,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAA,8BAAgB,EACnC,kBAAkB,EAClB,GAAG,EACH,QAAQ,CAAC,MAAM,CAChB,CAAC;QACF,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9C,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;YAClB,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACxC,YAAY,CAAC,KAAK,EAAE;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,oBAAoB,EAChD,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,iBAAiB,EAC7C,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAA,8BAAgB,EACtC,iBAAiB,EACjB,GAAG,EACH,QAAQ,CAAC,SAAS,CACnB,CAAC;QACF,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC3C,eAAe,CAAC,KAAK,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,oBAAoB,EAChD,wEAAwE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAapD,SAAgB,iBAAiB,CAAC,QAA2B;IAC3D,IACE,QAAQ,CAAC,MAAM,CAAC,UAAU,KAAK,aAAa;QAC5C,QAAQ,CAAC,SAAS,CAAC,UAAU,KAAK,aAAa;QAC/C,QAAQ,CAAC,WAAW,CAAC,UAAU,KAAK,eAAe;QACnD,QAAQ,CAAC,cAAc,CAAC,UAAU,KAAK,eAAe,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,iBAAiB,EAC7C,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,iBAAiB,EAC7C,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,cAAc;QACd,cAAc;QACd,QAAQ,CAAC,MAAM;QACf,QAAQ,CAAC,WAAW;QACpB,aAAa;QACb,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,SAAS;QAClB,QAAQ,CAAC,cAAc;QACvB,QAAQ,CAAC,UAAU;KACpB,CAAC,CAAC;AACL,CAAC;AAGD,SAAgB,oBAAoB,CAAC,KAAa;IAChD,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC,UAAU;QAC7C,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CACpE,CAAC;AACJ,CAAC;AAMD,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,iBAAiB,EAC7C,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC;IAEvC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,KAAa,EAAU,EAAE;QACrD,IAAI,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,CAAC,iBAAiB,EAC7C,yCAAyC,KAAK,GAAG,CAClD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;QACtD,MAAM,IAAI,MAAM,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE1C,OAAO;QACL,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACjC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;QAC3C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;KACpC,CAAC;AACJ,CAAC;AAMD,SAAgB,aAAa,CAC3B,GAAW,EACX,KAAa,EACb,SAAiB;IAEjB,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,CAAC;AAMD,SAAgB,aAAa,CAC3B,GAAW,EACX,KAAa,EACb,KAAa;IAEb,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/nestjs/auth/service-actor.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-actor.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-actor.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAkCxB,qBACa,iBAAkB,YAAW,WAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAE7D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAoChD"}
+{"version":3,"file":"service-actor.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-actor.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAkCxB,qBACa,iBAAkB,YAAW,WAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAE7D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CA2ChD"}

package/dist/nestjs/auth/service-actor.guard.js

@@ -24,18 +24,19 @@ let ServiceActorGuard = ServiceActorGuard_1 = class ServiceActorGuard {
                 message: 'Internal route misconfigured: missing request context.',
             });
         }
-        if (ctx.tokenClass !== subject_1.TokenClass.ServiceJwt) {
+        const isDelegated = ctx.actorChain.length > 0;
+        if (ctx.tokenClass !== subject_1.TokenClass.ServiceJwt || isDelegated) {
             this.logger.warn({
                 message: 'service-actor-required',
                 route: `${request.method} ${request.originalUrl}`,
                 actorId: ctx.actorId,
                 tokenClass: ctx.tokenClass,
                 subjectKind: ctx.subject.kind,
-                delegated: ctx.actorChain.length > 0,
+                delegated: isDelegated,
             });
             throw new common_1.ForbiddenException({
                 code: 'ACTOR_NOT_SERVICE',
-                message: 'This endpoint is restricted to service-account callers. ' +
+                message: 'This endpoint is restricted to non-delegated service-account callers. ' +
                     'Mint a token via IdentityBootstrapService.getAccessToken().',
             });
         }

package/dist/nestjs/auth/service-actor.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-actor.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-actor.guard.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAOwB;AAExB,8DAA8D;AAC9D,+DAA4D;AAgCrD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAE7D,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sDAAsD;gBACpD,4EAA4E,CAC/E,CAAC;YACF,MAAM,IAAI,qCAA4B,CAAC;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,KAAK,oBAAU,CAAC,UAAU,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,wBAAwB;gBACjC,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE;gBACjD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;gBAC7B,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,0DAA0D;oBAC1D,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAvCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CAuC7B"}
+{"version":3,"file":"service-actor.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-actor.guard.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAOwB;AAExB,8DAA8D;AAC9D,+DAA4D;AAgCrD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAE7D,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sDAAsD;gBACpD,4EAA4E,CAC/E,CAAC;YACF,MAAM,IAAI,qCAA4B,CAAC;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC;QACL,CAAC;QAQD,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,UAAU,KAAK,oBAAU,CAAC,UAAU,IAAI,WAAW,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,wBAAwB;gBACjC,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE;gBACjD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;gBAC7B,SAAS,EAAE,WAAW;aACvB,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,wEAAwE;oBACxE,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA9CY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CA8C7B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/platform-common",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"