@xemahq/platform-common 0.12.6 → 0.12.7

package/dist/lib/redaction/redaction.service.js

@@ -0,0 +1,110 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var RedactionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedactionService = void 0;
+const common_1 = require("@nestjs/common");
+const default_rules_1 = require("./default-rules");
+const DISABLED_RULES_ENV = 'REDACTION_DISABLED_RULES';
+let RedactionService = RedactionService_1 = class RedactionService {
+    rules;
+    constructor() {
+        const disabled = parseDisabledRules(process.env[DISABLED_RULES_ENV]);
+        this.rules = default_rules_1.DEFAULT_REDACTION_RULES.filter((r) => !disabled.has(r.name));
+    }
+    static withRules(rules) {
+        const svc = Object.create(RedactionService_1.prototype);
+        const disabled = parseDisabledRules(process.env[DISABLED_RULES_ENV]);
+        svc.rules = rules.filter((r) => !disabled.has(r.name));
+        return svc;
+    }
+    redact(value) {
+        return this.walk(value, undefined, new WeakSet());
+    }
+    walk(value, key, seen) {
+        if (key !== undefined) {
+            for (const rule of this.rules) {
+                if (rule.fieldName && rule.fieldName.test(key)) {
+                    return rule.replacement;
+                }
+            }
+        }
+        if (typeof value === 'string') {
+            return applyStringRules(value, this.rules);
+        }
+        if (Array.isArray(value)) {
+            if (seen.has(value)) {
+                return '[redacted-cycle]';
+            }
+            seen.add(value);
+            let mutated = false;
+            const next = new Array(value.length);
+            for (let i = 0; i < value.length; i++) {
+                const v = value[i];
+                const w = this.walk(v, undefined, seen);
+                if (w !== v) {
+                    mutated = true;
+                }
+                next[i] = w;
+            }
+            seen.delete(value);
+            return mutated ? next : value;
+        }
+        if (value !== null && typeof value === 'object') {
+            if (seen.has(value)) {
+                return '[redacted-cycle]';
+            }
+            seen.add(value);
+            const record = value;
+            let mutated = false;
+            const out = {};
+            for (const k of Object.keys(record)) {
+                const v = record[k];
+                const w = this.walk(v, k, seen);
+                if (w !== v) {
+                    mutated = true;
+                }
+                out[k] = w;
+            }
+            seen.delete(value);
+            return mutated ? out : value;
+        }
+        return value;
+    }
+};
+exports.RedactionService = RedactionService;
+exports.RedactionService = RedactionService = RedactionService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], RedactionService);
+function applyStringRules(value, rules) {
+    let current = value;
+    for (const rule of rules) {
+        if (!rule.stringPattern) {
+            continue;
+        }
+        if (rule.stringPattern.test(current)) {
+            const regex = new RegExp(rule.stringPattern.source, rule.stringPattern.flags);
+            current = current.replace(regex, rule.replacement);
+        }
+    }
+    return current;
+}
+function parseDisabledRules(raw) {
+    if (!raw) {
+        return new Set();
+    }
+    return new Set(raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0));
+}
+//# sourceMappingURL=redaction.service.js.map

package/dist/lib/redaction/redaction.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.service.js","sourceRoot":"","sources":["../../../src/lib/redaction/redaction.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAA4C;AAE5C,mDAA0D;AAS1D,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAe/C,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IACV,KAAK,CAA2B;IAQjD;QACE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,GAAG,uCAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAA+B;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAgB,CAAC,SAAS,CAAqB,CAAC;QAC1E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACpE,GAAsD,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7B,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IAGD,MAAM,CAAI,KAAQ;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,OAAO,EAAE,CAAM,CAAC;IACzD,CAAC;IAEO,IAAI,CAAC,KAAc,EAAE,GAAuB,EAAE,IAAqB;QAGzE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,OAAO,IAAI,CAAC,WAAW,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,IAAI,GAAc,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACZ,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,EAAE,CAAC;gBAC9B,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACZ,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACb,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAjFY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;;GACA,gBAAgB,CAiF5B;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAA+B;IACtE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAIrC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9E,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CACZ,GAAG;SACA,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC"}

package/dist/lib/session-event-payloads/error-codes.d.ts

@@ -23,6 +23,8 @@ export declare enum SessionErrorCode {
     LaunchStepUnreachable = "step_unreachable",
     LaunchUnclassifiedFailure = "launch_unclassified",
     LaunchWorkspaceRestoreFailed = "workspace_restore_failed",
+    LaunchWorkspaceSnapshotCorrupt = "workspace_snapshot_corrupt",
+    LaunchWorkingFileSourceMissing = "working_file_source_missing",
     LaunchFinalizeFailed = "finalize_failed",
     LaunchFinalizeReadinessFailed = "finalize_readiness_failed",
     LaunchNoUsableProvider = "no_usable_provider",
@@ -33,8 +35,8 @@ export declare enum SessionErrorCode {
 }
 export type SessionTurnErrorCode = SessionErrorCode.ThreadBusy | SessionErrorCode.TurnFailed | SessionErrorCode.ConsentResumeFailed | SessionErrorCode.ToolIterationLimit | SessionErrorCode.NoTerminalFrame | SessionErrorCode.WorkerTurnFailed;
 export declare const SESSION_TURN_ERROR_CODES: readonly [SessionErrorCode.ThreadBusy, SessionErrorCode.TurnFailed, SessionErrorCode.ConsentResumeFailed, SessionErrorCode.ToolIterationLimit, SessionErrorCode.NoTerminalFrame, SessionErrorCode.WorkerTurnFailed];
-export type SessionLaunchErrorCode = SessionErrorCode.LaunchConfigResolutionFailed | SessionErrorCode.LaunchSelectionInvalid | SessionErrorCode.LaunchWorkerAcquireTimeout | SessionErrorCode.LaunchWorkerAcquireRejected | SessionErrorCode.LaunchWorkerAllocationLost | SessionErrorCode.LaunchControlBundleFailed | SessionErrorCode.LaunchControlBundleRejected | SessionErrorCode.LaunchBootstrapFailed | SessionErrorCode.LaunchBootstrapContractBroken | SessionErrorCode.LaunchProvisionFailed | SessionErrorCode.LaunchStepUnreachable | SessionErrorCode.LaunchUnclassifiedFailure | SessionErrorCode.LaunchWorkspaceRestoreFailed | SessionErrorCode.LaunchFinalizeFailed | SessionErrorCode.LaunchFinalizeReadinessFailed | SessionErrorCode.LaunchNoUsableProvider | SessionErrorCode.LaunchAgentUnavailable | SessionErrorCode.LaunchDeadlineExceeded | SessionErrorCode.LaunchIllegalTransition | SessionErrorCode.LaunchAbandoned;
-export declare const SESSION_LAUNCH_ERROR_CODES: readonly [SessionErrorCode.LaunchConfigResolutionFailed, SessionErrorCode.LaunchSelectionInvalid, SessionErrorCode.LaunchWorkerAcquireTimeout, SessionErrorCode.LaunchWorkerAcquireRejected, SessionErrorCode.LaunchWorkerAllocationLost, SessionErrorCode.LaunchControlBundleFailed, SessionErrorCode.LaunchControlBundleRejected, SessionErrorCode.LaunchBootstrapFailed, SessionErrorCode.LaunchBootstrapContractBroken, SessionErrorCode.LaunchProvisionFailed, SessionErrorCode.LaunchStepUnreachable, SessionErrorCode.LaunchUnclassifiedFailure, SessionErrorCode.LaunchWorkspaceRestoreFailed, SessionErrorCode.LaunchFinalizeFailed, SessionErrorCode.LaunchFinalizeReadinessFailed, SessionErrorCode.LaunchNoUsableProvider, SessionErrorCode.LaunchAgentUnavailable, SessionErrorCode.LaunchDeadlineExceeded, SessionErrorCode.LaunchIllegalTransition, SessionErrorCode.LaunchAbandoned];
+export type SessionLaunchErrorCode = SessionErrorCode.LaunchConfigResolutionFailed | SessionErrorCode.LaunchSelectionInvalid | SessionErrorCode.LaunchWorkerAcquireTimeout | SessionErrorCode.LaunchWorkerAcquireRejected | SessionErrorCode.LaunchWorkerAllocationLost | SessionErrorCode.LaunchControlBundleFailed | SessionErrorCode.LaunchControlBundleRejected | SessionErrorCode.LaunchBootstrapFailed | SessionErrorCode.LaunchBootstrapContractBroken | SessionErrorCode.LaunchProvisionFailed | SessionErrorCode.LaunchStepUnreachable | SessionErrorCode.LaunchUnclassifiedFailure | SessionErrorCode.LaunchWorkspaceRestoreFailed | SessionErrorCode.LaunchWorkspaceSnapshotCorrupt | SessionErrorCode.LaunchWorkingFileSourceMissing | SessionErrorCode.LaunchFinalizeFailed | SessionErrorCode.LaunchFinalizeReadinessFailed | SessionErrorCode.LaunchNoUsableProvider | SessionErrorCode.LaunchAgentUnavailable | SessionErrorCode.LaunchDeadlineExceeded | SessionErrorCode.LaunchIllegalTransition | SessionErrorCode.LaunchAbandoned;
+export declare const SESSION_LAUNCH_ERROR_CODES: readonly [SessionErrorCode.LaunchConfigResolutionFailed, SessionErrorCode.LaunchSelectionInvalid, SessionErrorCode.LaunchWorkerAcquireTimeout, SessionErrorCode.LaunchWorkerAcquireRejected, SessionErrorCode.LaunchWorkerAllocationLost, SessionErrorCode.LaunchControlBundleFailed, SessionErrorCode.LaunchControlBundleRejected, SessionErrorCode.LaunchBootstrapFailed, SessionErrorCode.LaunchBootstrapContractBroken, SessionErrorCode.LaunchProvisionFailed, SessionErrorCode.LaunchStepUnreachable, SessionErrorCode.LaunchUnclassifiedFailure, SessionErrorCode.LaunchWorkspaceRestoreFailed, SessionErrorCode.LaunchWorkspaceSnapshotCorrupt, SessionErrorCode.LaunchWorkingFileSourceMissing, SessionErrorCode.LaunchFinalizeFailed, SessionErrorCode.LaunchFinalizeReadinessFailed, SessionErrorCode.LaunchNoUsableProvider, SessionErrorCode.LaunchAgentUnavailable, SessionErrorCode.LaunchDeadlineExceeded, SessionErrorCode.LaunchIllegalTransition, SessionErrorCode.LaunchAbandoned];
 export declare const SESSION_LAUNCH_FAILURE_CODES: Readonly<Record<string, SessionLaunchErrorCode>>;
 export declare function mapLaunchFailureToSessionErrorCode(launchFailureKind: string): SessionLaunchErrorCode;
 //# sourceMappingURL=error-codes.d.ts.map

package/dist/lib/session-event-payloads/error-codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../../../src/lib/session-event-payloads/error-codes.ts"],"names":[],"mappings":"AA4BA,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,YAAY,iBAAiB;CAC9B;AA6BD,oBAAY,gBAAgB;IAM1B,UAAU,uBAAuB;IAMjC,UAAU,uBAAuB;IAUjC,mBAAmB,yBAAyB;IAO5C,kBAAkB,gCAAgC;IAKlD,eAAe,6BAA6B;IAU5C,gBAAgB,+BAA+B;IAkB/C,4BAA4B,6BAA6B;IAOzD,sBAAsB,6BAA6B;IAEnD,0BAA0B,2BAA2B;IAErD,2BAA2B,4BAA4B;IAWvD,0BAA0B,2BAA2B;IAQrD,yBAAyB,0BAA0B;IAenD,2BAA2B,4BAA4B;IAEvD,qBAAqB,qBAAqB;IAa1C,6BAA6B,8BAA8B;IAkB3D,qBAAqB,qBAAqB;IAqC1C,qBAAqB,qBAAqB;IAuB1C,yBAAyB,wBAAwB;IAEjD,4BAA4B,6BAA6B;IAiBzD,oBAAoB,oBAAoB;IAWxC,6BAA6B,8BAA8B;IAK3D,sBAAsB,uBAAuB;IAM7C,sBAAsB,sBAAsB;IAa5C,sBAAsB,sBAAsB;IAE5C,uBAAuB,uBAAuB;IAK9C,eAAe,qBAAqB;CACrC;AAUD,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,CAAC,UAAU,GAC3B,gBAAgB,CAAC,UAAU,GAC3B,gBAAgB,CAAC,mBAAmB,GACpC,gBAAgB,CAAC,kBAAkB,GACnC,gBAAgB,CAAC,eAAe,GAChC,gBAAgB,CAAC,gBAAgB,CAAC;AAGtC,eAAO,MAAM,wBAAwB,qNAOe,CAAC;AAUrD,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,CAAC,4BAA4B,GAC7C,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,0BAA0B,GAC3C,gBAAgB,CAAC,2BAA2B,GAC5C,gBAAgB,CAAC,0BAA0B,GAC3C,gBAAgB,CAAC,yBAAyB,GAC1C,gBAAgB,CAAC,2BAA2B,GAC5C,gBAAgB,CAAC,qBAAqB,GACtC,gBAAgB,CAAC,6BAA6B,GAC9C,gBAAgB,CAAC,qBAAqB,GACtC,gBAAgB,CAAC,qBAAqB,GACtC,gBAAgB,CAAC,yBAAyB,GAC1C,gBAAgB,CAAC,4BAA4B,GAC7C,gBAAgB,CAAC,oBAAoB,GACrC,gBAAgB,CAAC,6BAA6B,GAC9C,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,uBAAuB,GACxC,gBAAgB,CAAC,eAAe,CAAC;AAGrC,eAAO,MAAM,0BAA0B,s2BAqBe,CAAC;AAiBvD,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAKvC,CAAC;AAuBF,wBAAgB,kCAAkC,CAChD,iBAAiB,EAAE,MAAM,GACxB,sBAAsB,CAWxB"}
+{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../../../src/lib/session-event-payloads/error-codes.ts"],"names":[],"mappings":"AA4BA,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,YAAY,iBAAiB;CAC9B;AA6BD,oBAAY,gBAAgB;IAM1B,UAAU,uBAAuB;IAMjC,UAAU,uBAAuB;IAUjC,mBAAmB,yBAAyB;IAO5C,kBAAkB,gCAAgC;IAKlD,eAAe,6BAA6B;IAU5C,gBAAgB,+BAA+B;IAkB/C,4BAA4B,6BAA6B;IAOzD,sBAAsB,6BAA6B;IAEnD,0BAA0B,2BAA2B;IAErD,2BAA2B,4BAA4B;IAWvD,0BAA0B,2BAA2B;IAQrD,yBAAyB,0BAA0B;IAenD,2BAA2B,4BAA4B;IAEvD,qBAAqB,qBAAqB;IAa1C,6BAA6B,8BAA8B;IAkB3D,qBAAqB,qBAAqB;IAqC1C,qBAAqB,qBAAqB;IAuB1C,yBAAyB,wBAAwB;IAYjD,4BAA4B,6BAA6B;IAazD,8BAA8B,+BAA+B;IAY7D,8BAA8B,gCAAgC;IAiB9D,oBAAoB,oBAAoB;IAWxC,6BAA6B,8BAA8B;IAK3D,sBAAsB,uBAAuB;IAM7C,sBAAsB,sBAAsB;IAa5C,sBAAsB,sBAAsB;IAE5C,uBAAuB,uBAAuB;IAK9C,eAAe,qBAAqB;CACrC;AAUD,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,CAAC,UAAU,GAC3B,gBAAgB,CAAC,UAAU,GAC3B,gBAAgB,CAAC,mBAAmB,GACpC,gBAAgB,CAAC,kBAAkB,GACnC,gBAAgB,CAAC,eAAe,GAChC,gBAAgB,CAAC,gBAAgB,CAAC;AAGtC,eAAO,MAAM,wBAAwB,qNAOe,CAAC;AAUrD,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,CAAC,4BAA4B,GAC7C,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,0BAA0B,GAC3C,gBAAgB,CAAC,2BAA2B,GAC5C,gBAAgB,CAAC,0BAA0B,GAC3C,gBAAgB,CAAC,yBAAyB,GAC1C,gBAAgB,CAAC,2BAA2B,GAC5C,gBAAgB,CAAC,qBAAqB,GACtC,gBAAgB,CAAC,6BAA6B,GAC9C,gBAAgB,CAAC,qBAAqB,GACtC,gBAAgB,CAAC,qBAAqB,GACtC,gBAAgB,CAAC,yBAAyB,GAC1C,gBAAgB,CAAC,4BAA4B,GAC7C,gBAAgB,CAAC,8BAA8B,GAC/C,gBAAgB,CAAC,8BAA8B,GAC/C,gBAAgB,CAAC,oBAAoB,GACrC,gBAAgB,CAAC,6BAA6B,GAC9C,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,uBAAuB,GACxC,gBAAgB,CAAC,eAAe,CAAC;AAGrC,eAAO,MAAM,0BAA0B,w8BAuBe,CAAC;AAiBvD,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAKvC,CAAC;AAuBF,wBAAgB,kCAAkC,CAChD,iBAAiB,EAAE,MAAM,GACxB,sBAAsB,CAWxB"}

package/dist/lib/session-event-payloads/error-codes.js

@@ -29,6 +29,8 @@ var SessionErrorCode;
     SessionErrorCode["LaunchStepUnreachable"] = "step_unreachable";
     SessionErrorCode["LaunchUnclassifiedFailure"] = "launch_unclassified";
     SessionErrorCode["LaunchWorkspaceRestoreFailed"] = "workspace_restore_failed";
+    SessionErrorCode["LaunchWorkspaceSnapshotCorrupt"] = "workspace_snapshot_corrupt";
+    SessionErrorCode["LaunchWorkingFileSourceMissing"] = "working_file_source_missing";
     SessionErrorCode["LaunchFinalizeFailed"] = "finalize_failed";
     SessionErrorCode["LaunchFinalizeReadinessFailed"] = "finalize_readiness_failed";
     SessionErrorCode["LaunchNoUsableProvider"] = "no_usable_provider";
@@ -59,6 +61,8 @@ exports.SESSION_LAUNCH_ERROR_CODES = [
     SessionErrorCode.LaunchStepUnreachable,
     SessionErrorCode.LaunchUnclassifiedFailure,
     SessionErrorCode.LaunchWorkspaceRestoreFailed,
+    SessionErrorCode.LaunchWorkspaceSnapshotCorrupt,
+    SessionErrorCode.LaunchWorkingFileSourceMissing,
     SessionErrorCode.LaunchFinalizeFailed,
     SessionErrorCode.LaunchFinalizeReadinessFailed,
     SessionErrorCode.LaunchNoUsableProvider,

package/dist/lib/session-event-payloads/error-codes.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../../../src/lib/session-event-payloads/error-codes.ts"],"names":[],"mappings":";;;AAicA,gFAaC;AAlbD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,kCAAa,CAAA;IACb,sCAAiB,CAAA;IACjB,kDAA6B,CAAA;AAC/B,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AA6BD,IAAY,gBAsQX;AAtQD,WAAY,gBAAgB;IAM1B,qDAAiC,CAAA;IAMjC,qDAAiC,CAAA;IAUjC,gEAA4C,CAAA;IAO5C,sEAAkD,CAAA;IAKlD,gEAA4C,CAAA;IAU5C,mEAA+C,CAAA;IAkB/C,6EAAyD,CAAA;IAOzD,uEAAmD,CAAA;IAEnD,yEAAqD,CAAA;IAErD,2EAAuD,CAAA;IAWvD,yEAAqD,CAAA;IAQrD,uEAAmD,CAAA;IAenD,2EAAuD,CAAA;IAEvD,8DAA0C,CAAA;IAa1C,+EAA2D,CAAA;IAkB3D,8DAA0C,CAAA;IAqC1C,8DAA0C,CAAA;IAuB1C,qEAAiD,CAAA;IAEjD,6EAAyD,CAAA;IAiBzD,4DAAwC,CAAA;IAWxC,+EAA2D,CAAA;IAK3D,iEAA6C,CAAA;IAM7C,gEAA4C,CAAA;IAa5C,gEAA4C,CAAA;IAE5C,kEAA8C,CAAA;IAK9C,wDAAoC,CAAA;AACtC,CAAC,EAtQW,gBAAgB,gCAAhB,gBAAgB,QAsQ3B;AAmBY,QAAA,wBAAwB,GAAG;IACtC,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,mBAAmB;IACpC,gBAAgB,CAAC,kBAAkB;IACnC,gBAAgB,CAAC,eAAe;IAChC,gBAAgB,CAAC,gBAAgB;CACiB,CAAC;AAiCxC,QAAA,0BAA0B,GAAG;IACxC,gBAAgB,CAAC,4BAA4B;IAC7C,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,2BAA2B;IAC5C,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,2BAA2B;IAC5C,gBAAgB,CAAC,qBAAqB;IACtC,gBAAgB,CAAC,6BAA6B;IAC9C,gBAAgB,CAAC,qBAAqB;IACtC,gBAAgB,CAAC,qBAAqB;IACtC,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,4BAA4B;IAC7C,gBAAgB,CAAC,oBAAoB;IACrC,gBAAgB,CAAC,6BAA6B;IAC9C,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,uBAAuB;IACxC,gBAAgB,CAAC,eAAe;CACoB,CAAC;AAiB1C,QAAA,4BAA4B,GAErC,MAAM,CAAC,MAAM,CACf,MAAM,CAAC,WAAW,CAChB,kCAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAc,EAAE,IAAI,CAAC,CAAC,CACvB,CAC5C,CAAC;AAuBF,SAAgB,kCAAkC,CAChD,iBAAyB;IAEzB,MAAM,IAAI,GAAG,oCAA4B,CAAC,iBAAiB,CAAC,CAAC;IAC7D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CACjB,wBAAwB,iBAAiB,6BAA6B;YACpE,qEAAqE;YACrE,iDAAiD;YACjD,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../../../src/lib/session-event-payloads/error-codes.ts"],"names":[],"mappings":";;;AAweA,gFAaC;AAzdD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,kCAAa,CAAA;IACb,sCAAiB,CAAA;IACjB,kDAA6B,CAAA;AAC/B,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AA6BD,IAAY,gBAySX;AAzSD,WAAY,gBAAgB;IAM1B,qDAAiC,CAAA;IAMjC,qDAAiC,CAAA;IAUjC,gEAA4C,CAAA;IAO5C,sEAAkD,CAAA;IAKlD,gEAA4C,CAAA;IAU5C,mEAA+C,CAAA;IAkB/C,6EAAyD,CAAA;IAOzD,uEAAmD,CAAA;IAEnD,yEAAqD,CAAA;IAErD,2EAAuD,CAAA;IAWvD,yEAAqD,CAAA;IAQrD,uEAAmD,CAAA;IAenD,2EAAuD,CAAA;IAEvD,8DAA0C,CAAA;IAa1C,+EAA2D,CAAA;IAkB3D,8DAA0C,CAAA;IAqC1C,8DAA0C,CAAA;IAuB1C,qEAAiD,CAAA;IAYjD,6EAAyD,CAAA;IAazD,iFAA6D,CAAA;IAY7D,kFAA8D,CAAA;IAiB9D,4DAAwC,CAAA;IAWxC,+EAA2D,CAAA;IAK3D,iEAA6C,CAAA;IAM7C,gEAA4C,CAAA;IAa5C,gEAA4C,CAAA;IAE5C,kEAA8C,CAAA;IAK9C,wDAAoC,CAAA;AACtC,CAAC,EAzSW,gBAAgB,gCAAhB,gBAAgB,QAyS3B;AAmBY,QAAA,wBAAwB,GAAG;IACtC,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,mBAAmB;IACpC,gBAAgB,CAAC,kBAAkB;IACnC,gBAAgB,CAAC,eAAe;IAChC,gBAAgB,CAAC,gBAAgB;CACiB,CAAC;AAmCxC,QAAA,0BAA0B,GAAG;IACxC,gBAAgB,CAAC,4BAA4B;IAC7C,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,2BAA2B;IAC5C,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,2BAA2B;IAC5C,gBAAgB,CAAC,qBAAqB;IACtC,gBAAgB,CAAC,6BAA6B;IAC9C,gBAAgB,CAAC,qBAAqB;IACtC,gBAAgB,CAAC,qBAAqB;IACtC,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,4BAA4B;IAC7C,gBAAgB,CAAC,8BAA8B;IAC/C,gBAAgB,CAAC,8BAA8B;IAC/C,gBAAgB,CAAC,oBAAoB;IACrC,gBAAgB,CAAC,6BAA6B;IAC9C,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,uBAAuB;IACxC,gBAAgB,CAAC,eAAe;CACoB,CAAC;AAiB1C,QAAA,4BAA4B,GAErC,MAAM,CAAC,MAAM,CACf,MAAM,CAAC,WAAW,CAChB,kCAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAc,EAAE,IAAI,CAAC,CAAC,CACvB,CAC5C,CAAC;AAuBF,SAAgB,kCAAkC,CAChD,iBAAyB;IAEzB,MAAM,IAAI,GAAG,oCAA4B,CAAC,iBAAiB,CAAC,CAAC;IAC7D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CACjB,wBAAwB,iBAAiB,6BAA6B;YACpE,qEAAqE;YACrE,iDAAiD;YACjD,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/session-event-payloads/validation.d.ts

@@ -63,12 +63,12 @@ export declare const SESSION_EVENT_PAYLOAD_SCHEMAS: {
         detail: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strict>, z.ZodObject<{
         phase: z.ZodLiteral<SessionErrorPhase.Resume>;
-        code: z.ZodLiteral<import("./error-codes").SessionErrorCode.LaunchConfigResolutionFailed | import("./error-codes").SessionErrorCode.LaunchSelectionInvalid | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireTimeout | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireRejected | import("./error-codes").SessionErrorCode.LaunchWorkerAllocationLost | import("./error-codes").SessionErrorCode.LaunchControlBundleFailed | import("./error-codes").SessionErrorCode.LaunchControlBundleRejected | import("./error-codes").SessionErrorCode.LaunchBootstrapFailed | import("./error-codes").SessionErrorCode.LaunchBootstrapContractBroken | import("./error-codes").SessionErrorCode.LaunchProvisionFailed | import("./error-codes").SessionErrorCode.LaunchStepUnreachable | import("./error-codes").SessionErrorCode.LaunchUnclassifiedFailure | import("./error-codes").SessionErrorCode.LaunchWorkspaceRestoreFailed | import("./error-codes").SessionErrorCode.LaunchFinalizeFailed | import("./error-codes").SessionErrorCode.LaunchFinalizeReadinessFailed | import("./error-codes").SessionErrorCode.LaunchNoUsableProvider | import("./error-codes").SessionErrorCode.LaunchAgentUnavailable | import("./error-codes").SessionErrorCode.LaunchDeadlineExceeded | import("./error-codes").SessionErrorCode.LaunchIllegalTransition | import("./error-codes").SessionErrorCode.LaunchAbandoned>;
+        code: z.ZodLiteral<import("./error-codes").SessionErrorCode.LaunchConfigResolutionFailed | import("./error-codes").SessionErrorCode.LaunchSelectionInvalid | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireTimeout | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireRejected | import("./error-codes").SessionErrorCode.LaunchWorkerAllocationLost | import("./error-codes").SessionErrorCode.LaunchControlBundleFailed | import("./error-codes").SessionErrorCode.LaunchControlBundleRejected | import("./error-codes").SessionErrorCode.LaunchBootstrapFailed | import("./error-codes").SessionErrorCode.LaunchBootstrapContractBroken | import("./error-codes").SessionErrorCode.LaunchProvisionFailed | import("./error-codes").SessionErrorCode.LaunchStepUnreachable | import("./error-codes").SessionErrorCode.LaunchUnclassifiedFailure | import("./error-codes").SessionErrorCode.LaunchWorkspaceRestoreFailed | import("./error-codes").SessionErrorCode.LaunchWorkspaceSnapshotCorrupt | import("./error-codes").SessionErrorCode.LaunchWorkingFileSourceMissing | import("./error-codes").SessionErrorCode.LaunchFinalizeFailed | import("./error-codes").SessionErrorCode.LaunchFinalizeReadinessFailed | import("./error-codes").SessionErrorCode.LaunchNoUsableProvider | import("./error-codes").SessionErrorCode.LaunchAgentUnavailable | import("./error-codes").SessionErrorCode.LaunchDeadlineExceeded | import("./error-codes").SessionErrorCode.LaunchIllegalTransition | import("./error-codes").SessionErrorCode.LaunchAbandoned>;
         message: z.ZodString;
         agentSlug: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>, z.ZodObject<{
         phase: z.ZodLiteral<SessionErrorPhase.Provisioning>;
-        code: z.ZodLiteral<import("./error-codes").SessionErrorCode.LaunchConfigResolutionFailed | import("./error-codes").SessionErrorCode.LaunchSelectionInvalid | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireTimeout | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireRejected | import("./error-codes").SessionErrorCode.LaunchWorkerAllocationLost | import("./error-codes").SessionErrorCode.LaunchControlBundleFailed | import("./error-codes").SessionErrorCode.LaunchControlBundleRejected | import("./error-codes").SessionErrorCode.LaunchBootstrapFailed | import("./error-codes").SessionErrorCode.LaunchBootstrapContractBroken | import("./error-codes").SessionErrorCode.LaunchProvisionFailed | import("./error-codes").SessionErrorCode.LaunchStepUnreachable | import("./error-codes").SessionErrorCode.LaunchUnclassifiedFailure | import("./error-codes").SessionErrorCode.LaunchWorkspaceRestoreFailed | import("./error-codes").SessionErrorCode.LaunchFinalizeFailed | import("./error-codes").SessionErrorCode.LaunchFinalizeReadinessFailed | import("./error-codes").SessionErrorCode.LaunchNoUsableProvider | import("./error-codes").SessionErrorCode.LaunchAgentUnavailable | import("./error-codes").SessionErrorCode.LaunchDeadlineExceeded | import("./error-codes").SessionErrorCode.LaunchIllegalTransition | import("./error-codes").SessionErrorCode.LaunchAbandoned>;
+        code: z.ZodLiteral<import("./error-codes").SessionErrorCode.LaunchConfigResolutionFailed | import("./error-codes").SessionErrorCode.LaunchSelectionInvalid | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireTimeout | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireRejected | import("./error-codes").SessionErrorCode.LaunchWorkerAllocationLost | import("./error-codes").SessionErrorCode.LaunchControlBundleFailed | import("./error-codes").SessionErrorCode.LaunchControlBundleRejected | import("./error-codes").SessionErrorCode.LaunchBootstrapFailed | import("./error-codes").SessionErrorCode.LaunchBootstrapContractBroken | import("./error-codes").SessionErrorCode.LaunchProvisionFailed | import("./error-codes").SessionErrorCode.LaunchStepUnreachable | import("./error-codes").SessionErrorCode.LaunchUnclassifiedFailure | import("./error-codes").SessionErrorCode.LaunchWorkspaceRestoreFailed | import("./error-codes").SessionErrorCode.LaunchWorkspaceSnapshotCorrupt | import("./error-codes").SessionErrorCode.LaunchWorkingFileSourceMissing | import("./error-codes").SessionErrorCode.LaunchFinalizeFailed | import("./error-codes").SessionErrorCode.LaunchFinalizeReadinessFailed | import("./error-codes").SessionErrorCode.LaunchNoUsableProvider | import("./error-codes").SessionErrorCode.LaunchAgentUnavailable | import("./error-codes").SessionErrorCode.LaunchDeadlineExceeded | import("./error-codes").SessionErrorCode.LaunchIllegalTransition | import("./error-codes").SessionErrorCode.LaunchAbandoned>;
         message: z.ZodString;
     }, z.core.$strict>], "phase">;
 };

package/dist/lib/to-prisma-json.d.ts

@@ -0,0 +1,6 @@
+import type { ZodType } from 'zod';
+export declare function toPrismaJson<T>(schema: ZodType<T>, value: T, context?: {
+    workItemId?: string;
+    hint?: string;
+}): unknown;
+//# sourceMappingURL=to-prisma-json.d.ts.map

package/dist/lib/to-prisma-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"to-prisma-json.d.ts","sourceRoot":"","sources":["../../src/lib/to-prisma-json.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAmBnC,wBAAgB,YAAY,CAAC,CAAC,EAC5B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,KAAK,EAAE,CAAC,EACR,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACnD,OAAO,CAYT"}

package/dist/lib/to-prisma-json.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPrismaJson = toPrismaJson;
+const pipeline_errors_1 = require("./errors/pipeline-errors");
+function toPrismaJson(schema, value, context = {}) {
+    const parsed = schema.safeParse(value);
+    if (!parsed.success) {
+        throw new pipeline_errors_1.WorkItemPayloadInvalidError(`Work-item payload failed schema validation${context.hint ? ` (${context.hint})` : ''}`, context.workItemId ?? 'unknown', parsed.error.issues);
+    }
+    return structuredClone(parsed.data);
+}
+//# sourceMappingURL=to-prisma-json.js.map

package/dist/lib/to-prisma-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"to-prisma-json.js","sourceRoot":"","sources":["../../src/lib/to-prisma-json.ts"],"names":[],"mappings":";;AAwCA,oCAgBC;AAlCD,8DAAuE;AAkBvE,SAAgB,YAAY,CAC1B,MAAkB,EAClB,KAAQ,EACR,UAAkD,EAAE;IAEpD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,6CAA2B,CACnC,6CAA6C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EACvF,OAAO,CAAC,UAAU,IAAI,SAAS,EAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CACpB,CAAC;IACJ,CAAC;IAGD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/nestjs/auth/org-authority-observations.d.ts

@@ -0,0 +1,15 @@
+import type { OrgAuthorityCallerFacts } from './org-authority';
+export declare const ORG_AUTHORITY_OBSERVATION_LIMIT = 512;
+export interface OrgAuthorityObservation extends OrgAuthorityCallerFacts {
+    readonly count: number;
+    readonly firstSeenAt: string;
+}
+export interface OrgAuthorityCensus {
+    readonly observations: readonly OrgAuthorityObservation[];
+    readonly droppedByLimit: number;
+}
+export declare const UNKNOWN_CLIENT_ID = "<unknown>";
+export declare function recordUnprovenOrgAuthority(facts: OrgAuthorityCallerFacts): boolean;
+export declare function orgAuthorityCensus(): OrgAuthorityCensus;
+export declare function resetOrgAuthorityCensus(): void;
+//# sourceMappingURL=org-authority-observations.d.ts.map

package/dist/nestjs/auth/org-authority-observations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority-observations.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority-observations.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAO/D,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAGnD,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IAEtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAM1D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAWD,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAmB7C,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAiBT;AAGD,wBAAgB,kBAAkB,IAAI,kBAAkB,CAKvD;AAMD,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C"}

package/dist/nestjs/auth/org-authority-observations.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = void 0;
+exports.recordUnprovenOrgAuthority = recordUnprovenOrgAuthority;
+exports.orgAuthorityCensus = orgAuthorityCensus;
+exports.resetOrgAuthorityCensus = resetOrgAuthorityCensus;
+exports.ORG_AUTHORITY_OBSERVATION_LIMIT = 512;
+const observations = new Map();
+let droppedByLimit = 0;
+exports.UNKNOWN_CLIENT_ID = '<unknown>';
+function keyFor(facts) {
+    return [
+        facts.clientId,
+        facts.tokenClass,
+        facts.subjectKind,
+        facts.delegated ? 'delegated' : 'direct',
+    ].join('|');
+}
+function recordUnprovenOrgAuthority(facts) {
+    const key = keyFor(facts);
+    const existing = observations.get(key);
+    if (existing) {
+        existing.count += 1;
+        return false;
+    }
+    if (observations.size >= exports.ORG_AUTHORITY_OBSERVATION_LIMIT) {
+        droppedByLimit += 1;
+        return false;
+    }
+    observations.set(key, {
+        ...facts,
+        count: 1,
+        firstSeenAt: new Date().toISOString(),
+    });
+    return true;
+}
+function orgAuthorityCensus() {
+    return {
+        observations: [...observations.values()].map((entry) => ({ ...entry })),
+        droppedByLimit,
+    };
+}
+function resetOrgAuthorityCensus() {
+    observations.clear();
+    droppedByLimit = 0;
+}
+//# sourceMappingURL=org-authority-observations.js.map

package/dist/nestjs/auth/org-authority-observations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority-observations.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority-observations.ts"],"names":[],"mappings":";;;AAwFA,gEAmBC;AAGD,gDAKC;AAMD,0DAGC;AArFY,QAAA,+BAA+B,GAAG,GAAG,CAAC;AA0BnD,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;AAC3D,IAAI,cAAc,GAAG,CAAC,CAAC;AAGV,QAAA,iBAAiB,GAAG,WAAW,CAAC;AAE7C,SAAS,MAAM,CAAC,KAA8B;IAC5C,OAAO;QACL,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;KACzC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAUD,SAAgB,0BAA0B,CACxC,KAA8B;IAE9B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,IAAI,uCAA+B,EAAE,CAAC;QACzD,cAAc,IAAI,CAAC,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;QACpB,GAAG,KAAK;QACR,KAAK,EAAE,CAAC;QACR,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAgB,kBAAkB;IAChC,OAAO;QACL,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACvE,cAAc;KACf,CAAC;AACJ,CAAC;AAMD,SAAgB,uBAAuB;IACrC,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,cAAc,GAAG,CAAC,CAAC;AACrB,CAAC"}

package/dist/nestjs/auth/org-authority.d.ts

@@ -0,0 +1,32 @@
+import type { SubjectKind, TokenClass } from '@xemahq/kernel-contracts/subject';
+export declare enum OrgAuthoritySource {
+    OrgClaim = "org_claim",
+    OrgMembership = "org_membership",
+    NoOrgAsserted = "no_org_asserted",
+    ClaimMismatch = "claim_mismatch",
+    Unproven = "unproven_header"
+}
+export interface OrgAuthorityVerdict {
+    readonly source: OrgAuthoritySource;
+    readonly assertedOrgId: string;
+    readonly tokenOrgId?: string;
+}
+export declare function resolveOrgAuthority(claims: Record<string, unknown>, assertedOrgId: string): OrgAuthorityVerdict;
+export declare function isOrgAuthorityProven(verdict: OrgAuthorityVerdict): boolean;
+export declare function orgAuthorityRequiresProof(verdict: OrgAuthorityVerdict): boolean;
+export declare enum OrgAuthorityMode {
+    Observe = "observe",
+    Enforce = "enforce"
+}
+export declare const ORG_AUTHORITY_MODE_ENV = "XEMA_ORG_AUTHORITY_MODE";
+export declare class InvalidOrgAuthorityModeError extends Error {
+    constructor(value: string);
+}
+export declare function resolveOrgAuthorityMode(env?: NodeJS.ProcessEnv): OrgAuthorityMode;
+export interface OrgAuthorityCallerFacts {
+    readonly clientId: string;
+    readonly tokenClass: TokenClass;
+    readonly subjectKind: SubjectKind;
+    readonly delegated: boolean;
+}
+//# sourceMappingURL=org-authority.d.ts.map

package/dist/nestjs/auth/org-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAahF,oBAAY,kBAAkB;IAE5B,QAAQ,cAAc;IAEtB,aAAa,mBAAmB;IAKhC,aAAa,oBAAoB;IAYjC,aAAa,mBAAmB;IAKhC,QAAQ,oBAAoB;CAC7B;AAGD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAEpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAO/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAYD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,aAAa,EAAE,MAAM,GACpB,mBAAmB,CAuCrB;AAGD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAU1E;AAUD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAUT;AAiBD,oBAAY,gBAAgB;IAE1B,OAAO,YAAY;IAEnB,OAAO,YAAY;CACpB;AAGD,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAGhE,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,KAAK,EAAE,MAAM;CAO1B;AAYD,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,CAelB;AAQD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B"}

package/dist/nestjs/auth/org-authority.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidOrgAuthorityModeError = exports.ORG_AUTHORITY_MODE_ENV = exports.OrgAuthorityMode = exports.OrgAuthoritySource = void 0;
+exports.resolveOrgAuthority = resolveOrgAuthority;
+exports.isOrgAuthorityProven = isOrgAuthorityProven;
+exports.orgAuthorityRequiresProof = orgAuthorityRequiresProof;
+exports.resolveOrgAuthorityMode = resolveOrgAuthorityMode;
+const org_claim_1 = require("./org-claim");
+const org_role_1 = require("./org-role");
+var OrgAuthoritySource;
+(function (OrgAuthoritySource) {
+    OrgAuthoritySource["OrgClaim"] = "org_claim";
+    OrgAuthoritySource["OrgMembership"] = "org_membership";
+    OrgAuthoritySource["NoOrgAsserted"] = "no_org_asserted";
+    OrgAuthoritySource["ClaimMismatch"] = "claim_mismatch";
+    OrgAuthoritySource["Unproven"] = "unproven_header";
+})(OrgAuthoritySource || (exports.OrgAuthoritySource = OrgAuthoritySource = {}));
+function resolveOrgAuthority(claims, assertedOrgId) {
+    const asserted = assertedOrgId.trim();
+    if (asserted.length === 0) {
+        return {
+            source: OrgAuthoritySource.NoOrgAsserted,
+            assertedOrgId: '',
+        };
+    }
+    const claim = (0, org_claim_1.resolveOrgClaim)(claims);
+    if (claim) {
+        return claim.value.toLowerCase() === asserted.toLowerCase()
+            ? {
+                source: OrgAuthoritySource.OrgClaim,
+                assertedOrgId: asserted,
+                tokenOrgId: claim.value,
+            }
+            : {
+                source: OrgAuthoritySource.ClaimMismatch,
+                assertedOrgId: asserted,
+                tokenOrgId: claim.value,
+            };
+    }
+    const orgRoles = (0, org_role_1.resolveOrgRoles)(claims);
+    const assertedLower = asserted.toLowerCase();
+    for (const memberOrgId of Object.keys(orgRoles)) {
+        if (memberOrgId.toLowerCase() === assertedLower) {
+            return {
+                source: OrgAuthoritySource.OrgMembership,
+                assertedOrgId: asserted,
+            };
+        }
+    }
+    return { source: OrgAuthoritySource.Unproven, assertedOrgId: asserted };
+}
+function isOrgAuthorityProven(verdict) {
+    switch (verdict.source) {
+        case OrgAuthoritySource.OrgClaim:
+        case OrgAuthoritySource.OrgMembership:
+            return true;
+        case OrgAuthoritySource.NoOrgAsserted:
+        case OrgAuthoritySource.ClaimMismatch:
+        case OrgAuthoritySource.Unproven:
+            return false;
+    }
+}
+function orgAuthorityRequiresProof(verdict) {
+    switch (verdict.source) {
+        case OrgAuthoritySource.Unproven:
+            return true;
+        case OrgAuthoritySource.OrgClaim:
+        case OrgAuthoritySource.OrgMembership:
+        case OrgAuthoritySource.NoOrgAsserted:
+        case OrgAuthoritySource.ClaimMismatch:
+            return false;
+    }
+}
+var OrgAuthorityMode;
+(function (OrgAuthorityMode) {
+    OrgAuthorityMode["Observe"] = "observe";
+    OrgAuthorityMode["Enforce"] = "enforce";
+})(OrgAuthorityMode || (exports.OrgAuthorityMode = OrgAuthorityMode = {}));
+exports.ORG_AUTHORITY_MODE_ENV = 'XEMA_ORG_AUTHORITY_MODE';
+class InvalidOrgAuthorityModeError extends Error {
+    constructor(value) {
+        super(`${exports.ORG_AUTHORITY_MODE_ENV}="${value}" is not a valid org-authority mode. ` +
+            `Expected one of: ${Object.values(OrgAuthorityMode).join(', ')}. ` +
+            `Leave it unset for "${OrgAuthorityMode.Observe}".`);
+    }
+}
+exports.InvalidOrgAuthorityModeError = InvalidOrgAuthorityModeError;
+function resolveOrgAuthorityMode(env = process.env) {
+    const raw = env[exports.ORG_AUTHORITY_MODE_ENV];
+    if (raw === undefined || raw.trim().length === 0) {
+        return OrgAuthorityMode.Observe;
+    }
+    const normalized = raw.trim().toLowerCase();
+    const matched = Object.values(OrgAuthorityMode).includes(normalized)
+        ? normalized
+        : undefined;
+    if (!matched) {
+        throw new InvalidOrgAuthorityModeError(raw);
+    }
+    return matched;
+}
+//# sourceMappingURL=org-authority.js.map

package/dist/nestjs/auth/org-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority.ts"],"names":[],"mappings":";;;AAkHA,kDA0CC;AAGD,oDAUC;AAUD,8DAYC;AAgDD,0DAiBC;AA/MD,2CAA8C;AAC9C,yCAA6C;AAU7C,IAAY,kBA2BX;AA3BD,WAAY,kBAAkB;IAE5B,4CAAsB,CAAA;IAEtB,sDAAgC,CAAA;IAKhC,uDAAiC,CAAA;IAYjC,sDAAgC,CAAA;IAKhC,kDAA4B,CAAA;AAC9B,CAAC,EA3BW,kBAAkB,kCAAlB,kBAAkB,QA2B7B;AA2BD,SAAgB,mBAAmB,CACjC,MAA+B,EAC/B,aAAqB;IAErB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;YACxC,aAAa,EAAE,EAAE;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;YACzD,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,QAAQ;gBACnC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB,CAAC;IACR,CAAC;IAKD,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7C,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;YAChD,OAAO;gBACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAGD,SAAgB,oBAAoB,CAAC,OAA4B;IAC/D,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAUD,SAAgB,yBAAyB,CACvC,OAA4B;IAE5B,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAiBD,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAE1B,uCAAmB,CAAA;IAEnB,uCAAmB,CAAA;AACrB,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAGY,QAAA,sBAAsB,GAAG,yBAAyB,CAAC;AAGhE,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,KAAa;QACvB,KAAK,CACH,GAAG,8BAAsB,KAAK,KAAK,uCAAuC;YACxE,oBAAoB,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAClE,uBAAuB,gBAAgB,CAAC,OAAO,IAAI,CACtD,CAAC;IACJ,CAAC;CACF;AARD,oEAQC;AAYD,SAAgB,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,8BAAsB,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,gBAAgB,CAAC,OAAO,CAAC;IAClC,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAc,CAAC,QAAQ,CACpE,UAAU,CACX;QACC,CAAC,CAAE,UAA+B;QAClC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/nestjs/auth/org-claim.d.ts

@@ -0,0 +1,12 @@
+export declare enum OrgClaimKey {
+    Canonical = "xema_org_id"
+}
+export declare const ORG_CLAIM_KEYS: readonly OrgClaimKey[];
+export declare enum OrgHeaderName {
+    Canonical = "X-Xema-Org-Id"
+}
+export declare function resolveOrgClaim(claims: Record<string, unknown>): {
+    key: OrgClaimKey;
+    value: string;
+} | null;
+//# sourceMappingURL=org-claim.d.ts.map

package/dist/nestjs/auth/org-claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-claim.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-claim.ts"],"names":[],"mappings":"AA8BA,oBAAY,WAAW;IAErB,SAAS,gBAAgB;CAC1B;AAOD,eAAO,MAAM,cAAc,EAAE,SAAS,WAAW,EAEvC,CAAC;AAQX,oBAAY,aAAa;IAEvB,SAAS,kBAAkB;CAC5B;AAUD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ5C"}

package/dist/nestjs/auth/org-claim.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgHeaderName = exports.ORG_CLAIM_KEYS = exports.OrgClaimKey = void 0;
+exports.resolveOrgClaim = resolveOrgClaim;
+var OrgClaimKey;
+(function (OrgClaimKey) {
+    OrgClaimKey["Canonical"] = "xema_org_id";
+})(OrgClaimKey || (exports.OrgClaimKey = OrgClaimKey = {}));
+exports.ORG_CLAIM_KEYS = [
+    OrgClaimKey.Canonical,
+];
+var OrgHeaderName;
+(function (OrgHeaderName) {
+    OrgHeaderName["Canonical"] = "X-Xema-Org-Id";
+})(OrgHeaderName || (exports.OrgHeaderName = OrgHeaderName = {}));
+function resolveOrgClaim(claims) {
+    for (const key of exports.ORG_CLAIM_KEYS) {
+        const raw = claims[key];
+        if (typeof raw === 'string' && raw.length > 0) {
+            return { key, value: raw };
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=org-claim.js.map

package/dist/nestjs/auth/org-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-claim.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-claim.ts"],"names":[],"mappings":";;;AA+DA,0CAUC;AA3CD,IAAY,WAGX;AAHD,WAAY,WAAW;IAErB,wCAAyB,CAAA;AAC3B,CAAC,EAHW,WAAW,2BAAX,WAAW,QAGtB;AAOY,QAAA,cAAc,GAA2B;IACpD,WAAW,CAAC,SAAS;CACb,CAAC;AAQX,IAAY,aAGX;AAHD,WAAY,aAAa;IAEvB,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,6BAAb,aAAa,QAGxB;AAUD,SAAgB,eAAe,CAC7B,MAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,sBAAc,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/nestjs/auth/org-role.d.ts

@@ -0,0 +1,13 @@
+export declare enum OrgRolesClaimKey {
+    Canonical = "org_roles"
+}
+export declare const ORG_ROLES_CLAIM_KEYS: readonly OrgRolesClaimKey[];
+export declare enum OrgRole {
+    Owner = "org_owner",
+    Admin = "org_admin",
+    Member = "org_member"
+}
+export declare function resolveOrgRoles(claims: Record<string, unknown>): Record<string, OrgRole>;
+export declare function resolveOrgRoleForOrg(claims: Record<string, unknown>, orgId: string): OrgRole | null;
+export declare function orgRoleSatisfies(actual: OrgRole | null | undefined, required: OrgRole): boolean;
+//# sourceMappingURL=org-role.d.ts.map

package/dist/nestjs/auth/org-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-role.ts"],"names":[],"mappings":"AAoCA,oBAAY,gBAAgB;IAE1B,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,gBAAgB,EAElD,CAAC;AASX,oBAAY,OAAO;IACjB,KAAK,cAAc;IACnB,KAAK,cAAc;IACnB,MAAM,eAAe;CACtB;AA2BD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazB;AAMD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,MAAM,GACZ,OAAO,GAAG,IAAI,CAGhB;AAOD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EAClC,QAAQ,EAAE,OAAO,GAChB,OAAO,CAGT"}

package/dist/nestjs/auth/org-role.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgRole = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = void 0;
+exports.resolveOrgRoles = resolveOrgRoles;
+exports.resolveOrgRoleForOrg = resolveOrgRoleForOrg;
+exports.orgRoleSatisfies = orgRoleSatisfies;
+var OrgRolesClaimKey;
+(function (OrgRolesClaimKey) {
+    OrgRolesClaimKey["Canonical"] = "org_roles";
+})(OrgRolesClaimKey || (exports.OrgRolesClaimKey = OrgRolesClaimKey = {}));
+exports.ORG_ROLES_CLAIM_KEYS = [
+    OrgRolesClaimKey.Canonical,
+];
+var OrgRole;
+(function (OrgRole) {
+    OrgRole["Owner"] = "org_owner";
+    OrgRole["Admin"] = "org_admin";
+    OrgRole["Member"] = "org_member";
+})(OrgRole || (exports.OrgRole = OrgRole = {}));
+const ORG_ROLE_RANK = {
+    [OrgRole.Owner]: 3,
+    [OrgRole.Admin]: 2,
+    [OrgRole.Member]: 1,
+};
+function isOrgRole(value) {
+    return (typeof value === 'string' &&
+        Object.values(OrgRole).includes(value));
+}
+function resolveOrgRoles(claims) {
+    for (const key of exports.ORG_ROLES_CLAIM_KEYS) {
+        const parsed = coerceClaimObject(claims[key]);
+        if (!parsed)
+            continue;
+        const out = {};
+        for (const [orgId, role] of Object.entries(parsed)) {
+            if (orgId.length > 0 && isOrgRole(role)) {
+                out[orgId] = role;
+            }
+        }
+        return out;
+    }
+    return {};
+}
+function resolveOrgRoleForOrg(claims, orgId) {
+    if (!orgId)
+        return null;
+    return resolveOrgRoles(claims)[orgId] ?? null;
+}
+function orgRoleSatisfies(actual, required) {
+    if (!actual)
+        return false;
+    return ORG_ROLE_RANK[actual] >= ORG_ROLE_RANK[required];
+}
+function coerceClaimObject(raw) {
+    let value = raw;
+    if (Array.isArray(value)) {
+        value = value.length === 1 ? value[0] : undefined;
+    }
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        if (trimmed.length === 0)
+            return null;
+        try {
+            value = JSON.parse(trimmed);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+//# sourceMappingURL=org-role.js.map

package/dist/nestjs/auth/org-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-role.ts"],"names":[],"mappings":";;;AAmFA,0CAeC;AAMD,oDAMC;AAOD,4CAMC;AAvFD,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAE1B,2CAAuB,CAAA;AACzB,CAAC,EAHW,gBAAgB,gCAAhB,gBAAgB,QAG3B;AAEY,QAAA,oBAAoB,GAAgC;IAC/D,gBAAgB,CAAC,SAAS;CAClB,CAAC;AASX,IAAY,OAIX;AAJD,WAAY,OAAO;IACjB,8BAAmB,CAAA;IACnB,8BAAmB,CAAA;IACnB,gCAAqB,CAAA;AACvB,CAAC,EAJW,OAAO,uBAAP,OAAO,QAIlB;AAOD,MAAM,aAAa,GAA4B;IAC7C,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;CACpB,CAAC;AAEF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;AACJ,CAAC;AASD,SAAgB,eAAe,CAC7B,MAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,4BAAoB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAMD,SAAgB,oBAAoB,CAClC,MAA+B,EAC/B,KAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAOD,SAAgB,gBAAgB,CAC9B,MAAkC,EAClC,QAAiB;IAEjB,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAQD,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAgC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}