@xemahq/platform-common 0.13.0 → 0.14.0

package/dist/lib/redaction/redaction.service.js

@@ -0,0 +1,110 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var RedactionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedactionService = void 0;
+const common_1 = require("@nestjs/common");
+const default_rules_1 = require("./default-rules");
+const DISABLED_RULES_ENV = 'REDACTION_DISABLED_RULES';
+let RedactionService = RedactionService_1 = class RedactionService {
+    rules;
+    constructor() {
+        const disabled = parseDisabledRules(process.env[DISABLED_RULES_ENV]);
+        this.rules = default_rules_1.DEFAULT_REDACTION_RULES.filter((r) => !disabled.has(r.name));
+    }
+    static withRules(rules) {
+        const svc = Object.create(RedactionService_1.prototype);
+        const disabled = parseDisabledRules(process.env[DISABLED_RULES_ENV]);
+        svc.rules = rules.filter((r) => !disabled.has(r.name));
+        return svc;
+    }
+    redact(value) {
+        return this.walk(value, undefined, new WeakSet());
+    }
+    walk(value, key, seen) {
+        if (key !== undefined) {
+            for (const rule of this.rules) {
+                if (rule.fieldName && rule.fieldName.test(key)) {
+                    return rule.replacement;
+                }
+            }
+        }
+        if (typeof value === 'string') {
+            return applyStringRules(value, this.rules);
+        }
+        if (Array.isArray(value)) {
+            if (seen.has(value)) {
+                return '[redacted-cycle]';
+            }
+            seen.add(value);
+            let mutated = false;
+            const next = new Array(value.length);
+            for (let i = 0; i < value.length; i++) {
+                const v = value[i];
+                const w = this.walk(v, undefined, seen);
+                if (w !== v) {
+                    mutated = true;
+                }
+                next[i] = w;
+            }
+            seen.delete(value);
+            return mutated ? next : value;
+        }
+        if (value !== null && typeof value === 'object') {
+            if (seen.has(value)) {
+                return '[redacted-cycle]';
+            }
+            seen.add(value);
+            const record = value;
+            let mutated = false;
+            const out = {};
+            for (const k of Object.keys(record)) {
+                const v = record[k];
+                const w = this.walk(v, k, seen);
+                if (w !== v) {
+                    mutated = true;
+                }
+                out[k] = w;
+            }
+            seen.delete(value);
+            return mutated ? out : value;
+        }
+        return value;
+    }
+};
+exports.RedactionService = RedactionService;
+exports.RedactionService = RedactionService = RedactionService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], RedactionService);
+function applyStringRules(value, rules) {
+    let current = value;
+    for (const rule of rules) {
+        if (!rule.stringPattern) {
+            continue;
+        }
+        if (rule.stringPattern.test(current)) {
+            const regex = new RegExp(rule.stringPattern.source, rule.stringPattern.flags);
+            current = current.replace(regex, rule.replacement);
+        }
+    }
+    return current;
+}
+function parseDisabledRules(raw) {
+    if (!raw) {
+        return new Set();
+    }
+    return new Set(raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0));
+}
+//# sourceMappingURL=redaction.service.js.map

package/dist/lib/redaction/redaction.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.service.js","sourceRoot":"","sources":["../../../src/lib/redaction/redaction.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAA4C;AAE5C,mDAA0D;AAS1D,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAe/C,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IACV,KAAK,CAA2B;IAQjD;QACE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,GAAG,uCAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAA+B;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAgB,CAAC,SAAS,CAAqB,CAAC;QAC1E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACpE,GAAsD,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7B,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IAGD,MAAM,CAAI,KAAQ;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,OAAO,EAAE,CAAM,CAAC;IACzD,CAAC;IAEO,IAAI,CAAC,KAAc,EAAE,GAAuB,EAAE,IAAqB;QAGzE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,OAAO,IAAI,CAAC,WAAW,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,IAAI,GAAc,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACZ,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,EAAE,CAAC;gBAC9B,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACZ,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACb,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAjFY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;;GACA,gBAAgB,CAiF5B;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAA+B;IACtE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAIrC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9E,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CACZ,GAAG;SACA,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC"}

package/dist/lib/to-prisma-json.d.ts

@@ -0,0 +1,6 @@
+import type { ZodType } from 'zod';
+export declare function toPrismaJson<T>(schema: ZodType<T>, value: T, context?: {
+    workItemId?: string;
+    hint?: string;
+}): unknown;
+//# sourceMappingURL=to-prisma-json.d.ts.map

package/dist/lib/to-prisma-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"to-prisma-json.d.ts","sourceRoot":"","sources":["../../src/lib/to-prisma-json.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAmBnC,wBAAgB,YAAY,CAAC,CAAC,EAC5B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,KAAK,EAAE,CAAC,EACR,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACnD,OAAO,CAYT"}

package/dist/lib/to-prisma-json.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPrismaJson = toPrismaJson;
+const pipeline_errors_1 = require("./errors/pipeline-errors");
+function toPrismaJson(schema, value, context = {}) {
+    const parsed = schema.safeParse(value);
+    if (!parsed.success) {
+        throw new pipeline_errors_1.WorkItemPayloadInvalidError(`Work-item payload failed schema validation${context.hint ? ` (${context.hint})` : ''}`, context.workItemId ?? 'unknown', parsed.error.issues);
+    }
+    return structuredClone(parsed.data);
+}
+//# sourceMappingURL=to-prisma-json.js.map

package/dist/lib/to-prisma-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"to-prisma-json.js","sourceRoot":"","sources":["../../src/lib/to-prisma-json.ts"],"names":[],"mappings":";;AAwCA,oCAgBC;AAlCD,8DAAuE;AAkBvE,SAAgB,YAAY,CAC1B,MAAkB,EAClB,KAAQ,EACR,UAAkD,EAAE;IAEpD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,6CAA2B,CACnC,6CAA6C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EACvF,OAAO,CAAC,UAAU,IAAI,SAAS,EAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CACpB,CAAC;IACJ,CAAC;IAGD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/lib/write-policy.d.ts

@@ -0,0 +1,30 @@
+export interface WritePolicyContext {
+    allowedPageSlugs: string[];
+    allowedPageSlugPrefixes: string[];
+    allowedParentPageId: string | null;
+    allowedBacklogParent: string | null;
+    backlogMode: 'canonical' | 'proposal';
+    backlogCanonicalPrerequisites?: {
+        parentPredetermined: boolean;
+        ownershipClear: boolean;
+        duplicateDetectionDeterministic: boolean;
+    };
+    coordinatorOwned: boolean;
+    memoryWriteAllowed: boolean;
+    createPagesDisabled: boolean;
+    editOnlyPageSlugs: string[];
+    authorizedWritePaths: string[];
+    authorizedReadPaths: string[];
+}
+export declare function parseWritePolicy(headerValue: string | undefined): WritePolicyContext;
+export declare function validatePageSlugWrite(policy: WritePolicyContext, slug: string): string | null;
+export declare function validateParentPageWrite(policy: WritePolicyContext, parentPageId: string | null | undefined): string | null;
+export declare function validateMemoryWrite(policy: WritePolicyContext): string | null;
+export declare function validateBacklogWrite(policy: WritePolicyContext): {
+    allowed: true;
+    mode: 'canonical' | 'proposal';
+} | {
+    allowed: false;
+    reason: string;
+};
+//# sourceMappingURL=write-policy.d.ts.map

package/dist/lib/write-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-policy.d.ts","sourceRoot":"","sources":["../../src/lib/write-policy.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,WAAW,EAAE,WAAW,GAAG,UAAU,CAAC;IACtC,6BAA6B,CAAC,EAAE;QAC9B,mBAAmB,EAAE,OAAO,CAAC;QAC7B,cAAc,EAAE,OAAO,CAAC;QACxB,+BAA+B,EAAE,OAAO,CAAC;KAC1C,CAAC;IACF,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAaD,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,kBAAkB,CAWpB;AAMD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAQf;AAOD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,EAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,MAAM,GAAG,IAAI,CASf;AAKD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,GACzB,MAAM,GAAG,IAAI,CAMf;AAKD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,GACzB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,UAAU,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CASxF"}

package/dist/lib/write-policy.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseWritePolicy = parseWritePolicy;
+exports.validatePageSlugWrite = validatePageSlugWrite;
+exports.validateParentPageWrite = validateParentPageWrite;
+exports.validateMemoryWrite = validateMemoryWrite;
+exports.validateBacklogWrite = validateBacklogWrite;
+const pipeline_errors_1 = require("./errors/pipeline-errors");
+function parseWritePolicy(headerValue) {
+    if (!headerValue) {
+        throw new pipeline_errors_1.MissingWritePolicyError();
+    }
+    try {
+        return JSON.parse(headerValue);
+    }
+    catch (err) {
+        throw new Error(`Malformed X-Write-Policy header — expected JSON-encoded WritePolicyContext. ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+function validatePageSlugWrite(policy, slug) {
+    if (policy.allowedPageSlugs.includes(slug))
+        return null;
+    for (const prefix of policy.allowedPageSlugPrefixes) {
+        if (slug.startsWith(prefix))
+            return null;
+    }
+    return `Write policy violation: page slug "${slug}" is not in the allowed set. Allowed slugs: [${policy.allowedPageSlugs.join(', ')}], allowed prefixes: [${policy.allowedPageSlugPrefixes.join(', ')}]`;
+}
+function validateParentPageWrite(policy, parentPageId) {
+    if (!policy.allowedParentPageId)
+        return null;
+    if (!parentPageId)
+        return null;
+    if (parentPageId !== policy.allowedParentPageId) {
+        return `Write policy violation: parent page "${parentPageId}" is not the allowed parent "${policy.allowedParentPageId}"`;
+    }
+    return null;
+}
+function validateMemoryWrite(policy) {
+    if (!policy.memoryWriteAllowed) {
+        return 'Write policy violation: memory writes are not allowed for this agent.';
+    }
+    return null;
+}
+function validateBacklogWrite(policy) {
+    if (policy.backlogMode === 'proposal') {
+        return {
+            allowed: false,
+            reason: 'Write policy violation: backlog is in proposal mode — emit backlog proposals in your structured output instead of calling create_item directly.',
+        };
+    }
+    return { allowed: true, mode: policy.backlogMode };
+}
+//# sourceMappingURL=write-policy.js.map

package/dist/lib/write-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-policy.js","sourceRoot":"","sources":["../../src/lib/write-policy.ts"],"names":[],"mappings":";;AAkDA,4CAaC;AAMD,sDAWC;AAOD,0DAYC;AAKD,kDAQC;AAKD,oDAWC;AA9GD,8DAAmE;AAgCnE,SAAgB,gBAAgB,CAC9B,WAA+B;IAE/B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,yCAAuB,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAuB,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,+EAA+E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClI,CAAC;IACJ,CAAC;AACH,CAAC;AAMD,SAAgB,qBAAqB,CACnC,MAA0B,EAC1B,IAAY;IAEZ,IAAI,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAExD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IAED,OAAO,sCAAsC,IAAI,gDAAgD,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC3M,CAAC;AAOD,SAAgB,uBAAuB,CACrC,MAA0B,EAC1B,YAAuC;IAEvC,IAAI,CAAC,MAAM,CAAC,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,IAAI,YAAY,KAAK,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,wCAAwC,YAAY,gCAAgC,MAAM,CAAC,mBAAmB,GAAG,CAAC;IAC3H,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAKD,SAAgB,mBAAmB,CACjC,MAA0B;IAE1B,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,uEAAuE,CAAC;IACjF,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAKD,SAAgB,oBAAoB,CAClC,MAA0B;IAE1B,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,iJAAiJ;SAC1J,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AACrD,CAAC"}

package/dist/nestjs/auth/org-authority-observations.d.ts

@@ -0,0 +1,15 @@
+import type { OrgAuthorityCallerFacts } from './org-authority';
+export declare const ORG_AUTHORITY_OBSERVATION_LIMIT = 512;
+export interface OrgAuthorityObservation extends OrgAuthorityCallerFacts {
+    readonly count: number;
+    readonly firstSeenAt: string;
+}
+export interface OrgAuthorityCensus {
+    readonly observations: readonly OrgAuthorityObservation[];
+    readonly droppedByLimit: number;
+}
+export declare const UNKNOWN_CLIENT_ID = "<unknown>";
+export declare function recordUnprovenOrgAuthority(facts: OrgAuthorityCallerFacts): boolean;
+export declare function orgAuthorityCensus(): OrgAuthorityCensus;
+export declare function resetOrgAuthorityCensus(): void;
+//# sourceMappingURL=org-authority-observations.d.ts.map

package/dist/nestjs/auth/org-authority-observations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority-observations.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority-observations.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAO/D,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAGnD,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IAEtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAM1D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAWD,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAmB7C,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAiBT;AAGD,wBAAgB,kBAAkB,IAAI,kBAAkB,CAKvD;AAMD,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C"}

package/dist/nestjs/auth/org-authority-observations.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = void 0;
+exports.recordUnprovenOrgAuthority = recordUnprovenOrgAuthority;
+exports.orgAuthorityCensus = orgAuthorityCensus;
+exports.resetOrgAuthorityCensus = resetOrgAuthorityCensus;
+exports.ORG_AUTHORITY_OBSERVATION_LIMIT = 512;
+const observations = new Map();
+let droppedByLimit = 0;
+exports.UNKNOWN_CLIENT_ID = '<unknown>';
+function keyFor(facts) {
+    return [
+        facts.clientId,
+        facts.tokenClass,
+        facts.subjectKind,
+        facts.delegated ? 'delegated' : 'direct',
+    ].join('|');
+}
+function recordUnprovenOrgAuthority(facts) {
+    const key = keyFor(facts);
+    const existing = observations.get(key);
+    if (existing) {
+        existing.count += 1;
+        return false;
+    }
+    if (observations.size >= exports.ORG_AUTHORITY_OBSERVATION_LIMIT) {
+        droppedByLimit += 1;
+        return false;
+    }
+    observations.set(key, {
+        ...facts,
+        count: 1,
+        firstSeenAt: new Date().toISOString(),
+    });
+    return true;
+}
+function orgAuthorityCensus() {
+    return {
+        observations: [...observations.values()].map((entry) => ({ ...entry })),
+        droppedByLimit,
+    };
+}
+function resetOrgAuthorityCensus() {
+    observations.clear();
+    droppedByLimit = 0;
+}
+//# sourceMappingURL=org-authority-observations.js.map

package/dist/nestjs/auth/org-authority-observations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority-observations.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority-observations.ts"],"names":[],"mappings":";;;AAwFA,gEAmBC;AAGD,gDAKC;AAMD,0DAGC;AArFY,QAAA,+BAA+B,GAAG,GAAG,CAAC;AA0BnD,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;AAC3D,IAAI,cAAc,GAAG,CAAC,CAAC;AAGV,QAAA,iBAAiB,GAAG,WAAW,CAAC;AAE7C,SAAS,MAAM,CAAC,KAA8B;IAC5C,OAAO;QACL,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;KACzC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAUD,SAAgB,0BAA0B,CACxC,KAA8B;IAE9B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,IAAI,uCAA+B,EAAE,CAAC;QACzD,cAAc,IAAI,CAAC,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;QACpB,GAAG,KAAK;QACR,KAAK,EAAE,CAAC;QACR,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAgB,kBAAkB;IAChC,OAAO;QACL,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACvE,cAAc;KACf,CAAC;AACJ,CAAC;AAMD,SAAgB,uBAAuB;IACrC,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,cAAc,GAAG,CAAC,CAAC;AACrB,CAAC"}

package/dist/nestjs/auth/org-authority.d.ts

@@ -0,0 +1,32 @@
+import type { SubjectKind, TokenClass } from '@xemahq/kernel-contracts/subject';
+export declare enum OrgAuthoritySource {
+    OrgClaim = "org_claim",
+    OrgMembership = "org_membership",
+    NoOrgAsserted = "no_org_asserted",
+    ClaimMismatch = "claim_mismatch",
+    Unproven = "unproven_header"
+}
+export interface OrgAuthorityVerdict {
+    readonly source: OrgAuthoritySource;
+    readonly assertedOrgId: string;
+    readonly tokenOrgId?: string;
+}
+export declare function resolveOrgAuthority(claims: Record<string, unknown>, assertedOrgId: string): OrgAuthorityVerdict;
+export declare function isOrgAuthorityProven(verdict: OrgAuthorityVerdict): boolean;
+export declare function orgAuthorityRequiresProof(verdict: OrgAuthorityVerdict): boolean;
+export declare enum OrgAuthorityMode {
+    Observe = "observe",
+    Enforce = "enforce"
+}
+export declare const ORG_AUTHORITY_MODE_ENV = "XEMA_ORG_AUTHORITY_MODE";
+export declare class InvalidOrgAuthorityModeError extends Error {
+    constructor(value: string);
+}
+export declare function resolveOrgAuthorityMode(env?: NodeJS.ProcessEnv): OrgAuthorityMode;
+export interface OrgAuthorityCallerFacts {
+    readonly clientId: string;
+    readonly tokenClass: TokenClass;
+    readonly subjectKind: SubjectKind;
+    readonly delegated: boolean;
+}
+//# sourceMappingURL=org-authority.d.ts.map

package/dist/nestjs/auth/org-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAahF,oBAAY,kBAAkB;IAE5B,QAAQ,cAAc;IAEtB,aAAa,mBAAmB;IAKhC,aAAa,oBAAoB;IAYjC,aAAa,mBAAmB;IAKhC,QAAQ,oBAAoB;CAC7B;AAGD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAEpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAO/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAYD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,aAAa,EAAE,MAAM,GACpB,mBAAmB,CAuCrB;AAGD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAU1E;AAUD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAUT;AAiBD,oBAAY,gBAAgB;IAE1B,OAAO,YAAY;IAEnB,OAAO,YAAY;CACpB;AAGD,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAGhE,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,KAAK,EAAE,MAAM;CAO1B;AAYD,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,CAelB;AAQD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B"}

package/dist/nestjs/auth/org-authority.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidOrgAuthorityModeError = exports.ORG_AUTHORITY_MODE_ENV = exports.OrgAuthorityMode = exports.OrgAuthoritySource = void 0;
+exports.resolveOrgAuthority = resolveOrgAuthority;
+exports.isOrgAuthorityProven = isOrgAuthorityProven;
+exports.orgAuthorityRequiresProof = orgAuthorityRequiresProof;
+exports.resolveOrgAuthorityMode = resolveOrgAuthorityMode;
+const org_claim_1 = require("./org-claim");
+const org_role_1 = require("./org-role");
+var OrgAuthoritySource;
+(function (OrgAuthoritySource) {
+    OrgAuthoritySource["OrgClaim"] = "org_claim";
+    OrgAuthoritySource["OrgMembership"] = "org_membership";
+    OrgAuthoritySource["NoOrgAsserted"] = "no_org_asserted";
+    OrgAuthoritySource["ClaimMismatch"] = "claim_mismatch";
+    OrgAuthoritySource["Unproven"] = "unproven_header";
+})(OrgAuthoritySource || (exports.OrgAuthoritySource = OrgAuthoritySource = {}));
+function resolveOrgAuthority(claims, assertedOrgId) {
+    const asserted = assertedOrgId.trim();
+    if (asserted.length === 0) {
+        return {
+            source: OrgAuthoritySource.NoOrgAsserted,
+            assertedOrgId: '',
+        };
+    }
+    const claim = (0, org_claim_1.resolveOrgClaim)(claims);
+    if (claim) {
+        return claim.value.toLowerCase() === asserted.toLowerCase()
+            ? {
+                source: OrgAuthoritySource.OrgClaim,
+                assertedOrgId: asserted,
+                tokenOrgId: claim.value,
+            }
+            : {
+                source: OrgAuthoritySource.ClaimMismatch,
+                assertedOrgId: asserted,
+                tokenOrgId: claim.value,
+            };
+    }
+    const orgRoles = (0, org_role_1.resolveOrgRoles)(claims);
+    const assertedLower = asserted.toLowerCase();
+    for (const memberOrgId of Object.keys(orgRoles)) {
+        if (memberOrgId.toLowerCase() === assertedLower) {
+            return {
+                source: OrgAuthoritySource.OrgMembership,
+                assertedOrgId: asserted,
+            };
+        }
+    }
+    return { source: OrgAuthoritySource.Unproven, assertedOrgId: asserted };
+}
+function isOrgAuthorityProven(verdict) {
+    switch (verdict.source) {
+        case OrgAuthoritySource.OrgClaim:
+        case OrgAuthoritySource.OrgMembership:
+            return true;
+        case OrgAuthoritySource.NoOrgAsserted:
+        case OrgAuthoritySource.ClaimMismatch:
+        case OrgAuthoritySource.Unproven:
+            return false;
+    }
+}
+function orgAuthorityRequiresProof(verdict) {
+    switch (verdict.source) {
+        case OrgAuthoritySource.Unproven:
+            return true;
+        case OrgAuthoritySource.OrgClaim:
+        case OrgAuthoritySource.OrgMembership:
+        case OrgAuthoritySource.NoOrgAsserted:
+        case OrgAuthoritySource.ClaimMismatch:
+            return false;
+    }
+}
+var OrgAuthorityMode;
+(function (OrgAuthorityMode) {
+    OrgAuthorityMode["Observe"] = "observe";
+    OrgAuthorityMode["Enforce"] = "enforce";
+})(OrgAuthorityMode || (exports.OrgAuthorityMode = OrgAuthorityMode = {}));
+exports.ORG_AUTHORITY_MODE_ENV = 'XEMA_ORG_AUTHORITY_MODE';
+class InvalidOrgAuthorityModeError extends Error {
+    constructor(value) {
+        super(`${exports.ORG_AUTHORITY_MODE_ENV}="${value}" is not a valid org-authority mode. ` +
+            `Expected one of: ${Object.values(OrgAuthorityMode).join(', ')}. ` +
+            `Leave it unset for "${OrgAuthorityMode.Observe}".`);
+    }
+}
+exports.InvalidOrgAuthorityModeError = InvalidOrgAuthorityModeError;
+function resolveOrgAuthorityMode(env = process.env) {
+    const raw = env[exports.ORG_AUTHORITY_MODE_ENV];
+    if (raw === undefined || raw.trim().length === 0) {
+        return OrgAuthorityMode.Observe;
+    }
+    const normalized = raw.trim().toLowerCase();
+    const matched = Object.values(OrgAuthorityMode).includes(normalized)
+        ? normalized
+        : undefined;
+    if (!matched) {
+        throw new InvalidOrgAuthorityModeError(raw);
+    }
+    return matched;
+}
+//# sourceMappingURL=org-authority.js.map

package/dist/nestjs/auth/org-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority.ts"],"names":[],"mappings":";;;AAkHA,kDA0CC;AAGD,oDAUC;AAUD,8DAYC;AAgDD,0DAiBC;AA/MD,2CAA8C;AAC9C,yCAA6C;AAU7C,IAAY,kBA2BX;AA3BD,WAAY,kBAAkB;IAE5B,4CAAsB,CAAA;IAEtB,sDAAgC,CAAA;IAKhC,uDAAiC,CAAA;IAYjC,sDAAgC,CAAA;IAKhC,kDAA4B,CAAA;AAC9B,CAAC,EA3BW,kBAAkB,kCAAlB,kBAAkB,QA2B7B;AA2BD,SAAgB,mBAAmB,CACjC,MAA+B,EAC/B,aAAqB;IAErB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;YACxC,aAAa,EAAE,EAAE;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;YACzD,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,QAAQ;gBACnC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB,CAAC;IACR,CAAC;IAKD,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7C,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;YAChD,OAAO;gBACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAGD,SAAgB,oBAAoB,CAAC,OAA4B;IAC/D,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAUD,SAAgB,yBAAyB,CACvC,OAA4B;IAE5B,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAiBD,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAE1B,uCAAmB,CAAA;IAEnB,uCAAmB,CAAA;AACrB,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAGY,QAAA,sBAAsB,GAAG,yBAAyB,CAAC;AAGhE,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,KAAa;QACvB,KAAK,CACH,GAAG,8BAAsB,KAAK,KAAK,uCAAuC;YACxE,oBAAoB,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAClE,uBAAuB,gBAAgB,CAAC,OAAO,IAAI,CACtD,CAAC;IACJ,CAAC;CACF;AARD,oEAQC;AAYD,SAAgB,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,8BAAsB,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,gBAAgB,CAAC,OAAO,CAAC;IAClC,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAc,CAAC,QAAQ,CACpE,UAAU,CACX;QACC,CAAC,CAAE,UAA+B;QAClC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/nestjs/auth/org-claim.d.ts

@@ -0,0 +1,12 @@
+export declare enum OrgClaimKey {
+    Canonical = "xema_org_id"
+}
+export declare const ORG_CLAIM_KEYS: readonly OrgClaimKey[];
+export declare enum OrgHeaderName {
+    Canonical = "X-Xema-Org-Id"
+}
+export declare function resolveOrgClaim(claims: Record<string, unknown>): {
+    key: OrgClaimKey;
+    value: string;
+} | null;
+//# sourceMappingURL=org-claim.d.ts.map

package/dist/nestjs/auth/org-claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-claim.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-claim.ts"],"names":[],"mappings":"AA8BA,oBAAY,WAAW;IAErB,SAAS,gBAAgB;CAC1B;AAOD,eAAO,MAAM,cAAc,EAAE,SAAS,WAAW,EAEvC,CAAC;AAQX,oBAAY,aAAa;IAEvB,SAAS,kBAAkB;CAC5B;AAUD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ5C"}

package/dist/nestjs/auth/org-claim.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgHeaderName = exports.ORG_CLAIM_KEYS = exports.OrgClaimKey = void 0;
+exports.resolveOrgClaim = resolveOrgClaim;
+var OrgClaimKey;
+(function (OrgClaimKey) {
+    OrgClaimKey["Canonical"] = "xema_org_id";
+})(OrgClaimKey || (exports.OrgClaimKey = OrgClaimKey = {}));
+exports.ORG_CLAIM_KEYS = [
+    OrgClaimKey.Canonical,
+];
+var OrgHeaderName;
+(function (OrgHeaderName) {
+    OrgHeaderName["Canonical"] = "X-Xema-Org-Id";
+})(OrgHeaderName || (exports.OrgHeaderName = OrgHeaderName = {}));
+function resolveOrgClaim(claims) {
+    for (const key of exports.ORG_CLAIM_KEYS) {
+        const raw = claims[key];
+        if (typeof raw === 'string' && raw.length > 0) {
+            return { key, value: raw };
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=org-claim.js.map

package/dist/nestjs/auth/org-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-claim.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-claim.ts"],"names":[],"mappings":";;;AA+DA,0CAUC;AA3CD,IAAY,WAGX;AAHD,WAAY,WAAW;IAErB,wCAAyB,CAAA;AAC3B,CAAC,EAHW,WAAW,2BAAX,WAAW,QAGtB;AAOY,QAAA,cAAc,GAA2B;IACpD,WAAW,CAAC,SAAS;CACb,CAAC;AAQX,IAAY,aAGX;AAHD,WAAY,aAAa;IAEvB,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,6BAAb,aAAa,QAGxB;AAUD,SAAgB,eAAe,CAC7B,MAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,sBAAc,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/nestjs/auth/org-role.d.ts

@@ -0,0 +1,13 @@
+export declare enum OrgRolesClaimKey {
+    Canonical = "org_roles"
+}
+export declare const ORG_ROLES_CLAIM_KEYS: readonly OrgRolesClaimKey[];
+export declare enum OrgRole {
+    Owner = "org_owner",
+    Admin = "org_admin",
+    Member = "org_member"
+}
+export declare function resolveOrgRoles(claims: Record<string, unknown>): Record<string, OrgRole>;
+export declare function resolveOrgRoleForOrg(claims: Record<string, unknown>, orgId: string): OrgRole | null;
+export declare function orgRoleSatisfies(actual: OrgRole | null | undefined, required: OrgRole): boolean;
+//# sourceMappingURL=org-role.d.ts.map

package/dist/nestjs/auth/org-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-role.ts"],"names":[],"mappings":"AAoCA,oBAAY,gBAAgB;IAE1B,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,gBAAgB,EAElD,CAAC;AASX,oBAAY,OAAO;IACjB,KAAK,cAAc;IACnB,KAAK,cAAc;IACnB,MAAM,eAAe;CACtB;AA2BD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazB;AAMD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,MAAM,GACZ,OAAO,GAAG,IAAI,CAGhB;AAOD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EAClC,QAAQ,EAAE,OAAO,GAChB,OAAO,CAGT"}

package/dist/nestjs/auth/org-role.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgRole = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = void 0;
+exports.resolveOrgRoles = resolveOrgRoles;
+exports.resolveOrgRoleForOrg = resolveOrgRoleForOrg;
+exports.orgRoleSatisfies = orgRoleSatisfies;
+var OrgRolesClaimKey;
+(function (OrgRolesClaimKey) {
+    OrgRolesClaimKey["Canonical"] = "org_roles";
+})(OrgRolesClaimKey || (exports.OrgRolesClaimKey = OrgRolesClaimKey = {}));
+exports.ORG_ROLES_CLAIM_KEYS = [
+    OrgRolesClaimKey.Canonical,
+];
+var OrgRole;
+(function (OrgRole) {
+    OrgRole["Owner"] = "org_owner";
+    OrgRole["Admin"] = "org_admin";
+    OrgRole["Member"] = "org_member";
+})(OrgRole || (exports.OrgRole = OrgRole = {}));
+const ORG_ROLE_RANK = {
+    [OrgRole.Owner]: 3,
+    [OrgRole.Admin]: 2,
+    [OrgRole.Member]: 1,
+};
+function isOrgRole(value) {
+    return (typeof value === 'string' &&
+        Object.values(OrgRole).includes(value));
+}
+function resolveOrgRoles(claims) {
+    for (const key of exports.ORG_ROLES_CLAIM_KEYS) {
+        const parsed = coerceClaimObject(claims[key]);
+        if (!parsed)
+            continue;
+        const out = {};
+        for (const [orgId, role] of Object.entries(parsed)) {
+            if (orgId.length > 0 && isOrgRole(role)) {
+                out[orgId] = role;
+            }
+        }
+        return out;
+    }
+    return {};
+}
+function resolveOrgRoleForOrg(claims, orgId) {
+    if (!orgId)
+        return null;
+    return resolveOrgRoles(claims)[orgId] ?? null;
+}
+function orgRoleSatisfies(actual, required) {
+    if (!actual)
+        return false;
+    return ORG_ROLE_RANK[actual] >= ORG_ROLE_RANK[required];
+}
+function coerceClaimObject(raw) {
+    let value = raw;
+    if (Array.isArray(value)) {
+        value = value.length === 1 ? value[0] : undefined;
+    }
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        if (trimmed.length === 0)
+            return null;
+        try {
+            value = JSON.parse(trimmed);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+//# sourceMappingURL=org-role.js.map

package/dist/nestjs/auth/org-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-role.ts"],"names":[],"mappings":";;;AAmFA,0CAeC;AAMD,oDAMC;AAOD,4CAMC;AAvFD,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAE1B,2CAAuB,CAAA;AACzB,CAAC,EAHW,gBAAgB,gCAAhB,gBAAgB,QAG3B;AAEY,QAAA,oBAAoB,GAAgC;IAC/D,gBAAgB,CAAC,SAAS;CAClB,CAAC;AASX,IAAY,OAIX;AAJD,WAAY,OAAO;IACjB,8BAAmB,CAAA;IACnB,8BAAmB,CAAA;IACnB,gCAAqB,CAAA;AACvB,CAAC,EAJW,OAAO,uBAAP,OAAO,QAIlB;AAOD,MAAM,aAAa,GAA4B;IAC7C,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;CACpB,CAAC;AAEF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;AACJ,CAAC;AASD,SAAgB,eAAe,CAC7B,MAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,4BAAoB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAMD,SAAgB,oBAAoB,CAClC,MAA+B,EAC/B,KAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAOD,SAAgB,gBAAgB,CAC9B,MAAkC,EAClC,QAAiB;IAEjB,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAQD,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAgC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/nestjs/auth/realm-token-verifier.d.ts

@@ -0,0 +1,30 @@
+import type { DecodedJwtHeader, DecodedJwtPayload, IssuerTenantResolver } from '@xemahq/oidc-guard';
+import type { AuthModuleOptions } from './auth-module-options';
+export interface MultiRealmKeySource {
+    readonly discoveryBaseUrls: string[];
+    readonly allowedRealms: string[];
+}
+export declare class RealmTokenVerifier {
+    private readonly options?;
+    private static readonly SINGLE_REALM_CACHE_KEY;
+    private readonly logger;
+    private readonly jwks;
+    private readonly issuerMetadata;
+    readonly tenantResolver: IssuerTenantResolver;
+    private readonly oidcVerifier;
+    private multiRealmConfig;
+    private resolvingConfig;
+    constructor(options?: AuthModuleOptions | undefined);
+    decode(token: string): {
+        header: DecodedJwtHeader;
+        payload: DecodedJwtPayload;
+    };
+    verify(token: string): Promise<DecodedJwtPayload>;
+    assertKeySourceResolvable(consumer: string): Promise<void>;
+    configuredIssuers(): string[];
+    private verifySingleRealm;
+    private resolveMultiRealmKeySource;
+    private resolveKeycloakBaseUrl;
+    private resolveAllowedRealms;
+}
+//# sourceMappingURL=realm-token-verifier.d.ts.map