@xemahq/platform-common 0.14.1 → 0.15.0

package/dist/lib/redaction/redaction.service.js

@@ -1,110 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var RedactionService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RedactionService = void 0;
-const common_1 = require("@nestjs/common");
-const default_rules_1 = require("./default-rules");
-const DISABLED_RULES_ENV = 'REDACTION_DISABLED_RULES';
-let RedactionService = RedactionService_1 = class RedactionService {
-    rules;
-    constructor() {
-        const disabled = parseDisabledRules(process.env[DISABLED_RULES_ENV]);
-        this.rules = default_rules_1.DEFAULT_REDACTION_RULES.filter((r) => !disabled.has(r.name));
-    }
-    static withRules(rules) {
-        const svc = Object.create(RedactionService_1.prototype);
-        const disabled = parseDisabledRules(process.env[DISABLED_RULES_ENV]);
-        svc.rules = rules.filter((r) => !disabled.has(r.name));
-        return svc;
-    }
-    redact(value) {
-        return this.walk(value, undefined, new WeakSet());
-    }
-    walk(value, key, seen) {
-        if (key !== undefined) {
-            for (const rule of this.rules) {
-                if (rule.fieldName && rule.fieldName.test(key)) {
-                    return rule.replacement;
-                }
-            }
-        }
-        if (typeof value === 'string') {
-            return applyStringRules(value, this.rules);
-        }
-        if (Array.isArray(value)) {
-            if (seen.has(value)) {
-                return '[redacted-cycle]';
-            }
-            seen.add(value);
-            let mutated = false;
-            const next = new Array(value.length);
-            for (let i = 0; i < value.length; i++) {
-                const v = value[i];
-                const w = this.walk(v, undefined, seen);
-                if (w !== v) {
-                    mutated = true;
-                }
-                next[i] = w;
-            }
-            seen.delete(value);
-            return mutated ? next : value;
-        }
-        if (value !== null && typeof value === 'object') {
-            if (seen.has(value)) {
-                return '[redacted-cycle]';
-            }
-            seen.add(value);
-            const record = value;
-            let mutated = false;
-            const out = {};
-            for (const k of Object.keys(record)) {
-                const v = record[k];
-                const w = this.walk(v, k, seen);
-                if (w !== v) {
-                    mutated = true;
-                }
-                out[k] = w;
-            }
-            seen.delete(value);
-            return mutated ? out : value;
-        }
-        return value;
-    }
-};
-exports.RedactionService = RedactionService;
-exports.RedactionService = RedactionService = RedactionService_1 = __decorate([
-    (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [])
-], RedactionService);
-function applyStringRules(value, rules) {
-    let current = value;
-    for (const rule of rules) {
-        if (!rule.stringPattern) {
-            continue;
-        }
-        if (rule.stringPattern.test(current)) {
-            const regex = new RegExp(rule.stringPattern.source, rule.stringPattern.flags);
-            current = current.replace(regex, rule.replacement);
-        }
-    }
-    return current;
-}
-function parseDisabledRules(raw) {
-    if (!raw) {
-        return new Set();
-    }
-    return new Set(raw
-        .split(',')
-        .map((s) => s.trim())
-        .filter((s) => s.length > 0));
-}
-//# sourceMappingURL=redaction.service.js.map

package/dist/lib/redaction/redaction.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redaction.service.js","sourceRoot":"","sources":["../../../src/lib/redaction/redaction.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAA4C;AAE5C,mDAA0D;AAS1D,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAe/C,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IACV,KAAK,CAA2B;IAQjD;QACE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,GAAG,uCAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAA+B;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAgB,CAAC,SAAS,CAAqB,CAAC;QAC1E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACpE,GAAsD,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7B,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IAGD,MAAM,CAAI,KAAQ;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,OAAO,EAAE,CAAM,CAAC;IACzD,CAAC;IAEO,IAAI,CAAC,KAAc,EAAE,GAAuB,EAAE,IAAqB;QAGzE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,OAAO,IAAI,CAAC,WAAW,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,IAAI,GAAc,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACZ,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,EAAE,CAAC;gBAC9B,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACZ,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACb,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAjFY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;;GACA,gBAAgB,CAiF5B;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAA+B;IACtE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAIrC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9E,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CACZ,GAAG;SACA,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC"}

package/dist/lib/to-prisma-json.d.ts

@@ -1,6 +0,0 @@
-import type { ZodType } from 'zod';
-export declare function toPrismaJson<T>(schema: ZodType<T>, value: T, context?: {
-    workItemId?: string;
-    hint?: string;
-}): unknown;
-//# sourceMappingURL=to-prisma-json.d.ts.map

package/dist/lib/to-prisma-json.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"to-prisma-json.d.ts","sourceRoot":"","sources":["../../src/lib/to-prisma-json.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAmBnC,wBAAgB,YAAY,CAAC,CAAC,EAC5B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,KAAK,EAAE,CAAC,EACR,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACnD,OAAO,CAYT"}

package/dist/lib/to-prisma-json.js

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.toPrismaJson = toPrismaJson;
-const pipeline_errors_1 = require("./errors/pipeline-errors");
-function toPrismaJson(schema, value, context = {}) {
-    const parsed = schema.safeParse(value);
-    if (!parsed.success) {
-        throw new pipeline_errors_1.WorkItemPayloadInvalidError(`Work-item payload failed schema validation${context.hint ? ` (${context.hint})` : ''}`, context.workItemId ?? 'unknown', parsed.error.issues);
-    }
-    return structuredClone(parsed.data);
-}
-//# sourceMappingURL=to-prisma-json.js.map

package/dist/lib/to-prisma-json.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"to-prisma-json.js","sourceRoot":"","sources":["../../src/lib/to-prisma-json.ts"],"names":[],"mappings":";;AAwCA,oCAgBC;AAlCD,8DAAuE;AAkBvE,SAAgB,YAAY,CAC1B,MAAkB,EAClB,KAAQ,EACR,UAAkD,EAAE;IAEpD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,6CAA2B,CACnC,6CAA6C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EACvF,OAAO,CAAC,UAAU,IAAI,SAAS,EAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CACpB,CAAC;IACJ,CAAC;IAGD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/lib/tool-usage-counter.d.ts

@@ -1,20 +0,0 @@
-export declare const TOOL_USAGE_KEY_PREFIX = "xema:mcp:tool-usage";
-export declare const TOOL_USAGE_TTL_SECONDS: number;
-export declare function buildToolUsageKey(input: {
-    orgId: string;
-    sessionId: string;
-    mcpServiceSlug: string;
-    command: string;
-}): string;
-export declare function buildToolUsageSessionScanPattern(input: {
-    orgId: string;
-    sessionId: string;
-}): string;
-export interface ParsedToolUsageKey {
-    readonly orgId: string;
-    readonly sessionId: string;
-    readonly mcpServiceSlug: string;
-    readonly command: string;
-}
-export declare function parseToolUsageKey(key: string): ParsedToolUsageKey | null;
-//# sourceMappingURL=tool-usage-counter.d.ts.map

package/dist/lib/tool-usage-counter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool-usage-counter.d.ts","sourceRoot":"","sources":["../../src/lib/tool-usage-counter.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAS3D,eAAO,MAAM,sBAAsB,QAAoB,CAAC;AAMxD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAeT;AAMD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAST;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAkBD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAaxE"}

package/dist/lib/tool-usage-counter.js

@@ -1,50 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TOOL_USAGE_TTL_SECONDS = exports.TOOL_USAGE_KEY_PREFIX = void 0;
-exports.buildToolUsageKey = buildToolUsageKey;
-exports.buildToolUsageSessionScanPattern = buildToolUsageSessionScanPattern;
-exports.parseToolUsageKey = parseToolUsageKey;
-exports.TOOL_USAGE_KEY_PREFIX = 'xema:mcp:tool-usage';
-exports.TOOL_USAGE_TTL_SECONDS = 30 * 24 * 60 * 60;
-function buildToolUsageKey(input) {
-    const { orgId, sessionId, mcpServiceSlug, command } = input;
-    if (!orgId) {
-        throw new Error('buildToolUsageKey: orgId is required');
-    }
-    if (!sessionId) {
-        throw new Error('buildToolUsageKey: sessionId is required');
-    }
-    if (!mcpServiceSlug) {
-        throw new Error('buildToolUsageKey: mcpServiceSlug is required');
-    }
-    if (!command) {
-        throw new Error('buildToolUsageKey: command is required');
-    }
-    return `${exports.TOOL_USAGE_KEY_PREFIX}:${orgId}:${sessionId}:${mcpServiceSlug}:${command}`;
-}
-function buildToolUsageSessionScanPattern(input) {
-    const { orgId, sessionId } = input;
-    if (!orgId) {
-        throw new Error('buildToolUsageSessionScanPattern: orgId is required');
-    }
-    if (!sessionId) {
-        throw new Error('buildToolUsageSessionScanPattern: sessionId is required');
-    }
-    return `${exports.TOOL_USAGE_KEY_PREFIX}:${orgId}:${sessionId}:*:*`;
-}
-function parseToolUsageKey(key) {
-    const parts = key.split(':');
-    if (parts.length < 7)
-        return null;
-    if (parts[0] !== 'xema' || parts[1] !== 'mcp' || parts[2] !== 'tool-usage') {
-        return null;
-    }
-    const orgId = parts[3];
-    const sessionId = parts[4];
-    const command = parts[parts.length - 1];
-    const mcpServiceSlug = parts.slice(5, parts.length - 1).join(':');
-    if (!orgId || !sessionId || !mcpServiceSlug || !command)
-        return null;
-    return { orgId, sessionId, mcpServiceSlug, command };
-}
-//# sourceMappingURL=tool-usage-counter.js.map

package/dist/lib/tool-usage-counter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool-usage-counter.js","sourceRoot":"","sources":["../../src/lib/tool-usage-counter.ts"],"names":[],"mappings":";;;AA2CA,8CAoBC;AAMD,4EAYC;AAyBD,8CAaC;AA3FY,QAAA,qBAAqB,GAAG,qBAAqB,CAAC;AAS9C,QAAA,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAMxD,SAAgB,iBAAiB,CAAC,KAKjC;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,6BAAqB,IAAI,KAAK,IAAI,SAAS,IAAI,cAAc,IAAI,OAAO,EAAE,CAAC;AACvF,CAAC;AAMD,SAAgB,gCAAgC,CAAC,KAGhD;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,6BAAqB,IAAI,KAAK,IAAI,SAAS,MAAM,CAAC;AAC9D,CAAC;AAyBD,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC"}

package/dist/lib/write-policy.d.ts

@@ -1,30 +0,0 @@
-export interface WritePolicyContext {
-    allowedPageSlugs: string[];
-    allowedPageSlugPrefixes: string[];
-    allowedParentPageId: string | null;
-    allowedBacklogParent: string | null;
-    backlogMode: 'canonical' | 'proposal';
-    backlogCanonicalPrerequisites?: {
-        parentPredetermined: boolean;
-        ownershipClear: boolean;
-        duplicateDetectionDeterministic: boolean;
-    };
-    coordinatorOwned: boolean;
-    memoryWriteAllowed: boolean;
-    createPagesDisabled: boolean;
-    editOnlyPageSlugs: string[];
-    authorizedWritePaths: string[];
-    authorizedReadPaths: string[];
-}
-export declare function parseWritePolicy(headerValue: string | undefined): WritePolicyContext;
-export declare function validatePageSlugWrite(policy: WritePolicyContext, slug: string): string | null;
-export declare function validateParentPageWrite(policy: WritePolicyContext, parentPageId: string | null | undefined): string | null;
-export declare function validateMemoryWrite(policy: WritePolicyContext): string | null;
-export declare function validateBacklogWrite(policy: WritePolicyContext): {
-    allowed: true;
-    mode: 'canonical' | 'proposal';
-} | {
-    allowed: false;
-    reason: string;
-};
-//# sourceMappingURL=write-policy.d.ts.map

package/dist/lib/write-policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"write-policy.d.ts","sourceRoot":"","sources":["../../src/lib/write-policy.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,WAAW,EAAE,WAAW,GAAG,UAAU,CAAC;IACtC,6BAA6B,CAAC,EAAE;QAC9B,mBAAmB,EAAE,OAAO,CAAC;QAC7B,cAAc,EAAE,OAAO,CAAC;QACxB,+BAA+B,EAAE,OAAO,CAAC;KAC1C,CAAC;IACF,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAaD,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,kBAAkB,CAWpB;AAMD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAQf;AAOD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,EAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,MAAM,GAAG,IAAI,CASf;AAKD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,GACzB,MAAM,GAAG,IAAI,CAMf;AAKD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,GACzB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,UAAU,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CASxF"}

package/dist/lib/write-policy.js

@@ -1,54 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseWritePolicy = parseWritePolicy;
-exports.validatePageSlugWrite = validatePageSlugWrite;
-exports.validateParentPageWrite = validateParentPageWrite;
-exports.validateMemoryWrite = validateMemoryWrite;
-exports.validateBacklogWrite = validateBacklogWrite;
-const pipeline_errors_1 = require("./errors/pipeline-errors");
-function parseWritePolicy(headerValue) {
-    if (!headerValue) {
-        throw new pipeline_errors_1.MissingWritePolicyError();
-    }
-    try {
-        return JSON.parse(headerValue);
-    }
-    catch (err) {
-        throw new Error(`Malformed X-Write-Policy header — expected JSON-encoded WritePolicyContext. ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
-function validatePageSlugWrite(policy, slug) {
-    if (policy.allowedPageSlugs.includes(slug))
-        return null;
-    for (const prefix of policy.allowedPageSlugPrefixes) {
-        if (slug.startsWith(prefix))
-            return null;
-    }
-    return `Write policy violation: page slug "${slug}" is not in the allowed set. Allowed slugs: [${policy.allowedPageSlugs.join(', ')}], allowed prefixes: [${policy.allowedPageSlugPrefixes.join(', ')}]`;
-}
-function validateParentPageWrite(policy, parentPageId) {
-    if (!policy.allowedParentPageId)
-        return null;
-    if (!parentPageId)
-        return null;
-    if (parentPageId !== policy.allowedParentPageId) {
-        return `Write policy violation: parent page "${parentPageId}" is not the allowed parent "${policy.allowedParentPageId}"`;
-    }
-    return null;
-}
-function validateMemoryWrite(policy) {
-    if (!policy.memoryWriteAllowed) {
-        return 'Write policy violation: memory writes are not allowed for this agent.';
-    }
-    return null;
-}
-function validateBacklogWrite(policy) {
-    if (policy.backlogMode === 'proposal') {
-        return {
-            allowed: false,
-            reason: 'Write policy violation: backlog is in proposal mode — emit backlog proposals in your structured output instead of calling create_item directly.',
-        };
-    }
-    return { allowed: true, mode: policy.backlogMode };
-}
-//# sourceMappingURL=write-policy.js.map

package/dist/lib/write-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"write-policy.js","sourceRoot":"","sources":["../../src/lib/write-policy.ts"],"names":[],"mappings":";;AAkDA,4CAaC;AAMD,sDAWC;AAOD,0DAYC;AAKD,kDAQC;AAKD,oDAWC;AA9GD,8DAAmE;AAgCnE,SAAgB,gBAAgB,CAC9B,WAA+B;IAE/B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,yCAAuB,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAuB,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,+EAA+E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClI,CAAC;IACJ,CAAC;AACH,CAAC;AAMD,SAAgB,qBAAqB,CACnC,MAA0B,EAC1B,IAAY;IAEZ,IAAI,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAExD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IAED,OAAO,sCAAsC,IAAI,gDAAgD,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC3M,CAAC;AAOD,SAAgB,uBAAuB,CACrC,MAA0B,EAC1B,YAAuC;IAEvC,IAAI,CAAC,MAAM,CAAC,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,IAAI,YAAY,KAAK,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,wCAAwC,YAAY,gCAAgC,MAAM,CAAC,mBAAmB,GAAG,CAAC;IAC3H,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAKD,SAAgB,mBAAmB,CACjC,MAA0B;IAE1B,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,uEAAuE,CAAC;IACjF,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAKD,SAAgB,oBAAoB,CAClC,MAA0B;IAE1B,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,iJAAiJ;SAC1J,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AACrD,CAAC"}

package/dist/nestjs/auth/org-authority-observations.d.ts

@@ -1,15 +0,0 @@
-import type { OrgAuthorityCallerFacts } from './org-authority';
-export declare const ORG_AUTHORITY_OBSERVATION_LIMIT = 512;
-export interface OrgAuthorityObservation extends OrgAuthorityCallerFacts {
-    readonly count: number;
-    readonly firstSeenAt: string;
-}
-export interface OrgAuthorityCensus {
-    readonly observations: readonly OrgAuthorityObservation[];
-    readonly droppedByLimit: number;
-}
-export declare const UNKNOWN_CLIENT_ID = "<unknown>";
-export declare function recordUnprovenOrgAuthority(facts: OrgAuthorityCallerFacts): boolean;
-export declare function orgAuthorityCensus(): OrgAuthorityCensus;
-export declare function resetOrgAuthorityCensus(): void;
-//# sourceMappingURL=org-authority-observations.d.ts.map

package/dist/nestjs/auth/org-authority-observations.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-authority-observations.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority-observations.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAO/D,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAGnD,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IAEtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAM1D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAWD,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAmB7C,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAiBT;AAGD,wBAAgB,kBAAkB,IAAI,kBAAkB,CAKvD;AAMD,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C"}

package/dist/nestjs/auth/org-authority-observations.js

@@ -1,47 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = void 0;
-exports.recordUnprovenOrgAuthority = recordUnprovenOrgAuthority;
-exports.orgAuthorityCensus = orgAuthorityCensus;
-exports.resetOrgAuthorityCensus = resetOrgAuthorityCensus;
-exports.ORG_AUTHORITY_OBSERVATION_LIMIT = 512;
-const observations = new Map();
-let droppedByLimit = 0;
-exports.UNKNOWN_CLIENT_ID = '<unknown>';
-function keyFor(facts) {
-    return [
-        facts.clientId,
-        facts.tokenClass,
-        facts.subjectKind,
-        facts.delegated ? 'delegated' : 'direct',
-    ].join('|');
-}
-function recordUnprovenOrgAuthority(facts) {
-    const key = keyFor(facts);
-    const existing = observations.get(key);
-    if (existing) {
-        existing.count += 1;
-        return false;
-    }
-    if (observations.size >= exports.ORG_AUTHORITY_OBSERVATION_LIMIT) {
-        droppedByLimit += 1;
-        return false;
-    }
-    observations.set(key, {
-        ...facts,
-        count: 1,
-        firstSeenAt: new Date().toISOString(),
-    });
-    return true;
-}
-function orgAuthorityCensus() {
-    return {
-        observations: [...observations.values()].map((entry) => ({ ...entry })),
-        droppedByLimit,
-    };
-}
-function resetOrgAuthorityCensus() {
-    observations.clear();
-    droppedByLimit = 0;
-}
-//# sourceMappingURL=org-authority-observations.js.map

package/dist/nestjs/auth/org-authority-observations.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-authority-observations.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority-observations.ts"],"names":[],"mappings":";;;AAwFA,gEAmBC;AAGD,gDAKC;AAMD,0DAGC;AArFY,QAAA,+BAA+B,GAAG,GAAG,CAAC;AA0BnD,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;AAC3D,IAAI,cAAc,GAAG,CAAC,CAAC;AAGV,QAAA,iBAAiB,GAAG,WAAW,CAAC;AAE7C,SAAS,MAAM,CAAC,KAA8B;IAC5C,OAAO;QACL,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;KACzC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAUD,SAAgB,0BAA0B,CACxC,KAA8B;IAE9B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,IAAI,uCAA+B,EAAE,CAAC;QACzD,cAAc,IAAI,CAAC,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;QACpB,GAAG,KAAK;QACR,KAAK,EAAE,CAAC;QACR,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAgB,kBAAkB;IAChC,OAAO;QACL,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACvE,cAAc;KACf,CAAC;AACJ,CAAC;AAMD,SAAgB,uBAAuB;IACrC,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,cAAc,GAAG,CAAC,CAAC;AACrB,CAAC"}

package/dist/nestjs/auth/org-authority.d.ts

@@ -1,32 +0,0 @@
-import type { SubjectKind, TokenClass } from '@xemahq/kernel-contracts/subject';
-export declare enum OrgAuthoritySource {
-    OrgClaim = "org_claim",
-    OrgMembership = "org_membership",
-    NoOrgAsserted = "no_org_asserted",
-    ClaimMismatch = "claim_mismatch",
-    Unproven = "unproven_header"
-}
-export interface OrgAuthorityVerdict {
-    readonly source: OrgAuthoritySource;
-    readonly assertedOrgId: string;
-    readonly tokenOrgId?: string;
-}
-export declare function resolveOrgAuthority(claims: Record<string, unknown>, assertedOrgId: string): OrgAuthorityVerdict;
-export declare function isOrgAuthorityProven(verdict: OrgAuthorityVerdict): boolean;
-export declare function orgAuthorityRequiresProof(verdict: OrgAuthorityVerdict): boolean;
-export declare enum OrgAuthorityMode {
-    Observe = "observe",
-    Enforce = "enforce"
-}
-export declare const ORG_AUTHORITY_MODE_ENV = "XEMA_ORG_AUTHORITY_MODE";
-export declare class InvalidOrgAuthorityModeError extends Error {
-    constructor(value: string);
-}
-export declare function resolveOrgAuthorityMode(env?: NodeJS.ProcessEnv): OrgAuthorityMode;
-export interface OrgAuthorityCallerFacts {
-    readonly clientId: string;
-    readonly tokenClass: TokenClass;
-    readonly subjectKind: SubjectKind;
-    readonly delegated: boolean;
-}
-//# sourceMappingURL=org-authority.d.ts.map

package/dist/nestjs/auth/org-authority.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-authority.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAahF,oBAAY,kBAAkB;IAE5B,QAAQ,cAAc;IAEtB,aAAa,mBAAmB;IAKhC,aAAa,oBAAoB;IAYjC,aAAa,mBAAmB;IAKhC,QAAQ,oBAAoB;CAC7B;AAGD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAEpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAO/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAYD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,aAAa,EAAE,MAAM,GACpB,mBAAmB,CAuCrB;AAGD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAU1E;AAUD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAUT;AAiBD,oBAAY,gBAAgB;IAE1B,OAAO,YAAY;IAEnB,OAAO,YAAY;CACpB;AAGD,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAGhE,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,KAAK,EAAE,MAAM;CAO1B;AAYD,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,CAelB;AAQD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B"}

package/dist/nestjs/auth/org-authority.js

@@ -1,102 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidOrgAuthorityModeError = exports.ORG_AUTHORITY_MODE_ENV = exports.OrgAuthorityMode = exports.OrgAuthoritySource = void 0;
-exports.resolveOrgAuthority = resolveOrgAuthority;
-exports.isOrgAuthorityProven = isOrgAuthorityProven;
-exports.orgAuthorityRequiresProof = orgAuthorityRequiresProof;
-exports.resolveOrgAuthorityMode = resolveOrgAuthorityMode;
-const org_claim_1 = require("./org-claim");
-const org_role_1 = require("./org-role");
-var OrgAuthoritySource;
-(function (OrgAuthoritySource) {
-    OrgAuthoritySource["OrgClaim"] = "org_claim";
-    OrgAuthoritySource["OrgMembership"] = "org_membership";
-    OrgAuthoritySource["NoOrgAsserted"] = "no_org_asserted";
-    OrgAuthoritySource["ClaimMismatch"] = "claim_mismatch";
-    OrgAuthoritySource["Unproven"] = "unproven_header";
-})(OrgAuthoritySource || (exports.OrgAuthoritySource = OrgAuthoritySource = {}));
-function resolveOrgAuthority(claims, assertedOrgId) {
-    const asserted = assertedOrgId.trim();
-    if (asserted.length === 0) {
-        return {
-            source: OrgAuthoritySource.NoOrgAsserted,
-            assertedOrgId: '',
-        };
-    }
-    const claim = (0, org_claim_1.resolveOrgClaim)(claims);
-    if (claim) {
-        return claim.value.toLowerCase() === asserted.toLowerCase()
-            ? {
-                source: OrgAuthoritySource.OrgClaim,
-                assertedOrgId: asserted,
-                tokenOrgId: claim.value,
-            }
-            : {
-                source: OrgAuthoritySource.ClaimMismatch,
-                assertedOrgId: asserted,
-                tokenOrgId: claim.value,
-            };
-    }
-    const orgRoles = (0, org_role_1.resolveOrgRoles)(claims);
-    const assertedLower = asserted.toLowerCase();
-    for (const memberOrgId of Object.keys(orgRoles)) {
-        if (memberOrgId.toLowerCase() === assertedLower) {
-            return {
-                source: OrgAuthoritySource.OrgMembership,
-                assertedOrgId: asserted,
-            };
-        }
-    }
-    return { source: OrgAuthoritySource.Unproven, assertedOrgId: asserted };
-}
-function isOrgAuthorityProven(verdict) {
-    switch (verdict.source) {
-        case OrgAuthoritySource.OrgClaim:
-        case OrgAuthoritySource.OrgMembership:
-            return true;
-        case OrgAuthoritySource.NoOrgAsserted:
-        case OrgAuthoritySource.ClaimMismatch:
-        case OrgAuthoritySource.Unproven:
-            return false;
-    }
-}
-function orgAuthorityRequiresProof(verdict) {
-    switch (verdict.source) {
-        case OrgAuthoritySource.Unproven:
-            return true;
-        case OrgAuthoritySource.OrgClaim:
-        case OrgAuthoritySource.OrgMembership:
-        case OrgAuthoritySource.NoOrgAsserted:
-        case OrgAuthoritySource.ClaimMismatch:
-            return false;
-    }
-}
-var OrgAuthorityMode;
-(function (OrgAuthorityMode) {
-    OrgAuthorityMode["Observe"] = "observe";
-    OrgAuthorityMode["Enforce"] = "enforce";
-})(OrgAuthorityMode || (exports.OrgAuthorityMode = OrgAuthorityMode = {}));
-exports.ORG_AUTHORITY_MODE_ENV = 'XEMA_ORG_AUTHORITY_MODE';
-class InvalidOrgAuthorityModeError extends Error {
-    constructor(value) {
-        super(`${exports.ORG_AUTHORITY_MODE_ENV}="${value}" is not a valid org-authority mode. ` +
-            `Expected one of: ${Object.values(OrgAuthorityMode).join(', ')}. ` +
-            `Leave it unset for "${OrgAuthorityMode.Observe}".`);
-    }
-}
-exports.InvalidOrgAuthorityModeError = InvalidOrgAuthorityModeError;
-function resolveOrgAuthorityMode(env = process.env) {
-    const raw = env[exports.ORG_AUTHORITY_MODE_ENV];
-    if (raw === undefined || raw.trim().length === 0) {
-        return OrgAuthorityMode.Observe;
-    }
-    const normalized = raw.trim().toLowerCase();
-    const matched = Object.values(OrgAuthorityMode).includes(normalized)
-        ? normalized
-        : undefined;
-    if (!matched) {
-        throw new InvalidOrgAuthorityModeError(raw);
-    }
-    return matched;
-}
-//# sourceMappingURL=org-authority.js.map

package/dist/nestjs/auth/org-authority.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-authority.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority.ts"],"names":[],"mappings":";;;AAkHA,kDA0CC;AAGD,oDAUC;AAUD,8DAYC;AAgDD,0DAiBC;AA/MD,2CAA8C;AAC9C,yCAA6C;AAU7C,IAAY,kBA2BX;AA3BD,WAAY,kBAAkB;IAE5B,4CAAsB,CAAA;IAEtB,sDAAgC,CAAA;IAKhC,uDAAiC,CAAA;IAYjC,sDAAgC,CAAA;IAKhC,kDAA4B,CAAA;AAC9B,CAAC,EA3BW,kBAAkB,kCAAlB,kBAAkB,QA2B7B;AA2BD,SAAgB,mBAAmB,CACjC,MAA+B,EAC/B,aAAqB;IAErB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;YACxC,aAAa,EAAE,EAAE;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;YACzD,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,QAAQ;gBACnC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK;aACxB,CAAC;IACR,CAAC;IAKD,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7C,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;YAChD,OAAO;gBACL,MAAM,EAAE,kBAAkB,CAAC,aAAa;gBACxC,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAGD,SAAgB,oBAAoB,CAAC,OAA4B;IAC/D,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAUD,SAAgB,yBAAyB,CACvC,OAA4B;IAE5B,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,QAAQ;YAC9B,OAAO,IAAI,CAAC;QACd,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QACjC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAiBD,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAE1B,uCAAmB,CAAA;IAEnB,uCAAmB,CAAA;AACrB,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAGY,QAAA,sBAAsB,GAAG,yBAAyB,CAAC;AAGhE,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,KAAa;QACvB,KAAK,CACH,GAAG,8BAAsB,KAAK,KAAK,uCAAuC;YACxE,oBAAoB,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAClE,uBAAuB,gBAAgB,CAAC,OAAO,IAAI,CACtD,CAAC;IACJ,CAAC;CACF;AARD,oEAQC;AAYD,SAAgB,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,8BAAsB,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,gBAAgB,CAAC,OAAO,CAAC;IAClC,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAc,CAAC,QAAQ,CACpE,UAAU,CACX;QACC,CAAC,CAAE,UAA+B;QAClC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/nestjs/auth/org-claim.d.ts

@@ -1,12 +0,0 @@
-export declare enum OrgClaimKey {
-    Canonical = "xema_org_id"
-}
-export declare const ORG_CLAIM_KEYS: readonly OrgClaimKey[];
-export declare enum OrgHeaderName {
-    Canonical = "X-Xema-Org-Id"
-}
-export declare function resolveOrgClaim(claims: Record<string, unknown>): {
-    key: OrgClaimKey;
-    value: string;
-} | null;
-//# sourceMappingURL=org-claim.d.ts.map

package/dist/nestjs/auth/org-claim.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-claim.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-claim.ts"],"names":[],"mappings":"AA8BA,oBAAY,WAAW;IAErB,SAAS,gBAAgB;CAC1B;AAOD,eAAO,MAAM,cAAc,EAAE,SAAS,WAAW,EAEvC,CAAC;AAQX,oBAAY,aAAa;IAEvB,SAAS,kBAAkB;CAC5B;AAUD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ5C"}

package/dist/nestjs/auth/org-claim.js

@@ -1,25 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OrgHeaderName = exports.ORG_CLAIM_KEYS = exports.OrgClaimKey = void 0;
-exports.resolveOrgClaim = resolveOrgClaim;
-var OrgClaimKey;
-(function (OrgClaimKey) {
-    OrgClaimKey["Canonical"] = "xema_org_id";
-})(OrgClaimKey || (exports.OrgClaimKey = OrgClaimKey = {}));
-exports.ORG_CLAIM_KEYS = [
-    OrgClaimKey.Canonical,
-];
-var OrgHeaderName;
-(function (OrgHeaderName) {
-    OrgHeaderName["Canonical"] = "X-Xema-Org-Id";
-})(OrgHeaderName || (exports.OrgHeaderName = OrgHeaderName = {}));
-function resolveOrgClaim(claims) {
-    for (const key of exports.ORG_CLAIM_KEYS) {
-        const raw = claims[key];
-        if (typeof raw === 'string' && raw.length > 0) {
-            return { key, value: raw };
-        }
-    }
-    return null;
-}
-//# sourceMappingURL=org-claim.js.map

package/dist/nestjs/auth/org-claim.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-claim.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-claim.ts"],"names":[],"mappings":";;;AA+DA,0CAUC;AA3CD,IAAY,WAGX;AAHD,WAAY,WAAW;IAErB,wCAAyB,CAAA;AAC3B,CAAC,EAHW,WAAW,2BAAX,WAAW,QAGtB;AAOY,QAAA,cAAc,GAA2B;IACpD,WAAW,CAAC,SAAS;CACb,CAAC;AAQX,IAAY,aAGX;AAHD,WAAY,aAAa;IAEvB,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,6BAAb,aAAa,QAGxB;AAUD,SAAgB,eAAe,CAC7B,MAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,sBAAc,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/nestjs/auth/org-role.d.ts

@@ -1,13 +0,0 @@
-export declare enum OrgRolesClaimKey {
-    Canonical = "org_roles"
-}
-export declare const ORG_ROLES_CLAIM_KEYS: readonly OrgRolesClaimKey[];
-export declare enum OrgRole {
-    Owner = "org_owner",
-    Admin = "org_admin",
-    Member = "org_member"
-}
-export declare function resolveOrgRoles(claims: Record<string, unknown>): Record<string, OrgRole>;
-export declare function resolveOrgRoleForOrg(claims: Record<string, unknown>, orgId: string): OrgRole | null;
-export declare function orgRoleSatisfies(actual: OrgRole | null | undefined, required: OrgRole): boolean;
-//# sourceMappingURL=org-role.d.ts.map

package/dist/nestjs/auth/org-role.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-role.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-role.ts"],"names":[],"mappings":"AAoCA,oBAAY,gBAAgB;IAE1B,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,gBAAgB,EAElD,CAAC;AASX,oBAAY,OAAO;IACjB,KAAK,cAAc;IACnB,KAAK,cAAc;IACnB,MAAM,eAAe;CACtB;AA2BD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazB;AAMD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,MAAM,GACZ,OAAO,GAAG,IAAI,CAGhB;AAOD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EAClC,QAAQ,EAAE,OAAO,GAChB,OAAO,CAGT"}