@xemahq/platform-common 0.2.20 → 0.2.21

package/dist/nestjs/integration-webhooks/integration-webhook-envelope.dto.d.ts

@@ -1,6 +1,6 @@
-import { AdapterKey, ConnectorKind, WebhookEntityKind } from '../../lib/integration-webhooks';
+import { AdapterKey, WebhookEntityKind } from '../../lib/integration-webhooks';
 export declare class IntegrationWebhookEnvelopeDto<TPayload = unknown> {
-    provider: ConnectorKind;
+    provider: string;
     adapterKey: AdapterKey;
     event: string;
     entityKind: WebhookEntityKind;

package/dist/nestjs/integration-webhooks/integration-webhook-envelope.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration-webhook-envelope.dto.d.ts","sourceRoot":"","sources":["../../../src/nestjs/integration-webhooks/integration-webhook-envelope.dto.ts"],"names":[],"mappings":"AASA,OAAO,EACL,UAAU,EACV,aAAa,EACb,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAqBxC,qBAAa,6BAA6B,CAAC,QAAQ,GAAG,OAAO;IAQ3D,QAAQ,EAAG,aAAa,CAAC;IASzB,UAAU,EAAG,UAAU,CAAC;IAQxB,KAAK,EAAG,MAAM,CAAC;IAIf,UAAU,EAAG,iBAAiB,CAAC;IAQ/B,UAAU,EAAG,MAAM,CAAC;IAOpB,UAAU,EAAG,MAAM,CAAC;IAQpB,aAAa,EAAG,MAAM,CAAC;IASvB,UAAU,CAAC,EAAE,MAAM,CAAC;IASpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAK1B,OAAO,EAAG,QAAQ,CAAC;CACpB"}
+{"version":3,"file":"integration-webhook-envelope.dto.d.ts","sourceRoot":"","sources":["../../../src/nestjs/integration-webhooks/integration-webhook-envelope.dto.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,UAAU,EACV,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAqBxC,qBAAa,6BAA6B,CAAC,QAAQ,GAAG,OAAO;IAa3D,QAAQ,EAAG,MAAM,CAAC;IASlB,UAAU,EAAG,UAAU,CAAC;IAQxB,KAAK,EAAG,MAAM,CAAC;IAIf,UAAU,EAAG,iBAAiB,CAAC;IAQ/B,UAAU,EAAG,MAAM,CAAC;IAOpB,UAAU,EAAG,MAAM,CAAC;IAQpB,aAAa,EAAG,MAAM,CAAC;IASvB,UAAU,CAAC,EAAE,MAAM,CAAC;IASpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAK1B,OAAO,EAAG,QAAQ,CAAC;CACpB"}

package/dist/nestjs/integration-webhooks/integration-webhook-envelope.dto.js

@@ -28,12 +28,16 @@ class IntegrationWebhookEnvelopeDto {
 exports.IntegrationWebhookEnvelopeDto = IntegrationWebhookEnvelopeDto;
 __decorate([
     (0, swagger_1.ApiProperty)({
-        enum: integration_webhooks_1.ConnectorKind,
-        enumName: 'ConnectorKind',
-        description: 'External provider that emitted the webhook.',
-        example: integration_webhooks_1.ConnectorKind.GITHUB,
+        type: String,
+        description: 'Open provider key of the external provider that emitted the webhook. ' +
+            'Any curated ConnectorKind value (e.g. "GITHUB") OR a contributed ' +
+            'provider key (UPPER_SNAKE) is valid — validity is enforced at the ' +
+            'ingress seam by the connector registry (assertKnownConnectionProviderKey), ' +
+            'not by this DTO. See the H1 open-provider design.',
+        example: 'GITHUB',
     }),
-    (0, class_validator_1.IsEnum)(integration_webhooks_1.ConnectorKind),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
 ], IntegrationWebhookEnvelopeDto.prototype, "provider", void 0);
 __decorate([

package/dist/nestjs/integration-webhooks/integration-webhook-envelope.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"integration-webhook-envelope.dto.js","sourceRoot":"","sources":["../../../src/nestjs/integration-webhooks/integration-webhook-envelope.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,qDAMyB;AAEzB,yEAIwC;AAqBxC,MAAa,6BAA6B;IAQxC,QAAQ,CAAiB;IASzB,UAAU,CAAc;IAQxB,KAAK,CAAU;IAIf,UAAU,CAAqB;IAQ/B,UAAU,CAAU;IAOpB,UAAU,CAAU;IAQpB,aAAa,CAAU;IASvB,UAAU,CAAU;IASpB,gBAAgB,CAAU;IAK1B,OAAO,CAAY;CACpB;AA5ED,sEA4EC;AApEC;IAPC,IAAA,qBAAW,EAAC;QACX,IAAI,EAAE,oCAAa;QACnB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,oCAAa,CAAC,MAAM;KAC9B,CAAC;IACD,IAAA,wBAAM,EAAC,oCAAa,CAAC;;+DACG;AASzB;IADC,IAAA,wBAAM,EAAC,iCAAU,CAAC;;iEACK;AAQxB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,2HAA2H;QAC7H,OAAO,EAAE,kBAAkB;KAC5B,CAAC;IACD,IAAA,0BAAQ,GAAE;;4DACI;AAIf;IADC,IAAA,wBAAM,EAAC,wCAAiB,CAAC;;iEACK;AAQ/B;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,yHAAyH;QAC3H,OAAO,EAAE,sCAAsC;KAChD,CAAC;IACD,IAAA,0BAAQ,GAAE;;iEACS;AAOpB;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,0BAA0B;KACpC,CAAC;IACD,IAAA,2BAAS,GAAE;;iEACQ;AAQpB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,uFAAuF;QACzF,OAAO,EAAE,sCAAsC;KAChD,CAAC;IACD,IAAA,wBAAM,GAAE;;oEACc;AASvB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,4EAA4E;QAC9E,OAAO,EAAE,WAAW;KACrB,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;iEACS;AASpB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,gGAAgG;QAClG,OAAO,EAAE,cAAc;KACxB,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;uEACe"}
+{"version":3,"file":"integration-webhook-envelope.dto.js","sourceRoot":"","sources":["../../../src/nestjs/integration-webhooks/integration-webhook-envelope.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,qDAOyB;AAEzB,yEAGwC;AAqBxC,MAAa,6BAA6B;IAaxC,QAAQ,CAAU;IASlB,UAAU,CAAc;IAQxB,KAAK,CAAU;IAIf,UAAU,CAAqB;IAQ/B,UAAU,CAAU;IAOpB,UAAU,CAAU;IAQpB,aAAa,CAAU;IASvB,UAAU,CAAU;IASpB,gBAAgB,CAAU;IAK1B,OAAO,CAAY;CACpB;AAjFD,sEAiFC;AApEC;IAZC,IAAA,qBAAW,EAAC;QACX,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,uEAAuE;YACvE,mEAAmE;YACnE,oEAAoE;YACpE,6EAA6E;YAC7E,mDAAmD;QACrD,OAAO,EAAE,QAAQ;KAClB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+DACK;AASlB;IADC,IAAA,wBAAM,EAAC,iCAAU,CAAC;;iEACK;AAQxB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,2HAA2H;QAC7H,OAAO,EAAE,kBAAkB;KAC5B,CAAC;IACD,IAAA,0BAAQ,GAAE;;4DACI;AAIf;IADC,IAAA,wBAAM,EAAC,wCAAiB,CAAC;;iEACK;AAQ/B;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,yHAAyH;QAC3H,OAAO,EAAE,sCAAsC;KAChD,CAAC;IACD,IAAA,0BAAQ,GAAE;;iEACS;AAOpB;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,0BAA0B;KACpC,CAAC;IACD,IAAA,2BAAS,GAAE;;iEACQ;AAQpB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,uFAAuF;QACzF,OAAO,EAAE,sCAAsC;KAChD,CAAC;IACD,IAAA,wBAAM,GAAE;;oEACc;AASvB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,4EAA4E;QAC9E,OAAO,EAAE,WAAW;KACrB,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;iEACS;AASpB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,gGAAgG;QAClG,OAAO,EAAE,cAAc;KACxB,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;uEACe"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/platform-common",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "description": "Shared NestJS building blocks for Xema services — auth guards, response redaction, CORS configuration, and crypto helpers.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",

package/dist/nestjs/jwks/issuer-metadata-resolver.d.ts

@@ -1,7 +0,0 @@
-export declare class IssuerMetadataResolver {
-    private readonly cacheTtlMs;
-    private readonly cache;
-    constructor(cacheTtlMs?: number);
-    resolveJwksUri(discoveryUrl: string): Promise<string>;
-}
-//# sourceMappingURL=issuer-metadata-resolver.d.ts.map

package/dist/nestjs/jwks/issuer-metadata-resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"issuer-metadata-resolver.d.ts","sourceRoot":"","sources":["../../../src/nestjs/jwks/issuer-metadata-resolver.ts"],"names":[],"mappings":"AAuBA,qBAAa,sBAAsB;IAOrB,OAAO,CAAC,QAAQ,CAAC,UAAU;IANvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6D;gBAMtD,UAAU,GAAE,MAAkB;IAOrD,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAgC5D"}

package/dist/nestjs/jwks/issuer-metadata-resolver.js

@@ -1,36 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IssuerMetadataResolver = void 0;
-const jwks_verifier_1 = require("./jwks-verifier");
-class IssuerMetadataResolver {
-    cacheTtlMs;
-    cache = new Map();
-    constructor(cacheTtlMs = 3_600_000) {
-        this.cacheTtlMs = cacheTtlMs;
-    }
-    async resolveJwksUri(discoveryUrl) {
-        const cached = this.cache.get(discoveryUrl);
-        if (cached && Date.now() - cached.fetchedAt < this.cacheTtlMs) {
-            return cached.jwksUri;
-        }
-        let response;
-        try {
-            response = await fetch(discoveryUrl);
-        }
-        catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
-            throw new jwks_verifier_1.JwksVerificationError(`Failed to reach OIDC discovery endpoint ${discoveryUrl}: ${msg}`);
-        }
-        if (!response.ok) {
-            throw new jwks_verifier_1.JwksVerificationError(`Failed to fetch OIDC discovery from ${discoveryUrl}: ${response.status}`);
-        }
-        const doc = (await response.json());
-        if (typeof doc.jwks_uri !== 'string' || doc.jwks_uri.length === 0) {
-            throw new jwks_verifier_1.JwksVerificationError(`OIDC discovery at ${discoveryUrl} did not provide a jwks_uri`);
-        }
-        this.cache.set(discoveryUrl, { jwksUri: doc.jwks_uri, fetchedAt: Date.now() });
-        return doc.jwks_uri;
-    }
-}
-exports.IssuerMetadataResolver = IssuerMetadataResolver;
-//# sourceMappingURL=issuer-metadata-resolver.js.map

package/dist/nestjs/jwks/issuer-metadata-resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"issuer-metadata-resolver.js","sourceRoot":"","sources":["../../../src/nestjs/jwks/issuer-metadata-resolver.ts"],"names":[],"mappings":";;;AAAA,mDAAwD;AAuBxD,MAAa,sBAAsB;IAOJ;IANZ,KAAK,GAAG,IAAI,GAAG,EAAkD,CAAC;IAMnF,YAA6B,aAAqB,SAAS;QAA9B,eAAU,GAAV,UAAU,CAAoB;IAAG,CAAC;IAO/D,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEnE,MAAM,IAAI,qCAAqB,CAC7B,2CAA2C,YAAY,KAAK,GAAG,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,qCAAqB,CAC7B,uCAAuC,YAAY,KAAK,QAAQ,CAAC,MAAM,EAAE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,qCAAqB,CAC7B,qBAAqB,YAAY,6BAA6B,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;CACF;AA9CD,wDA8CC"}

package/dist/nestjs/jwks/jwks-verifier.d.ts

@@ -1,48 +0,0 @@
-export interface DecodedJwtHeader {
-    alg: string;
-    typ?: string;
-    kid?: string;
-}
-export interface DecodedJwtPayload {
-    iss?: string;
-    sub?: string;
-    exp?: number;
-    iat?: number;
-    nbf?: number;
-    aud?: string | string[];
-    [key: string]: unknown;
-}
-export interface Jwk {
-    kty: string;
-    kid: string;
-    use?: string;
-    n?: string;
-    e?: string;
-    x5c?: string[];
-    alg?: string;
-}
-export declare class JwksVerificationError extends Error {
-    constructor(message: string);
-}
-export interface JwksVerifyOptions {
-    jwksUrl: string;
-    cacheKey: string;
-    expectedIssuers?: readonly string[];
-}
-export declare class JwksVerifier {
-    private readonly cacheTtlMs;
-    private readonly caches;
-    constructor(cacheTtlMs?: number);
-    decode(jwt: string): {
-        header: DecodedJwtHeader;
-        payload: DecodedJwtPayload;
-    };
-    verify(jwt: string, options: JwksVerifyOptions): Promise<DecodedJwtPayload>;
-    private assertIssuer;
-    private verifySignature;
-    private getSigningKey;
-    private fetchJwks;
-    private resolveKey;
-    private mapAlgorithm;
-}
-//# sourceMappingURL=jwks-verifier.d.ts.map

package/dist/nestjs/jwks/jwks-verifier.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwks-verifier.d.ts","sourceRoot":"","sources":["../../../src/nestjs/jwks/jwks-verifier.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAOD,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAuBD,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAKD,MAAM,WAAW,iBAAiB;IAKhC,OAAO,EAAE,MAAM,CAAC;IAMhB,QAAQ,EAAE,MAAM,CAAC;IASjB,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAkBD,qBAAa,YAAY;IASX,OAAO,CAAC,QAAQ,CAAC,UAAU;IAPvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAO9B,UAAU,GAAE,MAAgB;IAQzD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE;IAyBvE,MAAM,CACV,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IAoC7B,OAAO,CAAC,YAAY;IAsBpB,OAAO,CAAC,eAAe;YAqBT,aAAa;YAsBb,SAAS;IAiCvB,OAAO,CAAC,UAAU;IAkBlB,OAAO,CAAC,YAAY;CAYrB"}

package/dist/nestjs/jwks/jwks-verifier.js

@@ -1,177 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JwksVerifier = exports.JwksVerificationError = void 0;
-const crypto = __importStar(require("node:crypto"));
-class JwksVerificationError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'JwksVerificationError';
-    }
-}
-exports.JwksVerificationError = JwksVerificationError;
-class JwksVerifier {
-    cacheTtlMs;
-    caches = new Map();
-    constructor(cacheTtlMs = 600_000) {
-        this.cacheTtlMs = cacheTtlMs;
-    }
-    decode(jwt) {
-        const [headerB64, payloadB64, signatureB64] = jwt.split('.');
-        if (!headerB64 || !payloadB64 || !signatureB64) {
-            throw new JwksVerificationError('Invalid token format');
-        }
-        let header;
-        let payload;
-        try {
-            header = JSON.parse(Buffer.from(headerB64, 'base64url').toString('utf8'));
-            payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf8'));
-        }
-        catch {
-            throw new JwksVerificationError('Invalid token format');
-        }
-        return { header, payload };
-    }
-    async verify(jwt, options) {
-        const [headerB64, payloadB64, signatureB64] = jwt.split('.');
-        if (!headerB64 || !payloadB64 || !signatureB64) {
-            throw new JwksVerificationError('Invalid token format');
-        }
-        const { header, payload } = this.decode(jwt);
-        const nowMs = Date.now();
-        if (typeof payload.exp === 'number' && nowMs >= payload.exp * 1000) {
-            throw new JwksVerificationError('Token expired');
-        }
-        if (typeof payload.nbf === 'number' && nowMs < payload.nbf * 1000) {
-            throw new JwksVerificationError('Token not yet valid');
-        }
-        if (options.expectedIssuers && options.expectedIssuers.length > 0) {
-            this.assertIssuer(payload.iss, options.expectedIssuers);
-        }
-        const publicKey = await this.getSigningKey(options.cacheKey, options.jwksUrl, header.kid);
-        this.verifySignature(headerB64, payloadB64, signatureB64, header.alg, publicKey);
-        return payload;
-    }
-    assertIssuer(iss, expectedIssuers) {
-        if (!iss) {
-            throw new JwksVerificationError('Token missing required issuer claim');
-        }
-        const realmSuffixes = [
-            ...new Set(expectedIssuers
-                .map((candidate) => candidate.match(/(\/realms\/[^/]+)$/)?.[1])
-                .filter((suffix) => Boolean(suffix))),
-        ];
-        const matched = expectedIssuers.includes(iss) ||
-            realmSuffixes.some((suffix) => iss.endsWith(suffix));
-        if (!matched) {
-            throw new JwksVerificationError('Invalid token issuer');
-        }
-    }
-    verifySignature(headerB64, payloadB64, signatureB64, alg, publicKey) {
-        const data = `${headerB64}.${payloadB64}`;
-        const signature = Buffer.from(signatureB64, 'base64url');
-        const algorithm = this.mapAlgorithm(alg);
-        const isValid = crypto.verify(algorithm, Buffer.from(data), publicKey, signature);
-        if (!isValid) {
-            throw new JwksVerificationError('Invalid token signature');
-        }
-    }
-    async getSigningKey(cacheKey, jwksUrl, kid) {
-        let cache = this.caches.get(cacheKey);
-        if (cache &&
-            kid &&
-            cache.keys.has(kid) &&
-            Date.now() - cache.lastFetch < this.cacheTtlMs) {
-            return cache.keys.get(kid);
-        }
-        const keys = await this.fetchJwks(jwksUrl);
-        cache = { keys, lastFetch: Date.now() };
-        this.caches.set(cacheKey, cache);
-        return this.resolveKey(cache, kid);
-    }
-    async fetchJwks(jwksUrl) {
-        let response;
-        try {
-            response = await fetch(jwksUrl);
-        }
-        catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
-            throw new JwksVerificationError(`Failed to reach JWKS endpoint ${jwksUrl}: ${msg}`);
-        }
-        if (!response.ok) {
-            throw new JwksVerificationError(`Failed to fetch JWKS from ${jwksUrl}: ${response.status}`);
-        }
-        const jwks = (await response.json());
-        const keys = new Map();
-        for (const key of jwks.keys) {
-            if (key.kty === 'RSA' && key.n && key.e) {
-                const publicKey = crypto.createPublicKey({
-                    key: { kty: 'RSA', n: key.n, e: key.e },
-                    format: 'jwk',
-                });
-                keys.set(key.kid, publicKey);
-            }
-        }
-        return keys;
-    }
-    resolveKey(cache, kid) {
-        if (kid) {
-            const key = cache.keys.get(kid);
-            if (!key) {
-                throw new JwksVerificationError(`Signing key not found for kid: ${kid}`);
-            }
-            return key;
-        }
-        const firstKey = cache.keys.values().next().value;
-        if (!firstKey) {
-            throw new JwksVerificationError('No valid signing keys found in JWKS');
-        }
-        return firstKey;
-    }
-    mapAlgorithm(alg) {
-        switch (alg) {
-            case 'RS256':
-                return 'sha256';
-            case 'RS384':
-                return 'sha384';
-            case 'RS512':
-                return 'sha512';
-            default:
-                throw new JwksVerificationError(`Unsupported JWT algorithm: ${alg}`);
-        }
-    }
-}
-exports.JwksVerifier = JwksVerifier;
-//# sourceMappingURL=jwks-verifier.js.map

package/dist/nestjs/jwks/jwks-verifier.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwks-verifier.js","sourceRoot":"","sources":["../../../src/nestjs/jwks/jwks-verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AA6DtC,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AALD,sDAKC;AA4CD,MAAa,YAAY;IASM;IAPZ,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAO3D,YAA6B,aAAqB,OAAO;QAA5B,eAAU,GAAV,UAAU,CAAkB;IAAG,CAAC;IAQ7D,MAAM,CAAC,GAAW;QAChB,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAwB,CAAC;QAC7B,IAAI,OAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjC,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC,KAAK,CAClB,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IAOD,KAAK,CAAC,MAAM,CACV,GAAW,EACX,OAA0B;QAE1B,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;YACnE,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;YAClE,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CACxC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,OAAO,EACf,MAAM,CAAC,GAAG,CACX,CAAC;QACF,IAAI,CAAC,eAAe,CAClB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,MAAM,CAAC,GAAG,EACV,SAAS,CACV,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,YAAY,CAClB,GAAuB,EACvB,eAAkC;QAElC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,aAAa,GAAG;YACpB,GAAG,IAAI,GAAG,CACR,eAAe;iBACZ,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBAC9D,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CACzD;SACF,CAAC;QACF,MAAM,OAAO,GACX,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC7B,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,eAAe,CACrB,SAAiB,EACjB,UAAkB,EAClB,YAAoB,EACpB,GAAW,EACX,SAA2B;QAE3B,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,SAAS,EACT,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,QAAgB,EAChB,OAAe,EACf,GAAuB;QAEvB,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IACE,KAAK;YACL,GAAG;YACH,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,EAC9C,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAC9B,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC3C,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAEjC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,OAAe;QAEf,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEnE,MAAM,IAAI,qBAAqB,CAC7B,iCAAiC,OAAO,KAAK,GAAG,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,qBAAqB,CAC7B,6BAA6B,OAAO,KAAK,QAAQ,CAAC,MAAM,EAAE,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;oBACvC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;oBACvC,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAChB,KAAoB,EACpB,GAAuB;QAEvB,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,OAAO;gBACV,OAAO,QAAQ,CAAC;YAClB,KAAK,OAAO;gBACV,OAAO,QAAQ,CAAC;YAClB,KAAK,OAAO;gBACV,OAAO,QAAQ,CAAC;YAClB;gBACE,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF;AAjND,oCAiNC"}

package/dist/nestjs/route-metadata-keys.d.ts

@@ -1,3 +0,0 @@
-export declare const XEMA_PUBLIC_ROUTE = "xema:public-route";
-export declare const XEMA_INTERNAL_ROUTE = "xema:internal-route";
-//# sourceMappingURL=route-metadata-keys.d.ts.map

package/dist/nestjs/route-metadata-keys.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"route-metadata-keys.d.ts","sourceRoot":"","sources":["../../src/nestjs/route-metadata-keys.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAGrD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC"}

package/dist/nestjs/route-metadata-keys.js

@@ -1,6 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.XEMA_INTERNAL_ROUTE = exports.XEMA_PUBLIC_ROUTE = void 0;
-exports.XEMA_PUBLIC_ROUTE = 'xema:public-route';
-exports.XEMA_INTERNAL_ROUTE = 'xema:internal-route';
-//# sourceMappingURL=route-metadata-keys.js.map

package/dist/nestjs/route-metadata-keys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"route-metadata-keys.js","sourceRoot":"","sources":["../../src/nestjs/route-metadata-keys.ts"],"names":[],"mappings":";;;AAwBa,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAGxC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC"}