@xemahq/platform-common 0.34.0 → 0.36.0

package/dist/lib/auth/org-scope-mint.d.ts

@@ -30,5 +30,11 @@ export interface OrgScopedTokenMinter {
     }): Promise<ScopedAccessToken>;
 }
 export declare function mintOrgScopedToken(minter: OrgScopedTokenMinter, scope: OrgScopeWitness): Promise<ScopedAccessToken>;
+export interface OrgScopedClaimDescriptor {
+    readonly realm: string;
+    readonly claimName: string;
+    readonly claimValue: string;
+}
+export declare function orgScopedClaim(realm: string, scope: OrgScopeWitness): OrgScopedClaimDescriptor;
 export {};
 //# sourceMappingURL=org-scope-mint.d.ts.map

package/dist/lib/auth/org-scope-mint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-scope-mint.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/org-scope-mint.ts"],"names":[],"mappings":"AAoFA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAC;AAUzB,oBAAY,kBAAkB;IAM5B,aAAa,mBAAmB;IAwBhC,SAAS,eAAe;IAWxB,aAAa,mBAAmB;CACjC;AAED,OAAO,CAAC,MAAM,uBAAuB,EAAE,OAAO,MAAM,CAAC;AAUrD,MAAM,WAAW,eAAe;IAE9B,QAAQ,CAAC,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC;IAEzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IAMxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAGD,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM;CAY1B;AAsBD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAC3B,eAAe,CASjB;AAQD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACpD,eAAe,CAMjB;AAQD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB;AAGD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CASlE;AAWD,MAAM,WAAW,oBAAoB;IACnC,oBAAoB,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChC;AAUD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAI5B"}
+{"version":3,"file":"org-scope-mint.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/org-scope-mint.ts"],"names":[],"mappings":"AAoFA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAC;AAUzB,oBAAY,kBAAkB;IAM5B,aAAa,mBAAmB;IAwBhC,SAAS,eAAe;IAWxB,aAAa,mBAAmB;CACjC;AAED,OAAO,CAAC,MAAM,uBAAuB,EAAE,OAAO,MAAM,CAAC;AAUrD,MAAM,WAAW,eAAe;IAE9B,QAAQ,CAAC,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC;IAEzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IAMxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAGD,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM;CAY1B;AAsBD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAC3B,eAAe,CASjB;AAQD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACpD,eAAe,CAMjB;AAQD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB;AAGD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CASlE;AAWD,MAAM,WAAW,oBAAoB;IACnC,oBAAoB,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChC;AAUD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAI5B;AAiBD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAmCD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,eAAe,GACrB,wBAAwB,CAkB1B"}

package/dist/lib/auth/org-scope-mint.js

@@ -6,6 +6,7 @@ exports.orgScopeFromOwningRow = orgScopeFromOwningRow;
 exports.orgScopeFromPlatformSweep = orgScopeFromPlatformSweep;
 exports.describeOrgScopeWitness = describeOrgScopeWitness;
 exports.mintOrgScopedToken = mintOrgScopedToken;
+exports.orgScopedClaim = orgScopedClaim;
 const org_claim_1 = require("./org-claim");
 const org_authority_1 = require("./org-authority");
 var OrgScopeProvenance;
@@ -64,4 +65,18 @@ async function mintOrgScopedToken(minter, scope) {
         scopedClaims: { [org_claim_1.OrgClaimKey.Canonical]: scope.orgId },
     });
 }
+function orgScopedClaim(realm, scope) {
+    const trimmedRealm = realm.trim();
+    if (trimmedRealm.length === 0 || trimmedRealm !== realm) {
+        throw new Error('[platform-common] orgScopedClaim: realm must be non-empty and must ' +
+            'not carry leading or trailing whitespace — identity-api matches the ' +
+            'grant EXACTLY, so a padded realm fails as a missing grant rather ' +
+            'than as a malformed one.');
+    }
+    return {
+        realm: trimmedRealm,
+        claimName: org_claim_1.OrgClaimKey.Canonical,
+        claimValue: scope.orgId,
+    };
+}
 //# sourceMappingURL=org-scope-mint.js.map

package/dist/lib/auth/org-scope-mint.js.map

@@ -1 +1 @@
-{"version":3,"file":"org-scope-mint.js","sourceRoot":"","sources":["../../../src/lib/auth/org-scope-mint.ts"],"names":[],"mappings":";;;AA+MA,8DAWC;AAQD,sDASC;AAQD,8DAKC;AAGD,0DASC;AAyBD,gDAOC;AA9MD,2CAA0C;AAC1C,mDAGyB;AAUzB,IAAY,kBA0CX;AA1CD,WAAY,kBAAkB;IAM5B,sDAAgC,CAAA;IAwBhC,8CAAwB,CAAA;IAWxB,sDAAgC,CAAA;AAClC,CAAC,EA1CW,kBAAkB,kCAAlB,kBAAkB,QA0C7B;AA4BD,MAAa,qBAAsB,SAAQ,KAAK;IAEnC;IACA;IAFX,YACW,aAAqB,EACrB,MAAc;QAEvB,KAAK,CACH,2CAA2C,aAAa,iBAAiB;YACvE,sCAAsC,MAAM,2BAA2B;YACvE,+DAA+D;YAC/D,sEAAsE;YACtE,uEAAuE;YACvE,mCAAmC,CACtC,CAAC;QAVO,kBAAa,GAAb,aAAa,CAAQ;QACrB,WAAM,GAAN,MAAM,CAAQ;QAUvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAfD,sDAeC;AAED,SAAS,OAAO,CACd,KAAa,EACb,UAA8B,EAC9B,QAAgB;IAEhB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAqB,CAAC,EAAE,EAAE,aAAa,UAAU,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAqB,CAAC;AACrE,CAAC;AAUD,SAAgB,yBAAyB,CACvC,OAA4B;IAE5B,IAAI,CAAC,IAAA,oCAAoB,EAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,OAAO,CACZ,OAAO,CAAC,aAAa,EACrB,kBAAkB,CAAC,aAAa,EAChC,SAAS,OAAO,CAAC,MAAM,EAAE,CAC1B,CAAC;AACJ,CAAC;AAQD,SAAgB,qBAAqB,CACnC,KAAa,EACb,GAAqD;IAErD,OAAO,OAAO,CACZ,KAAK,EACL,kBAAkB,CAAC,SAAS,EAC5B,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,CAC9B,CAAC;AACJ,CAAC;AAQD,SAAgB,yBAAyB,CACvC,KAAa,EACb,MAAc;IAEd,OAAO,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAC7E,CAAC;AAGD,SAAgB,uBAAuB,CAAC,CAAkB;IACxD,QAAQ,CAAC,CAAC,UAAU,EAAE,CAAC;QACrB,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,mBAAmB,CAAC,CAAC,QAAQ,GAAG,CAAC;QAC1C,KAAK,kBAAkB,CAAC,SAAS;YAC/B,OAAO,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,mBAAmB,CAAC,CAAC,QAAQ,GAAG,CAAC;IAC5C,CAAC;AACH,CAAC;AAyBM,KAAK,UAAU,kBAAkB,CACtC,MAA4B,EAC5B,KAAsB;IAEtB,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACjC,YAAY,EAAE,EAAE,CAAC,uBAAW,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE;KACvD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"org-scope-mint.js","sourceRoot":"","sources":["../../../src/lib/auth/org-scope-mint.ts"],"names":[],"mappings":";;;AA+MA,8DAWC;AAQD,sDASC;AAQD,8DAKC;AAGD,0DASC;AAyBD,gDAOC;AAwDD,wCAqBC;AA3RD,2CAA0C;AAC1C,mDAGyB;AAUzB,IAAY,kBA0CX;AA1CD,WAAY,kBAAkB;IAM5B,sDAAgC,CAAA;IAwBhC,8CAAwB,CAAA;IAWxB,sDAAgC,CAAA;AAClC,CAAC,EA1CW,kBAAkB,kCAAlB,kBAAkB,QA0C7B;AA4BD,MAAa,qBAAsB,SAAQ,KAAK;IAEnC;IACA;IAFX,YACW,aAAqB,EACrB,MAAc;QAEvB,KAAK,CACH,2CAA2C,aAAa,iBAAiB;YACvE,sCAAsC,MAAM,2BAA2B;YACvE,+DAA+D;YAC/D,sEAAsE;YACtE,uEAAuE;YACvE,mCAAmC,CACtC,CAAC;QAVO,kBAAa,GAAb,aAAa,CAAQ;QACrB,WAAM,GAAN,MAAM,CAAQ;QAUvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAfD,sDAeC;AAED,SAAS,OAAO,CACd,KAAa,EACb,UAA8B,EAC9B,QAAgB;IAEhB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAqB,CAAC,EAAE,EAAE,aAAa,UAAU,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAqB,CAAC;AACrE,CAAC;AAUD,SAAgB,yBAAyB,CACvC,OAA4B;IAE5B,IAAI,CAAC,IAAA,oCAAoB,EAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,OAAO,CACZ,OAAO,CAAC,aAAa,EACrB,kBAAkB,CAAC,aAAa,EAChC,SAAS,OAAO,CAAC,MAAM,EAAE,CAC1B,CAAC;AACJ,CAAC;AAQD,SAAgB,qBAAqB,CACnC,KAAa,EACb,GAAqD;IAErD,OAAO,OAAO,CACZ,KAAK,EACL,kBAAkB,CAAC,SAAS,EAC5B,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,CAC9B,CAAC;AACJ,CAAC;AAQD,SAAgB,yBAAyB,CACvC,KAAa,EACb,MAAc;IAEd,OAAO,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAC7E,CAAC;AAGD,SAAgB,uBAAuB,CAAC,CAAkB;IACxD,QAAQ,CAAC,CAAC,UAAU,EAAE,CAAC;QACrB,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,mBAAmB,CAAC,CAAC,QAAQ,GAAG,CAAC;QAC1C,KAAK,kBAAkB,CAAC,SAAS;YAC/B,OAAO,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC;QACtC,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,mBAAmB,CAAC,CAAC,QAAQ,GAAG,CAAC;IAC5C,CAAC;AACH,CAAC;AAyBM,KAAK,UAAU,kBAAkB,CACtC,MAA4B,EAC5B,KAAsB;IAEtB,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACjC,YAAY,EAAE,EAAE,CAAC,uBAAW,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE;KACvD,CAAC,CAAC;AACL,CAAC;AAwDD,SAAgB,cAAc,CAC5B,KAAa,EACb,KAAsB;IAEtB,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,sEAAsE;YACtE,mEAAmE;YACnE,0BAA0B,CAC7B,CAAC;IACJ,CAAC;IAID,OAAO;QACL,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,uBAAW,CAAC,SAAS;QAChC,UAAU,EAAE,KAAK,CAAC,KAAK;KACxB,CAAC;AACJ,CAAC"}

package/dist/nestjs/auth/declared-subject-class.d.ts

@@ -0,0 +1,10 @@
+import { UnauthorizedException } from '@nestjs/common';
+import type { VerifiedTokenSource } from './realm-token-verifier';
+export declare class UnclassifiableForeignBearerError extends UnauthorizedException {
+    constructor(issuer: string);
+}
+export declare class UnknownDeclaredSubjectClassError extends UnauthorizedException {
+    constructor(issuer: string, declared: string);
+}
+export declare function claimsWithDeclaredSubjectClass<T extends Record<string, unknown>>(payload: T, source: VerifiedTokenSource): T;
+//# sourceMappingURL=declared-subject-class.d.ts.map

package/dist/nestjs/auth/declared-subject-class.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-subject-class.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AA+BlE,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM;CAW3B;AAWD,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM7C;AAsBD,wBAAgB,8BAA8B,CAC5C,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,CAc5C"}

package/dist/nestjs/auth/declared-subject-class.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerError = void 0;
+exports.claimsWithDeclaredSubjectClass = claimsWithDeclaredSubjectClass;
+const common_1 = require("@nestjs/common");
+const subject_1 = require("@xemahq/contracts/subject");
+class UnclassifiableForeignBearerError extends common_1.UnauthorizedException {
+    constructor(issuer) {
+        super(`The access token was proved by trusted issuer '${issuer}', which ` +
+            `declares no "subjectClass", and the token carries no "token_class" ` +
+            `of its own. Nothing states what kind of subject this is, so it is ` +
+            `refused rather than assumed to be a user — the assumption that a ` +
+            `signal-less token is a browser login holds for this deployment's own ` +
+            `realm and for nothing else. Declare "subjectClass" on the issuer's ` +
+            `registry entry, or have the issuer stamp "token_class".`);
+    }
+}
+exports.UnclassifiableForeignBearerError = UnclassifiableForeignBearerError;
+class UnknownDeclaredSubjectClassError extends common_1.UnauthorizedException {
+    constructor(issuer, declared) {
+        super(`Trusted issuer '${issuer}' declares subjectClass ` +
+            `'${declared}', which is not a known TokenClass.`);
+    }
+}
+exports.UnknownDeclaredSubjectClassError = UnknownDeclaredSubjectClassError;
+function claimsWithDeclaredSubjectClass(payload, source) {
+    if (source.kind !== 'trusted-issuer')
+        return payload;
+    if (typeof payload.token_class === 'string' && payload.token_class) {
+        return payload;
+    }
+    const declared = source.entry.subjectClass;
+    if (!declared) {
+        throw new UnclassifiableForeignBearerError(source.entry.issuer);
+    }
+    const parsed = subject_1.TokenClassSchema.safeParse(declared);
+    if (!parsed.success) {
+        throw new UnknownDeclaredSubjectClassError(source.entry.issuer, declared);
+    }
+    return { ...payload, token_class: parsed.data };
+}
+//# sourceMappingURL=declared-subject-class.js.map

package/dist/nestjs/auth/declared-subject-class.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-subject-class.js","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":";;;AAsFA,wEAgBC;AAtGD,2CAAuD;AACvD,uDAA6D;AAiC7D,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc;QACxB,KAAK,CACH,kDAAkD,MAAM,WAAW;YACjE,qEAAqE;YACrE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;CACF;AAZD,4EAYC;AAWD,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc,EAAE,QAAgB;QAC1C,KAAK,CACH,mBAAmB,MAAM,0BAA0B;YACjD,IAAI,QAAQ,qCAAqC,CACpD,CAAC;IACJ,CAAC;CACF;AAPD,4EAOC;AAsBD,SAAgB,8BAA8B,CAE5C,OAAU,EAAE,MAA2B;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,0BAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC"}

package/dist/nestjs/auth/index.d.ts

@@ -12,12 +12,13 @@ export { holdsOrgAuthority, resolveOrgAuthorityInstrument, type OrgAuthorityInst
 export { PlatformAdminGuard } from './platform-admin.guard';
 export { configureAuthMiddleware, type ConfigureAuthMiddlewareOptions, } from './configure-auth-middleware';
 export { OrgClaimKey, OrgHeaderName, ORG_CLAIM_KEYS, resolveOrgClaim, } from '../../lib/auth/org-claim';
-export { RequireOrgClaim, REQUIRE_ORG_CLAIM } from './org-claim-required';
+export { RequireProvenOrgAuthority, REQUIRE_PROVEN_ORG_AUTHORITY } from './proven-org-authority-required';
 export { OrgAuthoritySource, type OrgAuthorityVerdict, type OrgAuthorityCaller, type OrgAuthorityCallerFacts, resolveOrgAuthority, isOrgAuthorityProven, orgAuthorityRequiresProof, } from '../../lib/auth/org-authority';
-export { OrgScopeProvenance, type OrgScopeWitness, type OrgScopedTokenMinter, UnprovenOrgScopeError, orgScopeFromProvenRequest, orgScopeFromOwningRow, orgScopeFromPlatformSweep, describeOrgScopeWitness, mintOrgScopedToken, } from '../../lib/auth/org-scope-mint';
+export { OrgScopeProvenance, type OrgScopeWitness, type OrgScopedTokenMinter, UnprovenOrgScopeError, orgScopeFromProvenRequest, orgScopeFromOwningRow, orgScopeFromPlatformSweep, describeOrgScopeWitness, mintOrgScopedToken, type OrgScopedClaimDescriptor, orgScopedClaim, } from '../../lib/auth/org-scope-mint';
 export { ORG_AUTHORITY_OBSERVATION_LIMIT, UNKNOWN_CLIENT_ID, type OrgAuthorityObservation, type OrgAuthorityCensus, recordUnprovenOrgAuthority, recordServiceRelayedOrgAuthority, orgAuthorityCensus, orgAuthorityRelayCensus, resetOrgAuthorityCensus, } from '../../lib/auth/org-authority-observations';
 export { resolveActorChainFromClaims, UnclassifiableActorHopError, UnknownActorHopSubjectKindError, ContradictoryActorHopKindError, MalformedActorHopError, } from './delegation-chain';
 export { SUBJECT_KIND_CLAIM, readDeclaredSubjectKind, UnknownTokenClassError, } from './actor-classification';
 export { RealmTokenVerifier, type MultiRealmKeySource, type VerifiedTokenSource, } from './realm-token-verifier';
+export { UnclassifiableForeignBearerError, UnknownDeclaredSubjectClassError, claimsWithDeclaredSubjectClass, } from './declared-subject-class';
 export { DEFAULT_TRUSTED_ISSUER_ALGORITHMS, TRUSTED_ISSUERS_ENV_VAR, TrustedIssuerConfigError, TrustedIssuerRegistry, parseTrustedIssuersFromEnv, type TrustedIssuerEntry, } from '@xemahq/oidc-guard';
 //# sourceMappingURL=index.d.ts.map

package/dist/nestjs/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,cAAc,GACf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}

package/dist/nestjs/auth/index.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveActorChainFromClaims = exports.resetOrgAuthorityCensus = exports.orgAuthorityRelayCensus = exports.orgAuthorityCensus = exports.recordServiceRelayedOrgAuthority = exports.recordUnprovenOrgAuthority = exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = exports.mintOrgScopedToken = exports.describeOrgScopeWitness = exports.orgScopeFromPlatformSweep = exports.orgScopeFromOwningRow = exports.orgScopeFromProvenRequest = exports.UnprovenOrgScopeError = exports.OrgScopeProvenance = exports.orgAuthorityRequiresProof = exports.isOrgAuthorityProven = exports.resolveOrgAuthority = exports.OrgAuthoritySource = exports.REQUIRE_ORG_CLAIM = exports.RequireOrgClaim = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.PlatformAdminGuard = exports.resolveOrgAuthorityInstrument = exports.holdsOrgAuthority = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.OrgRole = exports.ServiceOrOrgRoleGuard = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.isDirectServiceActor = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = void 0;
-exports.parseTrustedIssuersFromEnv = exports.TrustedIssuerRegistry = exports.TrustedIssuerConfigError = exports.TRUSTED_ISSUERS_ENV_VAR = exports.DEFAULT_TRUSTED_ISSUER_ALGORITHMS = exports.RealmTokenVerifier = exports.UnknownTokenClassError = exports.readDeclaredSubjectKind = exports.SUBJECT_KIND_CLAIM = exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = void 0;
+exports.resetOrgAuthorityCensus = exports.orgAuthorityRelayCensus = exports.orgAuthorityCensus = exports.recordServiceRelayedOrgAuthority = exports.recordUnprovenOrgAuthority = exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = exports.orgScopedClaim = exports.mintOrgScopedToken = exports.describeOrgScopeWitness = exports.orgScopeFromPlatformSweep = exports.orgScopeFromOwningRow = exports.orgScopeFromProvenRequest = exports.UnprovenOrgScopeError = exports.OrgScopeProvenance = exports.orgAuthorityRequiresProof = exports.isOrgAuthorityProven = exports.resolveOrgAuthority = exports.OrgAuthoritySource = exports.REQUIRE_PROVEN_ORG_AUTHORITY = exports.RequireProvenOrgAuthority = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.PlatformAdminGuard = exports.resolveOrgAuthorityInstrument = exports.holdsOrgAuthority = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.OrgRole = exports.ServiceOrOrgRoleGuard = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.isDirectServiceActor = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = void 0;
+exports.parseTrustedIssuersFromEnv = exports.TrustedIssuerRegistry = exports.TrustedIssuerConfigError = exports.TRUSTED_ISSUERS_ENV_VAR = exports.DEFAULT_TRUSTED_ISSUER_ALGORITHMS = exports.claimsWithDeclaredSubjectClass = exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerError = exports.RealmTokenVerifier = exports.UnknownTokenClassError = exports.readDeclaredSubjectKind = exports.SUBJECT_KIND_CLAIM = exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = exports.resolveActorChainFromClaims = void 0;
 var auth_module_1 = require("./auth.module");
 Object.defineProperty(exports, "AuthModule", { enumerable: true, get: function () { return auth_module_1.AuthModule; } });
 var auth_module_options_1 = require("./auth-module-options");
@@ -45,9 +45,9 @@ Object.defineProperty(exports, "OrgClaimKey", { enumerable: true, get: function
 Object.defineProperty(exports, "OrgHeaderName", { enumerable: true, get: function () { return org_claim_1.OrgHeaderName; } });
 Object.defineProperty(exports, "ORG_CLAIM_KEYS", { enumerable: true, get: function () { return org_claim_1.ORG_CLAIM_KEYS; } });
 Object.defineProperty(exports, "resolveOrgClaim", { enumerable: true, get: function () { return org_claim_1.resolveOrgClaim; } });
-var org_claim_required_1 = require("./org-claim-required");
-Object.defineProperty(exports, "RequireOrgClaim", { enumerable: true, get: function () { return org_claim_required_1.RequireOrgClaim; } });
-Object.defineProperty(exports, "REQUIRE_ORG_CLAIM", { enumerable: true, get: function () { return org_claim_required_1.REQUIRE_ORG_CLAIM; } });
+var proven_org_authority_required_1 = require("./proven-org-authority-required");
+Object.defineProperty(exports, "RequireProvenOrgAuthority", { enumerable: true, get: function () { return proven_org_authority_required_1.RequireProvenOrgAuthority; } });
+Object.defineProperty(exports, "REQUIRE_PROVEN_ORG_AUTHORITY", { enumerable: true, get: function () { return proven_org_authority_required_1.REQUIRE_PROVEN_ORG_AUTHORITY; } });
 var org_authority_1 = require("../../lib/auth/org-authority");
 Object.defineProperty(exports, "OrgAuthoritySource", { enumerable: true, get: function () { return org_authority_1.OrgAuthoritySource; } });
 Object.defineProperty(exports, "resolveOrgAuthority", { enumerable: true, get: function () { return org_authority_1.resolveOrgAuthority; } });
@@ -61,6 +61,7 @@ Object.defineProperty(exports, "orgScopeFromOwningRow", { enumerable: true, get:
 Object.defineProperty(exports, "orgScopeFromPlatformSweep", { enumerable: true, get: function () { return org_scope_mint_1.orgScopeFromPlatformSweep; } });
 Object.defineProperty(exports, "describeOrgScopeWitness", { enumerable: true, get: function () { return org_scope_mint_1.describeOrgScopeWitness; } });
 Object.defineProperty(exports, "mintOrgScopedToken", { enumerable: true, get: function () { return org_scope_mint_1.mintOrgScopedToken; } });
+Object.defineProperty(exports, "orgScopedClaim", { enumerable: true, get: function () { return org_scope_mint_1.orgScopedClaim; } });
 var org_authority_observations_1 = require("../../lib/auth/org-authority-observations");
 Object.defineProperty(exports, "ORG_AUTHORITY_OBSERVATION_LIMIT", { enumerable: true, get: function () { return org_authority_observations_1.ORG_AUTHORITY_OBSERVATION_LIMIT; } });
 Object.defineProperty(exports, "UNKNOWN_CLIENT_ID", { enumerable: true, get: function () { return org_authority_observations_1.UNKNOWN_CLIENT_ID; } });
@@ -81,6 +82,10 @@ Object.defineProperty(exports, "readDeclaredSubjectKind", { enumerable: true, ge
 Object.defineProperty(exports, "UnknownTokenClassError", { enumerable: true, get: function () { return actor_classification_1.UnknownTokenClassError; } });
 var realm_token_verifier_1 = require("./realm-token-verifier");
 Object.defineProperty(exports, "RealmTokenVerifier", { enumerable: true, get: function () { return realm_token_verifier_1.RealmTokenVerifier; } });
+var declared_subject_class_1 = require("./declared-subject-class");
+Object.defineProperty(exports, "UnclassifiableForeignBearerError", { enumerable: true, get: function () { return declared_subject_class_1.UnclassifiableForeignBearerError; } });
+Object.defineProperty(exports, "UnknownDeclaredSubjectClassError", { enumerable: true, get: function () { return declared_subject_class_1.UnknownDeclaredSubjectClassError; } });
+Object.defineProperty(exports, "claimsWithDeclaredSubjectClass", { enumerable: true, get: function () { return declared_subject_class_1.claimsWithDeclaredSubjectClass; } });
 var oidc_guard_1 = require("@xemahq/oidc-guard");
 Object.defineProperty(exports, "DEFAULT_TRUSTED_ISSUER_ALGORITHMS", { enumerable: true, get: function () { return oidc_guard_1.DEFAULT_TRUSTED_ISSUER_ALGORITHMS; } });
 Object.defineProperty(exports, "TRUSTED_ISSUERS_ENV_VAR", { enumerable: true, get: function () { return oidc_guard_1.TRUSTED_ISSUERS_ENV_VAR; } });

package/dist/nestjs/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":";;;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAI+B;AAH7B,0HAAA,mBAAmB,OAAA;AAIrB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,6DAG+B;AAF7B,wHAAA,iBAAiB,OAAA;AACjB,2HAAA,oBAAoB,OAAA;AAEtB,yDAI6B;AAH3B,oHAAA,eAAe,OAAA;AACf,sHAAA,iBAAiB,OAAA;AACjB,wHAAA,mBAAmB,OAAA;AAErB,mDAI0B;AAHxB,8GAAA,YAAY,OAAA;AACZ,gHAAA,cAAc,OAAA;AACd,kHAAA,gBAAgB,OAAA;AAElB,yEAAoE;AAA3D,kIAAA,qBAAqB,OAAA;AAC9B,oDAOiC;AAN/B,mGAAA,OAAO,OAAA;AACP,4GAAA,gBAAgB,OAAA;AAChB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AACpB,4GAAA,gBAAgB,OAAA;AAElB,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,6DAI+B;AAH7B,wHAAA,iBAAiB,OAAA;AACjB,oIAAA,6BAA6B,OAAA;AAG/B,+DAA4D;AAAnD,0HAAA,kBAAkB,OAAA;AAC3B,yEAGqC;AAFnC,oIAAA,uBAAuB,OAAA;AAGzB,sDAKkC;AAJhC,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AACb,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA;AAEjB,2DAA0E;AAAjE,qHAAA,eAAe,OAAA;AAAE,uHAAA,iBAAiB,OAAA;AAC3C,8DAQsC;AAPpC,mHAAA,kBAAkB,OAAA;AAIlB,oHAAA,mBAAmB,OAAA;AACnB,qHAAA,oBAAoB,OAAA;AACpB,0HAAA,yBAAyB,OAAA;AAE3B,gEAUuC;AATrC,oHAAA,kBAAkB,OAAA;AAGlB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,yHAAA,uBAAuB,OAAA;AACvB,oHAAA,kBAAkB,OAAA;AAEpB,wFAUmD;AATjD,6IAAA,+BAA+B,OAAA;AAC/B,+HAAA,iBAAiB,OAAA;AAGjB,wIAAA,0BAA0B,OAAA;AAC1B,8IAAA,gCAAgC,OAAA;AAChC,gIAAA,kBAAkB,OAAA;AAClB,qIAAA,uBAAuB,OAAA;AACvB,qIAAA,uBAAuB,OAAA;AAEzB,uDAM4B;AAL1B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAUpB,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":";;;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAI+B;AAH7B,0HAAA,mBAAmB,OAAA;AAIrB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,6DAG+B;AAF7B,wHAAA,iBAAiB,OAAA;AACjB,2HAAA,oBAAoB,OAAA;AAEtB,yDAI6B;AAH3B,oHAAA,eAAe,OAAA;AACf,sHAAA,iBAAiB,OAAA;AACjB,wHAAA,mBAAmB,OAAA;AAErB,mDAI0B;AAHxB,8GAAA,YAAY,OAAA;AACZ,gHAAA,cAAc,OAAA;AACd,kHAAA,gBAAgB,OAAA;AAElB,yEAAoE;AAA3D,kIAAA,qBAAqB,OAAA;AAC9B,oDAOiC;AAN/B,mGAAA,OAAO,OAAA;AACP,4GAAA,gBAAgB,OAAA;AAChB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AACpB,4GAAA,gBAAgB,OAAA;AAElB,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,6DAI+B;AAH7B,wHAAA,iBAAiB,OAAA;AACjB,oIAAA,6BAA6B,OAAA;AAG/B,+DAA4D;AAAnD,0HAAA,kBAAkB,OAAA;AAC3B,yEAGqC;AAFnC,oIAAA,uBAAuB,OAAA;AAGzB,sDAKkC;AAJhC,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AACb,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA;AAEjB,iFAA0G;AAAjG,0IAAA,yBAAyB,OAAA;AAAE,6IAAA,4BAA4B,OAAA;AAChE,8DAQsC;AAPpC,mHAAA,kBAAkB,OAAA;AAIlB,oHAAA,mBAAmB,OAAA;AACnB,qHAAA,oBAAoB,OAAA;AACpB,0HAAA,yBAAyB,OAAA;AAE3B,gEAYuC;AAXrC,oHAAA,kBAAkB,OAAA;AAGlB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,yHAAA,uBAAuB,OAAA;AACvB,oHAAA,kBAAkB,OAAA;AAElB,gHAAA,cAAc,OAAA;AAEhB,wFAUmD;AATjD,6IAAA,+BAA+B,OAAA;AAC/B,+HAAA,iBAAiB,OAAA;AAGjB,wIAAA,0BAA0B,OAAA;AAC1B,8IAAA,gCAAgC,OAAA;AAChC,gIAAA,kBAAkB,OAAA;AAClB,qIAAA,uBAAuB,OAAA;AACvB,qIAAA,uBAAuB,OAAA;AAEzB,uDAM4B;AAL1B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAIpB,mEAIkC;AAHhC,0IAAA,gCAAgC,OAAA;AAChC,0IAAA,gCAAgC,OAAA;AAChC,wIAAA,8BAA8B,OAAA;AAQhC,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA"}

package/dist/nestjs/auth/internal-caller.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal-caller.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/internal-caller.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAiCxB,qBACa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CA8BhD"}
+{"version":3,"file":"internal-caller.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/internal-caller.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAuExB,qBACa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CA6DhD"}

package/dist/nestjs/auth/internal-caller.guard.js

@@ -10,7 +10,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.InternalCallerGuard = void 0;
 const common_1 = require("@nestjs/common");
 const subject_1 = require("@xemahq/contracts/subject");
+const org_authority_1 = require("../../lib/auth/org-authority");
 const request_context_1 = require("../../lib/request-context");
+const decorator_metadata_1 = require("../decorator-metadata");
+const proven_org_authority_required_1 = require("./proven-org-authority-required");
 let InternalCallerGuard = InternalCallerGuard_1 = class InternalCallerGuard {
     logger = new common_1.Logger(InternalCallerGuard_1.name);
     canActivate(context) {
@@ -28,6 +31,25 @@ let InternalCallerGuard = InternalCallerGuard_1 = class InternalCallerGuard {
                 `(tokenClass=${ctx.tokenClass}, delegated=false).`);
             throw new common_1.ForbiddenException('This endpoint is restricted to platform service callers.');
         }
+        const requireProvenOrgAuthority = (0, decorator_metadata_1.readDecoratorOverride)(proven_org_authority_required_1.REQUIRE_PROVEN_ORG_AUTHORITY, [
+            context.getHandler(),
+            context.getClass(),
+        ]) === true;
+        const orgProven = ctx.orgAuthority !== undefined && (0, org_authority_1.isOrgAuthorityProven)(ctx.orgAuthority);
+        if (requireProvenOrgAuthority && !orgProven) {
+            this.logger.warn({
+                message: 'internal-caller-org-authority-unproven',
+                actorId: ctx.actorId,
+                source: ctx.orgAuthority?.source,
+                assertedOrgId: ctx.orgAuthority?.assertedOrgId,
+            });
+            throw new common_1.ForbiddenException({
+                code: 'ORG_CLAIM_REQUIRED',
+                message: 'This endpoint requires a caller whose token BACKS the organization ' +
+                    'it named. A relayed X-Xema-Org-Id header is routing context, not a ' +
+                    'tenancy claim.',
+            });
+        }
         return true;
     }
 };

package/dist/nestjs/auth/internal-caller.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"internal-caller.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/internal-caller.guard.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAOwB;AAExB,uDAAuD;AACvD,+DAA4D;AA+BrD,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IACb,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;IAE/D,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wDAAwD;gBACtD,2EAA2E,CAC9E,CAAC;YACF,MAAM,IAAI,qCAA4B,CACpC,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,KAAK,oBAAU,CAAC,UAAU,CAAC;QAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sCAAsC,GAAG,CAAC,OAAO,GAAG;gBAClD,eAAe,GAAG,CAAC,UAAU,qBAAqB,CACrD,CAAC;YACF,MAAM,IAAI,2BAAkB,CAC1B,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAjCY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;GACA,mBAAmB,CAiC/B"}
+{"version":3,"file":"internal-caller.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/internal-caller.guard.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAOwB;AAExB,uDAAuD;AACvD,gEAAoE;AACpE,+DAA4D;AAC5D,8DAA8D;AAC9D,mFAA+E;AAkExE,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IACb,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;IAE/D,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wDAAwD;gBACtD,2EAA2E,CAC9E,CAAC;YACF,MAAM,IAAI,qCAA4B,CACpC,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,KAAK,oBAAU,CAAC,UAAU,CAAC;QAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sCAAsC,GAAG,CAAC,OAAO,GAAG;gBAClD,eAAe,GAAG,CAAC,UAAU,qBAAqB,CACrD,CAAC;YACF,MAAM,IAAI,2BAAkB,CAC1B,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAKD,MAAM,yBAAyB,GAC7B,IAAA,0CAAqB,EAAU,4DAA4B,EAAE;YAC3D,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,KAAK,IAAI,CAAC;QAMd,MAAM,SAAS,GACb,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,IAAA,oCAAoB,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3E,IAAI,yBAAyB,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,wCAAwC;gBACjD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,MAAM;gBAChC,aAAa,EAAE,GAAG,CAAC,YAAY,EAAE,aAAa;aAC/C,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EACL,qEAAqE;oBACrE,qEAAqE;oBACrE,gBAAgB;aACnB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAhEY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;GACA,mBAAmB,CAgE/B"}

package/dist/nestjs/auth/proven-org-authority-required.d.ts

@@ -0,0 +1,3 @@
+export declare const REQUIRE_PROVEN_ORG_AUTHORITY = "xema:require-proven-org-authority";
+export declare const RequireProvenOrgAuthority: () => MethodDecorator & ClassDecorator;
+//# sourceMappingURL=proven-org-authority-required.d.ts.map

package/dist/nestjs/auth/proven-org-authority-required.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proven-org-authority-required.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/proven-org-authority-required.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,4BAA4B,sCAAsC,CAAC;AAyHhF,eAAO,MAAM,yBAAyB,QAAO,eAAe,GAC1D,cAAiE,CAAC"}

package/dist/nestjs/auth/proven-org-authority-required.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequireProvenOrgAuthority = exports.REQUIRE_PROVEN_ORG_AUTHORITY = void 0;
+const common_1 = require("@nestjs/common");
+exports.REQUIRE_PROVEN_ORG_AUTHORITY = 'xema:require-proven-org-authority';
+const RequireProvenOrgAuthority = () => (0, common_1.SetMetadata)(exports.REQUIRE_PROVEN_ORG_AUTHORITY, true);
+exports.RequireProvenOrgAuthority = RequireProvenOrgAuthority;
+//# sourceMappingURL=proven-org-authority-required.js.map

package/dist/nestjs/auth/proven-org-authority-required.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proven-org-authority-required.js","sourceRoot":"","sources":["../../../src/nestjs/auth/proven-org-authority-required.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAOhC,QAAA,4BAA4B,GAAG,mCAAmC,CAAC;AAyHzE,MAAM,yBAAyB,GAAG,GACxB,EAAE,CAAC,IAAA,oBAAW,EAAC,oCAA4B,EAAE,IAAI,CAAC,CAAC;AADvD,QAAA,yBAAyB,6BAC8B"}

package/dist/nestjs/auth/service-actor.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-actor.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-actor.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAchE,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,YAAY,CAAC,GACrD,OAAO,CAET;AA8BD,qBACa,iBAAkB,YAAW,WAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAE7D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAsEhD"}
+{"version":3,"file":"service-actor.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-actor.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAehE,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,YAAY,CAAC,GACrD,OAAO,CAET;AA8BD,qBACa,iBAAkB,YAAW,WAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAE7D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAgGhD"}

package/dist/nestjs/auth/service-actor.guard.js

@@ -12,7 +12,8 @@ exports.isDirectServiceActor = isDirectServiceActor;
 const common_1 = require("@nestjs/common");
 const subject_1 = require("@xemahq/contracts/subject");
 const request_context_1 = require("../../lib/request-context");
-const org_claim_required_1 = require("./org-claim-required");
+const proven_org_authority_required_1 = require("./proven-org-authority-required");
+const org_authority_1 = require("../../lib/auth/org-authority");
 const decorator_metadata_1 = require("../decorator-metadata");
 function isDirectServiceActor(ctx) {
     return ctx.tokenClass === subject_1.TokenClass.ServiceJwt && ctx.actorChain.length === 0;
@@ -46,20 +47,24 @@ let ServiceActorGuard = ServiceActorGuard_1 = class ServiceActorGuard {
                     'Mint a token via IdentityBootstrapService.getAccessToken().',
             });
         }
-        const requireOrgClaim = (0, decorator_metadata_1.readDecoratorOverride)(org_claim_required_1.REQUIRE_ORG_CLAIM, [
+        const requireProvenOrgAuthority = (0, decorator_metadata_1.readDecoratorOverride)(proven_org_authority_required_1.REQUIRE_PROVEN_ORG_AUTHORITY, [
             context.getHandler(),
             context.getClass(),
         ]) === true;
-        if (requireOrgClaim && !ctx.orgId) {
+        const orgProven = ctx.orgAuthority !== undefined && (0, org_authority_1.isOrgAuthorityProven)(ctx.orgAuthority);
+        if (requireProvenOrgAuthority && !orgProven) {
             this.logger.warn({
-                message: 'service-actor-org-claim-required-but-absent',
+                message: 'service-actor-org-claim-required-but-unproven',
                 route: `${request.method} ${request.originalUrl}`,
                 actorId: ctx.actorId,
+                orgAuthority: ctx.orgAuthority?.source,
             });
             throw new common_1.ForbiddenException({
                 code: 'ORG_CLAIM_REQUIRED',
-                message: 'This endpoint requires a tenant-scoped service token (missing ' +
-                    'xema_org_id claim).',
+                message: 'This endpoint requires a tenant-scoped service token: the org must ' +
+                    'be backed by a signed `xema_org_id` claim, not by the ' +
+                    '`X-Xema-Org-Id` header alone. Mint with mintOrgScopedToken from ' +
+                    "'@xemahq/platform-common'.",
             });
         }
         return true;

package/dist/nestjs/auth/service-actor.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-actor.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-actor.guard.ts"],"names":[],"mappings":";;;;;;;;;;AAyBA,oDAIC;AA7BD,2CAOwB;AAExB,uDAAuD;AACvD,+DAA4D;AAE5D,6DAAyD;AACzD,8DAA8D;AAY9D,SAAgB,oBAAoB,CAClC,GAAsD;IAEtD,OAAO,GAAG,CAAC,UAAU,KAAK,oBAAU,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;AACjF,CAAC;AA+BM,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAE7D,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sDAAsD;gBACpD,4EAA4E,CAC/E,CAAC;YACF,MAAM,IAAI,qCAA4B,CAAC;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC;QACL,CAAC;QAQD,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,wBAAwB;gBACjC,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE;gBACjD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;gBAC7B,SAAS,EAAE,WAAW;aACvB,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,wEAAwE;oBACxE,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QAUD,MAAM,eAAe,GACnB,IAAA,0CAAqB,EAAU,sCAAiB,EAAE;YAChD,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,KAAK,IAAI,CAAC;QACd,IAAI,eAAe,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,6CAA6C;gBACtD,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE;gBACjD,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EACL,gEAAgE;oBAChE,qBAAqB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAzEY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CAyE7B"}
+{"version":3,"file":"service-actor.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-actor.guard.ts"],"names":[],"mappings":";;;;;;;;;;AA0BA,oDAIC;AA9BD,2CAOwB;AAExB,uDAAuD;AACvD,+DAA4D;AAE5D,mFAA+E;AAC/E,gEAAoE;AACpE,8DAA8D;AAY9D,SAAgB,oBAAoB,CAClC,GAAsD;IAEtD,OAAO,GAAG,CAAC,UAAU,KAAK,oBAAU,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;AACjF,CAAC;AA+BM,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAE7D,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sDAAsD;gBACpD,4EAA4E,CAC/E,CAAC;YACF,MAAM,IAAI,qCAA4B,CAAC;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC;QACL,CAAC;QAQD,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,wBAAwB;gBACjC,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE;gBACjD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;gBAC7B,SAAS,EAAE,WAAW;aACvB,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,wEAAwE;oBACxE,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QAyBD,MAAM,yBAAyB,GAC7B,IAAA,0CAAqB,EAAU,4DAA4B,EAAE;YAC3D,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,KAAK,IAAI,CAAC;QAOd,MAAM,SAAS,GACb,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,IAAA,oCAAoB,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3E,IAAI,yBAAyB,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,+CAA+C;gBACxD,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE;gBACjD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,MAAM;aACvC,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EACL,qEAAqE;oBACrE,wDAAwD;oBACxD,kEAAkE;oBAClE,4BAA4B;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAnGY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CAmG7B"}

package/dist/nestjs/auth/service-token.guard.d.ts

@@ -6,6 +6,7 @@ export declare class ServiceTokenGuard implements CanActivate, OnApplicationBoot
     constructor(authOptions?: AuthModuleOptions);
     onApplicationBootstrap(): Promise<void>;
     canActivate(context: ExecutionContext): Promise<boolean>;
+    private assertProvenOrgAuthority;
     private assertServiceTokenClass;
     private verifyToken;
     private headerValue;

package/dist/nestjs/auth/service-token.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-token.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":"AAyEA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKhB,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAO/D,qBACa,iBAAkB,YAAW,WAAW,EAAE,sBAAsB;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAK5C,WAAW,CAAC,EAAE,iBAAiB;IAoB3B,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIvC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoE9D,OAAO,CAAC,uBAAuB;YAuBjB,WAAW;IAgBzB,OAAO,CAAC,WAAW;IA0BnB,OAAO,CAAC,2BAA2B;CA6CpC"}
+{"version":3,"file":"service-token.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":"AAyEA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKhB,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAO/D,qBACa,iBAAkB,YAAW,WAAW,EAAE,sBAAsB;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAK5C,WAAW,CAAC,EAAE,iBAAiB;IAoB3B,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIvC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAyH9D,OAAO,CAAC,wBAAwB;IAiIhC,OAAO,CAAC,uBAAuB;YAmCjB,WAAW;IAgBzB,OAAO,CAAC,WAAW;IA0BnB,OAAO,CAAC,2BAA2B;CA4BpC"}

package/dist/nestjs/auth/service-token.guard.js

@@ -17,9 +17,10 @@ exports.ServiceTokenGuard = void 0;
 const common_1 = require("@nestjs/common");
 const subject_1 = require("@xemahq/contracts/subject");
 const oidc_guard_1 = require("@xemahq/oidc-guard");
+const org_authority_1 = require("../../lib/auth/org-authority");
 const org_claim_1 = require("../../lib/auth/org-claim");
 const auth_module_options_1 = require("./auth-module-options");
-const org_claim_required_1 = require("./org-claim-required");
+const proven_org_authority_required_1 = require("./proven-org-authority-required");
 const realm_token_verifier_1 = require("./realm-token-verifier");
 const decorator_metadata_1 = require("../decorator-metadata");
 let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
@@ -40,12 +41,15 @@ let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
         const token = authHeader.substring(7);
         try {
             const payload = await this.verifyToken(token);
-            const requireOrgClaim = (0, decorator_metadata_1.readDecoratorOverride)(org_claim_required_1.REQUIRE_ORG_CLAIM, [
+            const requireProvenOrgAuthority = (0, decorator_metadata_1.readDecoratorOverride)(proven_org_authority_required_1.REQUIRE_PROVEN_ORG_AUTHORITY, [
                 context.getHandler(),
                 context.getClass(),
             ]) === true;
-            this.assertOrgClaimMatchesHeader(payload, request, requireOrgClaim);
             this.assertServiceTokenClass(payload);
+            this.assertOrgClaimMatchesHeader(payload, request);
+            if (requireProvenOrgAuthority) {
+                this.assertProvenOrgAuthority(payload, request);
+            }
             request.serviceAuth = payload;
             return true;
         }
@@ -62,10 +66,73 @@ let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
             throw new common_1.UnauthorizedException('Invalid service token');
         }
     }
+    assertProvenOrgAuthority(claims, request) {
+        const headerName = org_claim_1.OrgHeaderName.Canonical;
+        const assertedOrgId = this.headerValue(request, 'x-xema-org-id') ?? '';
+        const verdict = (0, org_authority_1.resolveOrgAuthority)(claims, assertedOrgId, {
+            subjectKind: subject_1.SubjectKind.Service,
+            delegated: claims['act'] !== undefined && claims['act'] !== null,
+        });
+        if ((0, org_authority_1.isOrgAuthorityProven)(verdict)) {
+            return;
+        }
+        switch (verdict.source) {
+            case org_authority_1.OrgAuthoritySource.NoOrgAsserted:
+                this.logger.warn({
+                    message: 'service-token-org-header-required-but-absent',
+                });
+                throw new common_1.ForbiddenException({
+                    code: 'ORG_HEADER_REQUIRED',
+                    message: `This endpoint requires the ${headerName} tenant header.`,
+                });
+            case org_authority_1.OrgAuthoritySource.ClaimMismatch:
+                this.logger.warn({
+                    message: 'service-token-tenant-claim-mismatch',
+                    claimValue: verdict.tokenOrgId,
+                    header: headerName,
+                    headerValue: verdict.assertedOrgId,
+                });
+                throw new common_1.ForbiddenException({
+                    code: 'ORG_CLAIM_MISMATCH',
+                    message: `${headerName} does not match the tenant claim on the service token.`,
+                });
+            case org_authority_1.OrgAuthoritySource.ServiceRelayedContext:
+            case org_authority_1.OrgAuthoritySource.Unproven:
+                this.logger.warn({
+                    message: 'service-token-org-claim-required-but-absent',
+                    source: verdict.source,
+                });
+                throw new common_1.ForbiddenException({
+                    code: 'ORG_CLAIM_REQUIRED',
+                    message: 'This endpoint requires a tenant-scoped service token (missing ' +
+                        'xema_org_id claim).',
+                });
+            case org_authority_1.OrgAuthoritySource.OrgClaim:
+            case org_authority_1.OrgAuthoritySource.OrgMembership:
+                return;
+        }
+        throw new common_1.ForbiddenException({
+            code: 'ORG_AUTHORITY_UNRESOLVED',
+            message: 'Org authority could not be resolved for this request.',
+        });
+    }
     assertServiceTokenClass(payload) {
         const tokenClass = payload['token_class'];
-        if (typeof tokenClass === 'string' &&
-            tokenClass !== subject_1.TokenClass.ServiceJwt) {
+        if (typeof tokenClass !== 'string' || tokenClass.length === 0) {
+            this.logger.warn({
+                message: 'service-token-class-missing',
+                issuer: typeof payload['iss'] === 'string' ? payload['iss'] : undefined,
+                azp: typeof payload['azp'] === 'string' ? payload['azp'] : undefined,
+            });
+            throw new common_1.ForbiddenException({
+                code: 'TOKEN_CLASS_MISSING',
+                message: 'This service endpoint requires a bearer that STATES its token ' +
+                    'class. The presented token carries no token_class claim, which is ' +
+                    'the shape of a browser login. If this is a machine caller, its ' +
+                    'Keycloak client is not reconciled by identity-api.',
+            });
+        }
+        if (tokenClass !== subject_1.TokenClass.ServiceJwt) {
             this.logger.warn({
                 message: 'service-token-class-mismatch',
                 tokenClass,
@@ -100,29 +167,14 @@ let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
         }
         return '';
     }
-    assertOrgClaimMatchesHeader(claims, request, required = false) {
+    assertOrgClaimMatchesHeader(claims, request) {
         const resolved = (0, org_claim_1.resolveOrgClaim)(claims);
         if (!resolved) {
-            if (required) {
-                this.logger.warn({ message: 'service-token-org-claim-required-but-absent' });
-                throw new common_1.ForbiddenException({
-                    code: 'ORG_CLAIM_REQUIRED',
-                    message: 'This endpoint requires a tenant-scoped service token (missing ' +
-                        'xema_org_id claim).',
-                });
-            }
             return;
         }
         const headerName = org_claim_1.OrgHeaderName.Canonical;
         const headerValue = this.headerValue(request, 'x-xema-org-id');
         if (!headerValue) {
-            if (required) {
-                this.logger.warn({ message: 'service-token-org-header-required-but-absent' });
-                throw new common_1.ForbiddenException({
-                    code: 'ORG_HEADER_REQUIRED',
-                    message: `This endpoint requires the ${headerName} tenant header.`,
-                });
-            }
             return;
         }
         if (resolved.value.toLowerCase() !== headerValue.toLowerCase()) {

package/dist/nestjs/auth/service-token.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-token.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAyEA,2CAUwB;AACxB,uDAAuD;AACvD,mDAA2D;AAG3D,wDAA0E;AAC1E,+DAA4D;AAE5D,6DAAyD;AACzD,iEAA4D;AAC5D,8DAA8D;AAKvD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAqB;IAE9C,YAGE,WAA+B;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAiBD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAmC,CAAC;QAEvE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAe9C,MAAM,eAAe,GACnB,IAAA,0CAAqB,EAAU,sCAAiB,EAAE;gBAChD,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,KAAK,IAAI,CAAC;YACd,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;YACpE,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAGrC,OAAmC,CAAC,WAAW,GAAG,OAAO,CAAC;YAE3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKf,IACE,KAAK,YAAY,8BAAqB;gBACtC,KAAK,YAAY,2BAAkB,EACnC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,mCAAmC;gBAC5C,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;YACH,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAUO,uBAAuB,CAAC,OAAmB;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1C,IACE,OAAO,UAAU,KAAK,QAAQ;YAC9B,UAAU,KAAK,oBAAU,CAAC,UAAU,EACpC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,8BAA8B;gBACvC,UAAU;aACX,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,WAAW,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAOO,WAAW,CACjB,OAA8C,EAC9C,IAAY;QAEZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAU,EAAE,EAAE,CAC1E,GAAG,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IASO,2BAA2B,CACjC,MAAkB,EAClB,OAA8C,EAC9C,QAAQ,GAAG,KAAK;QAEhB,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;gBAC7E,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EACL,gEAAgE;wBAChE,qBAAqB;iBACxB,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;gBAC9E,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,8BAA8B,UAAU,iBAAiB;iBACnE,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,qCAAqC;gBAC9C,KAAK,EAAE,QAAQ,CAAC,GAAG;gBACnB,UAAU,EAAE,QAAQ,CAAC,KAAK;gBAC1B,MAAM,EAAE,UAAU;gBAClB,WAAW;aACZ,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAC1B,GAAG,UAAU,KAAK,WAAW,wBAAwB,QAAQ,CAAC,GAAG,8BAA8B,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAjNY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GANnB,iBAAiB,CAiN7B"}
+{"version":3,"file":"service-token.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAyEA,2CAUwB;AACxB,uDAAoE;AACpE,mDAA2D;AAG3D,gEAIsC;AACtC,wDAA0E;AAC1E,+DAA4D;AAE5D,mFAA+E;AAC/E,iEAA4D;AAC5D,8DAA8D;AAKvD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAqB;IAE9C,YAGE,WAA+B;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAiBD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAmC,CAAC;QAEvE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAc9C,MAAM,yBAAyB,GAC7B,IAAA,0CAAqB,EAAU,4DAA4B,EAAE;gBAC3D,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,KAAK,IAAI,CAAC;YAad,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAGA,OAAmC,CAAC,WAAW,GAAG,OAAO,CAAC;YAE3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKf,IACE,KAAK,YAAY,8BAAqB;gBACtC,KAAK,YAAY,2BAAkB,EACnC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,mCAAmC;gBAC5C,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;YACH,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAiDO,wBAAwB,CAC9B,MAAkB,EAClB,OAA8C;QAE9C,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC;QAEvE,MAAM,OAAO,GAAG,IAAA,mCAAmB,EAAC,MAAM,EAAE,aAAa,EAAE;YACzD,WAAW,EAAE,qBAAW,CAAC,OAAO;YAChC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI;SACjE,CAAC,CAAC;QAEH,IAAI,IAAA,oCAAoB,EAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,kCAAkB,CAAC,aAAa;gBACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,8CAA8C;iBACxD,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,8BAA8B,UAAU,iBAAiB;iBACnE,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,aAAa;gBAKnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,qCAAqC;oBAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,UAAU;oBAClB,WAAW,EAAE,OAAO,CAAC,aAAa;iBACnC,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,GAAG,UAAU,wDAAwD;iBAC/E,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,qBAAqB,CAAC;YAC9C,KAAK,kCAAkB,CAAC,QAAQ;gBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,6CAA6C;oBACtD,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EACL,gEAAgE;wBAChE,qBAAqB;iBACxB,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,QAAQ,CAAC;YACjC,KAAK,kCAAkB,CAAC,aAAa;gBAInC,OAAO;QACX,CAAC;QAKD,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;IA8DO,uBAAuB,CAAC,OAAmB;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,6BAA6B;gBACtC,MAAM,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvE,GAAG,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;aACrE,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EACL,gEAAgE;oBAChE,oEAAoE;oBACpE,iEAAiE;oBACjE,oDAAoD;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,KAAK,oBAAU,CAAC,UAAU,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,8BAA8B;gBACvC,UAAU;aACX,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,WAAW,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAOO,WAAW,CACjB,OAA8C,EAC9C,IAAY;QAEZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAU,EAAE,EAAE,CAC1E,GAAG,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IASO,2BAA2B,CACjC,MAAkB,EAClB,OAA8C;QAE9C,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,qCAAqC;gBAC9C,KAAK,EAAE,QAAQ,CAAC,GAAG;gBACnB,UAAU,EAAE,QAAQ,CAAC,KAAK;gBAC1B,MAAM,EAAE,UAAU;gBAClB,WAAW;aACZ,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAC1B,GAAG,UAAU,KAAK,WAAW,wBAAwB,QAAQ,CAAC,GAAG,8BAA8B,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAlYY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GANnB,iBAAiB,CAkY7B"}

package/dist/nestjs/global-exception.filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-exception.filter.d.ts","sourceRoot":"","sources":["../../src/nestjs/global-exception.filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAS,aAAa,EAAU,MAAM,gBAAgB,CAAC;AA2B/E,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,OAAO,GACjB,IAAI,CAoBN;AAkDD,qBACa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI;IAQpD,OAAO,CAAC,YAAY;CAkCrB"}
+{"version":3,"file":"global-exception.filter.d.ts","sourceRoot":"","sources":["../../src/nestjs/global-exception.filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAS,aAAa,EAAU,MAAM,gBAAgB,CAAC;AAmC/E,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,OAAO,GACjB,IAAI,CAiCN;AAkDD,qBACa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI;IAQpD,OAAO,CAAC,YAAY;CAkCrB"}

package/dist/nestjs/global-exception.filter.js

@@ -11,13 +11,21 @@ exports.GlobalExceptionFilter = void 0;
 exports.sendProblemResponse = sendProblemResponse;
 const common_1 = require("@nestjs/common");
 const http_1 = require("@xemahq/contracts/http");
+const problem_extensions_1 = require("./problem-extensions");
 const refusal_1 = require("./refusal");
+const problemRenderLogger = new common_1.Logger('ProblemDetailsRenderer');
 function sendProblemResponse(host, exception) {
     const ctx = host.switchToHttp();
     const response = ctx.getResponse();
     const request = ctx.getRequest();
     const refusal = (0, refusal_1.refusalFrom)(exception);
     const traceId = traceIdFromRequest(request);
+    if (refusal.droppedExtensions !== undefined && refusal.droppedExtensions.length > 0) {
+        const thrower = exception instanceof Error ? exception.constructor.name : typeof exception;
+        problemRenderLogger.error(`${request.method} ${request.url} - ${refusal.status} ${refusal.code} - ` +
+            `problem extension member(s) DROPPED from a ${thrower}: ` +
+            (0, problem_extensions_1.describeDroppedProblemExtensions)(refusal.droppedExtensions));
+    }
     response
         .status(refusal.status)
         .type(http_1.PROBLEM_DETAILS_CONTENT_TYPE)

package/dist/nestjs/global-exception.filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"global-exception.filter.js","sourceRoot":"","sources":["../../src/nestjs/global-exception.filter.ts"],"names":[],"mappings":";;;;;;;;;;AA2BA,kDAuBC;AAlDD,2CAA+E;AAG/E,iDAAsE;AAEtE,uCAAyE;AAsBzE,SAAgB,mBAAmB,CACjC,IAAmB,EACnB,SAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAY,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAW,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAA,qBAAW,EAAC,SAAS,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAM5C,QAAQ;SACL,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACtB,IAAI,CAAC,mCAA4B,CAAC;SAClC,IAAI,CACH,IAAA,2BAAiB,EAAC,OAAO,EAAE;QACzB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC,CACH,CAAC;AACN,CAAC;AAmDM,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IACf,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAEjE,KAAK,CAAC,SAAkB,EAAE,IAAmB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAE1D,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,IAAA,qBAAW,EAAC,SAAS,CAAC,CAAC,CAAC;QAE9D,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAEO,YAAY,CAClB,SAAkB,EAClB,OAAgB,EAChB,OAAgB;QAMhB,MAAM,eAAe,GACnB,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC;QAClD,MAAM,KAAK,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAE3B,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,MAAM,MAAM,OAAO,EAAE,EAC3D,KAAK,CACN,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAK1B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,MAAM,MAAM,OAAO,WAAW,mBAAmB,CAAC,OAAO,CAAC,EAAE,CACnG,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,MAAM,MAAM,OAAO,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AA7CY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,cAAK,GAAE;GACK,qBAAqB,CA6CjC;AAmBD,MAAM,WAAW,GAAG,mDAAmD,CAAC;AAExE,SAAS,kBAAkB,CAAC,OAAgB;IAM1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1D,CAAC;AAUD,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,IAAI,GAAI,OAAyC,CAAC,IAAI,CAAC;IAC7D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,GAAG,OAAO,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACpF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,IAAI,CAAC,MAAM,GAAG,CAAC;IAE5D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC7B,UAAU;QACV,OAAO;QACP,eAAe;QACf,QAAQ;QACR,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,aAAa;KACd,CAAC,CAAC;IACH,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"global-exception.filter.js","sourceRoot":"","sources":["../../src/nestjs/global-exception.filter.ts"],"names":[],"mappings":";;;;;;;;;;AAmCA,kDAoCC;AAvED,2CAA+E;AAG/E,iDAAsE;AAEtE,6DAAwE;AACxE,uCAAyE;AAOzE,MAAM,mBAAmB,GAAG,IAAI,eAAM,CAAC,wBAAwB,CAAC,CAAC;AAsBjE,SAAgB,mBAAmB,CACjC,IAAmB,EACnB,SAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAY,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAW,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAA,qBAAW,EAAC,SAAS,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAK5C,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,MAAM,OAAO,GACX,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC;QAC7E,mBAAmB,CAAC,KAAK,CACvB,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK;YACvE,8CAA8C,OAAO,IAAI;YACzD,IAAA,qDAAgC,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAC9D,CAAC;IACJ,CAAC;IAMD,QAAQ;SACL,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACtB,IAAI,CAAC,mCAA4B,CAAC;SAClC,IAAI,CACH,IAAA,2BAAiB,EAAC,OAAO,EAAE;QACzB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC,CACH,CAAC;AACN,CAAC;AAmDM,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IACf,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAEjE,KAAK,CAAC,SAAkB,EAAE,IAAmB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAE1D,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,IAAA,qBAAW,EAAC,SAAS,CAAC,CAAC,CAAC;QAE9D,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAEO,YAAY,CAClB,SAAkB,EAClB,OAAgB,EAChB,OAAgB;QAMhB,MAAM,eAAe,GACnB,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC;QAClD,MAAM,KAAK,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAE3B,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,MAAM,MAAM,OAAO,EAAE,EAC3D,KAAK,CACN,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAK1B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,MAAM,MAAM,OAAO,WAAW,mBAAmB,CAAC,OAAO,CAAC,EAAE,CACnG,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,MAAM,MAAM,OAAO,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AA7CY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,cAAK,GAAE;GACK,qBAAqB,CA6CjC;AAmBD,MAAM,WAAW,GAAG,mDAAmD,CAAC;AAExE,SAAS,kBAAkB,CAAC,OAAgB;IAM1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1D,CAAC;AAUD,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,IAAI,GAAI,OAAyC,CAAC,IAAI,CAAC;IAC7D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,GAAG,OAAO,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACpF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,IAAI,CAAC,MAAM,GAAG,CAAC;IAE5D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC7B,UAAU;QACV,OAAO;QACP,eAAe;QACf,QAAQ;QACR,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,aAAa;KACd,CAAC,CAAC;IACH,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC"}