@xemahq/platform-common 0.40.0 → 0.41.0

package/dist/nestjs/auth/claim-authority.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnsupportedContextVersionError = exports.InvalidBoundaryContextError = exports.BoundarySubjectKind = exports.FOREIGN_CALLER_IDENTITY_CLAIMS = exports.PLATFORM_AUTHORITY_CLAIMS = exports.ACT_CLAIM = exports.TOKEN_CLASS_CLAIM = exports.DELEGATION_ID_CLAIM = exports.SUPPORTED_CONTEXT_VERSION = exports.CONTEXT_VERSION_CLAIM = void 0;
+exports.kernelSubjectKindForBoundary = kernelSubjectKindForBoundary;
+exports.normalizeClaimAuthorityClaims = normalizeClaimAuthorityClaims;
+exports.withoutPlatformAuthorityClaims = withoutPlatformAuthorityClaims;
+exports.resolveDelegationIdFromBoundaryClaims = resolveDelegationIdFromBoundaryClaims;
+const common_1 = require("@nestjs/common");
+const identity_client_1 = require("@xemahq/identity-client");
+const subject_1 = require("@xemahq/contracts/subject");
+const org_claim_1 = require("../../lib/auth/org-claim");
+const org_role_1 = require("../../lib/auth/org-role");
+const actor_classification_1 = require("./actor-classification");
+const boundary_context_brand_1 = require("./boundary-context-brand");
+exports.CONTEXT_VERSION_CLAIM = 'ctx_ver';
+exports.SUPPORTED_CONTEXT_VERSION = 1;
+exports.DELEGATION_ID_CLAIM = 'did';
+exports.TOKEN_CLASS_CLAIM = 'token_class';
+exports.ACT_CLAIM = 'act';
+exports.PLATFORM_AUTHORITY_CLAIMS = [
+    'realm_access',
+    boundary_context_brand_1.PLATFORM_ROLES_CLAIM,
+    org_role_1.OrgRolesClaimKey.Canonical,
+    org_claim_1.OrgClaimKey.Canonical,
+    exports.TOKEN_CLASS_CLAIM,
+    actor_classification_1.SUBJECT_KIND_CLAIM,
+    exports.ACT_CLAIM,
+    exports.DELEGATION_ID_CLAIM,
+    exports.CONTEXT_VERSION_CLAIM,
+    identity_client_1.PRINCIPAL_ID_CLAIM,
+];
+exports.FOREIGN_CALLER_IDENTITY_CLAIMS = [
+    'azp',
+    'client_id',
+];
+var BoundarySubjectKind;
+(function (BoundarySubjectKind) {
+    BoundarySubjectKind["User"] = "user";
+    BoundarySubjectKind["Workload"] = "workload";
+    BoundarySubjectKind["Agent"] = "agent";
+})(BoundarySubjectKind || (exports.BoundarySubjectKind = BoundarySubjectKind = {}));
+function kernelSubjectKindForBoundary(kind) {
+    switch (kind) {
+        case BoundarySubjectKind.User:
+            return subject_1.SubjectKind.User;
+        case BoundarySubjectKind.Workload:
+            return subject_1.SubjectKind.Service;
+        case BoundarySubjectKind.Agent:
+            return subject_1.SubjectKind.Agent;
+    }
+}
+function parseBoundarySubjectKind(value) {
+    return typeof value === 'string' &&
+        Object.values(BoundarySubjectKind).includes(value)
+        ? value
+        : null;
+}
+class InvalidBoundaryContextError extends common_1.UnauthorizedException {
+    constructor(issuer, reason) {
+        super(`The access token from claim authority '${issuer}' is refused: ${reason} ` +
+            `A claim-authority context carries its classification explicitly; ` +
+            `nothing is inferred from its absence.`);
+    }
+}
+exports.InvalidBoundaryContextError = InvalidBoundaryContextError;
+class UnsupportedContextVersionError extends InvalidBoundaryContextError {
+    constructor(issuer, declared) {
+        super(issuer, declared === undefined
+            ? `it carries no "${exports.CONTEXT_VERSION_CLAIM}" claim.`
+            : `"${exports.CONTEXT_VERSION_CLAIM}" is ${JSON.stringify(declared)}; this ` +
+                `kernel reads version ${exports.SUPPORTED_CONTEXT_VERSION} only.`);
+    }
+}
+exports.UnsupportedContextVersionError = UnsupportedContextVersionError;
+function normalizeClaimAuthorityClaims(payload, issuer) {
+    const ctxVer = payload[exports.CONTEXT_VERSION_CLAIM];
+    if (ctxVer !== exports.SUPPORTED_CONTEXT_VERSION) {
+        throw new UnsupportedContextVersionError(issuer, ctxVer);
+    }
+    const declaredClass = (0, actor_classification_1.asNonEmptyString)(payload[exports.TOKEN_CLASS_CLAIM]);
+    if (!declaredClass) {
+        throw new InvalidBoundaryContextError(issuer, `it carries no "${exports.TOKEN_CLASS_CLAIM}" claim.`);
+    }
+    if (!Object.values(subject_1.TokenClass).includes(declaredClass)) {
+        throw new InvalidBoundaryContextError(issuer, `"${exports.TOKEN_CLASS_CLAIM}" ${JSON.stringify(declaredClass)} is not a known TokenClass.`);
+    }
+    const tokenClass = declaredClass;
+    if (!(actor_classification_1.SUBJECT_KIND_CLAIM in payload)) {
+        throw new InvalidBoundaryContextError(issuer, `it carries no "${actor_classification_1.SUBJECT_KIND_CLAIM}" claim.`);
+    }
+    const boundaryKind = parseBoundarySubjectKind(payload[actor_classification_1.SUBJECT_KIND_CLAIM]);
+    if (!boundaryKind) {
+        throw new InvalidBoundaryContextError(issuer, `"${actor_classification_1.SUBJECT_KIND_CLAIM}" ${JSON.stringify(payload[actor_classification_1.SUBJECT_KIND_CLAIM])} ` +
+            `is not one of ${Object.values(BoundarySubjectKind).join(' | ')}.`);
+    }
+    const subjectKind = kernelSubjectKindForBoundary(boundaryKind);
+    if ((0, actor_classification_1.subjectKindForTokenClass)(tokenClass) !== subjectKind) {
+        throw new InvalidBoundaryContextError(issuer, `"${exports.TOKEN_CLASS_CLAIM}" '${tokenClass}' and "${actor_classification_1.SUBJECT_KIND_CLAIM}" ` +
+            `'${boundaryKind}' name different kinds of subject.`);
+    }
+    const rawRoles = payload[boundary_context_brand_1.PLATFORM_ROLES_CLAIM];
+    if (rawRoles !== undefined &&
+        (!Array.isArray(rawRoles) || rawRoles.some((r) => typeof r !== 'string'))) {
+        throw new InvalidBoundaryContextError(issuer, `"${boundary_context_brand_1.PLATFORM_ROLES_CLAIM}" must be an array of strings.`);
+    }
+    const platformRoles = rawRoles ?? [];
+    assertSingleOrgScope(payload, issuer);
+    const hasAct = payload[exports.ACT_CLAIM] !== undefined;
+    const hasDid = payload[exports.DELEGATION_ID_CLAIM] !== undefined;
+    if (hasDid && !(0, actor_classification_1.asNonEmptyString)(payload[exports.DELEGATION_ID_CLAIM])) {
+        throw new InvalidBoundaryContextError(issuer, `"${exports.DELEGATION_ID_CLAIM}" must be a non-empty string.`);
+    }
+    if (hasAct !== hasDid) {
+        throw new InvalidBoundaryContextError(issuer, hasAct
+            ? `it carries "${exports.ACT_CLAIM}" with no "${exports.DELEGATION_ID_CLAIM}" — a ` +
+                `delegation with no validated record.`
+            : `it carries "${exports.DELEGATION_ID_CLAIM}" with no "${exports.ACT_CLAIM}".`);
+    }
+    const normalized = { ...payload };
+    delete normalized['realm_access'];
+    normalized[exports.TOKEN_CLASS_CLAIM] = tokenClass;
+    normalized[actor_classification_1.SUBJECT_KIND_CLAIM] = subjectKind;
+    normalized[boundary_context_brand_1.PLATFORM_ROLES_CLAIM] = [...platformRoles];
+    if (hasAct) {
+        normalized[exports.ACT_CLAIM] = normalizeActHops(payload[exports.ACT_CLAIM], issuer);
+    }
+    normalized[boundary_context_brand_1.BOUNDARY_CONTEXT_CLAIMS] = true;
+    return normalized;
+}
+function withoutPlatformAuthorityClaims(payload) {
+    const stripped = { ...payload };
+    for (const claim of [
+        ...exports.PLATFORM_AUTHORITY_CLAIMS,
+        ...exports.FOREIGN_CALLER_IDENTITY_CLAIMS,
+    ]) {
+        delete stripped[claim];
+    }
+    return stripped;
+}
+function resolveDelegationIdFromBoundaryClaims(claims) {
+    return (0, actor_classification_1.asNonEmptyString)(claims[exports.DELEGATION_ID_CLAIM]);
+}
+function assertSingleOrgScope(payload, issuer) {
+    const orgRoles = (0, org_role_1.resolveOrgRoles)(payload);
+    const orgIds = Object.keys(orgRoles);
+    if (orgIds.length === 0)
+        return;
+    const tenant = (0, org_claim_1.resolveOrgClaim)(payload)?.value;
+    if (!tenant) {
+        throw new InvalidBoundaryContextError(issuer, `it carries "${org_role_1.OrgRolesClaimKey.Canonical}" but no ` +
+            `"${org_claim_1.OrgClaimKey.Canonical}" — a context is minted for ONE org.`);
+    }
+    const foreign = orgIds.filter((orgId) => orgId.toLowerCase() !== tenant.toLowerCase());
+    if (foreign.length > 0) {
+        throw new InvalidBoundaryContextError(issuer, `"${org_role_1.OrgRolesClaimKey.Canonical}" names org(s) other than the ` +
+            `"${org_claim_1.OrgClaimKey.Canonical}" it was minted for — a context carries ` +
+            `the roles of ONE org, never every membership.`);
+    }
+}
+function normalizeActHops(act, issuer) {
+    if (!act || typeof act !== 'object' || Array.isArray(act)) {
+        return act;
+    }
+    const hop = { ...act };
+    if (actor_classification_1.SUBJECT_KIND_CLAIM in hop) {
+        const kind = parseBoundarySubjectKind(hop[actor_classification_1.SUBJECT_KIND_CLAIM]);
+        if (!kind) {
+            throw new InvalidBoundaryContextError(issuer, `a delegation hop states "${actor_classification_1.SUBJECT_KIND_CLAIM}" ` +
+                `${JSON.stringify(hop[actor_classification_1.SUBJECT_KIND_CLAIM])}, outside the boundary vocabulary.`);
+        }
+        hop[actor_classification_1.SUBJECT_KIND_CLAIM] = kernelSubjectKindForBoundary(kind);
+    }
+    if (hop[exports.ACT_CLAIM] !== undefined) {
+        hop[exports.ACT_CLAIM] = normalizeActHops(hop[exports.ACT_CLAIM], issuer);
+    }
+    return hop;
+}
+//# sourceMappingURL=claim-authority.js.map

package/dist/nestjs/auth/claim-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-authority.js","sourceRoot":"","sources":["../../../src/nestjs/auth/claim-authority.ts"],"names":[],"mappings":";;;AAmHA,oEAWC;AA2DD,sEAwFC;AAQD,wEAWC;AAQD,sFAIC;AAhTD,2CAAuD;AACvD,6DAA6D;AAC7D,uDAAoE;AAEpE,wDAAwE;AACxE,sDAA4E;AAC5E,iEAIgC;AAChC,qEAGkC;AAyBrB,QAAA,qBAAqB,GAAG,SAAS,CAAC;AAGlC,QAAA,yBAAyB,GAAG,CAAC,CAAC;AAG9B,QAAA,mBAAmB,GAAG,KAAK,CAAC;AAG5B,QAAA,iBAAiB,GAAG,aAAa,CAAC;AAGlC,QAAA,SAAS,GAAG,KAAK,CAAC;AAalB,QAAA,yBAAyB,GAAsB;IAC1D,cAAc;IACd,6CAAoB;IACpB,2BAAgB,CAAC,SAAS;IAC1B,uBAAW,CAAC,SAAS;IACrB,yBAAiB;IACjB,yCAAkB;IAClB,iBAAS;IACT,2BAAmB;IACnB,6BAAqB;IACrB,oCAAkB;CACnB,CAAC;AAiBW,QAAA,8BAA8B,GAAsB;IAC/D,KAAK;IACL,WAAW;CACZ,CAAC;AAOF,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,4CAAqB,CAAA;IACrB,sCAAe,CAAA;AACjB,CAAC,EAJW,mBAAmB,mCAAnB,mBAAmB,QAI9B;AASD,SAAgB,4BAA4B,CAC1C,IAAyB;IAEzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,mBAAmB,CAAC,IAAI;YAC3B,OAAO,qBAAW,CAAC,IAAI,CAAC;QAC1B,KAAK,mBAAmB,CAAC,QAAQ;YAC/B,OAAO,qBAAW,CAAC,OAAO,CAAC;QAC7B,KAAK,mBAAmB,CAAC,KAAK;YAC5B,OAAO,qBAAW,CAAC,KAAK,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC7B,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAA6B;QAChC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAGD,MAAa,2BAA4B,SAAQ,8BAAqB;IACpE,YAAY,MAAc,EAAE,MAAc;QACxC,KAAK,CACH,0CAA0C,MAAM,iBAAiB,MAAM,GAAG;YACxE,mEAAmE;YACnE,uCAAuC,CAC1C,CAAC;IACJ,CAAC;CACF;AARD,kEAQC;AAOD,MAAa,8BAA+B,SAAQ,2BAA2B;IAC7E,YAAY,MAAc,EAAE,QAAiB;QAC3C,KAAK,CACH,MAAM,EACN,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,kBAAkB,6BAAqB,UAAU;YACnD,CAAC,CAAC,IAAI,6BAAqB,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS;gBAChE,wBAAwB,iCAAyB,QAAQ,CAChE,CAAC;IACJ,CAAC;CACF;AAVD,wEAUC;AAwBD,SAAgB,6BAA6B,CAE3C,OAAU,EAAE,MAAc;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,6BAAqB,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,iCAAyB,EAAE,CAAC;QACzC,MAAM,IAAI,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,aAAa,GAAG,IAAA,uCAAgB,EAAC,OAAO,CAAC,yBAAiB,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,kBAAkB,yBAAiB,UAAU,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,CAAE,MAAM,CAAC,MAAM,CAAC,oBAAU,CAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,yBAAiB,KAAK,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,6BAA6B,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,aAA2B,CAAC;IAE/C,IAAI,CAAC,CAAC,yCAAkB,IAAI,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,kBAAkB,yCAAkB,UAAU,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,OAAO,CAAC,yCAAkB,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,yCAAkB,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yCAAkB,CAAC,CAAC,GAAG;YACvE,iBAAiB,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,4BAA4B,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,IAAA,+CAAwB,EAAC,UAAU,CAAC,KAAK,WAAW,EAAE,CAAC;QACzD,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,yBAAiB,MAAM,UAAU,UAAU,yCAAkB,IAAI;YACnE,IAAI,YAAY,oCAAoC,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,6CAAoB,CAAC,CAAC;IAC/C,IACE,QAAQ,KAAK,SAAS;QACtB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,6CAAoB,gCAAgC,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAI,QAAiC,IAAI,EAAE,CAAC;IAE/D,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAS,CAAC,KAAK,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,2BAAmB,CAAC,KAAK,SAAS,CAAC;IAC1D,IAAI,MAAM,IAAI,CAAC,IAAA,uCAAgB,EAAC,OAAO,CAAC,2BAAmB,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,2BAAmB,+BAA+B,CACvD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,MAAM;YACJ,CAAC,CAAC,eAAe,iBAAS,cAAc,2BAAmB,QAAQ;gBAC/D,sCAAsC;YAC1C,CAAC,CAAC,eAAe,2BAAmB,cAAc,iBAAS,IAAI,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAqC,EAAE,GAAG,OAAO,EAAE,CAAC;IACpE,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;IAClC,UAAU,CAAC,yBAAiB,CAAC,GAAG,UAAU,CAAC;IAC3C,UAAU,CAAC,yCAAkB,CAAC,GAAG,WAAW,CAAC;IAC7C,UAAU,CAAC,6CAAoB,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,iBAAS,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,iBAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IACD,UAAU,CAAC,gDAAuB,CAAC,GAAG,IAAI,CAAC;IAC3C,OAAO,UAAe,CAAC;AACzB,CAAC;AAQD,SAAgB,8BAA8B,CAE5C,OAAU;IACV,MAAM,QAAQ,GAA4B,EAAE,GAAG,OAAO,EAAE,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI;QAClB,GAAG,iCAAyB;QAC5B,GAAG,sCAA8B;KAClC,EAAE,CAAC;QACF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,QAAa,CAAC;AACvB,CAAC;AAQD,SAAgB,qCAAqC,CACnD,MAA+B;IAE/B,OAAO,IAAA,uCAAgB,EAAC,MAAM,CAAC,2BAAmB,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAgC,EAChC,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,eAAe,2BAAgB,CAAC,SAAS,WAAW;YAClD,IAAI,uBAAW,CAAC,SAAS,sCAAsC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CACxD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,2BAAgB,CAAC,SAAS,gCAAgC;YAC5D,IAAI,uBAAW,CAAC,SAAS,0CAA0C;YACnE,+CAA+C,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,MAAc;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAG1D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,GAAI,GAA+B,EAAE,CAAC;IAC7E,IAAI,yCAAkB,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,yCAAkB,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,4BAA4B,yCAAkB,IAAI;gBAChD,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yCAAkB,CAAC,CAAC,oCAAoC,CACjF,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,yCAAkB,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,iBAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,iBAAS,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,iBAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/nestjs/auth/declared-subject-class.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"declared-subject-class.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AA+BlE,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM;CAW3B;AAWD,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM7C;AAsBD,wBAAgB,8BAA8B,CAC5C,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,CAc5C"}
+{"version":3,"file":"declared-subject-class.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAOvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAiClE,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM;CAY3B;AAWD,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM7C;AAsCD,wBAAgB,8BAA8B,CAC5C,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,CAe5C"}

package/dist/nestjs/auth/declared-subject-class.js

@@ -4,15 +4,17 @@ exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerEr
 exports.claimsWithDeclaredSubjectClass = claimsWithDeclaredSubjectClass;
 const common_1 = require("@nestjs/common");
 const subject_1 = require("@xemahq/contracts/subject");
+const claim_authority_1 = require("./claim-authority");
 class UnclassifiableForeignBearerError extends common_1.UnauthorizedException {
     constructor(issuer) {
         super(`The access token was proved by trusted issuer '${issuer}', which ` +
-            `declares no "subjectClass", and the token carries no "token_class" ` +
-            `of its own. Nothing states what kind of subject this is, so it is ` +
+            `declares no "subjectClass". A token's own "token_class" is honoured ` +
+            `only from the claim authority, so nothing states what kind of ` +
+            `subject this is, and it is ` +
             `refused rather than assumed to be a user — the assumption that a ` +
             `signal-less token is a browser login holds for this deployment's own ` +
             `realm and for nothing else. Declare "subjectClass" on the issuer's ` +
-            `registry entry, or have the issuer stamp "token_class".`);
+            `registry entry, or "claimAuthority": true if it is the identity boundary.`);
     }
 }
 exports.UnclassifiableForeignBearerError = UnclassifiableForeignBearerError;
@@ -26,9 +28,10 @@ exports.UnknownDeclaredSubjectClassError = UnknownDeclaredSubjectClassError;
 function claimsWithDeclaredSubjectClass(payload, source) {
     if (source.kind !== 'trusted-issuer')
         return payload;
-    if (typeof payload.token_class === 'string' && payload.token_class) {
-        return payload;
+    if (source.entry.claimAuthority === true) {
+        return (0, claim_authority_1.normalizeClaimAuthorityClaims)(payload, source.entry.issuer);
     }
+    const foreign = (0, claim_authority_1.withoutPlatformAuthorityClaims)(payload);
     const declared = source.entry.subjectClass;
     if (!declared) {
         throw new UnclassifiableForeignBearerError(source.entry.issuer);
@@ -37,6 +40,6 @@ function claimsWithDeclaredSubjectClass(payload, source) {
     if (!parsed.success) {
         throw new UnknownDeclaredSubjectClassError(source.entry.issuer, declared);
     }
-    return { ...payload, token_class: parsed.data };
+    return { ...foreign, token_class: parsed.data };
 }
 //# sourceMappingURL=declared-subject-class.js.map

package/dist/nestjs/auth/declared-subject-class.js.map

@@ -1 +1 @@
-{"version":3,"file":"declared-subject-class.js","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":";;;AAsFA,wEAgBC;AAtGD,2CAAuD;AACvD,uDAA6D;AAiC7D,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc;QACxB,KAAK,CACH,kDAAkD,MAAM,WAAW;YACjE,qEAAqE;YACrE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;CACF;AAZD,4EAYC;AAWD,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc,EAAE,QAAgB;QAC1C,KAAK,CACH,mBAAmB,MAAM,0BAA0B;YACjD,IAAI,QAAQ,qCAAqC,CACpD,CAAC;IACJ,CAAC;CACF;AAPD,4EAOC;AAsBD,SAAgB,8BAA8B,CAE5C,OAAU,EAAE,MAA2B;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,0BAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC"}
+{"version":3,"file":"declared-subject-class.js","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":";;;AA6GA,wEAiBC;AA9HD,2CAAuD;AACvD,uDAA6D;AAE7D,uDAG2B;AAkC3B,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc;QACxB,KAAK,CACH,kDAAkD,MAAM,WAAW;YACjE,sEAAsE;YACtE,gEAAgE;YAChE,6BAA6B;YAC7B,mEAAmE;YACnE,uEAAuE;YACvE,qEAAqE;YACrE,2EAA2E,CAC9E,CAAC;IACJ,CAAC;CACF;AAbD,4EAaC;AAWD,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc,EAAE,QAAgB;QAC1C,KAAK,CACH,mBAAmB,MAAM,0BAA0B;YACjD,IAAI,QAAQ,qCAAqC,CACpD,CAAC;IACJ,CAAC;CACF;AAPD,4EAOC;AAsCD,SAAgB,8BAA8B,CAE5C,OAAU,EAAE,MAA2B;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,IAAA,+CAA6B,EAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,gDAA8B,EAAC,OAAO,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,0BAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC"}

package/dist/nestjs/auth/index.d.ts

@@ -20,5 +20,7 @@ export { resolveActorChainFromClaims, UnclassifiableActorHopError, UnknownActorH
 export { SUBJECT_KIND_CLAIM, readDeclaredSubjectKind, UnknownTokenClassError, } from './actor-classification';
 export { RealmTokenVerifier, type MultiRealmKeySource, type VerifiedTokenSource, } from './realm-token-verifier';
 export { UnclassifiableForeignBearerError, UnknownDeclaredSubjectClassError, claimsWithDeclaredSubjectClass, } from './declared-subject-class';
+export { BoundarySubjectKind, CONTEXT_VERSION_CLAIM, DELEGATION_ID_CLAIM, FOREIGN_CALLER_IDENTITY_CLAIMS, InvalidBoundaryContextError, PLATFORM_AUTHORITY_CLAIMS, SUPPORTED_CONTEXT_VERSION, UnsupportedContextVersionError, kernelSubjectKindForBoundary, } from './claim-authority';
+export { PLATFORM_ROLES_CLAIM } from './boundary-context-brand';
 export { DEFAULT_TRUSTED_ISSUER_ALGORITHMS, TRUSTED_ISSUERS_ENV_VAR, TrustedIssuerConfigError, TrustedIssuerRegistry, parseTrustedIssuersFromEnv, type TrustedIssuerEntry, } from '@xemahq/oidc-guard';
 //# sourceMappingURL=index.d.ts.map

package/dist/nestjs/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,cAAc,GACf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,cAAc,GACf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAOhE,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}

package/dist/nestjs/auth/index.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resetOrgAuthorityCensus = exports.orgAuthorityRelayCensus = exports.orgAuthorityCensus = exports.recordServiceRelayedOrgAuthority = exports.recordUnprovenOrgAuthority = exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = exports.orgScopedClaim = exports.mintOrgScopedToken = exports.describeOrgScopeWitness = exports.orgScopeFromPlatformSweep = exports.orgScopeFromOwningRow = exports.orgScopeFromProvenRequest = exports.UnprovenOrgScopeError = exports.OrgScopeProvenance = exports.orgAuthorityRequiresProof = exports.isOrgAuthorityProven = exports.resolveOrgAuthority = exports.OrgAuthoritySource = exports.REQUIRE_PROVEN_ORG_AUTHORITY = exports.RequireProvenOrgAuthority = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.PlatformAdminGuard = exports.resolveOrgAuthorityInstrument = exports.holdsOrgAuthority = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.OrgRole = exports.ServiceOrOrgRoleGuard = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.isDirectServiceActor = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = void 0;
-exports.parseTrustedIssuersFromEnv = exports.TrustedIssuerRegistry = exports.TrustedIssuerConfigError = exports.TRUSTED_ISSUERS_ENV_VAR = exports.DEFAULT_TRUSTED_ISSUER_ALGORITHMS = exports.claimsWithDeclaredSubjectClass = exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerError = exports.RealmTokenVerifier = exports.UnknownTokenClassError = exports.readDeclaredSubjectKind = exports.SUBJECT_KIND_CLAIM = exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = exports.resolveActorChainFromClaims = void 0;
+exports.parseTrustedIssuersFromEnv = exports.TrustedIssuerRegistry = exports.TrustedIssuerConfigError = exports.TRUSTED_ISSUERS_ENV_VAR = exports.DEFAULT_TRUSTED_ISSUER_ALGORITHMS = exports.PLATFORM_ROLES_CLAIM = exports.kernelSubjectKindForBoundary = exports.UnsupportedContextVersionError = exports.SUPPORTED_CONTEXT_VERSION = exports.PLATFORM_AUTHORITY_CLAIMS = exports.InvalidBoundaryContextError = exports.FOREIGN_CALLER_IDENTITY_CLAIMS = exports.DELEGATION_ID_CLAIM = exports.CONTEXT_VERSION_CLAIM = exports.BoundarySubjectKind = exports.claimsWithDeclaredSubjectClass = exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerError = exports.RealmTokenVerifier = exports.UnknownTokenClassError = exports.readDeclaredSubjectKind = exports.SUBJECT_KIND_CLAIM = exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = exports.resolveActorChainFromClaims = void 0;
 var auth_module_1 = require("./auth.module");
 Object.defineProperty(exports, "AuthModule", { enumerable: true, get: function () { return auth_module_1.AuthModule; } });
 var auth_module_options_1 = require("./auth-module-options");
@@ -86,6 +86,18 @@ var declared_subject_class_1 = require("./declared-subject-class");
 Object.defineProperty(exports, "UnclassifiableForeignBearerError", { enumerable: true, get: function () { return declared_subject_class_1.UnclassifiableForeignBearerError; } });
 Object.defineProperty(exports, "UnknownDeclaredSubjectClassError", { enumerable: true, get: function () { return declared_subject_class_1.UnknownDeclaredSubjectClassError; } });
 Object.defineProperty(exports, "claimsWithDeclaredSubjectClass", { enumerable: true, get: function () { return declared_subject_class_1.claimsWithDeclaredSubjectClass; } });
+var claim_authority_1 = require("./claim-authority");
+Object.defineProperty(exports, "BoundarySubjectKind", { enumerable: true, get: function () { return claim_authority_1.BoundarySubjectKind; } });
+Object.defineProperty(exports, "CONTEXT_VERSION_CLAIM", { enumerable: true, get: function () { return claim_authority_1.CONTEXT_VERSION_CLAIM; } });
+Object.defineProperty(exports, "DELEGATION_ID_CLAIM", { enumerable: true, get: function () { return claim_authority_1.DELEGATION_ID_CLAIM; } });
+Object.defineProperty(exports, "FOREIGN_CALLER_IDENTITY_CLAIMS", { enumerable: true, get: function () { return claim_authority_1.FOREIGN_CALLER_IDENTITY_CLAIMS; } });
+Object.defineProperty(exports, "InvalidBoundaryContextError", { enumerable: true, get: function () { return claim_authority_1.InvalidBoundaryContextError; } });
+Object.defineProperty(exports, "PLATFORM_AUTHORITY_CLAIMS", { enumerable: true, get: function () { return claim_authority_1.PLATFORM_AUTHORITY_CLAIMS; } });
+Object.defineProperty(exports, "SUPPORTED_CONTEXT_VERSION", { enumerable: true, get: function () { return claim_authority_1.SUPPORTED_CONTEXT_VERSION; } });
+Object.defineProperty(exports, "UnsupportedContextVersionError", { enumerable: true, get: function () { return claim_authority_1.UnsupportedContextVersionError; } });
+Object.defineProperty(exports, "kernelSubjectKindForBoundary", { enumerable: true, get: function () { return claim_authority_1.kernelSubjectKindForBoundary; } });
+var boundary_context_brand_1 = require("./boundary-context-brand");
+Object.defineProperty(exports, "PLATFORM_ROLES_CLAIM", { enumerable: true, get: function () { return boundary_context_brand_1.PLATFORM_ROLES_CLAIM; } });
 var oidc_guard_1 = require("@xemahq/oidc-guard");
 Object.defineProperty(exports, "DEFAULT_TRUSTED_ISSUER_ALGORITHMS", { enumerable: true, get: function () { return oidc_guard_1.DEFAULT_TRUSTED_ISSUER_ALGORITHMS; } });
 Object.defineProperty(exports, "TRUSTED_ISSUERS_ENV_VAR", { enumerable: true, get: function () { return oidc_guard_1.TRUSTED_ISSUERS_ENV_VAR; } });

package/dist/nestjs/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":";;;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAI+B;AAH7B,0HAAA,mBAAmB,OAAA;AAIrB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,6DAG+B;AAF7B,wHAAA,iBAAiB,OAAA;AACjB,2HAAA,oBAAoB,OAAA;AAEtB,yDAI6B;AAH3B,oHAAA,eAAe,OAAA;AACf,sHAAA,iBAAiB,OAAA;AACjB,wHAAA,mBAAmB,OAAA;AAErB,mDAI0B;AAHxB,8GAAA,YAAY,OAAA;AACZ,gHAAA,cAAc,OAAA;AACd,kHAAA,gBAAgB,OAAA;AAElB,yEAAoE;AAA3D,kIAAA,qBAAqB,OAAA;AAC9B,oDAOiC;AAN/B,mGAAA,OAAO,OAAA;AACP,4GAAA,gBAAgB,OAAA;AAChB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AACpB,4GAAA,gBAAgB,OAAA;AAElB,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,6DAI+B;AAH7B,wHAAA,iBAAiB,OAAA;AACjB,oIAAA,6BAA6B,OAAA;AAG/B,+DAA4D;AAAnD,0HAAA,kBAAkB,OAAA;AAC3B,yEAGqC;AAFnC,oIAAA,uBAAuB,OAAA;AAGzB,sDAKkC;AAJhC,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AACb,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA;AAEjB,iFAA0G;AAAjG,0IAAA,yBAAyB,OAAA;AAAE,6IAAA,4BAA4B,OAAA;AAChE,8DAQsC;AAPpC,mHAAA,kBAAkB,OAAA;AAIlB,oHAAA,mBAAmB,OAAA;AACnB,qHAAA,oBAAoB,OAAA;AACpB,0HAAA,yBAAyB,OAAA;AAE3B,gEAYuC;AAXrC,oHAAA,kBAAkB,OAAA;AAGlB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,yHAAA,uBAAuB,OAAA;AACvB,oHAAA,kBAAkB,OAAA;AAElB,gHAAA,cAAc,OAAA;AAEhB,wFAUmD;AATjD,6IAAA,+BAA+B,OAAA;AAC/B,+HAAA,iBAAiB,OAAA;AAGjB,wIAAA,0BAA0B,OAAA;AAC1B,8IAAA,gCAAgC,OAAA;AAChC,gIAAA,kBAAkB,OAAA;AAClB,qIAAA,uBAAuB,OAAA;AACvB,qIAAA,uBAAuB,OAAA;AAEzB,uDAM4B;AAL1B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAIpB,mEAIkC;AAHhC,0IAAA,gCAAgC,OAAA;AAChC,0IAAA,gCAAgC,OAAA;AAChC,wIAAA,8BAA8B,OAAA;AAQhC,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":";;;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAI+B;AAH7B,0HAAA,mBAAmB,OAAA;AAIrB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,6DAG+B;AAF7B,wHAAA,iBAAiB,OAAA;AACjB,2HAAA,oBAAoB,OAAA;AAEtB,yDAI6B;AAH3B,oHAAA,eAAe,OAAA;AACf,sHAAA,iBAAiB,OAAA;AACjB,wHAAA,mBAAmB,OAAA;AAErB,mDAI0B;AAHxB,8GAAA,YAAY,OAAA;AACZ,gHAAA,cAAc,OAAA;AACd,kHAAA,gBAAgB,OAAA;AAElB,yEAAoE;AAA3D,kIAAA,qBAAqB,OAAA;AAC9B,oDAOiC;AAN/B,mGAAA,OAAO,OAAA;AACP,4GAAA,gBAAgB,OAAA;AAChB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AACpB,4GAAA,gBAAgB,OAAA;AAElB,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,6DAI+B;AAH7B,wHAAA,iBAAiB,OAAA;AACjB,oIAAA,6BAA6B,OAAA;AAG/B,+DAA4D;AAAnD,0HAAA,kBAAkB,OAAA;AAC3B,yEAGqC;AAFnC,oIAAA,uBAAuB,OAAA;AAGzB,sDAKkC;AAJhC,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AACb,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA;AAEjB,iFAA0G;AAAjG,0IAAA,yBAAyB,OAAA;AAAE,6IAAA,4BAA4B,OAAA;AAChE,8DAQsC;AAPpC,mHAAA,kBAAkB,OAAA;AAIlB,oHAAA,mBAAmB,OAAA;AACnB,qHAAA,oBAAoB,OAAA;AACpB,0HAAA,yBAAyB,OAAA;AAE3B,gEAYuC;AAXrC,oHAAA,kBAAkB,OAAA;AAGlB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,yHAAA,uBAAuB,OAAA;AACvB,oHAAA,kBAAkB,OAAA;AAElB,gHAAA,cAAc,OAAA;AAEhB,wFAUmD;AATjD,6IAAA,+BAA+B,OAAA;AAC/B,+HAAA,iBAAiB,OAAA;AAGjB,wIAAA,0BAA0B,OAAA;AAC1B,8IAAA,gCAAgC,OAAA;AAChC,gIAAA,kBAAkB,OAAA;AAClB,qIAAA,uBAAuB,OAAA;AACvB,qIAAA,uBAAuB,OAAA;AAEzB,uDAM4B;AAL1B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAIpB,mEAIkC;AAHhC,0IAAA,gCAAgC,OAAA;AAChC,0IAAA,gCAAgC,OAAA;AAChC,wIAAA,8BAA8B,OAAA;AAEhC,qDAU2B;AATzB,sHAAA,mBAAmB,OAAA;AACnB,wHAAA,qBAAqB,OAAA;AACrB,sHAAA,mBAAmB,OAAA;AACnB,iIAAA,8BAA8B,OAAA;AAC9B,8HAAA,2BAA2B,OAAA;AAC3B,4HAAA,yBAAyB,OAAA;AACzB,4HAAA,yBAAyB,OAAA;AACzB,iIAAA,8BAA8B,OAAA;AAC9B,+HAAA,4BAA4B,OAAA;AAE9B,mEAAgE;AAAvD,8HAAA,oBAAoB,OAAA;AAO7B,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA"}

package/dist/nestjs/auth/org-authority-fence.d.ts

@@ -0,0 +1,16 @@
+import type { SubjectKind, TokenClass } from '@xemahq/contracts/subject';
+import { OrgHeaderName } from '../../lib/auth/org-claim';
+import { type OrgAuthorityVerdict } from '../../lib/auth/org-authority';
+export interface OrgAuthorityLogger {
+    log(message: unknown): void;
+    warn(message: unknown): void;
+}
+export declare function assertOrgHeaderPresentForCaller(orgId: string | undefined, actorType: 'human' | 'agent' | 'service'): void;
+export declare function assertOrgClaimMatchesHeader(logger: OrgAuthorityLogger, claims: Record<string, unknown>, headerValue: string, headerName: OrgHeaderName): void;
+export declare function fenceOrgAuthority(logger: OrgAuthorityLogger, claims: Record<string, unknown>, resolvedOrgId: string, facts: {
+    tokenClass: TokenClass;
+    subjectKind: SubjectKind;
+    clientId: string | undefined;
+    delegated: boolean;
+}, route: string, correlationId: string): OrgAuthorityVerdict;
+//# sourceMappingURL=org-authority-fence.d.ts.map

package/dist/nestjs/auth/org-authority-fence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority-fence.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority-fence.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEzE,OAAO,EAAe,aAAa,EAAmB,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAqBtC,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAMD,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,GACvC,IAAI,CAMN;AAiBD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,aAAa,GACxB,IAAI,CAkBN;AAgCD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IACL,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,EAAE,OAAO,CAAC;CACpB,EACD,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,mBAAmB,CAiDrB"}

package/dist/nestjs/auth/org-authority-fence.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertOrgHeaderPresentForCaller = assertOrgHeaderPresentForCaller;
+exports.assertOrgClaimMatchesHeader = assertOrgClaimMatchesHeader;
+exports.fenceOrgAuthority = fenceOrgAuthority;
+const common_1 = require("@nestjs/common");
+const org_claim_1 = require("../../lib/auth/org-claim");
+const org_authority_1 = require("../../lib/auth/org-authority");
+const org_authority_observations_1 = require("../../lib/auth/org-authority-observations");
+function assertOrgHeaderPresentForCaller(orgId, actorType) {
+    if (!orgId && actorType !== 'service') {
+        throw new common_1.BadRequestException(`Missing required header: ${org_claim_1.OrgHeaderName.Canonical}`);
+    }
+}
+function assertOrgClaimMatchesHeader(logger, claims, headerValue, headerName) {
+    const resolved = (0, org_claim_1.resolveOrgClaim)(claims);
+    if (!resolved) {
+        return;
+    }
+    if (resolved.value.toLowerCase() !== headerValue.toLowerCase()) {
+        logger.warn({
+            message: 'tenant-claim-mismatch',
+            claim: resolved.key,
+            claimValue: resolved.value,
+            header: headerName,
+            headerValue,
+        });
+        throw new common_1.ForbiddenException(`${headerName} (${headerValue || '<empty>'}) does not match ` +
+            `the ${resolved.key} claim on the access token.`);
+    }
+}
+function fenceOrgAuthority(logger, claims, resolvedOrgId, facts, route, correlationId) {
+    const verdict = (0, org_authority_1.resolveOrgAuthority)(claims, resolvedOrgId, {
+        subjectKind: facts.subjectKind,
+        delegated: facts.delegated,
+    });
+    const callerFacts = {
+        clientId: facts.clientId ?? org_authority_observations_1.UNKNOWN_CLIENT_ID,
+        tokenClass: facts.tokenClass,
+        subjectKind: facts.subjectKind,
+        delegated: facts.delegated,
+    };
+    if (verdict.source === org_authority_1.OrgAuthoritySource.ServiceRelayedContext) {
+        if ((0, org_authority_observations_1.recordServiceRelayedOrgAuthority)(callerFacts)) {
+            logger.log({
+                message: 'ORG_AUTHORITY_SERVICE_RELAY',
+                source: verdict.source,
+                orgId: verdict.assertedOrgId,
+                ...callerFacts,
+                route,
+                correlationId,
+            });
+        }
+        return verdict;
+    }
+    if (!(0, org_authority_1.orgAuthorityRequiresProof)(verdict)) {
+        return verdict;
+    }
+    if ((0, org_authority_observations_1.recordUnprovenOrgAuthority)(callerFacts)) {
+        logger.warn({
+            message: 'ORG_AUTHORITY_UNPROVEN',
+            source: verdict.source,
+            orgId: verdict.assertedOrgId,
+            ...callerFacts,
+            route,
+            correlationId,
+        });
+    }
+    throw new common_1.ForbiddenException({
+        code: 'ORG_AUTHORITY_UNPROVEN',
+        message: `The caller asserted ${org_claim_1.OrgHeaderName.Canonical}=` +
+            `"${verdict.assertedOrgId}" but the access token carries neither an ` +
+            `${org_claim_1.OrgClaimKey.Canonical} claim for that org nor an org_roles ` +
+            `membership in it. A tenant cannot be named by header alone.`,
+    });
+}
+//# sourceMappingURL=org-authority-fence.js.map

package/dist/nestjs/auth/org-authority-fence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority-fence.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority-fence.ts"],"names":[],"mappings":";;AAuCA,0EASC;AAiBD,kEAuBC;AAgCD,8CA6DC;AArLD,2CAAyE;AAGzE,wDAAuF;AACvF,gEAKsC;AACtC,0FAImD;AAyBnD,SAAgB,+BAA+B,CAC7C,KAAyB,EACzB,SAAwC;IAExC,IAAI,CAAC,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,4BAAmB,CAC3B,4BAA4B,yBAAa,CAAC,SAAS,EAAE,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAiBD,SAAgB,2BAA2B,CACzC,MAA0B,EAC1B,MAA+B,EAC/B,WAAmB,EACnB,UAAyB;IAEzB,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,QAAQ,CAAC,GAAG;YACnB,UAAU,EAAE,QAAQ,CAAC,KAAK;YAC1B,MAAM,EAAE,UAAU;YAClB,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,IAAI,2BAAkB,CAC1B,GAAG,UAAU,KAAK,WAAW,IAAI,SAAS,mBAAmB;YAC3D,OAAO,QAAQ,CAAC,GAAG,6BAA6B,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAgCD,SAAgB,iBAAiB,CAC/B,MAA0B,EAC1B,MAA+B,EAC/B,aAAqB,EACrB,KAKC,EACD,KAAa,EACb,aAAqB;IAErB,MAAM,OAAO,GAAG,IAAA,mCAAmB,EAAC,MAAM,EAAE,aAAa,EAAE;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,MAAM,WAAW,GAAG;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,8CAAiB;QAC7C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,kCAAkB,CAAC,qBAAqB,EAAE,CAAC;QAChE,IAAI,IAAA,6DAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC;gBACT,OAAO,EAAE,6BAA6B;gBACtC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,CAAC,aAAa;gBAC5B,GAAG,WAAW;gBACd,KAAK;gBACL,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,IAAA,yCAAyB,EAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,IAAA,uDAA0B,EAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,wBAAwB;YACjC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,aAAa;YAC5B,GAAG,WAAW;YACd,KAAK;YACL,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC;QAC3B,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EACL,uBAAuB,yBAAa,CAAC,SAAS,GAAG;YACjD,IAAI,OAAO,CAAC,aAAa,4CAA4C;YACrE,GAAG,uBAAW,CAAC,SAAS,uCAAuC;YAC/D,6DAA6D;KAChE,CAAC,CAAC;AACL,CAAC"}

package/dist/nestjs/auth/service-token.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-token.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":"AAyEA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKhB,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAO/D,qBACa,iBAAkB,YAAW,WAAW,EAAE,sBAAsB;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAK5C,WAAW,CAAC,EAAE,iBAAiB;IAoB3B,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIvC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAyH9D,OAAO,CAAC,wBAAwB;IAiIhC,OAAO,CAAC,uBAAuB;YAmCjB,WAAW;IAgBzB,OAAO,CAAC,WAAW;IA0BnB,OAAO,CAAC,2BAA2B;CA4BpC"}
+{"version":3,"file":"service-token.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":"AAyEA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKhB,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ/D,qBACa,iBAAkB,YAAW,WAAW,EAAE,sBAAsB;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAK5C,WAAW,CAAC,EAAE,iBAAiB;IAoB3B,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIvC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IA8H9D,OAAO,CAAC,wBAAwB;IAiIhC,OAAO,CAAC,uBAAuB;YAmCjB,WAAW;IAiBzB,OAAO,CAAC,WAAW;IA0BnB,OAAO,CAAC,2BAA2B;CA4BpC"}

package/dist/nestjs/auth/service-token.guard.js

@@ -21,6 +21,7 @@ const org_authority_1 = require("../../lib/auth/org-authority");
 const org_claim_1 = require("../../lib/auth/org-claim");
 const auth_module_options_1 = require("./auth-module-options");
 const proven_org_authority_required_1 = require("./proven-org-authority-required");
+const declared_subject_class_1 = require("./declared-subject-class");
 const realm_token_verifier_1 = require("./realm-token-verifier");
 const decorator_metadata_1 = require("../decorator-metadata");
 let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
@@ -145,7 +146,8 @@ let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
     }
     async verifyToken(token) {
         try {
-            return await this.verifier.verify(token);
+            const { payload, source } = await this.verifier.verifyWithSource(token);
+            return (0, declared_subject_class_1.claimsWithDeclaredSubjectClass)(payload, source);
         }
         catch (error) {
             if (error instanceof oidc_guard_1.JwksVerificationError) {

package/dist/nestjs/auth/service-token.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-token.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAyEA,2CAUwB;AACxB,uDAAoE;AACpE,mDAA2D;AAG3D,gEAIsC;AACtC,wDAA0E;AAC1E,+DAA4D;AAE5D,mFAA+E;AAC/E,iEAA4D;AAC5D,8DAA8D;AAKvD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAqB;IAE9C,YAGE,WAA+B;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAiBD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAmC,CAAC;QAEvE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAc9C,MAAM,yBAAyB,GAC7B,IAAA,0CAAqB,EAAU,4DAA4B,EAAE;gBAC3D,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,KAAK,IAAI,CAAC;YAad,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAGA,OAAmC,CAAC,WAAW,GAAG,OAAO,CAAC;YAE3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKf,IACE,KAAK,YAAY,8BAAqB;gBACtC,KAAK,YAAY,2BAAkB,EACnC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,mCAAmC;gBAC5C,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;YACH,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAiDO,wBAAwB,CAC9B,MAAkB,EAClB,OAA8C;QAE9C,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC;QAEvE,MAAM,OAAO,GAAG,IAAA,mCAAmB,EAAC,MAAM,EAAE,aAAa,EAAE;YACzD,WAAW,EAAE,qBAAW,CAAC,OAAO;YAChC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI;SACjE,CAAC,CAAC;QAEH,IAAI,IAAA,oCAAoB,EAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,kCAAkB,CAAC,aAAa;gBACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,8CAA8C;iBACxD,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,8BAA8B,UAAU,iBAAiB;iBACnE,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,aAAa;gBAKnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,qCAAqC;oBAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,UAAU;oBAClB,WAAW,EAAE,OAAO,CAAC,aAAa;iBACnC,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,GAAG,UAAU,wDAAwD;iBAC/E,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,qBAAqB,CAAC;YAC9C,KAAK,kCAAkB,CAAC,QAAQ;gBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,6CAA6C;oBACtD,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EACL,gEAAgE;wBAChE,qBAAqB;iBACxB,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,QAAQ,CAAC;YACjC,KAAK,kCAAkB,CAAC,aAAa;gBAInC,OAAO;QACX,CAAC;QAKD,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;IA8DO,uBAAuB,CAAC,OAAmB;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,6BAA6B;gBACtC,MAAM,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvE,GAAG,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;aACrE,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EACL,gEAAgE;oBAChE,oEAAoE;oBACpE,iEAAiE;oBACjE,oDAAoD;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,KAAK,oBAAU,CAAC,UAAU,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,8BAA8B;gBACvC,UAAU;aACX,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,WAAW,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAOO,WAAW,CACjB,OAA8C,EAC9C,IAAY;QAEZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAU,EAAE,EAAE,CAC1E,GAAG,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IASO,2BAA2B,CACjC,MAAkB,EAClB,OAA8C;QAE9C,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,qCAAqC;gBAC9C,KAAK,EAAE,QAAQ,CAAC,GAAG;gBACnB,UAAU,EAAE,QAAQ,CAAC,KAAK;gBAC1B,MAAM,EAAE,UAAU;gBAClB,WAAW;aACZ,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAC1B,GAAG,UAAU,KAAK,WAAW,wBAAwB,QAAQ,CAAC,GAAG,8BAA8B,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAlYY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GANnB,iBAAiB,CAkY7B"}
+{"version":3,"file":"service-token.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAyEA,2CAUwB;AACxB,uDAAoE;AACpE,mDAA2D;AAG3D,gEAIsC;AACtC,wDAA0E;AAC1E,+DAA4D;AAE5D,mFAA+E;AAC/E,qEAA0E;AAC1E,iEAA4D;AAC5D,8DAA8D;AAKvD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAqB;IAE9C,YAGE,WAA+B;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAiBD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAmC,CAAC;QAEvE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YAMH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAc9C,MAAM,yBAAyB,GAC7B,IAAA,0CAAqB,EAAU,4DAA4B,EAAE;gBAC3D,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,KAAK,IAAI,CAAC;YAad,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAGA,OAAmC,CAAC,WAAW,GAAG,OAAO,CAAC;YAE3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKf,IACE,KAAK,YAAY,8BAAqB;gBACtC,KAAK,YAAY,2BAAkB,EACnC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,mCAAmC;gBAC5C,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;YACH,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAiDO,wBAAwB,CAC9B,MAAkB,EAClB,OAA8C;QAE9C,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC;QAEvE,MAAM,OAAO,GAAG,IAAA,mCAAmB,EAAC,MAAM,EAAE,aAAa,EAAE;YACzD,WAAW,EAAE,qBAAW,CAAC,OAAO;YAChC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI;SACjE,CAAC,CAAC;QAEH,IAAI,IAAA,oCAAoB,EAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,kCAAkB,CAAC,aAAa;gBACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,8CAA8C;iBACxD,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,8BAA8B,UAAU,iBAAiB;iBACnE,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,aAAa;gBAKnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,qCAAqC;oBAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,UAAU;oBAClB,WAAW,EAAE,OAAO,CAAC,aAAa;iBACnC,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,GAAG,UAAU,wDAAwD;iBAC/E,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,qBAAqB,CAAC;YAC9C,KAAK,kCAAkB,CAAC,QAAQ;gBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,6CAA6C;oBACtD,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EACL,gEAAgE;wBAChE,qBAAqB;iBACxB,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,QAAQ,CAAC;YACjC,KAAK,kCAAkB,CAAC,aAAa;gBAInC,OAAO;QACX,CAAC;QAKD,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;IA8DO,uBAAuB,CAAC,OAAmB;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,6BAA6B;gBACtC,MAAM,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvE,GAAG,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;aACrE,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EACL,gEAAgE;oBAChE,oEAAoE;oBACpE,iEAAiE;oBACjE,oDAAoD;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,KAAK,oBAAU,CAAC,UAAU,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,8BAA8B;gBACvC,UAAU;aACX,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,WAAW,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACxE,OAAO,IAAA,uDAA8B,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAOO,WAAW,CACjB,OAA8C,EAC9C,IAAY;QAEZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAU,EAAE,EAAE,CAC1E,GAAG,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IASO,2BAA2B,CACjC,MAAkB,EAClB,OAA8C;QAE9C,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,qCAAqC;gBAC9C,KAAK,EAAE,QAAQ,CAAC,GAAG;gBACnB,UAAU,EAAE,QAAQ,CAAC,KAAK;gBAC1B,MAAM,EAAE,UAAU;gBAClB,WAAW;aACZ,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAC1B,GAAG,UAAU,KAAK,WAAW,wBAAwB,QAAQ,CAAC,GAAG,8BAA8B,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAxYY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GANnB,iBAAiB,CAwY7B"}

package/dist/nestjs/index.d.ts

@@ -32,7 +32,7 @@ export { RolesGuard } from './roles.guard';
 export { GlobalExceptionFilter, sendProblemResponse, } from './global-exception.filter';
 export { problemDetailsFor, problemFieldIssuesFromZod, refusalFrom, titleForCode, isZodError, type Refusal, } from './refusal';
 export { DroppedProblemExtensionReason, sanitizeProblemExtensions, describeDroppedProblemExtensions, type DroppedProblemExtension, type SanitizedProblemExtensions, } from './problem-extensions';
-export { AuthModule, AUTH_MODULE_OPTIONS, type AuthModuleOptions, type AuthModuleAsyncOptions, RealmTokenVerifier, type MultiRealmKeySource, type VerifiedTokenSource, claimsWithDeclaredSubjectClass, UnknownDeclaredSubjectClassError, ServiceTokenGuard, InternalCallerGuard, ServiceActorGuard, isDirectServiceActor, TokenClassGuard, RequireTokenClass, REQUIRE_TOKEN_CLASS, OrgRoleGuard, RequireOrgRole, REQUIRE_ORG_ROLE, ServiceOrOrgRoleGuard, OrgRolesClaimKey, ORG_ROLES_CLAIM_KEYS, resolveOrgRoles, resolveOrgRoleForOrg, orgRoleSatisfies, PlatformRole, hasPlatformRole, PlatformAdminGuard, holdsOrgAuthority, resolveOrgAuthorityInstrument, type OrgAuthorityInstrument, configureAuthMiddleware, type ConfigureAuthMiddlewareOptions, OrgClaimKey, OrgHeaderName, ORG_CLAIM_KEYS, resolveOrgClaim, RequireProvenOrgAuthority, REQUIRE_PROVEN_ORG_AUTHORITY, OrgAuthoritySource, type OrgAuthorityVerdict, type OrgAuthorityCallerFacts, resolveOrgAuthority, isOrgAuthorityProven, orgAuthorityRequiresProof, ORG_AUTHORITY_OBSERVATION_LIMIT, UNKNOWN_CLIENT_ID, type OrgAuthorityObservation, type OrgAuthorityCensus, recordUnprovenOrgAuthority, orgAuthorityCensus, resetOrgAuthorityCensus, OrgScopeProvenance, type OrgScopeWitness, type OrgScopedTokenMinter, UnprovenOrgScopeError, orgScopeFromProvenRequest, orgScopeFromOwningRow, orgScopeFromPlatformSweep, describeOrgScopeWitness, mintOrgScopedToken, type OrgScopedClaimDescriptor, orgScopedClaim, } from './auth';
+export { AuthModule, AUTH_MODULE_OPTIONS, type AuthModuleOptions, type AuthModuleAsyncOptions, RealmTokenVerifier, type MultiRealmKeySource, type VerifiedTokenSource, claimsWithDeclaredSubjectClass, UnknownDeclaredSubjectClassError, BoundarySubjectKind, CONTEXT_VERSION_CLAIM, DELEGATION_ID_CLAIM, FOREIGN_CALLER_IDENTITY_CLAIMS, InvalidBoundaryContextError, PLATFORM_AUTHORITY_CLAIMS, PLATFORM_ROLES_CLAIM, SUPPORTED_CONTEXT_VERSION, UnsupportedContextVersionError, kernelSubjectKindForBoundary, ServiceTokenGuard, InternalCallerGuard, ServiceActorGuard, isDirectServiceActor, TokenClassGuard, RequireTokenClass, REQUIRE_TOKEN_CLASS, OrgRoleGuard, RequireOrgRole, REQUIRE_ORG_ROLE, ServiceOrOrgRoleGuard, OrgRolesClaimKey, ORG_ROLES_CLAIM_KEYS, resolveOrgRoles, resolveOrgRoleForOrg, orgRoleSatisfies, PlatformRole, hasPlatformRole, PlatformAdminGuard, holdsOrgAuthority, resolveOrgAuthorityInstrument, type OrgAuthorityInstrument, configureAuthMiddleware, type ConfigureAuthMiddlewareOptions, OrgClaimKey, OrgHeaderName, ORG_CLAIM_KEYS, resolveOrgClaim, RequireProvenOrgAuthority, REQUIRE_PROVEN_ORG_AUTHORITY, OrgAuthoritySource, type OrgAuthorityVerdict, type OrgAuthorityCallerFacts, resolveOrgAuthority, isOrgAuthorityProven, orgAuthorityRequiresProof, ORG_AUTHORITY_OBSERVATION_LIMIT, UNKNOWN_CLIENT_ID, type OrgAuthorityObservation, type OrgAuthorityCensus, recordUnprovenOrgAuthority, orgAuthorityCensus, resetOrgAuthorityCensus, OrgScopeProvenance, type OrgScopeWitness, type OrgScopedTokenMinter, UnprovenOrgScopeError, orgScopeFromProvenRequest, orgScopeFromOwningRow, orgScopeFromPlatformSweep, describeOrgScopeWitness, mintOrgScopedToken, type OrgScopedClaimDescriptor, orgScopedClaim, } from './auth';
 export { ConnectorWebhookEnvelopeDto, ConnectorEnvelopePipe, ApiConnectorEnvelope, type ApiConnectorEnvelopeOptions, type ConnectorEnvelopeVariant, } from './connector-webhooks';
 export { type IdempotencyService, type IdempotencyOutcome, IDEMPOTENCY_RECORD_MODEL, DataStoreIdempotencyService, IDEMPOTENCY_DATA_STORE_CLIENT, type IdempotencyDataStoreClient, type IdempotencyDataStoreDelegate, IDEMPOTENCY_SERVICE, } from './idempotency';
 export { RedactionService, RedactionInterceptor, RedactResponse, REDACT_RESPONSE_KEY, } from './redaction';

package/dist/nestjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EACL,qBAAqB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,YAAY,EAKZ,yBAAyB,EAGzB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EAGtB,yBAAyB,EAGzB,4BAA4B,EAG5B,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,2BAA2B,EAC3B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,iCAAiC,EACjC,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EAIpB,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,4BAA4B,EAC5B,iCAAiC,EACjC,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,GAAG,EACR,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAG3D,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,KAAK,iBAAiB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,qBAAqB,EAIrB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,YAAY,EACZ,UAAU,EACV,KAAK,OAAO,GACb,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAQ3B,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAGxB,8BAA8B,EAC9B,gCAAgC,EAChC,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EAKpB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EAGnB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAGhB,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAIhB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAKlB,iBAAiB,EAKjB,6BAA6B,EAC7B,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,KAAK,8BAA8B,EAKnC,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,EAIf,yBAAyB,EACzB,4BAA4B,EAQ5B,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EAMvB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,cAAc,gCAAgC,CAAC;AAK/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAQ3D,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GACf,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EACL,qBAAqB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,YAAY,EAKZ,yBAAyB,EAGzB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EAGtB,yBAAyB,EAGzB,4BAA4B,EAG5B,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,2BAA2B,EAC3B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,iCAAiC,EACjC,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EAIpB,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,4BAA4B,EAC5B,iCAAiC,EACjC,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,GAAG,EACR,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAG3D,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,KAAK,iBAAiB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,qBAAqB,EAIrB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,YAAY,EACZ,UAAU,EACV,KAAK,OAAO,GACb,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAQ3B,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAKxB,8BAA8B,EAC9B,gCAAgC,EAChC,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAC5B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EAKpB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EAGnB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAGhB,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAIhB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAKlB,iBAAiB,EAKjB,6BAA6B,EAC7B,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,KAAK,8BAA8B,EAKnC,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,EAIf,yBAAyB,EACzB,4BAA4B,EAQ5B,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EAMvB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,cAAc,gCAAgC,CAAC;AAK/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAQ3D,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GACf,MAAM,aAAa,CAAC"}

package/dist/nestjs/index.js

@@ -16,8 +16,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwksVerifier = exports.selectTenantResolver = exports.DEFAULT_IDP_KIND = exports.IdpKind = exports.UnclassifiableForeignBearerError = exports.JwtVerificationGuard = exports.buildKeycloakSwaggerUiOptions = exports.enrichOpenApiWithKeycloakSecurity = exports.getKeycloakSwaggerUrls = exports.enhanceOpenApiDocumentation = exports.ApiProblemResponse = exports.ApiStandardErrors = exports.ApiPaginatedResponse = exports.ApiAcceptedDataResponse = exports.ApiCreatedDataResponse = exports.ApiDataArrayResponse = exports.ApiDataResponse = exports.ApiStandardOperation = exports.ProblemFieldIssueDto = exports.ProblemDetailsDto = exports.AmbientOrgContextMiddleware = exports.parseTrustedIssuersFromEnv = exports.TrustedIssuerRegistry = exports.TrustedIssuerConfigError = exports.TRUSTED_ISSUERS_ENV_VAR = exports.DEFAULT_TRUSTED_ISSUER_ALGORITHMS = exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = exports.resolveActorChainFromClaims = exports.asNonEmptyString = exports.readDeclaredSubjectKind = exports.SUBJECT_KIND_CLAIM = exports.resolvePrincipalIdFromClaims = exports.resolveClientIdFromClaims = exports.resolveActAsFromClaims = exports.resolveRolesFromClaims = exports.UnknownTokenClassError = exports.tryResolveSubjectAndClass = exports.actorTypeFor = exports.actorTypeForSubjectKind = exports.deriveActorClassification = exports.RequestContextMiddleware = exports.ResponseEnvelopeInterceptor = exports.getEnvOrThrow = exports.getExactCorsConfig = exports.getCorsConfig = exports.readDecoratorOverride = exports.applyStandardBodyParsers = void 0;
 exports.titleForCode = exports.refusalFrom = exports.problemFieldIssuesFromZod = exports.problemDetailsFor = exports.sendProblemResponse = exports.GlobalExceptionFilter = exports.RolesGuard = exports.ROLES_KEY = exports.Roles = exports.fetchJson = exports.fetchEnvelopeOptional = exports.fetchEnvelope = exports.SA_TOKEN_PATH = exports.SA_NS_PATH = exports.SA_CA_PATH = exports.ClusterCaDispatcher = exports.fetchWithRetry = exports.buildCursorPaginatedResponse = exports.CursorPaginationMeta = exports.CursorPaginationQueryDto = exports.buildPaginatedResponse = exports.parsePagination = exports.PAGINATION_MAX_PAGE = exports.PAGINATION_MAX_LIMIT = exports.PAGINATION_DEFAULT_LIMIT = exports.PaginationRangeError = exports.PaginationMeta = exports.PaginationQueryDto = exports.Ctx = exports.requirePipelineRunId = exports.resolveCapabilityTenancy = exports.CapabilityEdgeTenancyError = exports.requireProjectId = exports.RAW_RESPONSE_KEY = exports.RawResponse = exports.collectPublicRouteExcludes = exports.registerPublicRouteDeclaration = exports.joinNestPaths = exports.readSwaggerOperationId = exports.readNestHttpVerb = exports.readNestPath = exports.readNestControllerPath = exports.IS_PUBLIC_KEY = exports.Public = exports.extractRealmFromIssuer = exports.OidcDiscoveryIssuerTenantResolver = exports.KeycloakIssuerTenantResolver = exports.OidcTokenVerifier = exports.IssuerMetadataResolver = exports.JwksVerificationError = void 0;
-exports.orgScopeFromOwningRow = exports.orgScopeFromProvenRequest = exports.UnprovenOrgScopeError = exports.OrgScopeProvenance = exports.resetOrgAuthorityCensus = exports.orgAuthorityCensus = exports.recordUnprovenOrgAuthority = exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = exports.orgAuthorityRequiresProof = exports.isOrgAuthorityProven = exports.resolveOrgAuthority = exports.OrgAuthoritySource = exports.REQUIRE_PROVEN_ORG_AUTHORITY = exports.RequireProvenOrgAuthority = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.resolveOrgAuthorityInstrument = exports.holdsOrgAuthority = exports.PlatformAdminGuard = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.ServiceOrOrgRoleGuard = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.isDirectServiceActor = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.UnknownDeclaredSubjectClassError = exports.claimsWithDeclaredSubjectClass = exports.RealmTokenVerifier = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = exports.describeDroppedProblemExtensions = exports.sanitizeProblemExtensions = exports.DroppedProblemExtensionReason = exports.isZodError = void 0;
-exports.assertOrgScope = exports.OrgScopeRequiredError = exports.OrgScopeErrorCode = exports.resolveCallerOrgScope = exports.REDACT_RESPONSE_KEY = exports.RedactResponse = exports.RedactionInterceptor = exports.RedactionService = exports.IDEMPOTENCY_SERVICE = exports.IDEMPOTENCY_DATA_STORE_CLIENT = exports.DataStoreIdempotencyService = exports.IDEMPOTENCY_RECORD_MODEL = exports.ApiConnectorEnvelope = exports.ConnectorEnvelopePipe = exports.ConnectorWebhookEnvelopeDto = exports.orgScopedClaim = exports.mintOrgScopedToken = exports.describeOrgScopeWitness = exports.orgScopeFromPlatformSweep = void 0;
+exports.isOrgAuthorityProven = exports.resolveOrgAuthority = exports.OrgAuthoritySource = exports.REQUIRE_PROVEN_ORG_AUTHORITY = exports.RequireProvenOrgAuthority = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.resolveOrgAuthorityInstrument = exports.holdsOrgAuthority = exports.PlatformAdminGuard = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.ServiceOrOrgRoleGuard = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.isDirectServiceActor = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.kernelSubjectKindForBoundary = exports.UnsupportedContextVersionError = exports.SUPPORTED_CONTEXT_VERSION = exports.PLATFORM_ROLES_CLAIM = exports.PLATFORM_AUTHORITY_CLAIMS = exports.InvalidBoundaryContextError = exports.FOREIGN_CALLER_IDENTITY_CLAIMS = exports.DELEGATION_ID_CLAIM = exports.CONTEXT_VERSION_CLAIM = exports.BoundarySubjectKind = exports.UnknownDeclaredSubjectClassError = exports.claimsWithDeclaredSubjectClass = exports.RealmTokenVerifier = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = exports.describeDroppedProblemExtensions = exports.sanitizeProblemExtensions = exports.DroppedProblemExtensionReason = exports.isZodError = void 0;
+exports.assertOrgScope = exports.OrgScopeRequiredError = exports.OrgScopeErrorCode = exports.resolveCallerOrgScope = exports.REDACT_RESPONSE_KEY = exports.RedactResponse = exports.RedactionInterceptor = exports.RedactionService = exports.IDEMPOTENCY_SERVICE = exports.IDEMPOTENCY_DATA_STORE_CLIENT = exports.DataStoreIdempotencyService = exports.IDEMPOTENCY_RECORD_MODEL = exports.ApiConnectorEnvelope = exports.ConnectorEnvelopePipe = exports.ConnectorWebhookEnvelopeDto = exports.orgScopedClaim = exports.mintOrgScopedToken = exports.describeOrgScopeWitness = exports.orgScopeFromPlatformSweep = exports.orgScopeFromOwningRow = exports.orgScopeFromProvenRequest = exports.UnprovenOrgScopeError = exports.OrgScopeProvenance = exports.resetOrgAuthorityCensus = exports.orgAuthorityCensus = exports.recordUnprovenOrgAuthority = exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = exports.orgAuthorityRequiresProof = void 0;
 var body_parsers_1 = require("./body-parsers");
 Object.defineProperty(exports, "applyStandardBodyParsers", { enumerable: true, get: function () { return body_parsers_1.applyStandardBodyParsers; } });
 var decorator_metadata_1 = require("./decorator-metadata");
@@ -162,6 +162,16 @@ Object.defineProperty(exports, "AUTH_MODULE_OPTIONS", { enumerable: true, get: f
 Object.defineProperty(exports, "RealmTokenVerifier", { enumerable: true, get: function () { return auth_1.RealmTokenVerifier; } });
 Object.defineProperty(exports, "claimsWithDeclaredSubjectClass", { enumerable: true, get: function () { return auth_1.claimsWithDeclaredSubjectClass; } });
 Object.defineProperty(exports, "UnknownDeclaredSubjectClassError", { enumerable: true, get: function () { return auth_1.UnknownDeclaredSubjectClassError; } });
+Object.defineProperty(exports, "BoundarySubjectKind", { enumerable: true, get: function () { return auth_1.BoundarySubjectKind; } });
+Object.defineProperty(exports, "CONTEXT_VERSION_CLAIM", { enumerable: true, get: function () { return auth_1.CONTEXT_VERSION_CLAIM; } });
+Object.defineProperty(exports, "DELEGATION_ID_CLAIM", { enumerable: true, get: function () { return auth_1.DELEGATION_ID_CLAIM; } });
+Object.defineProperty(exports, "FOREIGN_CALLER_IDENTITY_CLAIMS", { enumerable: true, get: function () { return auth_1.FOREIGN_CALLER_IDENTITY_CLAIMS; } });
+Object.defineProperty(exports, "InvalidBoundaryContextError", { enumerable: true, get: function () { return auth_1.InvalidBoundaryContextError; } });
+Object.defineProperty(exports, "PLATFORM_AUTHORITY_CLAIMS", { enumerable: true, get: function () { return auth_1.PLATFORM_AUTHORITY_CLAIMS; } });
+Object.defineProperty(exports, "PLATFORM_ROLES_CLAIM", { enumerable: true, get: function () { return auth_1.PLATFORM_ROLES_CLAIM; } });
+Object.defineProperty(exports, "SUPPORTED_CONTEXT_VERSION", { enumerable: true, get: function () { return auth_1.SUPPORTED_CONTEXT_VERSION; } });
+Object.defineProperty(exports, "UnsupportedContextVersionError", { enumerable: true, get: function () { return auth_1.UnsupportedContextVersionError; } });
+Object.defineProperty(exports, "kernelSubjectKindForBoundary", { enumerable: true, get: function () { return auth_1.kernelSubjectKindForBoundary; } });
 Object.defineProperty(exports, "ServiceTokenGuard", { enumerable: true, get: function () { return auth_1.ServiceTokenGuard; } });
 Object.defineProperty(exports, "InternalCallerGuard", { enumerable: true, get: function () { return auth_1.InternalCallerGuard; } });
 Object.defineProperty(exports, "ServiceActorGuard", { enumerable: true, get: function () { return auth_1.ServiceActorGuard; } });

package/dist/nestjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,+CAGwB;AAFtB,wHAAA,wBAAwB,OAAA;AAU1B,2DAG8B;AAF5B,2HAAA,qBAAqB,OAAA;AAGvB,6CAAkE;AAAzD,4GAAA,aAAa,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAC1C,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AACtB,iFAA8E;AAArE,4IAAA,2BAA2B,OAAA;AACpC,2EAAwE;AAA/D,sIAAA,wBAAwB,OAAA;AACjC,oEA0BqC;AAzBnC,iIAAA,yBAAyB,OAAA;AACzB,+HAAA,uBAAuB,OAAA;AACvB,oHAAA,YAAY,OAAA;AAKZ,iIAAA,yBAAyB,OAAA;AAGzB,8HAAA,sBAAsB,OAAA;AACtB,8HAAA,sBAAsB,OAAA;AACtB,8HAAA,sBAAsB,OAAA;AAGtB,iIAAA,yBAAyB,OAAA;AAGzB,oIAAA,4BAA4B,OAAA;AAG5B,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AACvB,wHAAA,gBAAgB,OAAA;AAOlB,4DAMiC;AAL/B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AAKxB,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA;AAG5B,mFAA+E;AAAtE,6IAAA,2BAA2B,OAAA;AACpC,6DAAgF;AAAvE,wHAAA,iBAAiB,OAAA;AAAE,2HAAA,oBAAoB,OAAA;AAChD,2DAS8B;AAR5B,0HAAA,oBAAoB,OAAA;AACpB,qHAAA,eAAe,OAAA;AACf,0HAAA,oBAAoB,OAAA;AACpB,4HAAA,sBAAsB,OAAA;AACtB,6HAAA,uBAAuB,OAAA;AACvB,0HAAA,oBAAoB,OAAA;AACpB,uHAAA,iBAAiB,OAAA;AACjB,wHAAA,kBAAkB,OAAA;AAEpB,iEAGiC;AAF/B,oIAAA,2BAA2B,OAAA;AAG7B,uDAQ4B;AAP1B,0HAAA,sBAAsB,OAAA;AACtB,qIAAA,iCAAiC,OAAA;AACjC,iIAAA,6BAA6B,OAAA;AAM/B,mEAMkC;AALhC,8HAAA,oBAAoB,OAAA;AAIpB,0IAAA,gCAAgC,OAAA;AAElC,kEAIoC;AAHlC,8GAAA,OAAO,OAAA;AACP,uHAAA,gBAAgB,OAAA;AAChB,2HAAA,oBAAoB,OAAA;AAKtB,iDAc4B;AAb1B,0GAAA,YAAY,OAAA;AACZ,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,+GAAA,iBAAiB,OAAA;AACjB,0HAAA,4BAA4B,OAAA;AAC5B,+HAAA,iCAAiC,OAAA;AACjC,oHAAA,sBAAsB,OAAA;AAQxB,uDAA2D;AAAlD,0GAAA,MAAM,OAAA;AAAE,iHAAA,aAAa,OAAA;AAG9B,6DAM+B;AAL7B,6HAAA,sBAAsB,OAAA;AACtB,mHAAA,YAAY,OAAA;AACZ,uHAAA,gBAAgB,OAAA;AAChB,6HAAA,sBAAsB,OAAA;AACtB,oHAAA,aAAa,OAAA;AAMf,iEAGiC;AAF/B,uIAAA,8BAA8B,OAAA;AAC9B,mIAAA,0BAA0B,OAAA;AAE5B,mEAAyE;AAAhE,qHAAA,WAAW,OAAA;AAAE,0HAAA,gBAAgB,OAAA;AACtC,2DAAwD;AAA/C,sHAAA,gBAAgB,OAAA;AACzB,qEAImC;AAHjC,qIAAA,0BAA0B,OAAA;AAC1B,mIAAA,wBAAwB,OAAA;AAG1B,qEAAiE;AAAxD,+HAAA,oBAAoB,OAAA;AAC7B,iDAAsC;AAA7B,oGAAA,GAAG,OAAA;AACZ,2CAYsB;AAXpB,gHAAA,kBAAkB,OAAA;AAClB,4GAAA,cAAc,OAAA;AACd,kHAAA,oBAAoB,OAAA;AACpB,sHAAA,wBAAwB,OAAA;AACxB,kHAAA,oBAAoB,OAAA;AACpB,iHAAA,mBAAmB,OAAA;AACnB,6GAAA,eAAe,OAAA;AACf,oHAAA,sBAAsB,OAAA;AACtB,sHAAA,wBAAwB,OAAA;AACxB,kHAAA,oBAAoB,OAAA;AACpB,0HAAA,4BAA4B,OAAA;AAE9B,uDAAuE;AAA9D,kHAAA,cAAc,OAAA;AACvB,iEAKiC;AAJ/B,4HAAA,mBAAmB,OAAA;AACnB,mHAAA,UAAU,OAAA;AACV,mHAAA,UAAU,OAAA;AACV,sHAAA,aAAa,OAAA;AAEf,mDAI0B;AAHxB,+GAAA,aAAa,OAAA;AACb,uHAAA,qBAAqB,OAAA;AACrB,2GAAA,SAAS,OAAA;AAEX,qDAAqD;AAA5C,wGAAA,KAAK,OAAA;AAAE,4GAAA,SAAS,OAAA;AACzB,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,qEAMmC;AALjC,gIAAA,qBAAqB,OAAA;AAIrB,8HAAA,mBAAmB,OAAA;AAOrB,qCAOmB;AANjB,4GAAA,iBAAiB,OAAA;AACjB,oHAAA,yBAAyB,OAAA;AACzB,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AAKZ,2DAM8B;AAL5B,mIAAA,6BAA6B,OAAA;AAC7B,+HAAA,yBAAyB,OAAA;AACzB,sIAAA,gCAAgC,OAAA;AAIlC,+BA+GgB;AA9Gd,kGAAA,UAAU,OAAA;AACV,2GAAA,mBAAmB,OAAA;AAUnB,0GAAA,kBAAkB,OAAA;AAKlB,sHAAA,8BAA8B,OAAA;AAC9B,wHAAA,gCAAgC,OAAA;AAChC,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AACnB,yGAAA,iBAAiB,OAAA;AACjB,4GAAA,oBAAoB,OAAA;AAKpB,uGAAA,eAAe,OAAA;AACf,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AAGnB,oGAAA,YAAY,OAAA;AACZ,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAGhB,6GAAA,qBAAqB,OAAA;AACrB,wGAAA,gBAAgB,OAAA;AAChB,4GAAA,oBAAoB,OAAA;AACpB,uGAAA,eAAe,OAAA;AACf,4GAAA,oBAAoB,OAAA;AACpB,wGAAA,gBAAgB,OAAA;AAIhB,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,0GAAA,kBAAkB,OAAA;AAKlB,yGAAA,iBAAiB,OAAA;AAKjB,qHAAA,6BAA6B,OAAA;AAE7B,+GAAA,uBAAuB,OAAA;AAMvB,mGAAA,WAAW,OAAA;AACX,qGAAA,aAAa,OAAA;AACb,sGAAA,cAAc,OAAA;AACd,uGAAA,eAAe,OAAA;AAIf,iHAAA,yBAAyB,OAAA;AACzB,oHAAA,4BAA4B,OAAA;AAQ5B,0GAAA,kBAAkB,OAAA;AAGlB,2GAAA,mBAAmB,OAAA;AACnB,4GAAA,oBAAoB,OAAA;AACpB,iHAAA,yBAAyB,OAAA;AACzB,uHAAA,+BAA+B,OAAA;AAC/B,yGAAA,iBAAiB,OAAA;AAGjB,kHAAA,0BAA0B,OAAA;AAC1B,0GAAA,kBAAkB,OAAA;AAClB,+GAAA,uBAAuB,OAAA;AAMvB,0GAAA,kBAAkB,OAAA;AAGlB,6GAAA,qBAAqB,OAAA;AACrB,iHAAA,yBAAyB,OAAA;AACzB,6GAAA,qBAAqB,OAAA;AACrB,iHAAA,yBAAyB,OAAA;AACzB,+GAAA,uBAAuB,OAAA;AACvB,0GAAA,kBAAkB,OAAA;AAElB,sGAAA,cAAc,OAAA;AAEhB,2DAM8B;AAL5B,iIAAA,2BAA2B,OAAA;AAC3B,2HAAA,qBAAqB,OAAA;AACrB,0HAAA,oBAAoB,OAAA;AAItB,6CASuB;AANrB,uHAAA,wBAAwB,OAAA;AACxB,0HAAA,2BAA2B,OAAA;AAC3B,4HAAA,6BAA6B,OAAA;AAG7B,kHAAA,mBAAmB,OAAA;AAIrB,yCAKqB;AAJnB,6GAAA,gBAAgB,OAAA;AAChB,iHAAA,oBAAoB,OAAA;AACpB,2GAAA,cAAc,OAAA;AACd,gHAAA,mBAAmB,OAAA;AAIrB,iEAA+C;AAK/C,uDAA2D;AAAlD,yHAAA,qBAAqB,OAAA;AAQ9B,yCAIqB;AAHnB,8GAAA,iBAAiB,OAAA;AACjB,kHAAA,qBAAqB,OAAA;AACrB,2GAAA,cAAc,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,+CAGwB;AAFtB,wHAAA,wBAAwB,OAAA;AAU1B,2DAG8B;AAF5B,2HAAA,qBAAqB,OAAA;AAGvB,6CAAkE;AAAzD,4GAAA,aAAa,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAC1C,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AACtB,iFAA8E;AAArE,4IAAA,2BAA2B,OAAA;AACpC,2EAAwE;AAA/D,sIAAA,wBAAwB,OAAA;AACjC,oEA0BqC;AAzBnC,iIAAA,yBAAyB,OAAA;AACzB,+HAAA,uBAAuB,OAAA;AACvB,oHAAA,YAAY,OAAA;AAKZ,iIAAA,yBAAyB,OAAA;AAGzB,8HAAA,sBAAsB,OAAA;AACtB,8HAAA,sBAAsB,OAAA;AACtB,8HAAA,sBAAsB,OAAA;AAGtB,iIAAA,yBAAyB,OAAA;AAGzB,oIAAA,4BAA4B,OAAA;AAG5B,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AACvB,wHAAA,gBAAgB,OAAA;AAOlB,4DAMiC;AAL/B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AAKxB,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA;AAG5B,mFAA+E;AAAtE,6IAAA,2BAA2B,OAAA;AACpC,6DAAgF;AAAvE,wHAAA,iBAAiB,OAAA;AAAE,2HAAA,oBAAoB,OAAA;AAChD,2DAS8B;AAR5B,0HAAA,oBAAoB,OAAA;AACpB,qHAAA,eAAe,OAAA;AACf,0HAAA,oBAAoB,OAAA;AACpB,4HAAA,sBAAsB,OAAA;AACtB,6HAAA,uBAAuB,OAAA;AACvB,0HAAA,oBAAoB,OAAA;AACpB,uHAAA,iBAAiB,OAAA;AACjB,wHAAA,kBAAkB,OAAA;AAEpB,iEAGiC;AAF/B,oIAAA,2BAA2B,OAAA;AAG7B,uDAQ4B;AAP1B,0HAAA,sBAAsB,OAAA;AACtB,qIAAA,iCAAiC,OAAA;AACjC,iIAAA,6BAA6B,OAAA;AAM/B,mEAMkC;AALhC,8HAAA,oBAAoB,OAAA;AAIpB,0IAAA,gCAAgC,OAAA;AAElC,kEAIoC;AAHlC,8GAAA,OAAO,OAAA;AACP,uHAAA,gBAAgB,OAAA;AAChB,2HAAA,oBAAoB,OAAA;AAKtB,iDAc4B;AAb1B,0GAAA,YAAY,OAAA;AACZ,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,+GAAA,iBAAiB,OAAA;AACjB,0HAAA,4BAA4B,OAAA;AAC5B,+HAAA,iCAAiC,OAAA;AACjC,oHAAA,sBAAsB,OAAA;AAQxB,uDAA2D;AAAlD,0GAAA,MAAM,OAAA;AAAE,iHAAA,aAAa,OAAA;AAG9B,6DAM+B;AAL7B,6HAAA,sBAAsB,OAAA;AACtB,mHAAA,YAAY,OAAA;AACZ,uHAAA,gBAAgB,OAAA;AAChB,6HAAA,sBAAsB,OAAA;AACtB,oHAAA,aAAa,OAAA;AAMf,iEAGiC;AAF/B,uIAAA,8BAA8B,OAAA;AAC9B,mIAAA,0BAA0B,OAAA;AAE5B,mEAAyE;AAAhE,qHAAA,WAAW,OAAA;AAAE,0HAAA,gBAAgB,OAAA;AACtC,2DAAwD;AAA/C,sHAAA,gBAAgB,OAAA;AACzB,qEAImC;AAHjC,qIAAA,0BAA0B,OAAA;AAC1B,mIAAA,wBAAwB,OAAA;AAG1B,qEAAiE;AAAxD,+HAAA,oBAAoB,OAAA;AAC7B,iDAAsC;AAA7B,oGAAA,GAAG,OAAA;AACZ,2CAYsB;AAXpB,gHAAA,kBAAkB,OAAA;AAClB,4GAAA,cAAc,OAAA;AACd,kHAAA,oBAAoB,OAAA;AACpB,sHAAA,wBAAwB,OAAA;AACxB,kHAAA,oBAAoB,OAAA;AACpB,iHAAA,mBAAmB,OAAA;AACnB,6GAAA,eAAe,OAAA;AACf,oHAAA,sBAAsB,OAAA;AACtB,sHAAA,wBAAwB,OAAA;AACxB,kHAAA,oBAAoB,OAAA;AACpB,0HAAA,4BAA4B,OAAA;AAE9B,uDAAuE;AAA9D,kHAAA,cAAc,OAAA;AACvB,iEAKiC;AAJ/B,4HAAA,mBAAmB,OAAA;AACnB,mHAAA,UAAU,OAAA;AACV,mHAAA,UAAU,OAAA;AACV,sHAAA,aAAa,OAAA;AAEf,mDAI0B;AAHxB,+GAAA,aAAa,OAAA;AACb,uHAAA,qBAAqB,OAAA;AACrB,2GAAA,SAAS,OAAA;AAEX,qDAAqD;AAA5C,wGAAA,KAAK,OAAA;AAAE,4GAAA,SAAS,OAAA;AACzB,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,qEAMmC;AALjC,gIAAA,qBAAqB,OAAA;AAIrB,8HAAA,mBAAmB,OAAA;AAOrB,qCAOmB;AANjB,4GAAA,iBAAiB,OAAA;AACjB,oHAAA,yBAAyB,OAAA;AACzB,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AAKZ,2DAM8B;AAL5B,mIAAA,6BAA6B,OAAA;AAC7B,+HAAA,yBAAyB,OAAA;AACzB,sIAAA,gCAAgC,OAAA;AAIlC,+BA2HgB;AA1Hd,kGAAA,UAAU,OAAA;AACV,2GAAA,mBAAmB,OAAA;AAUnB,0GAAA,kBAAkB,OAAA;AAOlB,sHAAA,8BAA8B,OAAA;AAC9B,wHAAA,gCAAgC,OAAA;AAChC,2GAAA,mBAAmB,OAAA;AACnB,6GAAA,qBAAqB,OAAA;AACrB,2GAAA,mBAAmB,OAAA;AACnB,sHAAA,8BAA8B,OAAA;AAC9B,mHAAA,2BAA2B,OAAA;AAC3B,iHAAA,yBAAyB,OAAA;AACzB,4GAAA,oBAAoB,OAAA;AACpB,iHAAA,yBAAyB,OAAA;AACzB,sHAAA,8BAA8B,OAAA;AAC9B,oHAAA,4BAA4B,OAAA;AAC5B,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AACnB,yGAAA,iBAAiB,OAAA;AACjB,4GAAA,oBAAoB,OAAA;AAKpB,uGAAA,eAAe,OAAA;AACf,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AAGnB,oGAAA,YAAY,OAAA;AACZ,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAGhB,6GAAA,qBAAqB,OAAA;AACrB,wGAAA,gBAAgB,OAAA;AAChB,4GAAA,oBAAoB,OAAA;AACpB,uGAAA,eAAe,OAAA;AACf,4GAAA,oBAAoB,OAAA;AACpB,wGAAA,gBAAgB,OAAA;AAIhB,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,0GAAA,kBAAkB,OAAA;AAKlB,yGAAA,iBAAiB,OAAA;AAKjB,qHAAA,6BAA6B,OAAA;AAE7B,+GAAA,uBAAuB,OAAA;AAMvB,mGAAA,WAAW,OAAA;AACX,qGAAA,aAAa,OAAA;AACb,sGAAA,cAAc,OAAA;AACd,uGAAA,eAAe,OAAA;AAIf,iHAAA,yBAAyB,OAAA;AACzB,oHAAA,4BAA4B,OAAA;AAQ5B,0GAAA,kBAAkB,OAAA;AAGlB,2GAAA,mBAAmB,OAAA;AACnB,4GAAA,oBAAoB,OAAA;AACpB,iHAAA,yBAAyB,OAAA;AACzB,uHAAA,+BAA+B,OAAA;AAC/B,yGAAA,iBAAiB,OAAA;AAGjB,kHAAA,0BAA0B,OAAA;AAC1B,0GAAA,kBAAkB,OAAA;AAClB,+GAAA,uBAAuB,OAAA;AAMvB,0GAAA,kBAAkB,OAAA;AAGlB,6GAAA,qBAAqB,OAAA;AACrB,iHAAA,yBAAyB,OAAA;AACzB,6GAAA,qBAAqB,OAAA;AACrB,iHAAA,yBAAyB,OAAA;AACzB,+GAAA,uBAAuB,OAAA;AACvB,0GAAA,kBAAkB,OAAA;AAElB,sGAAA,cAAc,OAAA;AAEhB,2DAM8B;AAL5B,iIAAA,2BAA2B,OAAA;AAC3B,2HAAA,qBAAqB,OAAA;AACrB,0HAAA,oBAAoB,OAAA;AAItB,6CASuB;AANrB,uHAAA,wBAAwB,OAAA;AACxB,0HAAA,2BAA2B,OAAA;AAC3B,4HAAA,6BAA6B,OAAA;AAG7B,kHAAA,mBAAmB,OAAA;AAIrB,yCAKqB;AAJnB,6GAAA,gBAAgB,OAAA;AAChB,iHAAA,oBAAoB,OAAA;AACpB,2GAAA,cAAc,OAAA;AACd,gHAAA,mBAAmB,OAAA;AAIrB,iEAA+C;AAK/C,uDAA2D;AAAlD,yHAAA,qBAAqB,OAAA;AAQ9B,yCAIqB;AAHnB,8GAAA,iBAAiB,OAAA;AACjB,kHAAA,qBAAqB,OAAA;AACrB,2GAAA,cAAc,OAAA"}

package/dist/nestjs/jwt-verification.guard.d.ts

@@ -8,7 +8,7 @@ export declare class JwtVerificationGuard implements CanActivate {
     canActivate(context: ExecutionContext): Promise<boolean>;
     private verifyToken;
     private attachRealmToContext;
-    private applyDeclaredSubjectClass;
+    private applyVerifiedClaims;
     private isPublicPath;
 }
 //# sourceMappingURL=jwt-verification.guard.d.ts.map