@xemahq/platform-common 0.40.0 → 0.42.0

package/dist/nestjs/auth/claim-authority.js

@@ -0,0 +1,276 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnsupportedContextVersionError = exports.InvalidBoundaryContextError = exports.BoundarySubjectKind = exports.FOREIGN_CALLER_IDENTITY_CLAIMS = exports.PLATFORM_AUTHORITY_CLAIMS = exports.AUTHORIZED_BY_CLAIM = exports.DELEGATED_RESOURCE_SCOPE_CLAIM = exports.DELEGATED_CAPABILITIES_CLAIM = exports.ACT_CLAIM = exports.TOKEN_CLASS_CLAIM = exports.DELEGATION_ID_CLAIM = exports.SUPPORTED_CONTEXT_VERSION = exports.CONTEXT_VERSION_CLAIM = void 0;
+exports.kernelSubjectKindForBoundary = kernelSubjectKindForBoundary;
+exports.normalizeClaimAuthorityClaims = normalizeClaimAuthorityClaims;
+exports.withoutPlatformAuthorityClaims = withoutPlatformAuthorityClaims;
+exports.resolveDelegationIdFromBoundaryClaims = resolveDelegationIdFromBoundaryClaims;
+exports.assertDelegationClaims = assertDelegationClaims;
+exports.resolveDelegatedAuthorityFromBoundaryClaims = resolveDelegatedAuthorityFromBoundaryClaims;
+const common_1 = require("@nestjs/common");
+const identity_client_1 = require("@xemahq/identity-client");
+const subject_1 = require("@xemahq/contracts/subject");
+const org_claim_1 = require("../../lib/auth/org-claim");
+const org_role_1 = require("../../lib/auth/org-role");
+const actor_classification_1 = require("./actor-classification");
+const boundary_context_brand_1 = require("./boundary-context-brand");
+exports.CONTEXT_VERSION_CLAIM = 'ctx_ver';
+exports.SUPPORTED_CONTEXT_VERSION = 1;
+exports.DELEGATION_ID_CLAIM = 'did';
+exports.TOKEN_CLASS_CLAIM = 'token_class';
+exports.ACT_CLAIM = 'act';
+exports.DELEGATED_CAPABILITIES_CLAIM = 'delegated_capabilities';
+exports.DELEGATED_RESOURCE_SCOPE_CLAIM = 'delegated_resource_scope';
+exports.AUTHORIZED_BY_CLAIM = 'authorized_by';
+exports.PLATFORM_AUTHORITY_CLAIMS = [
+    'realm_access',
+    boundary_context_brand_1.PLATFORM_ROLES_CLAIM,
+    org_role_1.OrgRolesClaimKey.Canonical,
+    org_claim_1.OrgClaimKey.Canonical,
+    exports.TOKEN_CLASS_CLAIM,
+    actor_classification_1.SUBJECT_KIND_CLAIM,
+    exports.ACT_CLAIM,
+    exports.DELEGATION_ID_CLAIM,
+    exports.DELEGATED_CAPABILITIES_CLAIM,
+    exports.DELEGATED_RESOURCE_SCOPE_CLAIM,
+    exports.AUTHORIZED_BY_CLAIM,
+    exports.CONTEXT_VERSION_CLAIM,
+    identity_client_1.PRINCIPAL_ID_CLAIM,
+];
+exports.FOREIGN_CALLER_IDENTITY_CLAIMS = [
+    'azp',
+    'client_id',
+];
+var BoundarySubjectKind;
+(function (BoundarySubjectKind) {
+    BoundarySubjectKind["User"] = "user";
+    BoundarySubjectKind["Workload"] = "workload";
+    BoundarySubjectKind["Agent"] = "agent";
+    BoundarySubjectKind["Organization"] = "organization";
+})(BoundarySubjectKind || (exports.BoundarySubjectKind = BoundarySubjectKind = {}));
+function kernelSubjectKindForBoundary(kind) {
+    switch (kind) {
+        case BoundarySubjectKind.User:
+            return subject_1.SubjectKind.User;
+        case BoundarySubjectKind.Workload:
+            return subject_1.SubjectKind.Service;
+        case BoundarySubjectKind.Agent:
+            return subject_1.SubjectKind.Agent;
+        case BoundarySubjectKind.Organization:
+            return subject_1.SubjectKind.Organization;
+    }
+}
+function parseBoundarySubjectKind(value) {
+    return typeof value === 'string' &&
+        Object.values(BoundarySubjectKind).includes(value)
+        ? value
+        : null;
+}
+class InvalidBoundaryContextError extends common_1.UnauthorizedException {
+    constructor(issuer, reason) {
+        super(`The access token from claim authority '${issuer}' is refused: ${reason} ` +
+            `A claim-authority context carries its classification explicitly; ` +
+            `nothing is inferred from its absence.`);
+    }
+}
+exports.InvalidBoundaryContextError = InvalidBoundaryContextError;
+class UnsupportedContextVersionError extends InvalidBoundaryContextError {
+    constructor(issuer, declared) {
+        super(issuer, declared === undefined
+            ? `it carries no "${exports.CONTEXT_VERSION_CLAIM}" claim.`
+            : `"${exports.CONTEXT_VERSION_CLAIM}" is ${JSON.stringify(declared)}; this ` +
+                `kernel reads version ${exports.SUPPORTED_CONTEXT_VERSION} only.`);
+    }
+}
+exports.UnsupportedContextVersionError = UnsupportedContextVersionError;
+function normalizeClaimAuthorityClaims(payload, issuer) {
+    const ctxVer = payload[exports.CONTEXT_VERSION_CLAIM];
+    if (ctxVer !== exports.SUPPORTED_CONTEXT_VERSION) {
+        throw new UnsupportedContextVersionError(issuer, ctxVer);
+    }
+    const declaredClass = (0, actor_classification_1.asNonEmptyString)(payload[exports.TOKEN_CLASS_CLAIM]);
+    if (!declaredClass) {
+        throw new InvalidBoundaryContextError(issuer, `it carries no "${exports.TOKEN_CLASS_CLAIM}" claim.`);
+    }
+    if (!Object.values(subject_1.TokenClass).includes(declaredClass)) {
+        throw new InvalidBoundaryContextError(issuer, `"${exports.TOKEN_CLASS_CLAIM}" ${JSON.stringify(declaredClass)} is not a known TokenClass.`);
+    }
+    const tokenClass = declaredClass;
+    if (!(actor_classification_1.SUBJECT_KIND_CLAIM in payload)) {
+        throw new InvalidBoundaryContextError(issuer, `it carries no "${actor_classification_1.SUBJECT_KIND_CLAIM}" claim.`);
+    }
+    const boundaryKind = parseBoundarySubjectKind(payload[actor_classification_1.SUBJECT_KIND_CLAIM]);
+    if (!boundaryKind) {
+        throw new InvalidBoundaryContextError(issuer, `"${actor_classification_1.SUBJECT_KIND_CLAIM}" ${JSON.stringify(payload[actor_classification_1.SUBJECT_KIND_CLAIM])} ` +
+            `is not one of ${Object.values(BoundarySubjectKind).join(' | ')}.`);
+    }
+    const subjectKind = kernelSubjectKindForBoundary(boundaryKind);
+    if ((0, actor_classification_1.subjectKindForTokenClass)(tokenClass) !== subjectKind) {
+        throw new InvalidBoundaryContextError(issuer, `"${exports.TOKEN_CLASS_CLAIM}" '${tokenClass}' and "${actor_classification_1.SUBJECT_KIND_CLAIM}" ` +
+            `'${boundaryKind}' name different kinds of subject.`);
+    }
+    const rawRoles = payload[boundary_context_brand_1.PLATFORM_ROLES_CLAIM];
+    if (rawRoles !== undefined &&
+        (!Array.isArray(rawRoles) || rawRoles.some((r) => typeof r !== 'string'))) {
+        throw new InvalidBoundaryContextError(issuer, `"${boundary_context_brand_1.PLATFORM_ROLES_CLAIM}" must be an array of strings.`);
+    }
+    const platformRoles = rawRoles ?? [];
+    assertSingleOrgScope(payload, issuer);
+    const hasAct = payload[exports.ACT_CLAIM] !== undefined;
+    const hasDid = payload[exports.DELEGATION_ID_CLAIM] !== undefined;
+    if (hasDid && !(0, actor_classification_1.asNonEmptyString)(payload[exports.DELEGATION_ID_CLAIM])) {
+        throw new InvalidBoundaryContextError(issuer, `"${exports.DELEGATION_ID_CLAIM}" must be a non-empty string.`);
+    }
+    if (hasAct !== hasDid) {
+        throw new InvalidBoundaryContextError(issuer, hasAct
+            ? `it carries "${exports.ACT_CLAIM}" with no "${exports.DELEGATION_ID_CLAIM}" — a ` +
+                `delegation with no validated record.`
+            : `it carries "${exports.DELEGATION_ID_CLAIM}" with no "${exports.ACT_CLAIM}".`);
+    }
+    assertDelegationClaims(payload, issuer, boundaryKind, hasAct);
+    const normalized = { ...payload };
+    delete normalized['realm_access'];
+    normalized[exports.TOKEN_CLASS_CLAIM] = tokenClass;
+    normalized[actor_classification_1.SUBJECT_KIND_CLAIM] = subjectKind;
+    normalized[boundary_context_brand_1.PLATFORM_ROLES_CLAIM] = [...platformRoles];
+    if (hasAct) {
+        normalized[exports.ACT_CLAIM] = normalizeActHops(payload[exports.ACT_CLAIM], issuer);
+    }
+    normalized[boundary_context_brand_1.BOUNDARY_CONTEXT_CLAIMS] = true;
+    return normalized;
+}
+function withoutPlatformAuthorityClaims(payload) {
+    const stripped = { ...payload };
+    for (const claim of [
+        ...exports.PLATFORM_AUTHORITY_CLAIMS,
+        ...exports.FOREIGN_CALLER_IDENTITY_CLAIMS,
+    ]) {
+        delete stripped[claim];
+    }
+    return stripped;
+}
+function resolveDelegationIdFromBoundaryClaims(claims) {
+    return (0, actor_classification_1.asNonEmptyString)(claims[exports.DELEGATION_ID_CLAIM]);
+}
+function assertSingleOrgScope(payload, issuer) {
+    const orgRoles = (0, org_role_1.resolveOrgRoles)(payload);
+    const orgIds = Object.keys(orgRoles);
+    if (orgIds.length === 0)
+        return;
+    const tenant = (0, org_claim_1.resolveOrgClaim)(payload)?.value;
+    if (!tenant) {
+        throw new InvalidBoundaryContextError(issuer, `it carries "${org_role_1.OrgRolesClaimKey.Canonical}" but no ` +
+            `"${org_claim_1.OrgClaimKey.Canonical}" — a context is minted for ONE org.`);
+    }
+    const foreign = orgIds.filter((orgId) => orgId.toLowerCase() !== tenant.toLowerCase());
+    if (foreign.length > 0) {
+        throw new InvalidBoundaryContextError(issuer, `"${org_role_1.OrgRolesClaimKey.Canonical}" names org(s) other than the ` +
+            `"${org_claim_1.OrgClaimKey.Canonical}" it was minted for — a context carries ` +
+            `the roles of ONE org, never every membership.`);
+    }
+}
+function normalizeActHops(act, issuer) {
+    if (!act || typeof act !== 'object' || Array.isArray(act)) {
+        return act;
+    }
+    const hop = { ...act };
+    if (actor_classification_1.SUBJECT_KIND_CLAIM in hop) {
+        const kind = parseBoundarySubjectKind(hop[actor_classification_1.SUBJECT_KIND_CLAIM]);
+        if (!kind) {
+            throw new InvalidBoundaryContextError(issuer, `a delegation hop states "${actor_classification_1.SUBJECT_KIND_CLAIM}" ` +
+                `${JSON.stringify(hop[actor_classification_1.SUBJECT_KIND_CLAIM])}, outside the boundary vocabulary.`);
+        }
+        if (kind === BoundarySubjectKind.Organization) {
+            throw new InvalidBoundaryContextError(issuer, `a delegation hop states "${actor_classification_1.SUBJECT_KIND_CLAIM}" 'organization' — an ` +
+                `organization is a delegator, never the party that acts.`);
+        }
+        hop[actor_classification_1.SUBJECT_KIND_CLAIM] = kernelSubjectKindForBoundary(kind);
+    }
+    if (hop[exports.ACT_CLAIM] !== undefined) {
+        hop[exports.ACT_CLAIM] = normalizeActHops(hop[exports.ACT_CLAIM], issuer);
+    }
+    return hop;
+}
+function nonEmptyStringList(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return null;
+    for (const entry of value) {
+        if (typeof entry !== 'string' || entry.length === 0)
+            return null;
+    }
+    return [...value];
+}
+function assertDelegationClaims(payload, issuer, kind, delegated) {
+    const has = (claim) => payload[claim] !== undefined;
+    if (!delegated) {
+        const stray = [
+            exports.DELEGATED_CAPABILITIES_CLAIM,
+            exports.DELEGATED_RESOURCE_SCOPE_CLAIM,
+            exports.AUTHORIZED_BY_CLAIM,
+        ].filter(has);
+        if (stray.length > 0) {
+            throw new InvalidBoundaryContextError(issuer, `it carries ${stray.map((c) => `"${c}"`).join(', ')} but is not ` +
+                `delegated (no "${exports.ACT_CLAIM}"/"${exports.DELEGATION_ID_CLAIM}").`);
+        }
+    }
+    else {
+        if (nonEmptyStringList(payload[exports.DELEGATED_CAPABILITIES_CLAIM]) === null) {
+            throw new InvalidBoundaryContextError(issuer, `a delegated context must carry "${exports.DELEGATED_CAPABILITIES_CLAIM}" as a ` +
+                `non-empty list of non-empty strings — a delegation that lends ` +
+                `nothing is not authority.`);
+        }
+        if (has(exports.DELEGATED_RESOURCE_SCOPE_CLAIM) &&
+            nonEmptyStringList(payload[exports.DELEGATED_RESOURCE_SCOPE_CLAIM]) === null) {
+            throw new InvalidBoundaryContextError(issuer, `"${exports.DELEGATED_RESOURCE_SCOPE_CLAIM}" must be a non-empty list of ` +
+                `non-empty strings when present.`);
+        }
+    }
+    const isOrganization = kind === BoundarySubjectKind.Organization;
+    if (has(exports.AUTHORIZED_BY_CLAIM) !== isOrganization) {
+        throw new InvalidBoundaryContextError(issuer, isOrganization
+            ? `an organization context must carry "${exports.AUTHORIZED_BY_CLAIM}" — the ` +
+                `administrator who authorized the delegation.`
+            : `"${exports.AUTHORIZED_BY_CLAIM}" is stated only on an organization context.`);
+    }
+    if (!isOrganization)
+        return;
+    if (!(0, actor_classification_1.asNonEmptyString)(payload[exports.AUTHORIZED_BY_CLAIM])) {
+        throw new InvalidBoundaryContextError(issuer, `"${exports.AUTHORIZED_BY_CLAIM}" must be a non-empty string.`);
+    }
+    if (!delegated) {
+        throw new InvalidBoundaryContextError(issuer, `an organization context exists only under a delegation, and it ` +
+            `carries no "${exports.ACT_CLAIM}"/"${exports.DELEGATION_ID_CLAIM}".`);
+    }
+    const organizationId = (0, actor_classification_1.asNonEmptyString)(payload['sub']);
+    const tenant = (0, org_claim_1.resolveOrgClaim)(payload)?.value;
+    if (!organizationId || !tenant || tenant !== organizationId) {
+        throw new InvalidBoundaryContextError(issuer, `an organization context must name its organization as "sub" and in ` +
+            `"${org_claim_1.OrgClaimKey.Canonical}", and the two must be the same.`);
+    }
+    if (payload[org_role_1.OrgRolesClaimKey.Canonical] !== undefined) {
+        throw new InvalidBoundaryContextError(issuer, `an organization context carries "${org_role_1.OrgRolesClaimKey.Canonical}" — an ` +
+            `organization is not a member of anything.`);
+    }
+}
+function resolveDelegatedAuthorityFromBoundaryClaims(claims, actorChain) {
+    const delegationId = resolveDelegationIdFromBoundaryClaims(claims);
+    if (delegationId === undefined)
+        return undefined;
+    const actor = actorChain[0];
+    const capabilities = nonEmptyStringList(claims[exports.DELEGATED_CAPABILITIES_CLAIM]);
+    if (actor === undefined || capabilities === null) {
+        throw new Error('A delegated claim-authority context reached projection without its ' +
+            'validated actor or capabilities; normalizeClaimAuthorityClaims must run first.');
+    }
+    const resourceScope = nonEmptyStringList(claims[exports.DELEGATED_RESOURCE_SCOPE_CLAIM]);
+    const authorizedBy = (0, actor_classification_1.asNonEmptyString)(claims[exports.AUTHORIZED_BY_CLAIM]);
+    return Object.freeze({
+        delegationId,
+        actor: Object.freeze({ ...actor }),
+        actorChain: Object.freeze(actorChain.map((hop) => Object.freeze({ ...hop }))),
+        capabilities: Object.freeze(capabilities),
+        ...(resourceScope !== null ? { resourceScope: Object.freeze(resourceScope) } : {}),
+        ...(authorizedBy !== undefined ? { authorizedBy } : {}),
+    });
+}
+//# sourceMappingURL=claim-authority.js.map

package/dist/nestjs/auth/claim-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-authority.js","sourceRoot":"","sources":["../../../src/nestjs/auth/claim-authority.ts"],"names":[],"mappings":";;;AAmJA,oEAaC;AAiED,sEA0FC;AAQD,wEAWC;AAQD,sFAIC;AAuFD,wDAiFC;AAaD,kGAwBC;AAviBD,2CAAuD;AACvD,6DAA6D;AAC7D,uDAKmC;AAEnC,wDAAwE;AACxE,sDAA4E;AAC5E,iEAIgC;AAChC,qEAGkC;AAyBrB,QAAA,qBAAqB,GAAG,SAAS,CAAC;AAGlC,QAAA,yBAAyB,GAAG,CAAC,CAAC;AAG9B,QAAA,mBAAmB,GAAG,KAAK,CAAC;AAG5B,QAAA,iBAAiB,GAAG,aAAa,CAAC;AAGlC,QAAA,SAAS,GAAG,KAAK,CAAC;AAOlB,QAAA,4BAA4B,GAAG,wBAAwB,CAAC;AAGxD,QAAA,8BAA8B,GAAG,0BAA0B,CAAC;AAM5D,QAAA,mBAAmB,GAAG,eAAe,CAAC;AAatC,QAAA,yBAAyB,GAAsB;IAC1D,cAAc;IACd,6CAAoB;IACpB,2BAAgB,CAAC,SAAS;IAC1B,uBAAW,CAAC,SAAS;IACrB,yBAAiB;IACjB,yCAAkB;IAClB,iBAAS;IACT,2BAAmB;IACnB,oCAA4B;IAC5B,sCAA8B;IAC9B,2BAAmB;IACnB,6BAAqB;IACrB,oCAAkB;CACnB,CAAC;AAiBW,QAAA,8BAA8B,GAAsB;IAC/D,KAAK;IACL,WAAW;CACZ,CAAC;AAQF,IAAY,mBAWX;AAXD,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,4CAAqB,CAAA;IACrB,sCAAe,CAAA;IAOf,oDAA6B,CAAA;AAC/B,CAAC,EAXW,mBAAmB,mCAAnB,mBAAmB,QAW9B;AASD,SAAgB,4BAA4B,CAC1C,IAAyB;IAEzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,mBAAmB,CAAC,IAAI;YAC3B,OAAO,qBAAW,CAAC,IAAI,CAAC;QAC1B,KAAK,mBAAmB,CAAC,QAAQ;YAC/B,OAAO,qBAAW,CAAC,OAAO,CAAC;QAC7B,KAAK,mBAAmB,CAAC,KAAK;YAC5B,OAAO,qBAAW,CAAC,KAAK,CAAC;QAC3B,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,qBAAW,CAAC,YAAY,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC7B,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAA6B;QAChC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAGD,MAAa,2BAA4B,SAAQ,8BAAqB;IACpE,YAAY,MAAc,EAAE,MAAc;QACxC,KAAK,CACH,0CAA0C,MAAM,iBAAiB,MAAM,GAAG;YACxE,mEAAmE;YACnE,uCAAuC,CAC1C,CAAC;IACJ,CAAC;CACF;AARD,kEAQC;AAOD,MAAa,8BAA+B,SAAQ,2BAA2B;IAC7E,YAAY,MAAc,EAAE,QAAiB;QAC3C,KAAK,CACH,MAAM,EACN,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,kBAAkB,6BAAqB,UAAU;YACnD,CAAC,CAAC,IAAI,6BAAqB,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS;gBAChE,wBAAwB,iCAAyB,QAAQ,CAChE,CAAC;IACJ,CAAC;CACF;AAVD,wEAUC;AA8BD,SAAgB,6BAA6B,CAE3C,OAAU,EAAE,MAAc;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,6BAAqB,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,iCAAyB,EAAE,CAAC;QACzC,MAAM,IAAI,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,aAAa,GAAG,IAAA,uCAAgB,EAAC,OAAO,CAAC,yBAAiB,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,kBAAkB,yBAAiB,UAAU,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,CAAE,MAAM,CAAC,MAAM,CAAC,oBAAU,CAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,yBAAiB,KAAK,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,6BAA6B,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,aAA2B,CAAC;IAE/C,IAAI,CAAC,CAAC,yCAAkB,IAAI,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,kBAAkB,yCAAkB,UAAU,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,OAAO,CAAC,yCAAkB,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,yCAAkB,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yCAAkB,CAAC,CAAC,GAAG;YACvE,iBAAiB,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,4BAA4B,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,IAAA,+CAAwB,EAAC,UAAU,CAAC,KAAK,WAAW,EAAE,CAAC;QACzD,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,yBAAiB,MAAM,UAAU,UAAU,yCAAkB,IAAI;YACnE,IAAI,YAAY,oCAAoC,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,6CAAoB,CAAC,CAAC;IAC/C,IACE,QAAQ,KAAK,SAAS;QACtB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,6CAAoB,gCAAgC,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAI,QAAiC,IAAI,EAAE,CAAC;IAE/D,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAS,CAAC,KAAK,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,2BAAmB,CAAC,KAAK,SAAS,CAAC;IAC1D,IAAI,MAAM,IAAI,CAAC,IAAA,uCAAgB,EAAC,OAAO,CAAC,2BAAmB,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,2BAAmB,+BAA+B,CACvD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,MAAM;YACJ,CAAC,CAAC,eAAe,iBAAS,cAAc,2BAAmB,QAAQ;gBAC/D,sCAAsC;YAC1C,CAAC,CAAC,eAAe,2BAAmB,cAAc,iBAAS,IAAI,CAClE,CAAC;IACJ,CAAC;IAED,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAE9D,MAAM,UAAU,GAAqC,EAAE,GAAG,OAAO,EAAE,CAAC;IACpE,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;IAClC,UAAU,CAAC,yBAAiB,CAAC,GAAG,UAAU,CAAC;IAC3C,UAAU,CAAC,yCAAkB,CAAC,GAAG,WAAW,CAAC;IAC7C,UAAU,CAAC,6CAAoB,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,iBAAS,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,iBAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IACD,UAAU,CAAC,gDAAuB,CAAC,GAAG,IAAI,CAAC;IAC3C,OAAO,UAAe,CAAC;AACzB,CAAC;AAQD,SAAgB,8BAA8B,CAE5C,OAAU;IACV,MAAM,QAAQ,GAA4B,EAAE,GAAG,OAAO,EAAE,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI;QAClB,GAAG,iCAAyB;QAC5B,GAAG,sCAA8B;KAClC,EAAE,CAAC;QACF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,QAAa,CAAC;AACvB,CAAC;AAQD,SAAgB,qCAAqC,CACnD,MAA+B;IAE/B,OAAO,IAAA,uCAAgB,EAAC,MAAM,CAAC,2BAAmB,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAgC,EAChC,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,eAAe,2BAAgB,CAAC,SAAS,WAAW;YAClD,IAAI,uBAAW,CAAC,SAAS,sCAAsC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CACxD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,2BAAgB,CAAC,SAAS,gCAAgC;YAC5D,IAAI,uBAAW,CAAC,SAAS,0CAA0C;YACnE,+CAA+C,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,MAAc;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAG1D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,GAAI,GAA+B,EAAE,CAAC;IAC7E,IAAI,yCAAkB,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,yCAAkB,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,4BAA4B,yCAAkB,IAAI;gBAChD,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yCAAkB,CAAC,CAAC,oCAAoC,CACjF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,4BAA4B,yCAAkB,wBAAwB;gBACpE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,yCAAkB,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,iBAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,iBAAS,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,iBAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACnE,CAAC;IACD,OAAO,CAAC,GAAI,KAAkB,CAAC,CAAC;AAClC,CAAC;AAoBD,SAAgB,sBAAsB,CACpC,OAAgC,EAChC,MAAc,EACd,IAAyB,EACzB,SAAkB;IAElB,MAAM,GAAG,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;IACrE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,KAAK,GAAG;YACZ,oCAA4B;YAC5B,sCAA8B;YAC9B,2BAAmB;SACpB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,cAAc,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAC/D,kBAAkB,iBAAS,MAAM,2BAAmB,KAAK,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,kBAAkB,CAAC,OAAO,CAAC,oCAA4B,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACvE,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,mCAAmC,oCAA4B,SAAS;gBACtE,gEAAgE;gBAChE,2BAA2B,CAC9B,CAAC;QACJ,CAAC;QACD,IACE,GAAG,CAAC,sCAA8B,CAAC;YACnC,kBAAkB,CAAC,OAAO,CAAC,sCAA8B,CAAC,CAAC,KAAK,IAAI,EACpE,CAAC;YACD,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,sCAA8B,gCAAgC;gBAChE,iCAAiC,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,KAAK,mBAAmB,CAAC,YAAY,CAAC;IACjE,IAAI,GAAG,CAAC,2BAAmB,CAAC,KAAK,cAAc,EAAE,CAAC;QAChD,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,cAAc;YACZ,CAAC,CAAC,uCAAuC,2BAAmB,UAAU;gBAClE,8CAA8C;YAClD,CAAC,CAAC,IAAI,2BAAmB,8CAA8C,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,IAAI,CAAC,IAAA,uCAAgB,EAAC,OAAO,CAAC,2BAAmB,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,2BAAmB,+BAA+B,CACvD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,iEAAiE;YAC/D,eAAe,iBAAS,MAAM,2BAAmB,IAAI,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAA,uCAAgB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IAC/C,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC5D,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,qEAAqE;YACnE,IAAI,uBAAW,CAAC,SAAS,kCAAkC,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,2BAAgB,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,oCAAoC,2BAAgB,CAAC,SAAS,SAAS;YACrE,2CAA2C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAaD,SAAgB,2CAA2C,CACzD,MAA+B,EAC/B,UAAmC;IAEnC,MAAM,YAAY,GAAG,qCAAqC,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,oCAA4B,CAAC,CAAC,CAAC;IAC9E,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,gFAAgF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,sCAA8B,CAAC,CAAC,CAAC;IACjF,MAAM,YAAY,GAAG,IAAA,uCAAgB,EAAC,MAAM,CAAC,2BAAmB,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY;QACZ,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;QAClC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7E,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/nestjs/auth/declared-subject-class.d.ts

@@ -6,5 +6,8 @@ export declare class UnclassifiableForeignBearerError extends UnauthorizedExcept
 export declare class UnknownDeclaredSubjectClassError extends UnauthorizedException {
     constructor(issuer: string, declared: string);
 }
+export declare class OrganizationDelegationRequiresClaimAuthorityError extends UnauthorizedException {
+    constructor(source: string);
+}
 export declare function claimsWithDeclaredSubjectClass<T extends Record<string, unknown>>(payload: T, source: VerifiedTokenSource): T;
 //# sourceMappingURL=declared-subject-class.d.ts.map

package/dist/nestjs/auth/declared-subject-class.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"declared-subject-class.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AA+BlE,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM;CAW3B;AAWD,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM7C;AAsBD,wBAAgB,8BAA8B,CAC5C,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,CAc5C"}
+{"version":3,"file":"declared-subject-class.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAOvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAiClE,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM;CAY3B;AAWD,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM7C;AAcD,qBAAa,iDAAkD,SAAQ,qBAAqB;gBAC9E,MAAM,EAAE,MAAM;CAQ3B;AAuCD,wBAAgB,8BAA8B,CAC5C,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,CA2B5C"}

package/dist/nestjs/auth/declared-subject-class.js

@@ -1,18 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerError = void 0;
+exports.OrganizationDelegationRequiresClaimAuthorityError = exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerError = void 0;
 exports.claimsWithDeclaredSubjectClass = claimsWithDeclaredSubjectClass;
 const common_1 = require("@nestjs/common");
 const subject_1 = require("@xemahq/contracts/subject");
+const claim_authority_1 = require("./claim-authority");
 class UnclassifiableForeignBearerError extends common_1.UnauthorizedException {
     constructor(issuer) {
         super(`The access token was proved by trusted issuer '${issuer}', which ` +
-            `declares no "subjectClass", and the token carries no "token_class" ` +
-            `of its own. Nothing states what kind of subject this is, so it is ` +
+            `declares no "subjectClass". A token's own "token_class" is honoured ` +
+            `only from the claim authority, so nothing states what kind of ` +
+            `subject this is, and it is ` +
             `refused rather than assumed to be a user — the assumption that a ` +
             `signal-less token is a browser login holds for this deployment's own ` +
             `realm and for nothing else. Declare "subjectClass" on the issuer's ` +
-            `registry entry, or have the issuer stamp "token_class".`);
+            `registry entry, or "claimAuthority": true if it is the identity boundary.`);
     }
 }
 exports.UnclassifiableForeignBearerError = UnclassifiableForeignBearerError;
@@ -23,12 +25,26 @@ class UnknownDeclaredSubjectClassError extends common_1.UnauthorizedException {
     }
 }
 exports.UnknownDeclaredSubjectClassError = UnknownDeclaredSubjectClassError;
+class OrganizationDelegationRequiresClaimAuthorityError extends common_1.UnauthorizedException {
+    constructor(source) {
+        super(`The access token from ${source} states the ` +
+            `"${subject_1.TokenClass.OrganizationDelegation}" class, which only the identity ` +
+            `boundary (the claim authority) may state — nothing else can have ` +
+            `validated the delegation it implies.`);
+    }
+}
+exports.OrganizationDelegationRequiresClaimAuthorityError = OrganizationDelegationRequiresClaimAuthorityError;
 function claimsWithDeclaredSubjectClass(payload, source) {
-    if (source.kind !== 'trusted-issuer')
-        return payload;
-    if (typeof payload.token_class === 'string' && payload.token_class) {
+    if (source.kind !== 'trusted-issuer') {
+        if (payload['token_class'] === subject_1.TokenClass.OrganizationDelegation) {
+            throw new OrganizationDelegationRequiresClaimAuthorityError("the deployment's own realm");
+        }
         return payload;
     }
+    if (source.entry.claimAuthority === true) {
+        return (0, claim_authority_1.normalizeClaimAuthorityClaims)(payload, source.entry.issuer);
+    }
+    const foreign = (0, claim_authority_1.withoutPlatformAuthorityClaims)(payload);
     const declared = source.entry.subjectClass;
     if (!declared) {
         throw new UnclassifiableForeignBearerError(source.entry.issuer);
@@ -37,6 +53,9 @@ function claimsWithDeclaredSubjectClass(payload, source) {
     if (!parsed.success) {
         throw new UnknownDeclaredSubjectClassError(source.entry.issuer, declared);
     }
-    return { ...payload, token_class: parsed.data };
+    if (parsed.data === subject_1.TokenClass.OrganizationDelegation) {
+        throw new OrganizationDelegationRequiresClaimAuthorityError(`trusted issuer '${source.entry.issuer}' (its declared subjectClass)`);
+    }
+    return { ...foreign, token_class: parsed.data };
 }
 //# sourceMappingURL=declared-subject-class.js.map

package/dist/nestjs/auth/declared-subject-class.js.map

@@ -1 +1 @@
-{"version":3,"file":"declared-subject-class.js","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":";;;AAsFA,wEAgBC;AAtGD,2CAAuD;AACvD,uDAA6D;AAiC7D,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc;QACxB,KAAK,CACH,kDAAkD,MAAM,WAAW;YACjE,qEAAqE;YACrE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;CACF;AAZD,4EAYC;AAWD,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc,EAAE,QAAgB;QAC1C,KAAK,CACH,mBAAmB,MAAM,0BAA0B;YACjD,IAAI,QAAQ,qCAAqC,CACpD,CAAC;IACJ,CAAC;CACF;AAPD,4EAOC;AAsBD,SAAgB,8BAA8B,CAE5C,OAAU,EAAE,MAA2B;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,0BAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC"}
+{"version":3,"file":"declared-subject-class.js","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":";;;AAqIA,wEA6BC;AAlKD,2CAAuD;AACvD,uDAAyE;AAEzE,uDAG2B;AAkC3B,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc;QACxB,KAAK,CACH,kDAAkD,MAAM,WAAW;YACjE,sEAAsE;YACtE,gEAAgE;YAChE,6BAA6B;YAC7B,mEAAmE;YACnE,uEAAuE;YACvE,qEAAqE;YACrE,2EAA2E,CAC9E,CAAC;IACJ,CAAC;CACF;AAbD,4EAaC;AAWD,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc,EAAE,QAAgB;QAC1C,KAAK,CACH,mBAAmB,MAAM,0BAA0B;YACjD,IAAI,QAAQ,qCAAqC,CACpD,CAAC;IACJ,CAAC;CACF;AAPD,4EAOC;AAcD,MAAa,iDAAkD,SAAQ,8BAAqB;IAC1F,YAAY,MAAc;QACxB,KAAK,CACH,yBAAyB,MAAM,cAAc;YAC3C,IAAI,oBAAU,CAAC,sBAAsB,mCAAmC;YACxE,mEAAmE;YACnE,sCAAsC,CACzC,CAAC;IACJ,CAAC;CACF;AATD,8GASC;AAuCD,SAAgB,8BAA8B,CAE5C,OAAU,EAAE,MAA2B;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,oBAAU,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,iDAAiD,CACzD,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,IAAA,+CAA6B,EAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,gDAA8B,EAAC,OAAO,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,0BAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAU,CAAC,sBAAsB,EAAE,CAAC;QACtD,MAAM,IAAI,iDAAiD,CACzD,mBAAmB,MAAM,CAAC,KAAK,CAAC,MAAM,+BAA+B,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC"}

package/dist/nestjs/auth/delegation-chain.d.ts

@@ -1,5 +1,6 @@
 import { BadRequestException } from '@nestjs/common';
-import type { ActingForRef, SubjectKind } from '@xemahq/contracts/subject';
+import { SubjectKind } from '@xemahq/contracts/subject';
+import type { ActingForRef } from '@xemahq/contracts/subject';
 export declare class UnclassifiableActorHopError extends BadRequestException {
     constructor(hopIndex: number, hopSub: string);
 }
@@ -9,6 +10,9 @@ export declare class UnknownActorHopSubjectKindError extends BadRequestException
 export declare class ContradictoryActorHopKindError extends BadRequestException {
     constructor(hopIndex: number, hopSub: string, declared: SubjectKind, derived: SubjectKind);
 }
+export declare class OrganizationActorHopError extends BadRequestException {
+    constructor(hopIndex: number, hopSub: string);
+}
 export declare class MalformedActorHopError extends BadRequestException {
     constructor(hopIndex: number);
 }

package/dist/nestjs/auth/delegation-chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delegation-chain.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/delegation-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACZ,MAAM,2BAA2B,CAAC;AA+BnC,qBAAa,2BAA4B,SAAQ,mBAAmB;gBACtD,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAS7C;AAWD,qBAAa,+BAAgC,SAAQ,mBAAmB;gBAC1D,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;CAQhE;AAaD,qBAAa,8BAA+B,SAAQ,mBAAmB;gBAEnE,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,WAAW;CASvB;AAGD,qBAAa,sBAAuB,SAAQ,mBAAmB;gBACjD,QAAQ,EAAE,MAAM;CAO7B;AA4FD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,YAAY,EAAE,CAyBhB"}
+{"version":3,"file":"delegation-chain.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/delegation-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA+B9D,qBAAa,2BAA4B,SAAQ,mBAAmB;gBACtD,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAS7C;AAWD,qBAAa,+BAAgC,SAAQ,mBAAmB;gBAC1D,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;CAQhE;AAaD,qBAAa,8BAA+B,SAAQ,mBAAmB;gBAEnE,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,WAAW;CASvB;AAQD,qBAAa,yBAA0B,SAAQ,mBAAmB;gBACpD,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM7C;AAgBD,qBAAa,sBAAuB,SAAQ,mBAAmB;gBACjD,QAAQ,EAAE,MAAM;CAO7B;AAkGD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,YAAY,EAAE,CAyBhB"}

package/dist/nestjs/auth/delegation-chain.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = void 0;
+exports.MalformedActorHopError = exports.OrganizationActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = void 0;
 exports.resolveActorChainFromClaims = resolveActorChainFromClaims;
 const common_1 = require("@nestjs/common");
+const subject_1 = require("@xemahq/contracts/subject");
 const actor_classification_1 = require("./actor-classification");
 class UnclassifiableActorHopError extends common_1.BadRequestException {
     constructor(hopIndex, hopSub) {
@@ -32,6 +33,14 @@ class ContradictoryActorHopKindError extends common_1.BadRequestException {
     }
 }
 exports.ContradictoryActorHopKindError = ContradictoryActorHopKindError;
+class OrganizationActorHopError extends common_1.BadRequestException {
+    constructor(hopIndex, hopSub) {
+        super(`Delegation hop #${hopIndex} (act.sub='${hopSub}') names an ` +
+            `organization as the acting party. An organization delegates; it never acts.`);
+    }
+}
+exports.OrganizationActorHopError = OrganizationActorHopError;
+const BOUNDARY_WORKLOAD_HOP_KIND = 'workload';
 class MalformedActorHopError extends common_1.BadRequestException {
     constructor(hopIndex) {
         super(`Delegation hop #${hopIndex} has no non-empty "sub" claim. An RFC 8693 ` +
@@ -46,7 +55,9 @@ function asClaimObject(value) {
         : undefined;
 }
 function classifyHop(hop, hopIndex, hopSub) {
-    const declared = (0, actor_classification_1.readDeclaredSubjectKind)(hop);
+    const declared = hop[actor_classification_1.SUBJECT_KIND_CLAIM] === BOUNDARY_WORKLOAD_HOP_KIND
+        ? subject_1.SubjectKind.Service
+        : (0, actor_classification_1.readDeclaredSubjectKind)(hop);
     if (declared === null) {
         throw new UnknownActorHopSubjectKindError(hopIndex, hopSub, hop[actor_classification_1.SUBJECT_KIND_CLAIM]);
     }
@@ -58,6 +69,9 @@ function classifyHop(hop, hopIndex, hopSub) {
     if (kind === undefined) {
         throw new UnclassifiableActorHopError(hopIndex, hopSub);
     }
+    if (kind === subject_1.SubjectKind.Organization) {
+        throw new OrganizationActorHopError(hopIndex, hopSub);
+    }
     return kind;
 }
 function resolveActorChainFromClaims(claims) {

package/dist/nestjs/auth/delegation-chain.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegation-chain.js","sourceRoot":"","sources":["../../../src/nestjs/auth/delegation-chain.ts"],"names":[],"mappings":";;;AAmMA,kEA2BC;AA9ND,2CAAqD;AAMrD,iEASgC;AAoBhC,MAAa,2BAA4B,SAAQ,4BAAmB;IAClE,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CACH,mBAAmB,QAAQ,cAAc,MAAM,gBAAgB;YAC7D,uEAAuE;YACvE,4EAA4E;YAC5E,mEAAmE;YACnE,8BAA8B,CACjC,CAAC;IACJ,CAAC;CACF;AAVD,kEAUC;AAWD,MAAa,+BAAgC,SAAQ,4BAAmB;IACtE,YAAY,QAAgB,EAAE,MAAc,EAAE,QAAiB;QAC7D,KAAK,CACH,mBAAmB,QAAQ,cAAc,MAAM,cAAc;YAC3D,IAAI,yCAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mBAAmB;YACvE,sEAAsE;YACtE,4EAA4E,CAC/E,CAAC;IACJ,CAAC;CACF;AATD,0EASC;AAaD,MAAa,8BAA+B,SAAQ,4BAAmB;IACrE,YACE,QAAgB,EAChB,MAAc,EACd,QAAqB,EACrB,OAAoB;QAEpB,KAAK,CACH,mBAAmB,QAAQ,cAAc,MAAM,yBAAyB;YACtE,IAAI,yCAAkB,eAAe,QAAQ,kBAAkB;YAC/D,6CAA6C,OAAO,gBAAgB;YACpE,6DAA6D,CAChE,CAAC;IACJ,CAAC;CACF;AAdD,wEAcC;AAGD,MAAa,sBAAuB,SAAQ,4BAAmB;IAC7D,YAAY,QAAgB;QAC1B,KAAK,CACH,mBAAmB,QAAQ,6CAA6C;YACtE,sEAAsE;YACtE,+BAA+B,CAClC,CAAC;IACJ,CAAC;CACF;AARD,wDAQC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAwBD,SAAS,WAAW,CAClB,GAA4B,EAC5B,QAAgB,EAChB,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAA,8CAAuB,EAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,+BAA+B,CACvC,QAAQ,EACR,MAAM,EACN,GAAG,CAAC,yCAAkB,CAAC,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,gDAAyB,EACvC,IAAA,6CAAsB,EAAC,GAAG,CAAC,EAC3B,GAAG,EACH,IAAA,6CAAsB,EAAC,GAAG,CAAC,CAC5B,EAAE,IAAI,CAAC;IAER,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC5E,MAAM,IAAI,8BAA8B,CACtC,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,IAAI,OAAO,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,2BAA2B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AA6BD,SAAgB,2BAA2B,CACzC,MAA+B;IAE/B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,IAAA,uCAAgB,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,gDAAyB,EAAC,IAAI,CAAC,CAAC;QAKjD,MAAM,WAAW,GAAG,IAAA,mDAA4B,EAAC,IAAI,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;YACtC,EAAE,EAAE,GAAG;YACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,QAAQ,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"delegation-chain.js","sourceRoot":"","sources":["../../../src/nestjs/auth/delegation-chain.ts"],"names":[],"mappings":";;;AAmOA,kEA2BC;AA9PD,2CAAqD;AACrD,uDAAwD;AAGxD,iEASgC;AAoBhC,MAAa,2BAA4B,SAAQ,4BAAmB;IAClE,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CACH,mBAAmB,QAAQ,cAAc,MAAM,gBAAgB;YAC7D,uEAAuE;YACvE,4EAA4E;YAC5E,mEAAmE;YACnE,8BAA8B,CACjC,CAAC;IACJ,CAAC;CACF;AAVD,kEAUC;AAWD,MAAa,+BAAgC,SAAQ,4BAAmB;IACtE,YAAY,QAAgB,EAAE,MAAc,EAAE,QAAiB;QAC7D,KAAK,CACH,mBAAmB,QAAQ,cAAc,MAAM,cAAc;YAC3D,IAAI,yCAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mBAAmB;YACvE,sEAAsE;YACtE,4EAA4E,CAC/E,CAAC;IACJ,CAAC;CACF;AATD,0EASC;AAaD,MAAa,8BAA+B,SAAQ,4BAAmB;IACrE,YACE,QAAgB,EAChB,MAAc,EACd,QAAqB,EACrB,OAAoB;QAEpB,KAAK,CACH,mBAAmB,QAAQ,cAAc,MAAM,yBAAyB;YACtE,IAAI,yCAAkB,eAAe,QAAQ,kBAAkB;YAC/D,6CAA6C,OAAO,gBAAgB;YACpE,6DAA6D,CAChE,CAAC;IACJ,CAAC;CACF;AAdD,wEAcC;AAQD,MAAa,yBAA0B,SAAQ,4BAAmB;IAChE,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CACH,mBAAmB,QAAQ,cAAc,MAAM,cAAc;YAC3D,6EAA6E,CAChF,CAAC;IACJ,CAAC;CACF;AAPD,8DAOC;AAaD,MAAM,0BAA0B,GAAG,UAAU,CAAC;AAG9C,MAAa,sBAAuB,SAAQ,4BAAmB;IAC7D,YAAY,QAAgB;QAC1B,KAAK,CACH,mBAAmB,QAAQ,6CAA6C;YACtE,sEAAsE;YACtE,+BAA+B,CAClC,CAAC;IACJ,CAAC;CACF;AARD,wDAQC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAwBD,SAAS,WAAW,CAClB,GAA4B,EAC5B,QAAgB,EAChB,MAAc;IAEd,MAAM,QAAQ,GACZ,GAAG,CAAC,yCAAkB,CAAC,KAAK,0BAA0B;QACpD,CAAC,CAAC,qBAAW,CAAC,OAAO;QACrB,CAAC,CAAC,IAAA,8CAAuB,EAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,+BAA+B,CACvC,QAAQ,EACR,MAAM,EACN,GAAG,CAAC,yCAAkB,CAAC,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,gDAAyB,EACvC,IAAA,6CAAsB,EAAC,GAAG,CAAC,EAC3B,GAAG,EACH,IAAA,6CAAsB,EAAC,GAAG,CAAC,CAC5B,EAAE,IAAI,CAAC;IAER,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC5E,MAAM,IAAI,8BAA8B,CACtC,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,IAAI,OAAO,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,2BAA2B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,KAAK,qBAAW,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AA6BD,SAAgB,2BAA2B,CACzC,MAA+B;IAE/B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,IAAA,uCAAgB,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,gDAAyB,EAAC,IAAI,CAAC,CAAC;QAKjD,MAAM,WAAW,GAAG,IAAA,mDAA4B,EAAC,IAAI,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;YACtC,EAAE,EAAE,GAAG;YACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,QAAQ,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/nestjs/auth/index.d.ts

@@ -16,9 +16,11 @@ export { RequireProvenOrgAuthority, REQUIRE_PROVEN_ORG_AUTHORITY } from './prove
 export { OrgAuthoritySource, type OrgAuthorityVerdict, type OrgAuthorityCaller, type OrgAuthorityCallerFacts, resolveOrgAuthority, isOrgAuthorityProven, orgAuthorityRequiresProof, } from '../../lib/auth/org-authority';
 export { OrgScopeProvenance, type OrgScopeWitness, type OrgScopedTokenMinter, UnprovenOrgScopeError, orgScopeFromProvenRequest, orgScopeFromOwningRow, orgScopeFromPlatformSweep, describeOrgScopeWitness, mintOrgScopedToken, type OrgScopedClaimDescriptor, orgScopedClaim, } from '../../lib/auth/org-scope-mint';
 export { ORG_AUTHORITY_OBSERVATION_LIMIT, UNKNOWN_CLIENT_ID, type OrgAuthorityObservation, type OrgAuthorityCensus, recordUnprovenOrgAuthority, recordServiceRelayedOrgAuthority, orgAuthorityCensus, orgAuthorityRelayCensus, resetOrgAuthorityCensus, } from '../../lib/auth/org-authority-observations';
-export { resolveActorChainFromClaims, UnclassifiableActorHopError, UnknownActorHopSubjectKindError, ContradictoryActorHopKindError, MalformedActorHopError, } from './delegation-chain';
+export { resolveActorChainFromClaims, UnclassifiableActorHopError, UnknownActorHopSubjectKindError, ContradictoryActorHopKindError, MalformedActorHopError, OrganizationActorHopError, } from './delegation-chain';
 export { SUBJECT_KIND_CLAIM, readDeclaredSubjectKind, UnknownTokenClassError, } from './actor-classification';
 export { RealmTokenVerifier, type MultiRealmKeySource, type VerifiedTokenSource, } from './realm-token-verifier';
-export { UnclassifiableForeignBearerError, UnknownDeclaredSubjectClassError, claimsWithDeclaredSubjectClass, } from './declared-subject-class';
+export { UnclassifiableForeignBearerError, UnknownDeclaredSubjectClassError, OrganizationDelegationRequiresClaimAuthorityError, claimsWithDeclaredSubjectClass, } from './declared-subject-class';
+export { BoundarySubjectKind, AUTHORIZED_BY_CLAIM, CONTEXT_VERSION_CLAIM, DELEGATED_CAPABILITIES_CLAIM, DELEGATED_RESOURCE_SCOPE_CLAIM, DELEGATION_ID_CLAIM, FOREIGN_CALLER_IDENTITY_CLAIMS, InvalidBoundaryContextError, PLATFORM_AUTHORITY_CLAIMS, SUPPORTED_CONTEXT_VERSION, UnsupportedContextVersionError, kernelSubjectKindForBoundary, } from './claim-authority';
+export { PLATFORM_ROLES_CLAIM } from './boundary-context-brand';
 export { DEFAULT_TRUSTED_ISSUER_ALGORITHMS, TRUSTED_ISSUERS_ENV_VAR, TrustedIssuerConfigError, TrustedIssuerRegistry, parseTrustedIssuersFromEnv, type TrustedIssuerEntry, } from '@xemahq/oidc-guard';
 //# sourceMappingURL=index.d.ts.map

package/dist/nestjs/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,cAAc,GACf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,cAAc,GACf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,iDAAiD,EACjD,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,4BAA4B,EAC5B,8BAA8B,EAC9B,mBAAmB,EACnB,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAOhE,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}

package/dist/nestjs/auth/index.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resetOrgAuthorityCensus = exports.orgAuthorityRelayCensus = exports.orgAuthorityCensus = exports.recordServiceRelayedOrgAuthority = exports.recordUnprovenOrgAuthority = exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = exports.orgScopedClaim = exports.mintOrgScopedToken = exports.describeOrgScopeWitness = exports.orgScopeFromPlatformSweep = exports.orgScopeFromOwningRow = exports.orgScopeFromProvenRequest = exports.UnprovenOrgScopeError = exports.OrgScopeProvenance = exports.orgAuthorityRequiresProof = exports.isOrgAuthorityProven = exports.resolveOrgAuthority = exports.OrgAuthoritySource = exports.REQUIRE_PROVEN_ORG_AUTHORITY = exports.RequireProvenOrgAuthority = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.PlatformAdminGuard = exports.resolveOrgAuthorityInstrument = exports.holdsOrgAuthority = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.OrgRole = exports.ServiceOrOrgRoleGuard = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.isDirectServiceActor = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = void 0;
-exports.parseTrustedIssuersFromEnv = exports.TrustedIssuerRegistry = exports.TrustedIssuerConfigError = exports.TRUSTED_ISSUERS_ENV_VAR = exports.DEFAULT_TRUSTED_ISSUER_ALGORITHMS = exports.claimsWithDeclaredSubjectClass = exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerError = exports.RealmTokenVerifier = exports.UnknownTokenClassError = exports.readDeclaredSubjectKind = exports.SUBJECT_KIND_CLAIM = exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = exports.resolveActorChainFromClaims = void 0;
+exports.parseTrustedIssuersFromEnv = exports.TrustedIssuerRegistry = exports.TrustedIssuerConfigError = exports.TRUSTED_ISSUERS_ENV_VAR = exports.DEFAULT_TRUSTED_ISSUER_ALGORITHMS = exports.PLATFORM_ROLES_CLAIM = exports.kernelSubjectKindForBoundary = exports.UnsupportedContextVersionError = exports.SUPPORTED_CONTEXT_VERSION = exports.PLATFORM_AUTHORITY_CLAIMS = exports.InvalidBoundaryContextError = exports.FOREIGN_CALLER_IDENTITY_CLAIMS = exports.DELEGATION_ID_CLAIM = exports.DELEGATED_RESOURCE_SCOPE_CLAIM = exports.DELEGATED_CAPABILITIES_CLAIM = exports.CONTEXT_VERSION_CLAIM = exports.AUTHORIZED_BY_CLAIM = exports.BoundarySubjectKind = exports.claimsWithDeclaredSubjectClass = exports.OrganizationDelegationRequiresClaimAuthorityError = exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerError = exports.RealmTokenVerifier = exports.UnknownTokenClassError = exports.readDeclaredSubjectKind = exports.SUBJECT_KIND_CLAIM = exports.OrganizationActorHopError = exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = exports.resolveActorChainFromClaims = void 0;
 var auth_module_1 = require("./auth.module");
 Object.defineProperty(exports, "AuthModule", { enumerable: true, get: function () { return auth_module_1.AuthModule; } });
 var auth_module_options_1 = require("./auth-module-options");
@@ -76,6 +76,7 @@ Object.defineProperty(exports, "UnclassifiableActorHopError", { enumerable: true
 Object.defineProperty(exports, "UnknownActorHopSubjectKindError", { enumerable: true, get: function () { return delegation_chain_1.UnknownActorHopSubjectKindError; } });
 Object.defineProperty(exports, "ContradictoryActorHopKindError", { enumerable: true, get: function () { return delegation_chain_1.ContradictoryActorHopKindError; } });
 Object.defineProperty(exports, "MalformedActorHopError", { enumerable: true, get: function () { return delegation_chain_1.MalformedActorHopError; } });
+Object.defineProperty(exports, "OrganizationActorHopError", { enumerable: true, get: function () { return delegation_chain_1.OrganizationActorHopError; } });
 var actor_classification_1 = require("./actor-classification");
 Object.defineProperty(exports, "SUBJECT_KIND_CLAIM", { enumerable: true, get: function () { return actor_classification_1.SUBJECT_KIND_CLAIM; } });
 Object.defineProperty(exports, "readDeclaredSubjectKind", { enumerable: true, get: function () { return actor_classification_1.readDeclaredSubjectKind; } });
@@ -85,7 +86,23 @@ Object.defineProperty(exports, "RealmTokenVerifier", { enumerable: true, get: fu
 var declared_subject_class_1 = require("./declared-subject-class");
 Object.defineProperty(exports, "UnclassifiableForeignBearerError", { enumerable: true, get: function () { return declared_subject_class_1.UnclassifiableForeignBearerError; } });
 Object.defineProperty(exports, "UnknownDeclaredSubjectClassError", { enumerable: true, get: function () { return declared_subject_class_1.UnknownDeclaredSubjectClassError; } });
+Object.defineProperty(exports, "OrganizationDelegationRequiresClaimAuthorityError", { enumerable: true, get: function () { return declared_subject_class_1.OrganizationDelegationRequiresClaimAuthorityError; } });
 Object.defineProperty(exports, "claimsWithDeclaredSubjectClass", { enumerable: true, get: function () { return declared_subject_class_1.claimsWithDeclaredSubjectClass; } });
+var claim_authority_1 = require("./claim-authority");
+Object.defineProperty(exports, "BoundarySubjectKind", { enumerable: true, get: function () { return claim_authority_1.BoundarySubjectKind; } });
+Object.defineProperty(exports, "AUTHORIZED_BY_CLAIM", { enumerable: true, get: function () { return claim_authority_1.AUTHORIZED_BY_CLAIM; } });
+Object.defineProperty(exports, "CONTEXT_VERSION_CLAIM", { enumerable: true, get: function () { return claim_authority_1.CONTEXT_VERSION_CLAIM; } });
+Object.defineProperty(exports, "DELEGATED_CAPABILITIES_CLAIM", { enumerable: true, get: function () { return claim_authority_1.DELEGATED_CAPABILITIES_CLAIM; } });
+Object.defineProperty(exports, "DELEGATED_RESOURCE_SCOPE_CLAIM", { enumerable: true, get: function () { return claim_authority_1.DELEGATED_RESOURCE_SCOPE_CLAIM; } });
+Object.defineProperty(exports, "DELEGATION_ID_CLAIM", { enumerable: true, get: function () { return claim_authority_1.DELEGATION_ID_CLAIM; } });
+Object.defineProperty(exports, "FOREIGN_CALLER_IDENTITY_CLAIMS", { enumerable: true, get: function () { return claim_authority_1.FOREIGN_CALLER_IDENTITY_CLAIMS; } });
+Object.defineProperty(exports, "InvalidBoundaryContextError", { enumerable: true, get: function () { return claim_authority_1.InvalidBoundaryContextError; } });
+Object.defineProperty(exports, "PLATFORM_AUTHORITY_CLAIMS", { enumerable: true, get: function () { return claim_authority_1.PLATFORM_AUTHORITY_CLAIMS; } });
+Object.defineProperty(exports, "SUPPORTED_CONTEXT_VERSION", { enumerable: true, get: function () { return claim_authority_1.SUPPORTED_CONTEXT_VERSION; } });
+Object.defineProperty(exports, "UnsupportedContextVersionError", { enumerable: true, get: function () { return claim_authority_1.UnsupportedContextVersionError; } });
+Object.defineProperty(exports, "kernelSubjectKindForBoundary", { enumerable: true, get: function () { return claim_authority_1.kernelSubjectKindForBoundary; } });
+var boundary_context_brand_1 = require("./boundary-context-brand");
+Object.defineProperty(exports, "PLATFORM_ROLES_CLAIM", { enumerable: true, get: function () { return boundary_context_brand_1.PLATFORM_ROLES_CLAIM; } });
 var oidc_guard_1 = require("@xemahq/oidc-guard");
 Object.defineProperty(exports, "DEFAULT_TRUSTED_ISSUER_ALGORITHMS", { enumerable: true, get: function () { return oidc_guard_1.DEFAULT_TRUSTED_ISSUER_ALGORITHMS; } });
 Object.defineProperty(exports, "TRUSTED_ISSUERS_ENV_VAR", { enumerable: true, get: function () { return oidc_guard_1.TRUSTED_ISSUERS_ENV_VAR; } });

package/dist/nestjs/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":";;;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAI+B;AAH7B,0HAAA,mBAAmB,OAAA;AAIrB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,6DAG+B;AAF7B,wHAAA,iBAAiB,OAAA;AACjB,2HAAA,oBAAoB,OAAA;AAEtB,yDAI6B;AAH3B,oHAAA,eAAe,OAAA;AACf,sHAAA,iBAAiB,OAAA;AACjB,wHAAA,mBAAmB,OAAA;AAErB,mDAI0B;AAHxB,8GAAA,YAAY,OAAA;AACZ,gHAAA,cAAc,OAAA;AACd,kHAAA,gBAAgB,OAAA;AAElB,yEAAoE;AAA3D,kIAAA,qBAAqB,OAAA;AAC9B,oDAOiC;AAN/B,mGAAA,OAAO,OAAA;AACP,4GAAA,gBAAgB,OAAA;AAChB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AACpB,4GAAA,gBAAgB,OAAA;AAElB,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,6DAI+B;AAH7B,wHAAA,iBAAiB,OAAA;AACjB,oIAAA,6BAA6B,OAAA;AAG/B,+DAA4D;AAAnD,0HAAA,kBAAkB,OAAA;AAC3B,yEAGqC;AAFnC,oIAAA,uBAAuB,OAAA;AAGzB,sDAKkC;AAJhC,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AACb,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA;AAEjB,iFAA0G;AAAjG,0IAAA,yBAAyB,OAAA;AAAE,6IAAA,4BAA4B,OAAA;AAChE,8DAQsC;AAPpC,mHAAA,kBAAkB,OAAA;AAIlB,oHAAA,mBAAmB,OAAA;AACnB,qHAAA,oBAAoB,OAAA;AACpB,0HAAA,yBAAyB,OAAA;AAE3B,gEAYuC;AAXrC,oHAAA,kBAAkB,OAAA;AAGlB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,yHAAA,uBAAuB,OAAA;AACvB,oHAAA,kBAAkB,OAAA;AAElB,gHAAA,cAAc,OAAA;AAEhB,wFAUmD;AATjD,6IAAA,+BAA+B,OAAA;AAC/B,+HAAA,iBAAiB,OAAA;AAGjB,wIAAA,0BAA0B,OAAA;AAC1B,8IAAA,gCAAgC,OAAA;AAChC,gIAAA,kBAAkB,OAAA;AAClB,qIAAA,uBAAuB,OAAA;AACvB,qIAAA,uBAAuB,OAAA;AAEzB,uDAM4B;AAL1B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAIpB,mEAIkC;AAHhC,0IAAA,gCAAgC,OAAA;AAChC,0IAAA,gCAAgC,OAAA;AAChC,wIAAA,8BAA8B,OAAA;AAQhC,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":";;;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAI+B;AAH7B,0HAAA,mBAAmB,OAAA;AAIrB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,6DAG+B;AAF7B,wHAAA,iBAAiB,OAAA;AACjB,2HAAA,oBAAoB,OAAA;AAEtB,yDAI6B;AAH3B,oHAAA,eAAe,OAAA;AACf,sHAAA,iBAAiB,OAAA;AACjB,wHAAA,mBAAmB,OAAA;AAErB,mDAI0B;AAHxB,8GAAA,YAAY,OAAA;AACZ,gHAAA,cAAc,OAAA;AACd,kHAAA,gBAAgB,OAAA;AAElB,yEAAoE;AAA3D,kIAAA,qBAAqB,OAAA;AAC9B,oDAOiC;AAN/B,mGAAA,OAAO,OAAA;AACP,4GAAA,gBAAgB,OAAA;AAChB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AACpB,4GAAA,gBAAgB,OAAA;AAElB,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,6DAI+B;AAH7B,wHAAA,iBAAiB,OAAA;AACjB,oIAAA,6BAA6B,OAAA;AAG/B,+DAA4D;AAAnD,0HAAA,kBAAkB,OAAA;AAC3B,yEAGqC;AAFnC,oIAAA,uBAAuB,OAAA;AAGzB,sDAKkC;AAJhC,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AACb,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA;AAEjB,iFAA0G;AAAjG,0IAAA,yBAAyB,OAAA;AAAE,6IAAA,4BAA4B,OAAA;AAChE,8DAQsC;AAPpC,mHAAA,kBAAkB,OAAA;AAIlB,oHAAA,mBAAmB,OAAA;AACnB,qHAAA,oBAAoB,OAAA;AACpB,0HAAA,yBAAyB,OAAA;AAE3B,gEAYuC;AAXrC,oHAAA,kBAAkB,OAAA;AAGlB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,yHAAA,uBAAuB,OAAA;AACvB,oHAAA,kBAAkB,OAAA;AAElB,gHAAA,cAAc,OAAA;AAEhB,wFAUmD;AATjD,6IAAA,+BAA+B,OAAA;AAC/B,+HAAA,iBAAiB,OAAA;AAGjB,wIAAA,0BAA0B,OAAA;AAC1B,8IAAA,gCAAgC,OAAA;AAChC,gIAAA,kBAAkB,OAAA;AAClB,qIAAA,uBAAuB,OAAA;AACvB,qIAAA,uBAAuB,OAAA;AAEzB,uDAO4B;AAN1B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AACtB,6HAAA,yBAAyB,OAAA;AAE3B,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAIpB,mEAKkC;AAJhC,0IAAA,gCAAgC,OAAA;AAChC,0IAAA,gCAAgC,OAAA;AAChC,2JAAA,iDAAiD,OAAA;AACjD,wIAAA,8BAA8B,OAAA;AAEhC,qDAa2B;AAZzB,sHAAA,mBAAmB,OAAA;AACnB,sHAAA,mBAAmB,OAAA;AACnB,wHAAA,qBAAqB,OAAA;AACrB,+HAAA,4BAA4B,OAAA;AAC5B,iIAAA,8BAA8B,OAAA;AAC9B,sHAAA,mBAAmB,OAAA;AACnB,iIAAA,8BAA8B,OAAA;AAC9B,8HAAA,2BAA2B,OAAA;AAC3B,4HAAA,yBAAyB,OAAA;AACzB,4HAAA,yBAAyB,OAAA;AACzB,iIAAA,8BAA8B,OAAA;AAC9B,+HAAA,4BAA4B,OAAA;AAE9B,mEAAgE;AAAvD,8HAAA,oBAAoB,OAAA;AAO7B,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA"}

package/dist/nestjs/auth/org-authority-fence.d.ts

@@ -0,0 +1,16 @@
+import type { SubjectKind, TokenClass } from '@xemahq/contracts/subject';
+import { OrgHeaderName } from '../../lib/auth/org-claim';
+import { type OrgAuthorityVerdict } from '../../lib/auth/org-authority';
+export interface OrgAuthorityLogger {
+    log(message: unknown): void;
+    warn(message: unknown): void;
+}
+export declare function assertOrgHeaderPresentForCaller(orgId: string | undefined, actorType: 'human' | 'agent' | 'service'): void;
+export declare function assertOrgClaimMatchesHeader(logger: OrgAuthorityLogger, claims: Record<string, unknown>, headerValue: string, headerName: OrgHeaderName): void;
+export declare function fenceOrgAuthority(logger: OrgAuthorityLogger, claims: Record<string, unknown>, resolvedOrgId: string, facts: {
+    tokenClass: TokenClass;
+    subjectKind: SubjectKind;
+    clientId: string | undefined;
+    delegated: boolean;
+}, route: string, correlationId: string): OrgAuthorityVerdict;
+//# sourceMappingURL=org-authority-fence.d.ts.map

package/dist/nestjs/auth/org-authority-fence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority-fence.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority-fence.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEzE,OAAO,EAAe,aAAa,EAAmB,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAqBtC,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAMD,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,GACvC,IAAI,CAMN;AAiBD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,aAAa,GACxB,IAAI,CAkBN;AAgCD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IACL,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,EAAE,OAAO,CAAC;CACpB,EACD,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,mBAAmB,CAiDrB"}