@appxdigital/appx-core 0.1.120 → 0.1.121-beta.10

package/RELEASING.md

@@ -0,0 +1,168 @@
+# Releasing
+
+This repo publishes **two independent packages**, each versioned on its own:
+
+- **`@appxdigital/appx-core`** — the runtime library (root `package.json`),
+  released via **`v*`** tags (`release.yml`).
+- **`@appxdigital/appx-core-cli`** — the `appx-core` CLI (`cli/package.json`),
+  released via **`cli-v*`** tags (`release-cli.yml`).
+
+Both follow the same posture: publishing is deliberate — **it only happens when
+you push a git tag** — and production (`latest`) pauses for a human approval
+before it goes live.
+
+## Channels
+
+Library (`v*` tags):
+
+| You push tag       | npm dist-tag | Consumers install with            | Gated?          |
+| ------------------ | ------------ | --------------------------------- | --------------- |
+| `v1.2.3-alpha.N`   | `alpha`      | `…/appx-core@alpha`               | no              |
+| `v1.2.3-beta.N`    | `beta`       | `…/appx-core@beta`                | no              |
+| `v1.2.3-rc.N`      | `next`       | `…/appx-core@next`                | no              |
+| `v1.2.3`           | `latest`     | `…/appx-core` (default)           | **yes** — approval |
+
+CLI (`cli-v*` tags) — identical channels for `@appxdigital/appx-core-cli`:
+
+| You push tag         | npm dist-tag | Consumers install with          | Gated?          |
+| -------------------- | ------------ | ------------------------------- | --------------- |
+| `cli-v1.2.3-beta.N`  | `beta`       | `…/appx-core-cli@beta`          | no              |
+| `cli-v1.2.3`         | `latest`     | `…/appx-core-cli` (default)     | **yes** — approval |
+
+Prereleases are excluded from `^1.2.x` range resolution, so a project on a caret
+range never pulls one by accident — testers opt in via the tag or an exact
+version. Merging to `main` **never** publishes; it only runs CI (library build +
+tests on mysql and postgres, plus a CLI smoke check).
+
+## Two files, two audiences
+
+- **`PRERELEASES.md`** — granular, one entry per alpha/beta build. What a tester
+  reads.
+- **`CHANGELOG.md`** — collapsed, one section per production release with
+  aggregated changes and consolidated migration steps. What an upgrading project
+  reads. When you promote a version, distil its prerelease entries into a single
+  `CHANGELOG.md` section.
+
+## One-time setup (before the first publish)
+
+1. **npm Trusted Publisher (OIDC) — one per package.** On npmjs.com → the
+   package → *Settings* → *Trusted Publisher* → GitHub Actions. Add **two**,
+   both owner `appxdigital`, repo `appx-core`:
+   - `@appxdigital/appx-core` → workflow `release.yml`
+   - `@appxdigital/appx-core-cli` → workflow `release-cli.yml`
+
+   This lets CI mint a short-lived publish token per run — **no `NPM_TOKEN`
+   secret is stored anywhere**, and every publish carries supply-chain
+   provenance.
+
+2. **GitHub `production` environment (the approval gate).** Repo → *Settings* →
+   *Environments* → *New environment* → name it exactly `production` → enable
+   *Required reviewers* and add yourself (and/or the team). The
+   `publish-production` job targets this environment, so a clean tag will wait
+   for a click before publishing to `latest`.
+
+## Cutting a release
+
+The tag must match `package.json`'s version exactly, or the release job fails
+fast (a guard against mistagging). Convenience scripts keep them in lockstep and
+create the tag for you — they **do not push**, so pushing stays a deliberate
+step:
+
+There are two per package — a **test build** and a **production release**:
+
+| Script                          | What it does                          | Tag             | Goes to           |
+| ------------------------------- | ------------------------------------- | --------------- | ----------------- |
+| `npm run release:beta`          | library test build (`…-beta.N`)       | `v…-beta.N`     | `beta` channel    |
+| `npm run release:production`    | promote library to everyone           | `vX.Y.Z`        | `latest` (gated)  |
+| `npm run release:cli:beta`      | CLI test build (`…-beta.N`)           | `cli-v…-beta.N` | `beta` channel    |
+| `npm run release:cli:production`| promote CLI to everyone               | `cli-vX.Y.Z`    | `latest` (gated)  |
+
+`release:beta` publishes only to people who opt in with `@beta`; `release:production`
+is what everyone gets by default, and it pauses for your approval before going
+live. Each command bumps the version, commits, and creates the tag, then prints
+the exact `git push origin HEAD --follow-tags` for you to run when ready — they
+never push on their own.
+
+Rarer cases go through the underlying script directly:
+`node scripts/release.mjs lib alpha` (alpha channel), `… lib minor` (a feature
+bump), or `… lib X.Y.Z-beta.0` (an explicit version — e.g. the first beta of a
+version already sitting in `package.json`).
+
+The manual steps below show what those scripts do under the hood.
+
+### Beta (test in projects first)
+
+```bash
+# set the version + create the matching tag + commit, without auto-pushing
+npm version 0.1.121-beta.0 --message "release: %s"
+git push origin main --follow-tags
+```
+
+The `Release` workflow builds, tests, and publishes to the `beta` dist-tag.
+Then, in a project you want to test against:
+
+```bash
+npm install @appxdigital/appx-core@beta
+```
+
+Iterate with `npm version prerelease --preid beta` (→ `-beta.1`, `-beta.2`, …),
+each push publishing a new granular `PRERELEASES.md` entry.
+
+### Promote to production (`latest`)
+
+When the beta is validated in real projects:
+
+```bash
+# drop the prerelease suffix -> clean version
+npm version 0.1.121 --message "release: %s"
+git push origin main --follow-tags
+```
+
+The workflow builds and tests, then **pauses** on the `production` environment.
+Approve it in the repo's *Actions* tab → the running release → *Review
+deployments* → *Approve and deploy*. It then publishes to `latest`.
+
+> Alternatively, promotion can be a pure retag without republishing:
+> `npm dist-tag add @appxdigital/appx-core@0.1.121-beta.N latest`. The
+> tag-driven workflow above is preferred because it re-runs tests and records
+> provenance for the exact `latest` artifact.
+
+### Alpha (rough, one or two projects)
+
+```bash
+npm version 0.1.122-alpha.0 --message "release: %s"
+git push origin main --follow-tags
+# in the project:  npm install @appxdigital/appx-core@alpha
+```
+
+### CLI (`@appxdigital/appx-core-cli`)
+
+Same flow, but bump `cli/package.json` and use the `cli-v` tag prefix. The tag
+must match `cli/package.json`'s version.
+
+```bash
+# beta:
+npm --prefix cli version 1.0.21-beta.0 --message "release cli: %s"
+git commit -am "release cli: 1.0.21-beta.0"   # npm version --prefix does not commit
+git tag cli-v1.0.21-beta.0
+git push origin main --follow-tags
+#   test:  npx @appxdigital/appx-core-cli@beta create …
+
+# production (gated — approve in the Actions tab):
+npm --prefix cli version 1.0.21 --message "release cli: %s"
+git commit -am "release cli: 1.0.21"
+git tag cli-v1.0.21
+git push origin main --follow-tags
+```
+
+> `npm version --prefix cli` bumps `cli/package.json` but does not create the
+> git commit/tag (that only happens when run in the repo root). Commit and tag
+> explicitly with the `cli-v` prefix as shown.
+
+## Manual fallback
+
+If CI is unavailable, you can still publish by hand: `rimraf dist && npm run
+build && npm publish --tag <dist-tag> --access public` for the library, and
+`cd cli && npm publish --tag <dist-tag> --access public` for the CLI. This
+bypasses the tests, the approval gate, and provenance, so prefer the tag-driven
+flow.

package/dist/common/config/permissionsConfigTypes.d.ts

@@ -3,6 +3,14 @@ import { Operation } from '@prisma/client/runtime/library';
 export declare const PermissionPlaceholder: {
     USER_ID: any;
 };
+/**
+ * Batch (`*Many`) actions inherit the singular rule when not declared
+ * explicitly, so a config can define just `create` / `update` / `delete`.
+ * One-directional: the singular is canonical (declaring only the `*Many`
+ * variant does not enable the singular). Consumed by the Prisma proxy
+ * (`selectPermission`) and the `RbacGuard`.
+ */
+export declare const SINGULAR_ACTION: Record<string, string>;
 /** Detect delegate keys on an arbitrary Prisma client type C */
 type DelegateKeyOf<C> = {
     [K in keyof C]: C[K] extends {

package/dist/common/config/permissionsConfigTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissionsConfigTypes.d.ts","sourceRoot":"","sources":["../../../src/common/config/permissionsConfigTypes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,MAAM,EAAE,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAC,SAAS,EAAC,MAAM,gCAAgC,CAAC;AAEzD,eAAO,MAAM,qBAAqB,EAAE;IAChC,OAAO,EAAE,GAAG,CAAC;CAGhB,CAAC;AAEF,gEAAgE;AAChE,KAAK,aAAa,CAAC,CAAC,IAAI;KACnB,CAAC,IAAI,MAAM,CAAC,GACb,CAAC,CAAC,CAAC,CAAC,SAAS;QAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAC,GAAG,CAAC,GAAG,KAAK;CAC/D,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpB,mDAAmD;AACnD,KAAK,iBAAiB,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;AAE7C,8DAA8D;AAC9D,KAAK,QAAQ,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IACjD,iBAAiB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5D,4EAA4E;AAC5E,KAAK,cAAc,CACf,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IAErB,CAAC,SAAS,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5B,CAAC,SAAS,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAC/E,KAAK,CAAC;AAEpB,oDAAoD;AACpD,KAAK,WAAW,CACZ,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE5B,0CAA0C;AAC1C,KAAK,UAAU,CACX,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,GAC7B,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,GAAG,KAAK;CACnE,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpC,iEAAiE;AACjE,KAAK,aAAa,CACd,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAEzC,oFAAoF;AACpF,KAAK,MAAM,CACP,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAC7B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtC,4DAA4D;AAC5D,KAAK,OAAO,CACR,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAE7B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACzC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACxC,KAAK,CAAC;AAElB,0DAA0D;AAC1D,KAAK,gBAAgB,CACjB,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACzB,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,GAAG,CAAC;CAC7C,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEhC,6DAA6D;AAE7D,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,EACjC,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,IAC5C,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjC,MAAM,WAAW,gBAAgB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,EAC3D,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC;IAEjF,UAAU,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAE3D;KACK,CAAC,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC;CAC7E,GAAG;IACJ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG;QACtB,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC/B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,gBAAgB,CACxB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;IACA,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;KACC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC;CACzC,CAAC"}
+{"version":3,"file":"permissionsConfigTypes.d.ts","sourceRoot":"","sources":["../../../src/common/config/permissionsConfigTypes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,MAAM,EAAE,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAC,SAAS,EAAC,MAAM,gCAAgC,CAAC;AAEzD,eAAO,MAAM,qBAAqB,EAAE;IAChC,OAAO,EAAE,GAAG,CAAC;CAGhB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIlD,CAAC;AAEF,gEAAgE;AAChE,KAAK,aAAa,CAAC,CAAC,IAAI;KACnB,CAAC,IAAI,MAAM,CAAC,GACb,CAAC,CAAC,CAAC,CAAC,SAAS;QAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAC,GAAG,CAAC,GAAG,KAAK;CAC/D,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpB,mDAAmD;AACnD,KAAK,iBAAiB,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;AAE7C,8DAA8D;AAC9D,KAAK,QAAQ,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IACjD,iBAAiB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5D,4EAA4E;AAC5E,KAAK,cAAc,CACf,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IAErB,CAAC,SAAS,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5B,CAAC,SAAS,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAC/E,KAAK,CAAC;AAEpB,oDAAoD;AACpD,KAAK,WAAW,CACZ,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE5B,0CAA0C;AAC1C,KAAK,UAAU,CACX,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,GAC7B,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,GAAG,KAAK;CACnE,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpC,iEAAiE;AACjE,KAAK,aAAa,CACd,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAEzC,oFAAoF;AACpF,KAAK,MAAM,CACP,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAC7B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtC,4DAA4D;AAC5D,KAAK,OAAO,CACR,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAE7B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACzC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACxC,KAAK,CAAC;AAElB,0DAA0D;AAC1D,KAAK,gBAAgB,CACjB,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACzB,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,GAAG,CAAC;CAC7C,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEhC,6DAA6D;AAE7D,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,EACjC,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,IAC5C,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjC,MAAM,WAAW,gBAAgB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,EAC3D,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC;IAEjF,UAAU,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAE3D;KACK,CAAC,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC;CAC7E,GAAG;IACJ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG;QACtB,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC/B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,gBAAgB,CACxB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;IACA,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;KACC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC;CACzC,CAAC"}

package/dist/common/config/permissionsConfigTypes.js

@@ -1,6 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PermissionPlaceholder = void 0;
+exports.SINGULAR_ACTION = exports.PermissionPlaceholder = void 0;
 exports.PermissionPlaceholder = {
     USER_ID: '$USER_ID',
 };
+/**
+ * Batch (`*Many`) actions inherit the singular rule when not declared
+ * explicitly, so a config can define just `create` / `update` / `delete`.
+ * One-directional: the singular is canonical (declaring only the `*Many`
+ * variant does not enable the singular). Consumed by the Prisma proxy
+ * (`selectPermission`) and the `RbacGuard`.
+ */
+exports.SINGULAR_ACTION = {
+    createMany: 'create',
+    updateMany: 'update',
+    deleteMany: 'delete',
+};

package/dist/common/decorators/permission.decorator.d.ts

@@ -1,3 +1,17 @@
 export declare const PERMISSION_METADATA_KEY = "permission";
+export declare const EXPOSE_MODELS_METADATA_KEY = "expose_models";
 export declare const Permission: (action: string, expose_models?: string[]) => import("@nestjs/common").CustomDecorator<string>;
+/**
+ * Expose one or more models for the duration of the request — WITHOUT requiring
+ * a permission action. Unlike `@Permission(action, models)`, this sets no
+ * action, so `RbacGuard` does not demand a role permission for the route. Use it
+ * for a public / GUEST endpoint that must read a model the caller isn't
+ * otherwise granted (e.g. an email-availability check) without having to add a
+ * `GUEST` rule for that model. Exposure is scoped to the request: the listed
+ * models skip row / field filtering only inside this handler.
+ *
+ * Combine with `@Permission(...)` if you also want an action check; both
+ * sources of exposed models are merged.
+ */
+export declare const ExposeModels: (...models: string[]) => import("@nestjs/common").CustomDecorator<string>;
 //# sourceMappingURL=permission.decorator.d.ts.map

package/dist/common/decorators/permission.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/permission.decorator.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,uBAAuB,eAAe,CAAC;AAEpD,eAAO,MAAM,UAAU,WAAY,MAAM,kBAAiB,MAAM,EAAE,qDACD,CAAC"}
+{"version":3,"file":"permission.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/permission.decorator.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,uBAAuB,eAAe,CAAC;AACpD,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAE1D,eAAO,MAAM,UAAU,WAAY,MAAM,kBAAiB,MAAM,EAAE,qDACD,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,cAAe,MAAM,EAAE,qDACG,CAAC"}

package/dist/common/decorators/permission.decorator.js

@@ -1,7 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Permission = exports.PERMISSION_METADATA_KEY = void 0;
+exports.ExposeModels = exports.Permission = exports.EXPOSE_MODELS_METADATA_KEY = exports.PERMISSION_METADATA_KEY = void 0;
 const common_1 = require("@nestjs/common");
 exports.PERMISSION_METADATA_KEY = 'permission';
+exports.EXPOSE_MODELS_METADATA_KEY = 'expose_models';
 const Permission = (action, expose_models = []) => (0, common_1.SetMetadata)(exports.PERMISSION_METADATA_KEY, { action, expose_models });
 exports.Permission = Permission;
+/**
+ * Expose one or more models for the duration of the request — WITHOUT requiring
+ * a permission action. Unlike `@Permission(action, models)`, this sets no
+ * action, so `RbacGuard` does not demand a role permission for the route. Use it
+ * for a public / GUEST endpoint that must read a model the caller isn't
+ * otherwise granted (e.g. an email-availability check) without having to add a
+ * `GUEST` rule for that model. Exposure is scoped to the request: the listed
+ * models skip row / field filtering only inside this handler.
+ *
+ * Combine with `@Permission(...)` if you also want an action check; both
+ * sources of exposed models are merged.
+ */
+const ExposeModels = (...models) => (0, common_1.SetMetadata)(exports.EXPOSE_MODELS_METADATA_KEY, models);
+exports.ExposeModels = ExposeModels;

package/dist/common/guards/rbac.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/rbac.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,WAAW,EACX,gBAAgB,EAInB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAC,qBAAqB,EAAkB,MAAM,kCAAkC,CAAC;AAExF,qBACa,SAAU,YAAW,WAAW;IAErC,OAAO,CAAC,SAAS;IACiB,OAAO,CAAC,iBAAiB;gBADnD,SAAS,EAAE,SAAS,EACc,iBAAiB,EAAE,qBAAqB;IAGhF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAoCjE"}
+{"version":3,"file":"rbac.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/rbac.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,WAAW,EACX,gBAAgB,EAInB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAC,qBAAqB,EAAmC,MAAM,kCAAkC,CAAC;AAEzG,qBACa,SAAU,YAAW,WAAW;IAErC,OAAO,CAAC,SAAS;IACiB,OAAO,CAAC,iBAAiB;gBADnD,SAAS,EAAE,SAAS,EACc,iBAAiB,EAAE,qBAAqB;IAGhF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA0CjE"}

package/dist/common/guards/rbac.guard.js

@@ -17,6 +17,7 @@ const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const permission_decorator_1 = require("../decorators/permission.decorator");
 const permissions_config_provider_1 = require("../config/permissions.config.provider");
+const permissionsConfigTypes_1 = require("../config/permissionsConfigTypes");
 let RbacGuard = exports.RbacGuard = class RbacGuard {
     constructor(reflector, permissionsConfig) {
         this.reflector = reflector;
@@ -38,7 +39,13 @@ let RbacGuard = exports.RbacGuard = class RbacGuard {
         if (!rolePermissions) {
             throw new common_1.ForbiddenException(`No permissions defined for role ${user.role} on model ${model}`);
         }
-        const permission = rolePermissions[action];
+        // A `*Many` action inherits its singular rule when not defined explicitly
+        // (createMany → create, updateMany → update, deleteMany → delete) — mirrors
+        // the data-access proxy, so a config can declare just the singular form.
+        let permission = rolePermissions[action];
+        if (!permission && permissionsConfigTypes_1.SINGULAR_ACTION[action]) {
+            permission = rolePermissions[permissionsConfigTypes_1.SINGULAR_ACTION[action]];
+        }
         if (!permission) {
             throw new common_1.ForbiddenException(`Action ${action} not allowed for role ${user.role} on model ${model}`);
         }

package/dist/common/interceptors/prisma.interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.interceptor.d.ts","sourceRoot":"","sources":["../../../src/common/interceptors/prisma.interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAE,gBAAgB,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAoB,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AACvC,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAG7C,OAAO,EAAC,UAAU,EAAa,MAAM,MAAM,CAAC;AAK5C,qBACa,iBAAkB,YAAW,eAAe;IAIjD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,aAAa;IALzB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;gBAG1B,aAAa,EAAE,aAAa,EACrC,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,aAAa;IAKxC,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC;CAoE3E"}
+{"version":3,"file":"prisma.interceptor.d.ts","sourceRoot":"","sources":["../../../src/common/interceptors/prisma.interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAE,gBAAgB,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAoB,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AACvC,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAG7C,OAAO,EAAC,UAAU,EAAa,MAAM,MAAM,CAAC;AAK5C,qBACa,iBAAkB,YAAW,eAAe;IAIjD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,aAAa;IALzB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;gBAG1B,aAAa,EAAE,aAAa,EACrC,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,aAAa;IAKxC,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC;CAmF3E"}

package/dist/common/interceptors/prisma.interceptor.js

@@ -31,39 +31,55 @@ let PrismaInterceptor = exports.PrismaInterceptor = class PrismaInterceptor {
         const req = handlerType === 'graphql'
             ? context.getArgByIndex(2) // GraphQL context
             : context.switchToHttp().getRequest(); // HTTP context
-        // Attach expose_models metadata if needed
+        // Attach expose_models metadata if needed. Models can come from
+        // @Permission(action, models) or the standalone @ExposeModels(...); both
+        // are merged so a route can expose models with or without a permission.
         const permissionMetadata = this.reflector.get(permission_decorator_1.PERMISSION_METADATA_KEY, context.getHandler()) || {};
+        const standaloneExposed = this.reflector.get(permission_decorator_1.EXPOSE_MODELS_METADATA_KEY, context.getHandler()) || [];
+        const exposedModels = [...(permissionMetadata['expose_models'] || []), ...standaloneExposed];
         return new rxjs_1.Observable((observer) => {
             prisma_service_1.CorePrismaContext.run({
-                exposedModels: permissionMetadata['expose_models'] || [],
+                exposedModels,
             }, () => {
                 const useTransaction = this.reflector.get('useTransaction', context.getHandler()) ?? this.defaultUseTransaction === 'true';
                 if (useTransaction) {
+                    // Run the handler inside the transaction and CAPTURE its result,
+                    // but do not emit the response yet: the client must not see a
+                    // success response until the transaction has actually committed.
+                    // Emitting inside the transaction (before it commits) races the
+                    // commit — an immediate read-after-write can miss the row.
+                    let handlerResult;
                     this.prismaService
                         .$transaction(async (transactionClient) => {
                         nestjs_request_context_1.RequestContext.currentContext.req.prisma = transactionClient;
-                        await new Promise((resolve, reject) => {
+                        handlerResult = await new Promise((resolve, reject) => {
+                            let captured;
                             next
                                 .handle()
-                                .pipe((0, operators_1.tap)(() => { }), (0, operators_1.catchError)((err) => {
+                                .pipe((0, operators_1.catchError)((err) => {
                                 const handledError = (0, error_handler_1.handleError)(err);
                                 reject(handledError);
                                 return (0, rxjs_1.throwError)(() => handledError);
                             }))
                                 .subscribe({
-                                next: (result) => observer.next(result),
+                                next: (result) => {
+                                    captured = result;
+                                },
                                 complete: () => {
                                     delete nestjs_request_context_1.RequestContext.currentContext.req.prisma;
-                                    observer.complete();
-                                    resolve(null);
+                                    resolve(captured);
                                 },
                                 error: (err) => {
                                     delete nestjs_request_context_1.RequestContext.currentContext.req.prisma;
-                                    observer.error(err);
                                     reject(err);
                                 },
                             });
                         });
+                    })
+                        .then(() => {
+                        // The transaction has committed — now it is safe to respond.
+                        observer.next(handlerResult);
+                        observer.complete();
                     })
                         .catch((err) => {
                         delete nestjs_request_context_1.RequestContext.currentContext.req.prisma;

package/dist/common/setup/core-config.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Boot-time configuration helpers used by the scaffold's `main.ts` /
+ * `app.module.ts`. They fail fast on insecure or ambiguous configuration
+ * instead of silently falling back.
+ */
+/** Minimum length we require of a session signing secret. */
+export declare const MIN_SESSION_SECRET_LENGTH = 32;
+export interface CoreSessionOptionsInput {
+    /** The session signing secret. Required — no fallback. */
+    secret?: string;
+    /** The express-session store (e.g. `CorePrismaSessionStore`). */
+    store: any;
+    /** Cookie name. */
+    cookieName?: string;
+    /** Session TTL in seconds (drives cookie `maxAge`). Default 86400. */
+    ttlSeconds?: number;
+    /**
+     * Force the `Secure` cookie flag. Defaults to `true` in production
+     * (`NODE_ENV === 'production'`), `false` otherwise so local HTTP dev works.
+     */
+    secure?: boolean;
+    /** `SameSite` policy. Default `'lax'`. */
+    sameSite?: boolean | 'lax' | 'strict' | 'none';
+}
+/**
+ * Builds hardened `express-session` options.
+ *
+ * - **:** throws if `secret` is missing or shorter than
+ *   {@link MIN_SESSION_SECRET_LENGTH}. There is no hardcoded fallback — a
+ *   missing secret must stop the boot, never silently sign sessions with a
+ *   public constant.
+ * - **:** sets `cookie: { httpOnly, secure, sameSite, maxAge }` so session
+ *   cookies are not readable by JS, are `Secure` in production, and carry a
+ *   `SameSite` policy.
+ *
+ * Pass the result straight to `session(...)`.
+ */
+export declare function buildCoreSessionOptions(input: CoreSessionOptionsInput): {
+    secret: string;
+    resave: boolean;
+    saveUninitialized: boolean;
+    name: string | undefined;
+    store: any;
+    cookie: {
+        httpOnly: boolean;
+        secure: boolean;
+        sameSite: boolean | "none" | "lax" | "strict";
+        maxAge: number;
+    };
+};
+/**
+ * Resolves the env file paths for `ConfigModule.forRoot({ envFilePath })`.
+ *
+ * Returns `['.env.<NODE_ENV>', '.env']`. `ConfigModule` gives the **first**
+ * existing file precedence, so environment-specific values in `.env.<NODE_ENV>`
+ * win, and a plain `.env` (what `appx-core create` generates) is loaded as a
+ * base/fallback. Without the `.env` fallback a freshly scaffolded project —
+ * which ships only `.env` — would load nothing and then fail the * `SESSION_SECRET` check at boot.
+ *
+ * **:** throws if `NODE_ENV` is unset instead of silently defaulting to
+ * `development` — a production deploy that forgets `NODE_ENV` must fail fast
+ * rather than load `.env.development` (dev DB creds, loose CORS, insecure
+ * cookies). Set `NODE_ENV` explicitly (`production` / `development` / `test`).
+ */
+export declare function coreEnvFilePath(): string[];
+//# sourceMappingURL=core-config.d.ts.map

package/dist/common/setup/core-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-config.d.ts","sourceRoot":"","sources":["../../../src/common/setup/core-config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,6DAA6D;AAC7D,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,MAAM,WAAW,uBAAuB;IACpC,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,GAAG,CAAC;IACX,mBAAmB;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,uBAAuB;;;;;;;;;;;;EAuBrE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAS1C"}

package/dist/common/setup/core-config.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * Boot-time configuration helpers used by the scaffold's `main.ts` /
+ * `app.module.ts`. They fail fast on insecure or ambiguous configuration
+ * instead of silently falling back.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coreEnvFilePath = exports.buildCoreSessionOptions = exports.MIN_SESSION_SECRET_LENGTH = void 0;
+/** Minimum length we require of a session signing secret. */
+exports.MIN_SESSION_SECRET_LENGTH = 32;
+/**
+ * Builds hardened `express-session` options.
+ *
+ * - **:** throws if `secret` is missing or shorter than
+ *   {@link MIN_SESSION_SECRET_LENGTH}. There is no hardcoded fallback — a
+ *   missing secret must stop the boot, never silently sign sessions with a
+ *   public constant.
+ * - **:** sets `cookie: { httpOnly, secure, sameSite, maxAge }` so session
+ *   cookies are not readable by JS, are `Secure` in production, and carry a
+ *   `SameSite` policy.
+ *
+ * Pass the result straight to `session(...)`.
+ */
+function buildCoreSessionOptions(input) {
+    const { secret, store, cookieName, ttlSeconds = 86400, secure, sameSite = 'lax' } = input;
+    if (!secret || secret.length < exports.MIN_SESSION_SECRET_LENGTH) {
+        throw new Error(`SESSION_SECRET must be set and at least ${exports.MIN_SESSION_SECRET_LENGTH} characters. ` +
+            'Refusing to start with a missing or weak session secret.');
+    }
+    return {
+        secret,
+        resave: false,
+        saveUninitialized: false,
+        name: cookieName,
+        store,
+        cookie: {
+            httpOnly: true,
+            secure: secure ?? process.env.NODE_ENV === 'production',
+            sameSite,
+            maxAge: ttlSeconds * 1000,
+        },
+    };
+}
+exports.buildCoreSessionOptions = buildCoreSessionOptions;
+/**
+ * Resolves the env file paths for `ConfigModule.forRoot({ envFilePath })`.
+ *
+ * Returns `['.env.<NODE_ENV>', '.env']`. `ConfigModule` gives the **first**
+ * existing file precedence, so environment-specific values in `.env.<NODE_ENV>`
+ * win, and a plain `.env` (what `appx-core create` generates) is loaded as a
+ * base/fallback. Without the `.env` fallback a freshly scaffolded project —
+ * which ships only `.env` — would load nothing and then fail the * `SESSION_SECRET` check at boot.
+ *
+ * **:** throws if `NODE_ENV` is unset instead of silently defaulting to
+ * `development` — a production deploy that forgets `NODE_ENV` must fail fast
+ * rather than load `.env.development` (dev DB creds, loose CORS, insecure
+ * cookies). Set `NODE_ENV` explicitly (`production` / `development` / `test`).
+ */
+function coreEnvFilePath() {
+    const env = process.env.NODE_ENV;
+    if (!env) {
+        throw new Error('NODE_ENV must be explicitly set (e.g. "production" or "development"). ' +
+            'Refusing to default to development.');
+    }
+    return [`.env.${env}`, '.env'];
+}
+exports.coreEnvFilePath = coreEnvFilePath;

package/dist/common/setup/setup-core-security.d.ts

@@ -0,0 +1,62 @@
+import { INestApplication, ValidationPipeOptions } from '@nestjs/common';
+/**
+ * Minimal CORS options accepted by {@link setupCoreSecurity}. Mirrors the
+ * subset of Nest's `CorsOptions` that most apps set; extra keys are passed
+ * through to `app.enableCors` untouched. Declared locally to avoid a fragile
+ * deep import into Nest internals.
+ */
+export interface CoreCorsOptions {
+    origin?: string | string[] | boolean | RegExp | (string | RegExp)[];
+    credentials?: boolean;
+    [key: string]: any;
+}
+/**
+ * Options for {@link setupCoreSecurity}. Each concern can be disabled by
+ * passing `false`, or tuned by passing an options object that is merged over
+ * the secure defaults.
+ */
+export interface CoreSecurityOptions {
+    /**
+     * Global `ValidationPipe`. Secure default:
+     * `{ transform: true, whitelist: true, forbidNonWhitelisted: true }`.
+     *
+     * `whitelist` strips body properties that carry no validation decorator;
+     * `forbidNonWhitelisted` turns such properties into a `400` instead of
+     * silently dropping them. Combined with DTOs that declare every accepted
+     * field, this rejects unknown body properties on `POST /auth/register`
+     * and every other class-validated request body.
+     *
+     * Pass `false` to skip (you must then register your own pipe), or an
+     * options object to override individual flags.
+     */
+    validationPipe?: ValidationPipeOptions | false;
+    /**
+     * CORS. Default: `{ origin: 'http://localhost:3000', credentials: true }`
+     * — the scaffold's historical default. Read `origin` from configuration
+     * (e.g. a `CORS_ORIGIN` env var) and pass it here so the allowed origin is
+     * deployment-configurable rather than hardcoded.
+     *
+     * Guardrail: `origin: '*'` together with `credentials: true` throws at
+     * setup — that combination is rejected by browsers and is a common footgun.
+     *
+     * Pass `false` to skip (you manage CORS yourself).
+     */
+    cors?: CoreCorsOptions | false;
+    /**
+     * Security headers via Helmet: `Content-Security-Policy`,
+     * `X-Content-Type-Options`, `Strict-Transport-Security`, frame-ancestors, etc.
+     * Default: enabled with Helmet's defaults. Pass an options object to tune
+     * (e.g. a custom CSP for the AdminJS UI), or `false` to skip.
+     */
+    helmet?: Record<string, any> | false;
+}
+/**
+ * Applies AppX Core's baseline HTTP hardening to a Nest application.
+ *
+ * Call once in `main.ts`, after `NestFactory.create(...)` and before
+ * `app.listen(...)`. New scaffolds call it for you; existing projects should
+ * add the call when upgrading — see the CHANGELOG migration note for the
+ * version that introduced each concern.
+ */
+export declare function setupCoreSecurity(app: INestApplication, options?: CoreSecurityOptions): void;
+//# sourceMappingURL=setup-core-security.d.ts.map

package/dist/common/setup/setup-core-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-core-security.d.ts","sourceRoot":"","sources":["../../../src/common/setup/setup-core-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,gBAAgB,EAAkB,qBAAqB,EAAC,MAAM,gBAAgB,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACpE,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IAE/C;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IAE/B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC7B,GAAG,EAAE,gBAAgB,EACrB,OAAO,GAAE,mBAAwB,GAClC,IAAI,CAkCN"}

package/dist/common/setup/setup-core-security.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupCoreSecurity = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Applies AppX Core's baseline HTTP hardening to a Nest application.
+ *
+ * Call once in `main.ts`, after `NestFactory.create(...)` and before
+ * `app.listen(...)`. New scaffolds call it for you; existing projects should
+ * add the call when upgrading — see the CHANGELOG migration note for the
+ * version that introduced each concern.
+ */
+function setupCoreSecurity(app, options = {}) {
+    if (options.validationPipe !== false) {
+        app.useGlobalPipes(new common_1.ValidationPipe({
+            transform: true,
+            whitelist: true,
+            forbidNonWhitelisted: true,
+            ...(options.validationPipe ?? {}),
+        }));
+    }
+    if (options.cors !== false) {
+        const cors = options.cors ?? {};
+        const origin = cors.origin ?? 'http://localhost:3000';
+        const credentials = cors.credentials ?? true;
+        if (credentials && origin === '*') {
+            throw new Error("setupCoreSecurity: CORS origin '*' is incompatible with credentials:true — " +
+                'browsers reject it and it exposes credentialed endpoints to every origin. ' +
+                'Set an explicit origin (e.g. via a CORS_ORIGIN env var) or disable credentials.');
+        }
+        app.enableCors({ ...cors, origin, credentials });
+    }
+    if (options.helmet !== false) {
+        // Lazy require: helmet is a peer dependency, only needed when enabled.
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const helmet = require('helmet');
+        app.use(typeof options.helmet === 'object' ? helmet(options.helmet) : helmet());
+    }
+}
+exports.setupCoreSecurity = setupCoreSecurity;

package/dist/config/generate-all.js

@@ -43,6 +43,10 @@ console.log('Generating Services...');
 (0, child_process_1.execSync)(`node ${path.join(scriptsDir, 'generate-services.js')}`, {
     stdio: 'inherit',
 });
+console.log('Generating DTOs...');
+(0, child_process_1.execSync)(`node ${path.join(scriptsDir, 'generate-dtos.js')}`, {
+    stdio: 'inherit',
+});
 console.log('Generating Controllers...');
 (0, child_process_1.execSync)(`node ${path.join(scriptsDir, 'generate-controllers.js')}`, {
     stdio: 'inherit',