@appxdigital/appx-core 0.1.121-beta.13 → 0.1.121-beta.15

package/PRERELEASES.md

@@ -31,6 +31,33 @@ Prereleases are excluded from normal semver range resolution, so a project on
 
 ---
 
+## [0.1.121-beta.15] — unreleased
+
+**Library / docs. Additive — no behaviour change.** Auth is now extensible from
+the package root instead of deep `dist/` imports.
+
+- **Exported the auth building blocks** from `@appxdigital/appx-core`:
+  `AuthController`, `AuthService`, `RegisterDto`, `UserDto`, `AuthField`,
+  `LocalStrategy`, `JwtStrategy`, `RefreshTokenStrategy`, `LocalAuthGuard`,
+  `RefreshTokenGuard`, `SessionSerializer`, `SessionAuthGuard`. Stop importing
+  these from `@appxdigital/appx-core/dist/...` — deep paths are internal.
+- **`AuthModule.forRoot({ controller?: boolean })`** — importing
+  `AuthModule.forRoot({ controller: false })` registers every auth provider
+  globally but **not** the built-in `AuthController`, so you can register your own
+  controller (e.g. `extends AuthController`) at the same `/auth` prefix with no
+  duplicate route. Importing the plain `AuthModule` is unchanged (still registers
+  the controller).
+- **New doc `docs/authentication.md`** — the built-in `/auth` surface and how to
+  override framework internals (widen `RegisterDto` to accept e.g. `name`, extend
+  `AuthService`, swap a Passport strategy), wired at the same prefix in `AppModule`.
+
+## [0.1.121-beta.14] — unreleased
+
+**Library / types.** `RolePermissions.relations` is now usable in a properly
+typed `PermissionsConfigType` (no `as any`) — the catch-all index signature no
+longer collides with the `relations` key. Guarded by a type-contract test. The
+boot validator now takes `PermissionsConfigType` directly. No runtime change.
+
 ## [0.1.121-beta.13] — unreleased
 
 **Library.** **Relation-scoped `connect` rules.** A `connect` rule can now be

package/dist/common/config/permissionsConfigTypes.d.ts

@@ -70,7 +70,7 @@ export type RolePermissions<M extends ModelKey<RuntimeClient> = ModelKey<Runtime
 } & {
     relations?: RelationConnectMap;
 } & {
-    [custom: string]: 'ALL' | {
+    [custom: string]: 'ALL' | RelationConnectMap | {
         conditions?: unknown | unknown[];
         setUserIdField?: string;
     };

package/dist/common/config/permissionsConfigTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissionsConfigTypes.d.ts","sourceRoot":"","sources":["../../../src/common/config/permissionsConfigTypes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,MAAM,EAAE,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAC,SAAS,EAAC,MAAM,gCAAgC,CAAC;AAEzD,eAAO,MAAM,qBAAqB,EAAE;IAChC,OAAO,EAAE,GAAG,CAAC;CAGhB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIlD,CAAC;AAEF,gEAAgE;AAChE,KAAK,aAAa,CAAC,CAAC,IAAI;KACnB,CAAC,IAAI,MAAM,CAAC,GACb,CAAC,CAAC,CAAC,CAAC,SAAS;QAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAC,GAAG,CAAC,GAAG,KAAK;CAC/D,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpB,mDAAmD;AACnD,KAAK,iBAAiB,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;AAE7C,8DAA8D;AAC9D,KAAK,QAAQ,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IACjD,iBAAiB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5D,4EAA4E;AAC5E,KAAK,cAAc,CACf,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IAErB,CAAC,SAAS,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5B,CAAC,SAAS,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAC/E,KAAK,CAAC;AAEpB,oDAAoD;AACpD,KAAK,WAAW,CACZ,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE5B,0CAA0C;AAC1C,KAAK,UAAU,CACX,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,GAC7B,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,GAAG,KAAK;CACnE,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpC,iEAAiE;AACjE,KAAK,aAAa,CACd,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAEzC,oFAAoF;AACpF,KAAK,MAAM,CACP,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAC7B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtC,4DAA4D;AAC5D,KAAK,OAAO,CACR,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAE7B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACzC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACxC,KAAK,CAAC;AAElB,0DAA0D;AAC1D,KAAK,gBAAgB,CACjB,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACzB,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,GAAG,CAAC;CAC7C,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEhC,6DAA6D;AAE7D,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,EACjC,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,IAC5C,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjC,MAAM,WAAW,gBAAgB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,EAC3D,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC;IAEjF,UAAU,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,KAAK,GAAG;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAAA;KAAE,CAAC;CACzD;AACD,MAAM,MAAM,kBAAkB,GAAG;IAAE,CAAC,aAAa,EAAE,MAAM,GAAG,mBAAmB,CAAA;CAAE,CAAC;AAElF,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAE3D;KACK,CAAC,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC;CAC7E,GAAG;IACA,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAClC,GAAG;IACJ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG;QACtB,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,gBAAgB,CACxB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;IACA,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;KACC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC;CACzC,CAAC"}
+{"version":3,"file":"permissionsConfigTypes.d.ts","sourceRoot":"","sources":["../../../src/common/config/permissionsConfigTypes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,MAAM,EAAE,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAC,SAAS,EAAC,MAAM,gCAAgC,CAAC;AAEzD,eAAO,MAAM,qBAAqB,EAAE;IAChC,OAAO,EAAE,GAAG,CAAC;CAGhB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIlD,CAAC;AAEF,gEAAgE;AAChE,KAAK,aAAa,CAAC,CAAC,IAAI;KACnB,CAAC,IAAI,MAAM,CAAC,GACb,CAAC,CAAC,CAAC,CAAC,SAAS;QAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAC,GAAG,CAAC,GAAG,KAAK;CAC/D,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpB,mDAAmD;AACnD,KAAK,iBAAiB,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;AAE7C,8DAA8D;AAC9D,KAAK,QAAQ,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IACjD,iBAAiB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5D,4EAA4E;AAC5E,KAAK,cAAc,CACf,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IAErB,CAAC,SAAS,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5B,CAAC,SAAS,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAC/E,KAAK,CAAC;AAEpB,oDAAoD;AACpD,KAAK,WAAW,CACZ,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE5B,0CAA0C;AAC1C,KAAK,UAAU,CACX,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,GAC7B,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,GAAG,KAAK;CACnE,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpC,iEAAiE;AACjE,KAAK,aAAa,CACd,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAEzC,oFAAoF;AACpF,KAAK,MAAM,CACP,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAC7B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtC,4DAA4D;AAC5D,KAAK,OAAO,CACR,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAE7B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACzC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACxC,KAAK,CAAC;AAElB,0DAA0D;AAC1D,KAAK,gBAAgB,CACjB,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACzB,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,GAAG,CAAC;CAC7C,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEhC,6DAA6D;AAE7D,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,EACjC,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,IAC5C,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjC,MAAM,WAAW,gBAAgB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,EAC3D,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC;IAEjF,UAAU,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,KAAK,GAAG;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAAA;KAAE,CAAC;CACzD;AACD,MAAM,MAAM,kBAAkB,GAAG;IAAE,CAAC,aAAa,EAAE,MAAM,GAAG,mBAAmB,CAAA;CAAE,CAAC;AAElF,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAE3D;KACK,CAAC,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC;CAC7E,GAAG;IACA,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAClC,GAAG;IAKJ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,kBAAkB,GAAG;QAC3C,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,gBAAgB,CACxB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;IACA,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;KACC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC;CACzC,CAAC"}

package/dist/index.d.ts

@@ -6,6 +6,18 @@ export * from './graphql/graphql.module';
 export * from './graphql/generic.resolver';
 export * from './tasks/session-cleanup.service';
 export * from './modules/auth/auth.module';
+export * from './modules/auth/auth.controller';
+export * from './modules/auth/auth.service';
+export * from './modules/auth/dto/register.dto';
+export * from './modules/auth/dto/user.dto';
+export * from './modules/auth/auth-field.decorator';
+export * from './modules/auth/local.strategy';
+export * from './modules/auth/local-auth.guard';
+export * from './modules/auth/jwt.strategy';
+export * from './modules/auth/refresh-token.strategy';
+export * from './modules/auth/refresh-token.guard';
+export * from './modules/auth/session/session-serializer';
+export * from './modules/auth/session/session-auth.guard';
 export * from './modules/auth/session/session-store';
 export * from './common/guards/rbac.guard';
 export * from './common/guards/user-population.guard';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAI3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}

package/dist/index.js

@@ -22,6 +22,21 @@ __exportStar(require("./graphql/graphql.module"), exports);
 __exportStar(require("./graphql/generic.resolver"), exports);
 __exportStar(require("./tasks/session-cleanup.service"), exports);
 __exportStar(require("./modules/auth/auth.module"), exports);
+// Auth building blocks — exported so consumers can extend/override them
+// (custom AuthController, widened RegisterDto, custom Passport strategy) without
+// deep-importing from `dist/`. See docs/authentication.md.
+__exportStar(require("./modules/auth/auth.controller"), exports);
+__exportStar(require("./modules/auth/auth.service"), exports);
+__exportStar(require("./modules/auth/dto/register.dto"), exports);
+__exportStar(require("./modules/auth/dto/user.dto"), exports);
+__exportStar(require("./modules/auth/auth-field.decorator"), exports);
+__exportStar(require("./modules/auth/local.strategy"), exports);
+__exportStar(require("./modules/auth/local-auth.guard"), exports);
+__exportStar(require("./modules/auth/jwt.strategy"), exports);
+__exportStar(require("./modules/auth/refresh-token.strategy"), exports);
+__exportStar(require("./modules/auth/refresh-token.guard"), exports);
+__exportStar(require("./modules/auth/session/session-serializer"), exports);
+__exportStar(require("./modules/auth/session/session-auth.guard"), exports);
 __exportStar(require("./modules/auth/session/session-store"), exports);
 __exportStar(require("./common/guards/rbac.guard"), exports);
 __exportStar(require("./common/guards/user-population.guard"), exports);

package/dist/modules/auth/auth.module.d.ts

@@ -1,3 +1,14 @@
+import { DynamicModule } from '@nestjs/common';
 export declare class AuthModule {
+    /**
+     * For overriding the auth endpoints. `AuthModule.forRoot({ controller: false })`
+     * imports every auth provider globally (AuthService, Jwt, Passport, strategies,
+     * guards) but does NOT register the built-in `AuthController` — so you can
+     * register your OWN controller (e.g. one that `extends AuthController`) at the
+     * same `/auth` prefix with no duplicate route. See docs/authentication.md.
+     */
+    static forRoot(options?: {
+        controller?: boolean;
+    }): DynamicModule;
 }
 //# sourceMappingURL=auth.module.d.ts.map

package/dist/modules/auth/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.module.ts"],"names":[],"mappings":"AAcA,qBAea,UAAU;CACtB"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAgC7D,qBAOa,UAAU;IACnB;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAG,aAAa;CAUlE"}

package/dist/modules/auth/auth.module.js

@@ -5,6 +5,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var AuthModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthModule = void 0;
 const common_1 = require("@nestjs/common");
@@ -20,22 +21,48 @@ const jwt_auth_guard_1 = require("./jwt-auth.guard");
 const authenticated_guard_1 = require("./authenticated.guard");
 const jwt_strategy_1 = require("./jwt.strategy");
 const refresh_token_strategy_1 = require("./refresh-token.strategy");
-let AuthModule = exports.AuthModule = class AuthModule {
+// Shared so the static @Module (default: registers AuthController) and the
+// forRoot() hook (optionally skips it) provide identical wiring.
+const authImports = [
+    config_1.ConfigModule,
+    user_module_1.UserModule,
+    passport_1.PassportModule.register({ session: true }),
+    jwt_1.JwtModule.registerAsync({
+        imports: [config_1.ConfigModule],
+        useFactory: async (config) => ({
+            secret: config.get('JWT_SECRET'),
+            signOptions: { expiresIn: config.get('JWT_EXPIRES_IN', '60m') },
+        }),
+        inject: [config_1.ConfigService],
+    }),
+];
+const authProviders = [auth_service_1.AuthService, local_strategy_1.LocalStrategy, session_serializer_1.SessionSerializer, jwt_strategy_1.JwtStrategy, jwt_auth_guard_1.JwtAuthGuard, authenticated_guard_1.AuthenticatedGuard, refresh_token_strategy_1.RefreshTokenStrategy];
+const authExports = [auth_service_1.AuthService, jwt_auth_guard_1.JwtAuthGuard, authenticated_guard_1.AuthenticatedGuard, jwt_1.JwtModule];
+let AuthModule = exports.AuthModule = AuthModule_1 = class AuthModule {
+    /**
+     * For overriding the auth endpoints. `AuthModule.forRoot({ controller: false })`
+     * imports every auth provider globally (AuthService, Jwt, Passport, strategies,
+     * guards) but does NOT register the built-in `AuthController` — so you can
+     * register your OWN controller (e.g. one that `extends AuthController`) at the
+     * same `/auth` prefix with no duplicate route. See docs/authentication.md.
+     */
+    static forRoot(options) {
+        return {
+            module: AuthModule_1,
+            global: true,
+            imports: authImports,
+            providers: authProviders,
+            controllers: options?.controller === false ? [] : [auth_controller_1.AuthController],
+            exports: authExports,
+        };
+    }
 };
-exports.AuthModule = AuthModule = __decorate([
+exports.AuthModule = AuthModule = AuthModule_1 = __decorate([
     (0, common_1.Global)(),
     (0, common_1.Module)({
-        imports: [config_1.ConfigModule, user_module_1.UserModule, passport_1.PassportModule.register({ session: true }),
-            jwt_1.JwtModule.registerAsync({
-                imports: [config_1.ConfigModule],
-                useFactory: async (config) => ({
-                    secret: config.get('JWT_SECRET'),
-                    signOptions: { expiresIn: config.get('JWT_EXPIRES_IN', '60m') },
-                }),
-                inject: [config_1.ConfigService],
-            }),],
-        providers: [auth_service_1.AuthService, local_strategy_1.LocalStrategy, session_serializer_1.SessionSerializer, jwt_strategy_1.JwtStrategy, jwt_auth_guard_1.JwtAuthGuard, authenticated_guard_1.AuthenticatedGuard, refresh_token_strategy_1.RefreshTokenStrategy],
+        imports: authImports,
+        providers: authProviders,
         controllers: [auth_controller_1.AuthController],
-        exports: [auth_service_1.AuthService, jwt_auth_guard_1.JwtAuthGuard, authenticated_guard_1.AuthenticatedGuard, jwt_1.JwtModule],
+        exports: authExports,
     })
 ], AuthModule);

package/dist/prisma/permissions-validator.d.ts

@@ -9,6 +9,7 @@
  *
  * Pure and schema-only (no database), so it is independently unit-testable.
  */
+import type { PermissionsConfigType } from '../common/config/permissionsConfigTypes';
 export type RelationKind = 'belongsTo' | 'hasMany';
 export interface RelationMeta {
     /** The relation navigation field name on the owning model. */
@@ -46,5 +47,5 @@ export interface ValidationIssue {
  *  - **warning** `missing-connect-optional` — an *optional* belongsTo FK's target
  *    has no `connect` rule for the role. Only denied when the payload sets it.
  */
-export declare function validatePermissionsConfig(config: Record<string, Record<string, any>>, relations: SchemaRelations): ValidationIssue[];
+export declare function validatePermissionsConfig(config: PermissionsConfigType, relations: SchemaRelations): ValidationIssue[];
 //# sourceMappingURL=permissions-validator.d.ts.map

package/dist/prisma/permissions-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-validator.d.ts","sourceRoot":"","sources":["../../src/prisma/permissions-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,SAAS,CAAC;AAEnD,MAAM,WAAW,YAAY;IACzB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,wGAAwG;IACxG,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;AAE7D,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAE7C,MAAM,MAAM,SAAS,GACf,8BAA8B,GAC9B,0BAA0B,GAC1B,iBAAiB,GACjB,uBAAuB,GACvB,kBAAkB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAC3C,SAAS,EAAE,eAAe,GAC3B,eAAe,EAAE,CAgHnB"}
+{"version":3,"file":"permissions-validator.d.ts","sourceRoot":"","sources":["../../src/prisma/permissions-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAErF,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,SAAS,CAAC;AAEnD,MAAM,WAAW,YAAY;IACzB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,wGAAwG;IACxG,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;AAE7D,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAE7C,MAAM,MAAM,SAAS,GACf,8BAA8B,GAC9B,0BAA0B,GAC1B,iBAAiB,GACjB,uBAAuB,GACvB,kBAAkB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,SAAS,EAAE,eAAe,GAC3B,eAAe,EAAE,CAmHnB"}

package/dist/prisma/permissions-validator.js

@@ -1,15 +1,4 @@
 "use strict";
-/**
- * Static validation of a `PermissionsConfig` against the Prisma schema.
- *
- * Runs at boot (in the PrismaService constructor). It encodes the Option A
- * authorization model: a create condition judges a model's own scalar fields
- * only, and every foreign-key reference a create establishes is authorized by
- * the target model's `connect` rule. Misconfigurations that would break at
- * runtime are surfaced here — errors reject boot, warnings are advisory.
- *
- * Pure and schema-only (no database), so it is independently unit-testable.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validatePermissionsConfig = void 0;
 /** Collects condition keys that name a relation (skips AND/OR/NOT, which recurse). */
@@ -46,9 +35,12 @@ function findRelationKeys(cond, relationFields, found = new Set()) {
  */
 function validatePermissionsConfig(config, relations) {
     const issues = [];
+    // Iterate the typed config structurally — model/role keys are dynamic, and
+    // condition/rule shapes are inspected at runtime.
+    const cfg = (config || {});
     const byModel = {};
-    for (const m of Object.keys(config || {}))
-        byModel[m.toLowerCase()] = config[m];
+    for (const m of Object.keys(cfg))
+        byModel[m.toLowerCase()] = cfg[m];
     const hasConnectRule = (targetModel, role) => {
         const rules = byModel[targetModel.toLowerCase()]?.[role];
         return !!rules && rules.connect !== undefined && rules.connect !== null;
@@ -58,8 +50,8 @@ function validatePermissionsConfig(config, relations) {
     const hasRelationConnect = (sourceRules, field) => !!sourceRules?.relations?.[field]?.connect;
     const canCreate = (rules) => !!rules && (rules.create !== undefined || rules.createMany !== undefined);
     const canUpdate = (rules) => !!rules && (rules.update !== undefined || rules.updateMany !== undefined);
-    for (const modelKey of Object.keys(config || {})) {
-        const roles = config[modelKey] || {};
+    for (const modelKey of Object.keys(cfg)) {
+        const roles = cfg[modelKey] || {};
         const rels = relations[modelKey.toLowerCase()] || [];
         const belongsTo = rels.filter((r) => r.kind === 'belongsTo' && r.referencingColumn);
         const relationFieldNames = new Set(rels.map((r) => r.field));

package/docs/README.md

@@ -7,6 +7,7 @@ Authoritative usage documentation for `@appxdigital/appx-core`. **This folder is
 - **[permissions.md](./permissions.md)** — the authorization model: the `@Permission` and `@ExposeModels` decorators, the `permissions.config.ts` shape, roles/actions, row-level `conditions`, field-level control, action fallbacks, and the `GUEST` (unauthenticated) flow.
 - **[dtos.md](./dtos.md)** — the generated CRUD validation DTOs: their two-file structure, **how to remove a field** (`OmitType` / `@NoWrite`), how to add validation, and why nested relation writes don't belong on generic CRUD.
 - **[data-access.md](./data-access.md)** — how you talk to the database: the Prisma proxy (`prisma.model.*`), how ABAC filtering and field omission are enforced on every call, the redirected single-record methods, relation behaviour, bypass hatches, and transactions.
+- **[authentication.md](./authentication.md)** — the built-in `/auth` surface, and **how to override framework internals** (extend the exported `AuthController`/`AuthService`/`RegisterDto`/Passport strategies and register your own at the same prefix via `AuthModule.forRoot({ controller: false })`) — e.g. adding `name` to registration.
 - **[graphql.md](./graphql.md)** — the **read-only** GraphQL API generated from your schema: queries, nested selections, and how ABAC filters them.
 - **[limitations.md](./limitations.md)** — **known limitations and features that are NOT ready for use** (e.g. `aggregate`, GraphQL writes). Read this before relying on any method not covered in the guides above.
 

package/docs/authentication.md

@@ -0,0 +1,215 @@
+# Authentication & overriding framework internals
+
+The framework ships a working auth surface. When you need to change part of it —
+add a field to registration, add endpoints, swap a Passport strategy — you don't
+fork it: you **extend the exported classes and register your own versions**. This
+page shows the pattern (auth is the main example, but it applies to any exported
+framework class).
+
+---
+
+## What `AuthModule` provides
+
+Importing `AuthModule` registers, under the `/auth` prefix:
+
+| Route | Guard | Body |
+|---|---|---|
+| `POST /auth/register` | — | `RegisterDto` (`email`, `password`) |
+| `POST /auth/login` | `LocalAuthGuard` | credentials |
+| `POST /auth/login/jwt` | `LocalAuthGuard` | credentials → tokens |
+| `POST /auth/refresh` | `RefreshTokenGuard` | refresh token |
+| `POST /auth/logout` · `logout/jwt` | `AuthenticatedGuard` | — |
+| `GET /auth/me`, `GET/POST /auth/sessions…` | `AuthenticatedGuard` | — |
+
+plus the providers (all **global**): `AuthService`, the Passport strategies
+(`LocalStrategy`, `JwtStrategy`, `RefreshTokenStrategy`), the guards
+(`LocalAuthGuard`, `JwtAuthGuard`, `AuthenticatedGuard`, `RefreshTokenGuard`,
+`SessionAuthGuard`), and `SessionSerializer`.
+
+**Registration is intentionally narrow.** `RegisterDto` accepts only `email` +
+`password`, and `AuthService.register` creates the user with `BYPASS_FILTERING`
+(it's an unauthenticated flow, so ABAC create-enforcement can't gate it). The
+`RegisterDto` whitelist is therefore the *only* thing controlling which fields a
+sign-up may set — which is exactly why widening it is a deliberate override, not
+a config toggle.
+
+All of these are exported from the package root — **import from
+`@appxdigital/appx-core`, never from `@appxdigital/appx-core/dist/...`** (deep
+paths are internal and can move between versions):
+
+```ts
+import {
+  AuthModule, AuthController, AuthService,
+  RegisterDto, UserDto, AuthField,
+  LocalStrategy, JwtStrategy, RefreshTokenStrategy,
+} from '@appxdigital/appx-core';
+```
+
+---
+
+## The override pattern
+
+To replace or extend an auth endpoint **at the same `/auth` prefix**:
+
+1. **Extend** the framework class (controller / service / strategy).
+2. Put your version in **your own module**.
+3. Import **`AuthModule.forRoot({ controller: false })`** — this keeps every auth
+   provider global but drops the built-in `AuthController`, so *your* controller
+   owns `/auth` with no duplicate route.
+4. Register your module in `AppModule` (in place of a bare `AuthModule`).
+
+```ts
+// app.module.ts
+@Module({
+  imports: [
+    AppxCoreModule.forRoot(PermissionsConfig),
+    AuthModule.forRoot({ controller: false }), // providers only, no built-in controller
+    MyAuthModule,                              // your controller/service live here
+    // …
+  ],
+})
+export class AppModule {}
+```
+
+```ts
+// my-auth.module.ts
+@Module({
+  controllers: [MyAuthController],
+  providers: [/* MyAuthService, MyLocalStrategy, … as needed */],
+})
+export class MyAuthModule {}
+```
+
+> **Why `forRoot({ controller: false })`?** If you import the plain `AuthModule`
+> *and* register your own `/auth` controller, you get two handlers for the same
+> routes. Skipping the built-in controller — while keeping its providers — is what
+> lets your controller take over cleanly. (Importing the plain `AuthModule` is
+> still correct when you're *not* overriding the controller.)
+
+---
+
+## Recipe 1 — add a field to registration (e.g. `name`)
+
+Extend `RegisterDto`, then override the inherited `register` handler:
+
+```ts
+// register-local.dto.ts
+import { RegisterDto } from '@appxdigital/appx-core';
+import { IsOptional, IsString } from 'class-validator';
+
+export class RegisterLocalDto extends RegisterDto {
+  @IsOptional()
+  @IsString()
+  name?: string;
+}
+```
+
+```ts
+// my-auth.controller.ts
+import { Body, Controller, Post } from '@nestjs/common';
+import { AuthController } from '@appxdigital/appx-core';
+import { RegisterLocalDto } from './register-local.dto';
+
+@Controller('auth')
+export class MyAuthController extends AuthController {
+  @Post('register')
+  async register(@Body() dto: RegisterLocalDto) {
+    return this.authService.register(dto); // authService is `protected` on AuthController
+  }
+}
+```
+
+`AuthService.register` spreads the DTO straight into the user create, so `name`
+persists (your `User` model must have the column). Everything else on
+`AuthController` — login, refresh, sessions — is inherited unchanged. The global
+validation pipe now validates the body against `RegisterLocalDto`, so `name` is
+accepted and any *other* unknown field still `400`s.
+
+> Keep registration a **narrow allowlist** — only add fields a self-service
+> sign-up should legitimately set. Never widen it to privileged columns (`role`,
+> tenant, ownership ids); mark those `/// @NoWrite` and set them server-side.
+
+---
+
+## Recipe 2 — extend the service (add methods / change behaviour)
+
+Extend `AuthService` and forward its constructor. Its signature is
+`(userService, prisma, jwtService, configService)`:
+
+```ts
+import { Injectable } from '@nestjs/common';
+import { AuthService, PrismaService } from '@appxdigital/appx-core';
+import { UserService } from '../user/user.service';
+import { ConfigService } from '@nestjs/config';
+import { JwtService } from '@nestjs/jwt';
+
+@Injectable()
+export class MyAuthService extends AuthService {
+  constructor(
+    userService: UserService,
+    prisma: PrismaService,
+    jwtService: JwtService,
+    configService: ConfigService,
+  ) {
+    super(userService, prisma, jwtService, configService);
+  }
+
+  async handleForgotPassword(email: string) { /* … */ }
+}
+```
+
+Provide `MyAuthService` in your module and inject it in your controller
+(`super(myAuthService)` if the controller extends `AuthController`). Because you
+imported `AuthModule.forRoot({ controller: false })`, `UserService`, `JwtService`,
+`PrismaService`, and `ConfigService` are all already available to inject.
+
+---
+
+## Recipe 3 — override a Passport strategy
+
+The built-in `LocalStrategy` reads the username/password field names from
+`@AuthField(...)` metadata on `UserDto` and delegates to
+`AuthService.validateUser`. To change credential validation, extend it (or
+`JwtStrategy` / `RefreshTokenStrategy`) and provide your version:
+
+```ts
+import { Injectable } from '@nestjs/common';
+import { LocalStrategy } from '@appxdigital/appx-core';
+
+@Injectable()
+export class MyLocalStrategy extends LocalStrategy {
+  async validate(username: string, password: string) {
+    // custom checks, then fall back to the framework behaviour:
+    return super.validate(username, password);
+  }
+}
+```
+
+```ts
+@Module({
+  controllers: [MyAuthController],
+  providers: [MyLocalStrategy], // Passport picks up the last-registered strategy of this name
+})
+export class MyAuthModule {}
+```
+
+> Passport registers strategies by name. Providing your own `LocalStrategy`
+> subclass in your module (with `AuthModule.forRoot({ controller: false })` for
+> the rest) makes yours the active `local` strategy.
+
+---
+
+## The general principle
+
+This isn't auth-specific. Every framework class you might need to specialise is
+exported from `@appxdigital/appx-core`. To override inner functionality:
+
+1. **Extend** the exported class.
+2. **Provide** your subclass in your own module (a subclass provider shadows the
+   base where you inject it).
+3. When the framework module would *also* register the thing you're replacing
+   (a controller, a route), import it in a mode that omits that piece — e.g.
+   `AuthModule.forRoot({ controller: false })` — so there's no duplicate.
+
+If a class you need to extend isn't exported, that's a framework gap — open it
+rather than deep-importing from `dist/`.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.121-beta.13",
+    "version": "0.1.121-beta.15",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",