@dudousxd/nestjs-catalog 0.2.0 → 0.3.0

package/README.md

@@ -84,6 +84,46 @@ overlay store (a JSON file by default; bring your own via `overlayStore`).
 searched columns against the catalog before anything reaches SQL, selects only
 the columns the catalog says are visible, and caps the page size.
 
+## Who may reach it
+
+The console's Access screen asks two questions with different owners, and the
+library treats them differently on purpose.
+
+**Applications** are the catalog's own. `catalog_principal` is a table this
+library defines and the grants on it are catalog grants, so
+`CatalogMikroOrmStoreModule` ships the implementation and you get
+`GET /access/principals` by mounting it.
+
+**People are almost certainly not the catalog's.** A catalog embedded in an
+application is embedded in one that already knows who its users are, and a
+second user store beside it is how you get two lists of employees that disagree
+about who was offboarded. So implement `listPeople` over what you already have:
+
+```ts
+class MyDirectory extends MikroOrmCatalogDirectory {   // applications, inherited
+  async listPeople() { return this.users.findAll().map(toPersonSummary); }
+}
+
+CatalogModule.forRoot({
+  directory: { provide: CATALOG_DIRECTORY, useClass: MyDirectory },
+});
+```
+
+Bind it through `directory` rather than only exporting it from an imported
+module: a provider declared inside `CatalogModule` **shadows** the same token
+exported by one of its imports, so a host that does both gets the shipped
+applications-only one and no error.
+
+Leave `listPeople` out and `GET /access/people` answers **501** naming the seam,
+rather than an empty list. That distinction is load-bearing — "nobody can sign in
+yet" and "we did not ask" send an operator to different places, and the first
+invites them to create an account that already exists. Same for `upsertPerson`,
+which most hosts should *not* implement: creating a user from a catalog console
+is a way to create one your IdP has never heard of.
+
+The routes mount at `accessPath`, a sibling of `path` by default — `api/catalog`
+gives `api/access`, which is the shape the React screens build.
+
 ## Build your own endpoints, or use ours
 
 The built-in controller is a convenience, not the interface. Pass

package/dist/access.controller.d.ts

@@ -0,0 +1,10 @@
+import { type Type } from '@nestjs/common';
+/**
+ * The Access screen's endpoints.
+ *
+ * A factory for the same reason as `createCatalogController`: the prefix and
+ * the guards come from `forRoot`, and this surface enumerates every application
+ * that can write to the catalog, which is not something to hand a library's
+ * default opinion about auth.
+ */
+export declare function createAccessController(path: string, guards: Type<unknown>[], decorators?: ClassDecorator[]): Type<unknown>;

package/dist/access.controller.js

@@ -0,0 +1,150 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessController = createAccessController;
+const common_1 = require("@nestjs/common");
+const catalog_access_1 = require("./catalog.access");
+const ROLES = ['viewer', 'curator', 'administrator'];
+function isRole(value) {
+    return typeof value === 'string' && ROLES.some((role) => role === value);
+}
+/**
+ * The Access screen's endpoints.
+ *
+ * A factory for the same reason as `createCatalogController`: the prefix and
+ * the guards come from `forRoot`, and this surface enumerates every application
+ * that can write to the catalog, which is not something to hand a library's
+ * default opinion about auth.
+ */
+function createAccessController(path, guards, decorators = []) {
+    let AccessController = class AccessController {
+        directory;
+        constructor(directory) {
+            this.directory = directory;
+        }
+        require() {
+            if (!this.directory) {
+                throw new common_1.NotImplementedException('This catalog has no directory, so it cannot say who may reach it. ' +
+                    'Provide CATALOG_DIRECTORY — `CatalogMikroOrmStoreModule` ships one that reads `catalog_principal`.');
+            }
+            return this.directory;
+        }
+        principals() {
+            return this.require().listApplications();
+        }
+        people(search, limit, offset) {
+            const directory = this.require();
+            if (!directory.listPeople) {
+                // 501, not 200-with-nothing. The screen renders a failed read and an
+                // empty list very differently on purpose, and this is genuinely the
+                // first: the people exist, they are just not ours to enumerate.
+                throw new common_1.NotImplementedException("People come from this application's own identity system, not from the catalog. " +
+                    'Implement `listPeople` on CATALOG_DIRECTORY to list them here.');
+            }
+            // Bounded HERE, not left to each implementation. A host's user table is
+            // its whole directory, and the seam would otherwise invite exactly the
+            // unbounded read this endpoint would then serve to a browser.
+            return directory.listPeople({
+                ...(search ? { search } : {}),
+                limit: boundedPage(limit),
+                offset: nonNegative(offset),
+            });
+        }
+        upsertPerson(body) {
+            const directory = this.require();
+            if (!directory.upsertPerson) {
+                throw new common_1.NotImplementedException("This catalog's directory is read-only. Add or change people where they actually live; " +
+                    'implement `upsertPerson` on CATALOG_DIRECTORY only if that is here.');
+            }
+            return directory.upsertPerson(parsePersonInput(body));
+        }
+    };
+    __decorate([
+        (0, common_1.Get)('principals'),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", []),
+        __metadata("design:returntype", void 0)
+    ], AccessController.prototype, "principals", null);
+    __decorate([
+        (0, common_1.Get)('people'),
+        __param(0, (0, common_1.Query)('search')),
+        __param(1, (0, common_1.Query)('limit')),
+        __param(2, (0, common_1.Query)('offset')),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", [String, String, String]),
+        __metadata("design:returntype", void 0)
+    ], AccessController.prototype, "people", null);
+    __decorate([
+        (0, common_1.Post)('people'),
+        __param(0, (0, common_1.Body)()),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", [Object]),
+        __metadata("design:returntype", void 0)
+    ], AccessController.prototype, "upsertPerson", null);
+    AccessController = __decorate([
+        (0, common_1.Controller)(path),
+        __param(0, (0, common_1.Optional)()),
+        __param(0, (0, common_1.Inject)(catalog_access_1.CATALOG_DIRECTORY)),
+        __metadata("design:paramtypes", [Object])
+    ], AccessController);
+    if (guards.length > 0)
+        (0, common_1.UseGuards)(...guards)(AccessController);
+    for (const decorate of decorators)
+        decorate(AccessController);
+    return AccessController;
+}
+/**
+ * A page size that cannot be talked out of its ceiling.
+ *
+ * Anything unparseable falls back to the default rather than to "no limit" —
+ * `?limit=all` must not be the one string that turns the bound off.
+ */
+function boundedPage(raw) {
+    const asked = Number.parseInt(raw ?? '', 10);
+    if (!Number.isFinite(asked) || asked <= 0)
+        return catalog_access_1.CATALOG_DIRECTORY_PAGE;
+    return Math.min(asked, catalog_access_1.CATALOG_DIRECTORY_MAX_PAGE);
+}
+function nonNegative(raw) {
+    const asked = Number.parseInt(raw ?? '', 10);
+    return Number.isFinite(asked) && asked > 0 ? asked : 0;
+}
+/**
+ * Validated here rather than with a DTO class, because this package ships no
+ * `class-validator` dependency and a host's global `ValidationPipe` is not
+ * something a library can assume is mounted.
+ */
+function parsePersonInput(body) {
+    if (!body || typeof body !== 'object') {
+        throw new common_1.BadRequestException('Expected an object describing the person.');
+    }
+    const email = Reflect.get(body, 'email');
+    if (typeof email !== 'string' || !email.includes('@')) {
+        throw new common_1.BadRequestException('`email` is required and must be an email address.');
+    }
+    const role = Reflect.get(body, 'role');
+    if (!isRole(role)) {
+        throw new common_1.BadRequestException(`\`role\` must be one of: ${ROLES.join(', ')}.`);
+    }
+    const displayName = Reflect.get(body, 'displayName');
+    const active = Reflect.get(body, 'active');
+    const password = Reflect.get(body, 'password');
+    return {
+        email,
+        role,
+        ...(typeof displayName === 'string' ? { displayName } : {}),
+        ...(typeof active === 'boolean' ? { active } : {}),
+        ...(typeof password === 'string' ? { password } : {}),
+    };
+}

package/dist/catalog.access.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Where the Access screen's two lists come from.
+ *
+ * The screen answers one question — "which application is allowed to touch
+ * what, and which person is behind it" — but the two halves of that answer have
+ * very different owners.
+ *
+ * *Applications* are the catalog's own. `catalog_principal` is a table this
+ * library defines, the grants on it are catalog grants, and no host has a
+ * pre-existing notion of "may load the `Vehicle` type". The library can and does
+ * serve this half itself.
+ *
+ * *People* are almost never the catalog's. A catalog embedded in an application
+ * is embedded in an application that already knows who its users are — an IdP, a
+ * session table, an OIDC provider — and standing up a second user store beside
+ * it is how you get two lists of employees that disagree about who was
+ * offboarded. So this half is a seam: the host implements it over whatever it
+ * already has, or it does not implement it and the screen says so.
+ *
+ * That asymmetry is why `listPeople` and `upsertPerson` are OPTIONAL while
+ * `listApplications` is not. A directory that only knows about applications is a
+ * complete, expected implementation, not a half-finished one.
+ */
+/** A calling application, as the Access screen needs it. */
+export interface CatalogApplicationSummary {
+    id: string;
+    displayName: string;
+    scopes: string[];
+    writeTypes: string[];
+    /** Null means every type — a safe default for read, unlike write. */
+    readTypes: string[] | null;
+    classifications: string[];
+    active: boolean;
+    /**
+     * How it authenticates. Never the credential itself — a console that can
+     * display one is a console that leaks it over somebody's shoulder.
+     */
+    authMethod: 'key' | 'token' | 'session';
+    lastSeenAt: string | null;
+    /**
+     * Types whose publishing this application owns.
+     *
+     * Distinct from `writeTypes`, which is the grant. Ownership is what actually
+     * decides a re-publish, so a screen showing only the grant can show an
+     * application that appears able to load a type it will be refused on.
+     */
+    ownedTypes: string[];
+}
+export type CatalogPersonRole = 'viewer' | 'curator' | 'administrator';
+/** A person: signs in, and acts through an application that caps them. */
+export interface CatalogPersonSummary {
+    email: string;
+    displayName: string;
+    role: CatalogPersonRole;
+    active: boolean;
+    /** Exactly the string their actions land in the audit trail as. */
+    principalId: string;
+    /**
+     * Whether they can sign in with a password *here*.
+     *
+     * False is the normal answer for a host-backed directory, where signing in
+     * happens somewhere this library never sees. It is not "no credential".
+     */
+    hasPassword: boolean;
+    createdAt: string;
+    lastLoginAt: string | null;
+    /** Sessions the host can see. `0` from a directory that does not track them. */
+    liveSessions: number;
+    /**
+     * The intersection with the application they sign in through, not the role in
+     * the abstract. An administrator whose console has had `catalog:admin`
+     * removed is not an administrator, and showing the role alone would say
+     * otherwise.
+     */
+    effective: {
+        scopes: string[];
+        writeTypes: string[];
+        readTypes: string[] | null;
+        classifications: string[];
+    };
+}
+/** The bound the endpoint applies before the directory is asked. */
+export interface CatalogDirectoryQuery {
+    /**
+     * Free text over whatever identifies a person to the host — email and display
+     * name, typically. Absent means no filter, NOT "match nothing".
+     */
+    search?: string;
+    /** Always present, always capped. See {@link CATALOG_DIRECTORY_MAX_PAGE}. */
+    limit: number;
+    offset: number;
+}
+/** The default page, when the caller asks for no particular one. */
+export declare const CATALOG_DIRECTORY_PAGE = 50;
+/**
+ * The ceiling, whatever a caller asks for.
+ *
+ * A cap rather than a default that can be overridden without limit, because the
+ * caller here is a browser and `?limit=100000` would be one URL away from the
+ * unbounded read this exists to prevent.
+ */
+export declare const CATALOG_DIRECTORY_MAX_PAGE = 500;
+export interface CatalogPeoplePage {
+    people: CatalogPersonSummary[];
+    /**
+     * How many match, ignoring the page. The console needs it to say "50 of 1,340"
+     * — a bounded list that cannot report what it is bounding is indistinguishable
+     * from a complete one, and an operator reading it as complete will conclude
+     * somebody has no access when they simply were not on the page.
+     */
+    total: number;
+    limit: number;
+    offset: number;
+}
+export interface CatalogPersonInput {
+    email: string;
+    displayName?: string;
+    role: CatalogPersonRole;
+    active?: boolean;
+    password?: string;
+}
+export interface CatalogPersonUpsertResult {
+    email: string;
+    created: boolean;
+    /**
+     * Whether open sessions were invalidated. Surfaced because demoting somebody
+     * whose tabs keep working is the failure that makes people distrust the whole
+     * session system.
+     */
+    sessionsRevoked: boolean;
+}
+/**
+ * The host's answer to "who may reach this catalog".
+ *
+ * Implement `listPeople` over the user store you already have. The three
+ * fields worth care are `principalId` — it must be the exact string that
+ * person's actions are recorded under, or the Activity screen attributes their
+ * work to nobody — `role`, and `effective`, which is the role capped by the
+ * application they sign in through rather than the role in the abstract.
+ */
+export interface CatalogDirectory {
+    /**
+     * Unpaged, and that is a claim about the data rather than an oversight:
+     * applications are rows an operator creates by hand, one per publisher, and a
+     * catalog with a thousand of them has a different problem than a missing
+     * `LIMIT`. People are the opposite — see {@link listPeople}.
+     */
+    listApplications(): Promise<CatalogApplicationSummary[]>;
+    /**
+     * Omit when people come from somewhere this catalog cannot see. The endpoint
+     * then refuses with a message naming this seam, which is a better answer than
+     * an empty list: "nobody can sign in yet" and "we did not ask" send an
+     * operator to completely different places, and the first invites them to
+     * create an account that already exists.
+     *
+     * **The query is not advisory.** It is passed so the bound reaches the
+     * database, not so the implementation can slice an array it already
+     * materialised — an embedded catalog's user table is the host's whole
+     * directory, and `SELECT *` over it is a screen that gets slower every time
+     * somebody is hired. `total` is what lets the console say how much it is not
+     * showing, which is the difference between a bounded list and a silently
+     * truncated one.
+     */
+    listPeople?(query: CatalogDirectoryQuery): Promise<CatalogPeoplePage>;
+    /**
+     * Omit when the host's directory is not writable from here — which is the
+     * common case, and the right one. Creating a user in the IdP from a catalog
+     * console is a way to create a user the IdP does not know about.
+     */
+    upsertPerson?(input: CatalogPersonInput): Promise<CatalogPersonUpsertResult>;
+}
+export declare const CATALOG_DIRECTORY: unique symbol;

package/dist/catalog.access.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * Where the Access screen's two lists come from.
+ *
+ * The screen answers one question — "which application is allowed to touch
+ * what, and which person is behind it" — but the two halves of that answer have
+ * very different owners.
+ *
+ * *Applications* are the catalog's own. `catalog_principal` is a table this
+ * library defines, the grants on it are catalog grants, and no host has a
+ * pre-existing notion of "may load the `Vehicle` type". The library can and does
+ * serve this half itself.
+ *
+ * *People* are almost never the catalog's. A catalog embedded in an application
+ * is embedded in an application that already knows who its users are — an IdP, a
+ * session table, an OIDC provider — and standing up a second user store beside
+ * it is how you get two lists of employees that disagree about who was
+ * offboarded. So this half is a seam: the host implements it over whatever it
+ * already has, or it does not implement it and the screen says so.
+ *
+ * That asymmetry is why `listPeople` and `upsertPerson` are OPTIONAL while
+ * `listApplications` is not. A directory that only knows about applications is a
+ * complete, expected implementation, not a half-finished one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CATALOG_DIRECTORY = exports.CATALOG_DIRECTORY_MAX_PAGE = exports.CATALOG_DIRECTORY_PAGE = void 0;
+/** The default page, when the caller asks for no particular one. */
+exports.CATALOG_DIRECTORY_PAGE = 50;
+/**
+ * The ceiling, whatever a caller asks for.
+ *
+ * A cap rather than a default that can be overridden without limit, because the
+ * caller here is a browser and `?limit=100000` would be one URL away from the
+ * unbounded read this exists to prevent.
+ */
+exports.CATALOG_DIRECTORY_MAX_PAGE = 500;
+exports.CATALOG_DIRECTORY = Symbol('CATALOG_DIRECTORY');

package/dist/catalog.module.js

@@ -10,6 +10,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CatalogModule = void 0;
 const node_path_1 = require("node:path");
 const common_1 = require("@nestjs/common");
+const access_controller_1 = require("./access.controller");
 const catalog_controller_1 = require("./catalog.controller");
 const catalog_options_1 = require("./catalog.options");
 const catalog_overlay_store_1 = require("./catalog.overlay-store");
@@ -24,7 +25,10 @@ let CatalogModule = CatalogModule_1 = class CatalogModule {
         const path = options.path ?? 'api/catalog';
         const mountController = options.controller !== false;
         const controllers = mountController
-            ? [(0, catalog_controller_1.createCatalogController)(path, options.guards ?? [], options.decorators ?? [])]
+            ? [
+                (0, catalog_controller_1.createCatalogController)(path, options.guards ?? [], options.decorators ?? []),
+                (0, access_controller_1.createAccessController)(options.accessPath ?? siblingPath(path, 'access'), options.guards ?? [], options.decorators ?? []),
+            ]
             : [];
         const overlayStore = options.overlayStore ??
             new catalog_overlay_store_1.FileCatalogOverlayStore(options.overlayPath ?? (0, node_path_1.join)(process.cwd(), '.catalog', 'overlay.json'));
@@ -59,6 +63,11 @@ let CatalogModule = CatalogModule_1 = class CatalogModule {
                 ...(options.store
                     ? [options.store]
                     : [mikro_orm_read_store_1.MikroOrmReadStore, { provide: catalog_store_1.CATALOG_STORE, useExisting: mikro_orm_read_store_1.MikroOrmReadStore }]),
+                // No default. Unlike the store and the registry there is nothing
+                // sensible to derive: who may reach a catalog is not a fact about its
+                // model. Absent, the Access routes answer 501 naming the token, which
+                // is the honest state for a host that has not decided yet.
+                ...(options.directory ? [options.directory] : []),
                 catalog_service_1.CatalogService,
             ],
             exports: [catalog_registry_base_1.CatalogRegistry, catalog_service_1.CatalogService, catalog_store_1.CATALOG_STORE],
@@ -69,3 +78,16 @@ exports.CatalogModule = CatalogModule;
 exports.CatalogModule = CatalogModule = CatalogModule_1 = __decorate([
     (0, common_1.Module)({})
 ], CatalogModule);
+/**
+ * `api/catalog` + `access` -> `api/access`.
+ *
+ * Replacing the last segment rather than appending, because the console builds
+ * the two paths as siblings under one API root. Appending would give
+ * `api/catalog/access`, which the console never asks for — and the symptom is a
+ * screen that 404s while the module reports itself mounted.
+ */
+function siblingPath(path, segment) {
+    const trimmed = path.replace(/\/+$/, '');
+    const parent = trimmed.slice(0, trimmed.lastIndexOf('/') + 1);
+    return `${parent}${segment}`;
+}

package/dist/catalog.options.d.ts

@@ -16,6 +16,21 @@ export interface CatalogModuleOptions {
      * Defaults to `api/catalog`.
      */
     path?: string;
+    /**
+     * Route prefix for the Access endpoints, which the console's Access screen
+     * reads.
+     *
+     * A sibling of {@link path} by default — `api/catalog` gives `api/access` —
+     * because that is the shape `@dudousxd/nestjs-catalog-react` builds by
+     * default: it prepends the console's `apiPath` to a base of `/access`, so
+     * the two land side by side under the same API root.
+     *
+     * The endpoints are served only when something provides `CATALOG_DIRECTORY`;
+     * see {@link CatalogDirectory}. Mounted regardless, so the console gets a
+     * 501 explaining what is unwired rather than a 404 that reads as a broken
+     * build.
+     */
+    accessPath?: string;
     /**
      * Guards applied to every catalog route. The library ships none: an
      * introspection endpoint that lists every table in the system is exactly the
@@ -55,6 +70,20 @@ export interface CatalogModuleOptions {
      * implementation here instead.
      */
     registry?: Provider;
+    /**
+     * Who may reach this catalog. A provider for `CATALOG_DIRECTORY`.
+     *
+     * Bound here rather than only exported from an imported module for the same
+     * reason `store` and `registry` are: a provider declared inside this module
+     * SHADOWS the same token exported by one of its imports, so a host that
+     * merely imports `CatalogMikroOrmStoreModule` alongside its own
+     * implementation gets the shipped applications-only one and no error.
+     *
+     * The common shape is to extend the shipped `MikroOrmCatalogDirectory` —
+     * which reads `catalog_principal` — and add `listPeople` over the user store
+     * the host already has. See {@link CatalogDirectory}.
+     */
+    directory?: Provider;
     /**
      * Mount the built-in controller. Default true.
      *

package/dist/catalog.pipeline.js

@@ -249,7 +249,7 @@ function validateWorkflow(graph) {
             });
             continue;
         }
-        const key = `${edge.from}${edge.to}`;
+        const key = `${edge.from}\0${edge.to}`;
         if (seenEdges.has(key)) {
             issues.push({
                 code: 'duplicate-edge',

package/dist/catalog.principal.d.ts

@@ -162,7 +162,7 @@ export declare function composePrincipalId(applicationId: string, actorId?: stri
  *
  * Total, and lenient by design: every id ever written parses, including the
  * millions written before actors existed. This is what lets a governance query
- * keep asking "everything `flip-nestjs` did" — it matches on `applicationId`
+ * keep asking "everything this application did" — it matches on `applicationId`
  * and gets both the machine's own loads and anything a person did through it.
  *
  * Splits on the *first* separator, so an actor id that somehow contains one

package/dist/catalog.principal.js

@@ -101,7 +101,7 @@ function composePrincipalId(applicationId, actorId) {
  *
  * Total, and lenient by design: every id ever written parses, including the
  * millions written before actors existed. This is what lets a governance query
- * keep asking "everything `flip-nestjs` did" — it matches on `applicationId`
+ * keep asking "everything this application did" — it matches on `applicationId`
  * and gets both the machine's own loads and anything a person did through it.
  *
  * Splits on the *first* separator, so an actor id that somehow contains one

package/dist/index.d.ts

@@ -14,6 +14,7 @@ export { SubprocessTransformRunner, type TransformRunnerOptions, } from './trans
 export { CatalogService } from './catalog.service';
 export { type AuditQuery, CATALOG_TRACE_OUTCOMES, CATALOG_TRACE_STORE, CATALOG_WORKSPACE_STORE, type CatalogAuditEvent, type CatalogTrace, type CatalogTraceList, type CatalogTraceOutcome, type CatalogTraceSpan, type CatalogTraceStore, type CatalogTraceTotals, type CatalogUnlinkedList, type CatalogWorkspaceStore, type Dashboard, type DashboardCard, isCatalogTraceOutcome, isTraceStore, isWorkspaceStore, type QueryVisualization, type SaveQueryInput, type SavedQuery, type TraceQuery, traceOutcomeFilter, } from './catalog.workspace';
 export { CATALOG_PRINCIPAL_RESOLVER, type CatalogActor, type CatalogGrants, type CatalogPrincipal, type CatalogPrincipalResolver, type CatalogScope, composePrincipalId, delegatePrincipal, expandScopes, hasScope, parsePrincipalId, PRINCIPAL_ACTOR_SEPARATOR, maySeeClassification, mayRead, mayWrite, StaticKeyPrincipalResolver, } from './catalog.principal';
+export { CATALOG_DIRECTORY, type CatalogApplicationSummary, type CatalogDirectory, type CatalogPersonInput, type CatalogPersonRole, type CatalogPersonSummary, type CatalogPersonUpsertResult, } from './catalog.access';
 export { assertNoColumnCollisions, CATALOG_RESERVED_COLUMNS, CATALOG_SNAPSHOT_MODES, CATALOG_STORE, type CarryForwardResult, type CatalogColumnCollision, CatalogColumnCollisionError, type CatalogMergeStore, type CatalogReadQuery, type CatalogReadResult, type CatalogReadStore, type CatalogReservedColumn, type CatalogSnapshotMode, type CatalogStoreCapabilities, type CatalogWriteStore, type ColumnCollisionOptions, findColumnCollisions, isCatalogStoreCapabilities, isReservedColumn, isWriteStore, type SnapshotRef, supportsCarryForward, } from './catalog.store';
 export { MikroOrmReadStore } from './stores/mikro-orm-read.store';
 export type { CatalogGraph, CatalogObjectPage, CatalogObjectQuery, CatalogObjectTypeDef, CatalogOverlay, CatalogPropertyDef, CatalogRelationDef, CatalogSnapshot, RelationKind, ScalarType, } from './catalog.types';

package/dist/index.js

@@ -15,7 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CATALOG_PRINCIPAL_RESOLVER = exports.traceOutcomeFilter = exports.isWorkspaceStore = exports.isTraceStore = exports.isCatalogTraceOutcome = exports.CATALOG_WORKSPACE_STORE = exports.CATALOG_TRACE_STORE = exports.CATALOG_TRACE_OUTCOMES = exports.CatalogService = exports.SubprocessTransformRunner = exports.toCsv = exports.QueryCache = exports.workflowRunOrder = exports.workflowGraphHash = exports.WORKFLOW_NODE_KINDS = exports.WORKFLOW_NODE_ID_PATTERN = exports.WORKFLOW_ISSUE_CODES = exports.WORKFLOW_EXECUTION_MODES = exports.validateWorkflow = exports.TRANSFORM_LANGUAGES = exports.TRANSFORM_RUNNER = exports.supportsWorkflowStages = exports.supportsWorkflows = exports.isWorkflowNodeKind = exports.isWorkflowNode = exports.isWorkflowExecutionMode = exports.isWorkflowEdge = exports.isTransformLanguage = exports.isPipelineStore = exports.isConnectorKind = exports.CONNECTOR_KINDS = exports.CATALOG_PIPELINE_STORE = exports.CatalogRegistry = exports.MikroOrmCatalogRegistry = exports.CATALOG_OVERLAY_STORE = exports.InMemoryCatalogOverlayStore = exports.FileCatalogOverlayStore = exports.CATALOG_OPTIONS = exports.isQueryStore = exports.assertReadOnlyShape = exports.CatalogModule = exports.emitCatalog = exports.channelNameFor = exports.catalogEventPhase = exports.CATALOG_LIB = exports.CATALOG_EVENTS = exports.CATALOG_EVENT_PHASE_FALLBACK = exports.CATALOG_EVENT_PHASE = exports.CatalogType = exports.CatalogProperty = void 0;
-exports.RequireScopes = exports.RequireHuman = exports.REQUIRES_HUMAN = exports.REQUIRED_SCOPES = exports.MikroOrmReadStore = exports.supportsCarryForward = exports.isWriteStore = exports.isReservedColumn = exports.isCatalogStoreCapabilities = exports.findColumnCollisions = exports.CatalogColumnCollisionError = exports.CATALOG_STORE = exports.CATALOG_SNAPSHOT_MODES = exports.CATALOG_RESERVED_COLUMNS = exports.assertNoColumnCollisions = exports.StaticKeyPrincipalResolver = exports.mayWrite = exports.mayRead = exports.maySeeClassification = exports.PRINCIPAL_ACTOR_SEPARATOR = exports.parsePrincipalId = exports.hasScope = exports.expandScopes = exports.delegatePrincipal = exports.composePrincipalId = void 0;
+exports.RequireScopes = exports.RequireHuman = exports.REQUIRES_HUMAN = exports.REQUIRED_SCOPES = exports.MikroOrmReadStore = exports.supportsCarryForward = exports.isWriteStore = exports.isReservedColumn = exports.isCatalogStoreCapabilities = exports.findColumnCollisions = exports.CatalogColumnCollisionError = exports.CATALOG_STORE = exports.CATALOG_SNAPSHOT_MODES = exports.CATALOG_RESERVED_COLUMNS = exports.assertNoColumnCollisions = exports.CATALOG_DIRECTORY = exports.StaticKeyPrincipalResolver = exports.mayWrite = exports.mayRead = exports.maySeeClassification = exports.PRINCIPAL_ACTOR_SEPARATOR = exports.parsePrincipalId = exports.hasScope = exports.expandScopes = exports.delegatePrincipal = exports.composePrincipalId = void 0;
 var catalog_decorators_1 = require("./catalog.decorators");
 Object.defineProperty(exports, "CatalogProperty", { enumerable: true, get: function () { return catalog_decorators_1.CatalogProperty; } });
 Object.defineProperty(exports, "CatalogType", { enumerable: true, get: function () { return catalog_decorators_1.CatalogType; } });
@@ -94,6 +94,8 @@ Object.defineProperty(exports, "maySeeClassification", { enumerable: true, get:
 Object.defineProperty(exports, "mayRead", { enumerable: true, get: function () { return catalog_principal_1.mayRead; } });
 Object.defineProperty(exports, "mayWrite", { enumerable: true, get: function () { return catalog_principal_1.mayWrite; } });
 Object.defineProperty(exports, "StaticKeyPrincipalResolver", { enumerable: true, get: function () { return catalog_principal_1.StaticKeyPrincipalResolver; } });
+var catalog_access_1 = require("./catalog.access");
+Object.defineProperty(exports, "CATALOG_DIRECTORY", { enumerable: true, get: function () { return catalog_access_1.CATALOG_DIRECTORY; } });
 var catalog_store_1 = require("./catalog.store");
 Object.defineProperty(exports, "assertNoColumnCollisions", { enumerable: true, get: function () { return catalog_store_1.assertNoColumnCollisions; } });
 Object.defineProperty(exports, "CATALOG_RESERVED_COLUMNS", { enumerable: true, get: function () { return catalog_store_1.CATALOG_RESERVED_COLUMNS; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-catalog",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "A metadata registry for NestJS: object types, properties and relations, derived from your ORM and enriched with decorators.",
   "license": "MIT",
   "author": "Davide Carvalho",