@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.10

package/dist/manifest/platform-user-owned-models.js

@@ -0,0 +1,256 @@
+"use strict";
+// =============================================================================
+// The platform's user-owned model inventory (issue #688; packaged by #866)
+// =============================================================================
+//
+// Every platform model with a foreign key to `User`, classified against its
+// `onDelete` in the platform's schema fragments (`@marinoscar/platform-db`,
+// `schema/*.prisma`). Every app composes every platform fragment, so every app
+// needs every entry: `registerPlatformUserOwnedModels()` registers them into
+// core's `userOwnedModelRegistry`, then the app's own.
+//
+// The base entries below were the reference app's
+// `prisma/ownership/platform-user-owned-models.ts`, moved unchanged; the
+// sharing, settings, credentials and android-app slices declare their own
+// models and are appended in the order the reference app registered them. The
+// registration order is the order the user-data export lists its datasets, so
+// it is append-only.
+//
+// OWNER: the row belongs to the user (a scoped client may read and write it).
+// ACTOR: the row only names a user who acted (a scoped client refuses it).
+// The `userOwnedData` conformance suite fails when this list and a schema
+// disagree; `test/manifest/user-owned-models.spec.ts` runs it against the
+// platform's fragments.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_USER_OWNED_MODELS = void 0;
+exports.registerPlatformUserOwnedModels = registerPlatformUserOwnedModels;
+const index_1 = require("../core/index");
+const index_2 = require("../android-app/index");
+const index_3 = require("../credentials/index");
+const index_4 = require("../settings/index");
+const index_5 = require("../sharing/index");
+/** The models of the base, identity, notifications, jobs, AI, storage and db-backup fragments. */
+const BASE_USER_OWNED_MODELS = [
+    // ---------------------------------------------------------------------------
+    // Owner models, deleted with the user (onDelete: Cascade)
+    // ---------------------------------------------------------------------------
+    {
+        model: 'UserIdentity',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'include',
+        rationale: 'The provider identities the user signs in with. It stores no provider tokens, only the subject and the email the provider reported.',
+    },
+    {
+        model: 'UserRole',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'include',
+        rationale: "The user's role assignments; meaningless without the user.",
+    },
+    {
+        model: 'UserSettings',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'include',
+        rationale: "The user's own preferences.",
+    },
+    {
+        model: 'RefreshToken',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'exclude',
+        rationale: 'Session state, not user data: a hash of a rotating credential with no value to the user outside this deployment.',
+    },
+    {
+        model: 'PersonalAccessToken',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'include',
+        exportOmit: ['tokenHash'],
+        rationale: "The user's own API tokens. The export lists names, prefixes and dates; the hash never leaves the server.",
+    },
+    {
+        model: 'DeviceCode',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'exclude',
+        rationale: 'A short-lived device authorization exchange; nothing worth exporting. The owner is null until a user approves the code.',
+    },
+    {
+        model: 'Membership',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'include',
+        rationale: "The user's membership of an organization (PP-6.1). It means nothing without the user; the export lists which organizations the user belongs to.",
+    },
+    {
+        model: 'Notification',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'include',
+        rationale: "The user's in-app inbox.",
+    },
+    {
+        model: 'PushSubscription',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'exclude',
+        rationale: "A browser's Web Push endpoint and keys: device state that is useless elsewhere and must not be copied around.",
+    },
+    {
+        model: 'NodeCredential',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'exclude',
+        rationale: 'A worker node identity token hash; a credential, not user data.',
+    },
+    {
+        model: 'UserAiKey',
+        ownerField: 'userId',
+        purge: 'delete',
+        export: 'include',
+        exportOmit: ['secret'],
+        rationale: "The user's own AI provider keys. The export lists providers and hints; the ciphertext never leaves the server.",
+    },
+    {
+        model: 'WorkerNode',
+        ownerField: 'createdById',
+        purge: 'delete',
+        export: 'exclude',
+        rationale: 'A worker node is managed only by the user who registered it, so an ownerless node could never be managed again; job history survives through Job.claimedByNode (SetNull). Fleet inventory, not personal data.',
+    },
+    // ---------------------------------------------------------------------------
+    // Owner models, detached from the user (onDelete: SetNull)
+    // ---------------------------------------------------------------------------
+    {
+        model: 'StorageObject',
+        ownerField: 'uploadedById',
+        purge: 'detach',
+        export: 'include',
+        rationale: "The user's uploads. Rows survive their uploader so the object store and the table stay in step; the storage purge removes the bytes.",
+    },
+    {
+        model: 'NotificationDelivery',
+        ownerField: 'userId',
+        purge: 'detach',
+        export: 'include',
+        rationale: 'The delivery log of what was sent to the user. Kept, unlinked, for operational history.',
+    },
+    {
+        model: 'AiRun',
+        ownerField: 'userId',
+        purge: 'detach',
+        export: 'include',
+        rationale: "The user's AI runs. Kept, unlinked, so usage accounting and job history stay whole.",
+    },
+    {
+        model: 'AiUsageEvent',
+        ownerField: 'userId',
+        purge: 'detach',
+        export: 'include',
+        rationale: "The user's AI usage and cost. Kept, unlinked, so deployment totals stay correct.",
+    },
+    // ---------------------------------------------------------------------------
+    // Actor-only models: the row names who acted (onDelete: SetNull)
+    // ---------------------------------------------------------------------------
+    {
+        model: 'SystemSettings',
+        actorFields: ['updatedByUserId'],
+        purge: 'detach',
+        export: 'exclude',
+        rationale: 'Deployment configuration; the user only last changed it.',
+    },
+    {
+        model: 'AuditEvent',
+        actorFields: ['actorUserId'],
+        purge: 'detach',
+        export: 'include',
+        rationale: 'The audit trail outlives the actor. A user is entitled to the record of what they did, so the export includes the events naming them.',
+    },
+    {
+        model: 'AllowedEmail',
+        actorFields: ['addedById', 'claimedById'],
+        purge: 'detach',
+        export: 'exclude',
+        rationale: 'The deployment allowlist; it records who added an entry and who claimed it, neither of whom owns it.',
+    },
+    {
+        model: 'NotificationBroadcast',
+        actorFields: ['createdById'],
+        purge: 'detach',
+        export: 'exclude',
+        rationale: "An administrator's broadcast to everyone; it belongs to the deployment, not its author.",
+    },
+    {
+        model: 'DatabaseBackupRun',
+        actorFields: ['createdById', 'restoredById'],
+        purge: 'detach',
+        export: 'exclude',
+        rationale: 'A deployment backup; it records who started it and who restored it.',
+    },
+    {
+        model: 'Organization',
+        actorFields: ['createdById'],
+        purge: 'detach',
+        export: 'exclude',
+        rationale: 'A tenancy boundary, owned by the deployment and its members, not by the user who created it (PP-6.1); the creator is only recorded.',
+    },
+    {
+        model: 'Invite',
+        actorFields: ['invitedById', 'acceptedById'],
+        purge: 'detach',
+        export: 'exclude',
+        rationale: 'An organization invitation (PP-6.1). It records who invited the address and who accepted; neither owns it, and it outlives both users (SetNull).',
+    },
+    {
+        model: 'AiModel',
+        actorFields: ['updatedByUserId'],
+        purge: 'detach',
+        export: 'exclude',
+        rationale: 'The deployment AI model catalog; the user only last changed an entry.',
+    },
+];
+/**
+ * Every platform model with a foreign key to `User`, with its role, purge and
+ * export policy, in registration order: the base inventory, then the sharing,
+ * settings, credentials and android-app slices' own entries.
+ *
+ * @stability experimental
+ */
+exports.PLATFORM_USER_OWNED_MODELS = Object.freeze([
+    ...BASE_USER_OWNED_MODELS,
+    // The sharing slice's models (#728).
+    ...index_5.SHARING_USER_OWNED_MODELS,
+    // The settings slice's org table (#733).
+    ...index_4.SETTINGS_USER_OWNED_MODELS,
+    // The credentials slice's three models (#735).
+    ...index_3.CREDENTIALS_USER_OWNED_MODELS,
+    // The android-app slice's release table.
+    ...index_2.ANDROID_APP_USER_OWNED_MODELS,
+]);
+/**
+ * Registers {@link PLATFORM_USER_OWNED_MODELS} in core's
+ * `userOwnedModelRegistry`, then the app's own models, so a collision with a
+ * platform entry names the app. Call it once, at import time, from the app's
+ * user-owned model manifest; afterwards `userOwnedModelRegistry.list()` is
+ * the whole inventory the `userOwnedData` conformance suite, the scoped
+ * client, the user-data export and the purge planner read.
+ *
+ * @param appModels - the app's own definitions (typed with its own model names if it likes).
+ * @throws RegistryError `INVALID_ENTRY`, `DUPLICATE_ID` or `FROZEN`.
+ *
+ * @example
+ * ```ts
+ * registerPlatformUserOwnedModels(APP_USER_OWNED_MODELS);
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+function registerPlatformUserOwnedModels(appModels = []) {
+    (0, index_1.registerUserOwnedModels)(exports.PLATFORM_USER_OWNED_MODELS);
+    (0, index_1.registerUserOwnedModels)(appModels);
+}
+//# sourceMappingURL=platform-user-owned-models.js.map

package/dist/manifest/platform-user-owned-models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-user-owned-models.js","sourceRoot":"","sources":["../../src/manifest/platform-user-owned-models.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,uDAAuD;AACvD,EAAE;AACF,kDAAkD;AAClD,yEAAyE;AACzE,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAC9E,qBAAqB;AACrB,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,wBAAwB;AACxB,gFAAgF;;;AA8OhF,0EAGC;AA/OD,yCAAgF;AAChF,gDAAqE;AACrE,gDAAqE;AACrE,6CAA+D;AAC/D,4CAA6D;AAE7D,kGAAkG;AAClG,MAAM,sBAAsB,GAAiC;IAC3D,8EAA8E;IAC9E,0DAA0D;IAC1D,8EAA8E;IAC9E;QACE,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EACP,qIAAqI;KACxI;IACD;QACE,KAAK,EAAE,UAAU;QACjB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,4DAA4D;KACxE;IACD;QACE,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,6BAA6B;KACzC;IACD;QACE,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,kHAAkH;KAC9H;IACD;QACE,KAAK,EAAE,qBAAqB;QAC5B,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,CAAC,WAAW,CAAC;QACzB,SAAS,EAAE,0GAA0G;KACtH;IACD;QACE,KAAK,EAAE,YAAY;QACnB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EACP,yHAAyH;KAC5H;IACD;QACE,KAAK,EAAE,YAAY;QACnB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EACP,iJAAiJ;KACpJ;IACD;QACE,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,0BAA0B;KACtC;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,+GAA+G;KAC3H;IACD;QACE,KAAK,EAAE,gBAAgB;QACvB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,iEAAiE;KAC7E;IACD;QACE,KAAK,EAAE,WAAW;QAClB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,SAAS,EAAE,gHAAgH;KAC5H;IACD;QACE,KAAK,EAAE,YAAY;QACnB,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EACP,+MAA+M;KAClN;IAED,8EAA8E;IAC9E,2DAA2D;IAC3D,8EAA8E;IAC9E;QACE,KAAK,EAAE,eAAe;QACtB,UAAU,EAAE,cAAc;QAC1B,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EACP,sIAAsI;KACzI;IACD;QACE,KAAK,EAAE,sBAAsB;QAC7B,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,yFAAyF;KACrG;IACD;QACE,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,qFAAqF;KACjG;IACD;QACE,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,kFAAkF;KAC9F;IAED,8EAA8E;IAC9E,iEAAiE;IACjE,8EAA8E;IAC9E;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,CAAC,iBAAiB,CAAC;QAChC,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,0DAA0D;KACtE;IACD;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,CAAC,aAAa,CAAC;QAC5B,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EACP,uIAAuI;KAC1I;IACD;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;QACzC,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,sGAAsG;KAClH;IACD;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,CAAC,aAAa,CAAC;QAC5B,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,yFAAyF;KACrG;IACD;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC;QAC5C,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,qEAAqE;KACjF;IACD;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,CAAC,aAAa,CAAC;QAC5B,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,qIAAqI;KACjJ;IACD;QACE,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC;QAC5C,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EACP,kJAAkJ;KACrJ;IACD;QACE,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,CAAC,iBAAiB,CAAC;QAChC,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,uEAAuE;KACnF;CACF,CAAC;AAEF;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAiC,MAAM,CAAC,MAAM,CAAC;IACpF,GAAG,sBAAsB;IACzB,qCAAqC;IACrC,GAAG,iCAAyB;IAC5B,yCAAyC;IACzC,GAAG,kCAA0B;IAC7B,+CAA+C;IAC/C,GAAG,qCAA6B;IAChC,yCAAyC;IACzC,GAAG,qCAA6B;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,+BAA+B,CAAwB,YAAkD,EAAE;IACzH,IAAA,+BAAuB,EAAC,kCAA0B,CAAC,CAAC;IACpD,IAAA,+BAAuB,EAAC,SAAS,CAAC,CAAC;AACrC,CAAC"}

package/dist/manifest/register-permissions.d.ts

@@ -0,0 +1,118 @@
+import { type Declarations, type PermissionCatalog, type PermissionDeclaration, type RoleDeclaration, type RoleGrantDeclaration } from '../core/index';
+import { type PlatformPermissionSlice } from './platform-permissions';
+/**
+ * What to register next to the platform's roles and permissions.
+ *
+ * @extensionPoint option
+ * @stability experimental
+ */
+export interface PlatformPermissionOptions {
+    /**
+     * The slices whose permissions to include, in any order (the sets keep
+     * their seed order). Default: every platform slice and every slice a package
+     * registered with `registerPermissionSet()`. `identity` is required: every
+     * app mounts it, and its roles are the platform roles. List each slice
+     * whose permissions the app's mounted slices enforce; a slice without
+     * declarations of its own (credentials, email, android-app...) enforces
+     * the `settings` slice's.
+     */
+    readonly slices?: readonly PlatformPermissionSlice[];
+    /** The app's own roles and permissions, registered after the platform's. */
+    readonly app?: {
+        /** Batches of app roles, registered after the platform roles, in order. */
+        readonly roles?: ReadonlyArray<Declarations<RoleDeclaration>>;
+        /** Batches of app permissions, registered after every platform permission, in order. */
+        readonly permissions?: ReadonlyArray<Declarations<PermissionDeclaration>>;
+        /**
+         * Permissions to give app roles on top of the permissions' own
+         * `defaultGrants`: how an app role receives a PLATFORM permission
+         * (`{ role: 'support', permissions: ['users:read'] }`). Each grant is
+         * validated (the role and the permission exist, the scopes match) and
+         * lands in the catalog's `rolePermissions`, so the seed writes it into
+         * `role_permissions` and the permission resolver reads it like a default
+         * grant. A platform role cannot be the target: the platform's matrix is
+         * the platform's (declare an app permission with `defaultGrants` to give a
+         * platform role something new).
+         */
+        readonly grants?: readonly RoleGrantDeclaration[];
+    };
+}
+/**
+ * The batches {@link registerPlatformPermissions} registers, in order.
+ *
+ * @stability experimental
+ */
+export interface PlatformPermissionDeclarations {
+    /** Role batches: the platform roles, those of registered slices, then the app's. */
+    roles: ReadonlyArray<Declarations<RoleDeclaration>>;
+    /** Permission batches: the selected platform sets in seed order, those of registered slices, then the app's. */
+    permissions: ReadonlyArray<Declarations<PermissionDeclaration>>;
+    /** Grant batches: the app's grants (one batch, or none). */
+    grants: ReadonlyArray<readonly RoleGrantDeclaration[]>;
+}
+/**
+ * The role, permission and grant batches, in registration order.
+ *
+ * @param options - see {@link PlatformPermissionOptions}.
+ * @returns what to register, in order.
+ * @throws Error when `slices` names an unknown slice or leaves out `identity`,
+ *   or a grant names a platform role.
+ *
+ * @example
+ * ```ts
+ * const { roles, permissions } = platformPermissionDeclarations({ slices: ['identity', 'settings'] });
+ * ```
+ *
+ * @stability experimental
+ */
+export declare function platformPermissionDeclarations(options?: PlatformPermissionOptions): PlatformPermissionDeclarations;
+/**
+ * Fills core's `roleRegistry`, `permissionRegistry` and `roleGrantRegistry`:
+ * the platform roles, those of registered slices, the app's roles, the
+ * platform permissions in seed order, those of registered slices, the app's
+ * permissions, then the app's grants. Call it once, at import time, from the
+ * app's permission manifest; the registries are frozen when the application
+ * bootstraps. It also freezes the permission-set registry, so a package that
+ * calls `registerPermissionSet()` too late fails loudly instead of missing the
+ * seed.
+ *
+ * @param options - see {@link PlatformPermissionOptions}.
+ * @throws RegistryError when a declaration is refused (an app id equal to a
+ *   platform id is `DUPLICATE_ID`; a grant to an unknown role `INVALID_ENTRY`),
+ *   naming the id; Error for a bad `slices` list or a grant to a platform role.
+ *
+ * @example
+ * ```ts
+ * registerPlatformPermissions({
+ *   app: {
+ *     roles: [APP_ROLES],
+ *     permissions: [APP_PERMISSIONS],
+ *     grants: [{ role: 'support', permissions: ['users:read'] }],
+ *   },
+ * });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare function registerPlatformPermissions(options?: PlatformPermissionOptions): void;
+/**
+ * The seed catalog of the platform's roles and permissions plus the app's,
+ * composed without touching core's registries. Exactly what
+ * `buildPermissionCatalog()` returns after `registerPlatformPermissions()`
+ * with the same options. Pass it to `platformSeedInputFrom()` of
+ * `@marinoscar/platform-db/seed` as `permissions`.
+ *
+ * @param options - see {@link PlatformPermissionOptions}.
+ * @returns the catalog.
+ *
+ * @example
+ * ```ts
+ * const permissions = platformPermissionCatalog({ slices: ['identity', 'settings', 'jobs', 'nodes'], app: { permissions: [NOTES_PERMISSIONS] } });
+ * await seedPlatform(prisma, platformSeedInputFrom({ permissions, settings }, process.env));
+ * ```
+ *
+ * @stability experimental
+ */
+export declare function platformPermissionCatalog(options?: PlatformPermissionOptions): PermissionCatalog;
+//# sourceMappingURL=register-permissions.d.ts.map

package/dist/manifest/register-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-permissions.d.ts","sourceRoot":"","sources":["../../src/manifest/register-permissions.ts"],"names":[],"mappings":"AAkBA,OAAO,EAKL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAC1B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAwE,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAE5I;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACrD,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC;QAC9D,wFAAwF;QACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC1E;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;KACnD,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C,oFAAoF;IACpF,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC;IACpD,gHAAgH;IAChH,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAChE,4DAA4D;IAC5D,MAAM,EAAE,aAAa,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,GAAE,yBAA8B,GAAG,8BAA8B,CAkBtH;AAgCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,yBAA8B,GAAG,IAAI,CAMzF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,yBAA8B,GAAG,iBAAiB,CAEpG"}

package/dist/manifest/register-permissions.js

@@ -0,0 +1,145 @@
+"use strict";
+// =============================================================================
+// Registering the platform's roles and permissions plus an app's (issue #866;
+// grants and open slices: PP-14.15)
+// =============================================================================
+//
+// One function fills core's static registries in the one order every app
+// uses:
+//
+//   1. platform roles          2. roles of registered slices   3. app roles
+//   4. platform permissions    5. permissions of registered slices
+//   6. app permissions         7. app grants
+//
+// "Registered slices" are the sets packages outside the platform add with
+// `registerPermissionSet()` (./permission-sets.ts). Its pure twin builds the
+// same catalog without touching the registries, for a seed that imports its
+// packages. Both read the same batches, so the two can never disagree.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.platformPermissionDeclarations = platformPermissionDeclarations;
+exports.registerPlatformPermissions = registerPlatformPermissions;
+exports.platformPermissionCatalog = platformPermissionCatalog;
+const index_1 = require("../core/index");
+const permission_sets_1 = require("./permission-sets");
+const platform_permissions_1 = require("./platform-permissions");
+/**
+ * The role, permission and grant batches, in registration order.
+ *
+ * @param options - see {@link PlatformPermissionOptions}.
+ * @returns what to register, in order.
+ * @throws Error when `slices` names an unknown slice or leaves out `identity`,
+ *   or a grant names a platform role.
+ *
+ * @example
+ * ```ts
+ * const { roles, permissions } = platformPermissionDeclarations({ slices: ['identity', 'settings'] });
+ * ```
+ *
+ * @stability experimental
+ */
+function platformPermissionDeclarations(options = {}) {
+    const selected = selectedSlices(options.slices);
+    const registered = permission_sets_1.permissionSetRegistry.list().filter((set) => selected.has(set.slice));
+    const grants = options.app?.grants ?? [];
+    refusePlatformRoleGrants(grants);
+    return {
+        roles: [
+            platform_permissions_1.PLATFORM_ROLES,
+            ...registered.flatMap((set) => (set.roles === undefined ? [] : [set.roles])),
+            ...(options.app?.roles ?? []),
+        ],
+        permissions: [
+            ...platform_permissions_1.PLATFORM_PERMISSION_SETS.filter((set) => selected.has(set.slice)).map((set) => set.permissions),
+            ...registered.flatMap((set) => (set.permissions === undefined ? [] : [set.permissions])),
+            ...(options.app?.permissions ?? []),
+        ],
+        grants: grants.length > 0 ? [grants] : [],
+    };
+}
+/** The selected slices, checked: the platform's and the registered ones. */
+function selectedSlices(slices) {
+    const known = new Set([...platform_permissions_1.PLATFORM_PERMISSION_SLICES, ...permission_sets_1.permissionSetRegistry.ids()]);
+    if (slices === undefined)
+        return known;
+    const unknown = slices.filter((slice) => !known.has(slice));
+    if (unknown.length > 0) {
+        throw new Error(`platform permissions: unknown slice(s) ${unknown.map((slice) => JSON.stringify(slice)).join(', ')}; ` +
+            `the slices that declare permissions are ${[...known].join(', ')} ` +
+            '(a package adds its own with registerPermissionSet(), before this call).');
+    }
+    if (!slices.includes('identity')) {
+        throw new Error("platform permissions: `slices` must include 'identity': every app mounts it, and its roles are the platform roles.");
+    }
+    return new Set(slices);
+}
+/** Refuses a grant whose target is a platform role: the platform's role matrix is not an app's to widen. */
+function refusePlatformRoleGrants(grants) {
+    const platformRoles = new Set(Object.values(platform_permissions_1.PLATFORM_ROLES).map((role) => role.id));
+    const refused = grants.filter((grant) => platformRoles.has(grant.role)).map((grant) => grant.role);
+    if (refused.length > 0) {
+        throw new Error(`platform permissions: app grants cannot target the platform role(s) ${[...new Set(refused)].map((role) => JSON.stringify(role)).join(', ')}; ` +
+            'grant permissions to your own roles, or declare an app permission whose defaultGrants name the platform role.');
+    }
+}
+/**
+ * Fills core's `roleRegistry`, `permissionRegistry` and `roleGrantRegistry`:
+ * the platform roles, those of registered slices, the app's roles, the
+ * platform permissions in seed order, those of registered slices, the app's
+ * permissions, then the app's grants. Call it once, at import time, from the
+ * app's permission manifest; the registries are frozen when the application
+ * bootstraps. It also freezes the permission-set registry, so a package that
+ * calls `registerPermissionSet()` too late fails loudly instead of missing the
+ * seed.
+ *
+ * @param options - see {@link PlatformPermissionOptions}.
+ * @throws RegistryError when a declaration is refused (an app id equal to a
+ *   platform id is `DUPLICATE_ID`; a grant to an unknown role `INVALID_ENTRY`),
+ *   naming the id; Error for a bad `slices` list or a grant to a platform role.
+ *
+ * @example
+ * ```ts
+ * registerPlatformPermissions({
+ *   app: {
+ *     roles: [APP_ROLES],
+ *     permissions: [APP_PERMISSIONS],
+ *     grants: [{ role: 'support', permissions: ['users:read'] }],
+ *   },
+ * });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+function registerPlatformPermissions(options = {}) {
+    const { roles, permissions, grants } = platformPermissionDeclarations(options);
+    for (const batch of roles)
+        (0, index_1.registerRoles)(batch);
+    for (const batch of permissions)
+        (0, index_1.registerPermissions)(batch);
+    for (const batch of grants)
+        (0, index_1.grantPermissions)(batch);
+    permission_sets_1.permissionSetRegistry.freeze();
+}
+/**
+ * The seed catalog of the platform's roles and permissions plus the app's,
+ * composed without touching core's registries. Exactly what
+ * `buildPermissionCatalog()` returns after `registerPlatformPermissions()`
+ * with the same options. Pass it to `platformSeedInputFrom()` of
+ * `@marinoscar/platform-db/seed` as `permissions`.
+ *
+ * @param options - see {@link PlatformPermissionOptions}.
+ * @returns the catalog.
+ *
+ * @example
+ * ```ts
+ * const permissions = platformPermissionCatalog({ slices: ['identity', 'settings', 'jobs', 'nodes'], app: { permissions: [NOTES_PERMISSIONS] } });
+ * await seedPlatform(prisma, platformSeedInputFrom({ permissions, settings }, process.env));
+ * ```
+ *
+ * @stability experimental
+ */
+function platformPermissionCatalog(options = {}) {
+    return (0, index_1.composePermissionCatalog)(platformPermissionDeclarations(options));
+}
+//# sourceMappingURL=register-permissions.js.map

package/dist/manifest/register-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-permissions.js","sourceRoot":"","sources":["../../src/manifest/register-permissions.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,8EAA8E;AAC9E,oCAAoC;AACpC,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,QAAQ;AACR,EAAE;AACF,4EAA4E;AAC5E,mEAAmE;AACnE,6CAA6C;AAC7C,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,gFAAgF;;AAmFhF,wEAkBC;AA6DD,kEAMC;AAoBD,8DAEC;AA5LD,yCAUuB;AACvB,uDAA0D;AAC1D,iEAA4I;AAsD5I;;;;;;;;;;;;;;GAcG;AACH,SAAgB,8BAA8B,CAAC,UAAqC,EAAE;IACpF,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,uCAAqB,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC;IACzC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO;QACL,KAAK,EAAE;YACL,qCAAc;YACd,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5E,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC;SAC9B;QACD,WAAW,EAAE;YACX,GAAG,+CAAwB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC;YAClG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,IAAI,EAAE,CAAC;SACpC;QACD,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;KAC1C,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CAAC,MAAsD;IAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,iDAA0B,EAAE,GAAG,uCAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACpG,2CAA2C,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACnE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,oHAAoH,CAAC,CAAC;IACxI,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,4GAA4G;AAC5G,SAAS,wBAAwB,CAAC,MAAuC;IACvE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,qCAAc,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uEAAuE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7I,+GAA+G,CAClH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,2BAA2B,CAAC,UAAqC,EAAE;IACjF,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAC/E,KAAK,MAAM,KAAK,IAAI,KAAK;QAAE,IAAA,qBAAa,EAAC,KAAK,CAAC,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,WAAW;QAAE,IAAA,2BAAmB,EAAC,KAAK,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,IAAA,wBAAgB,EAAC,KAAK,CAAC,CAAC;IACpD,uCAAqB,CAAC,MAAM,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,yBAAyB,CAAC,UAAqC,EAAE;IAC/E,OAAO,IAAA,gCAAwB,EAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/nodes/doctor/nodes-fleet.doctor-check.d.ts

@@ -0,0 +1,31 @@
+import { OnModuleInit } from '@nestjs/common';
+import { DoctorCheck, DoctorCheckOutcome } from '../../doctor/index';
+import { DoctorCheckRegistry } from '../../doctor/index';
+import { NodesAdminService } from '../nodes-admin.service';
+export declare const NODES_SETTINGS_PATH = "/admin/settings/workers";
+/**
+ * Pure: judges the fleet from the admin view, whose `health` is already
+ * `deriveNodeHealth`'s verdict (heartbeat age against the stale window).
+ *
+ * A DISABLED node is left out of the verdict: an operator switched it off, so
+ * its silence is not news. Its count is still reported.
+ */
+export declare function decideNodesFleet(nodes: Array<{
+    name: string;
+    status: string;
+    health: string;
+}>): DoctorCheckOutcome;
+/** `nodes` / `nodes.fleet` — every enrolled worker node is heartbeating. */
+export declare class NodesFleetDoctorCheck implements DoctorCheck, OnModuleInit {
+    private readonly registry;
+    private readonly nodesAdmin;
+    readonly id = "nodes.fleet";
+    readonly category = "nodes";
+    readonly label = "Worker node fleet";
+    readonly settingsPath = "/admin/settings/workers";
+    readonly dependsOn: string[];
+    constructor(registry: DoctorCheckRegistry, nodesAdmin: NodesAdminService);
+    onModuleInit(): void;
+    run(): Promise<DoctorCheckOutcome>;
+}
+//# sourceMappingURL=nodes-fleet.doctor-check.d.ts.map

package/dist/nodes/doctor/nodes-fleet.doctor-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodes-fleet.doctor-check.d.ts","sourceRoot":"","sources":["../../../src/nodes/doctor/nodes-fleet.doctor-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAE7D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,kBAAkB,CA8BnH;AAED,4EAA4E;AAC5E,qBACa,qBAAsB,YAAW,WAAW,EAAE,YAAY;IAQnE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAR7B,QAAQ,CAAC,EAAE,iBAAiB;IAC5B,QAAQ,CAAC,QAAQ,WAAW;IAC5B,QAAQ,CAAC,KAAK,uBAAuB;IACrC,QAAQ,CAAC,YAAY,6BAAuB;IAC5C,QAAQ,CAAC,SAAS,WAAqB;gBAGpB,QAAQ,EAAE,mBAAmB,EAC7B,UAAU,EAAE,iBAAiB;IAGhD,YAAY,IAAI,IAAI;IAId,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAGzC"}

package/dist/nodes/doctor/nodes-fleet.doctor-check.js

@@ -0,0 +1,77 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodesFleetDoctorCheck = exports.NODES_SETTINGS_PATH = void 0;
+exports.decideNodesFleet = decideNodesFleet;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../doctor/index");
+const nodes_admin_service_1 = require("../nodes-admin.service");
+exports.NODES_SETTINGS_PATH = '/admin/settings/workers';
+/**
+ * Pure: judges the fleet from the admin view, whose `health` is already
+ * `deriveNodeHealth`'s verdict (heartbeat age against the stale window).
+ *
+ * A DISABLED node is left out of the verdict: an operator switched it off, so
+ * its silence is not news. Its count is still reported.
+ */
+function decideNodesFleet(nodes) {
+    if (nodes.length === 0) {
+        return { status: 'pass', detail: 'No worker nodes enrolled; this API runs every job itself', data: { nodes: 0 } };
+    }
+    const active = nodes.filter((n) => n.status !== 'disabled');
+    const healthy = active.filter((n) => n.health === 'healthy');
+    const unhealthy = active.filter((n) => n.health !== 'healthy');
+    const data = {
+        nodes: nodes.length,
+        healthy: healthy.length,
+        stale: active.filter((n) => n.health === 'stale').length,
+        offline: active.filter((n) => n.health === 'offline').length,
+        disabled: nodes.length - active.length,
+    };
+    if (unhealthy.length > 0) {
+        const names = unhealthy.slice(0, 5).map((n) => `${n.name} (${n.health})`).join(', ');
+        return {
+            status: 'warn',
+            detail: `${unhealthy.length} of ${active.length} active node(s) not heartbeating: ${names}${unhealthy.length > 5 ? ', …' : ''}`,
+            remedy: `Check the node processes are running and can reach the API (\`appctl node status\` on the node), ` +
+                `or disable or remove them at ${exports.NODES_SETTINGS_PATH}.`,
+            data,
+        };
+    }
+    return { status: 'pass', detail: `${healthy.length} node(s) healthy`, data };
+}
+/** `nodes` / `nodes.fleet` — every enrolled worker node is heartbeating. */
+let NodesFleetDoctorCheck = class NodesFleetDoctorCheck {
+    registry;
+    nodesAdmin;
+    id = 'nodes.fleet';
+    category = 'nodes';
+    label = 'Worker node fleet';
+    settingsPath = exports.NODES_SETTINGS_PATH;
+    dependsOn = ['db.connection'];
+    constructor(registry, nodesAdmin) {
+        this.registry = registry;
+        this.nodesAdmin = nodesAdmin;
+    }
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    async run() {
+        return decideNodesFleet(await this.nodesAdmin.listFleet());
+    }
+};
+exports.NodesFleetDoctorCheck = NodesFleetDoctorCheck;
+exports.NodesFleetDoctorCheck = NodesFleetDoctorCheck = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.DoctorCheckRegistry,
+        nodes_admin_service_1.NodesAdminService])
+], NodesFleetDoctorCheck);
+//# sourceMappingURL=nodes-fleet.doctor-check.js.map

package/dist/nodes/doctor/nodes-fleet.doctor-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodes-fleet.doctor-check.js","sourceRoot":"","sources":["../../../src/nodes/doctor/nodes-fleet.doctor-check.ts"],"names":[],"mappings":";;;;;;;;;;;;AAeA,4CA8BC;AA7CD,2CAA0D;AAG1D,8CAAyD;AACzD,gEAA2D;AAE9C,QAAA,mBAAmB,GAAG,yBAAyB,CAAC;AAE7D;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,KAA8D;IAC7F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0DAA0D,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;IACpH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG;QACX,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM;QACxD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QAC5D,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;KACvC,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAErF,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,OAAO,MAAM,CAAC,MAAM,qCAAqC,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/H,MAAM,EACJ,mGAAmG;gBACnG,gCAAgC,2BAAmB,GAAG;YACxD,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,kBAAkB,EAAE,IAAI,EAAE,CAAC;AAC/E,CAAC;AAED,4EAA4E;AAErE,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAQb;IACA;IARV,EAAE,GAAG,aAAa,CAAC;IACnB,QAAQ,GAAG,OAAO,CAAC;IACnB,KAAK,GAAG,mBAAmB,CAAC;IAC5B,YAAY,GAAG,2BAAmB,CAAC;IACnC,SAAS,GAAG,CAAC,eAAe,CAAC,CAAC;IAEvC,YACmB,QAA6B,EAC7B,UAA6B;QAD7B,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,eAAU,GAAV,UAAU,CAAmB;IAC7C,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG;QACP,OAAO,gBAAgB,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF,CAAA;AAnBY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCASkB,2BAAmB;QACjB,uCAAiB;GATrC,qBAAqB,CAmBjC"}