@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.10

package/dist/nodes/dto/node-control-plane.dto.js

@@ -0,0 +1,72 @@
+"use strict";
+// =============================================================================
+// The node control plane's request bodies (issue #268, epic #254)
+//
+// The wire schemas, and the design notes that used to sit here, live in
+// `@marinoscar/platform-contract/nodes` since #734 (`schemas.ts`, section
+// "From node-control-plane.dto.ts"). This file wraps them with `createZodDto`, which is how
+// they reach the OpenAPI document and the global `ZodValidationPipe`.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeJobFailureDto = exports.NodeJobResultDto = exports.RenewLeaseDto = exports.ClaimJobsDto = exports.HeartbeatNodeDto = exports.RegisterNodeDto = exports.nodeJobFailureSchema = exports.nodeJobResultSchema = exports.renewLeaseSchema = exports.claimJobsSchema = exports.heartbeatNodeSchema = exports.registerNodeSchema = exports.nodeVitalsSchema = exports.nodeVitalsCountersSchema = exports.MAX_NODE_ELIGIBLE_TYPES = exports.MAX_NODE_CONCURRENCY = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const nodes_1 = require("@marinoscar/platform-contract/nodes");
+Object.defineProperty(exports, "MAX_NODE_CONCURRENCY", { enumerable: true, get: function () { return nodes_1.MAX_NODE_CONCURRENCY; } });
+Object.defineProperty(exports, "MAX_NODE_ELIGIBLE_TYPES", { enumerable: true, get: function () { return nodes_1.MAX_NODE_ELIGIBLE_TYPES; } });
+Object.defineProperty(exports, "claimJobsSchema", { enumerable: true, get: function () { return nodes_1.claimJobsSchema; } });
+Object.defineProperty(exports, "heartbeatNodeSchema", { enumerable: true, get: function () { return nodes_1.heartbeatNodeSchema; } });
+Object.defineProperty(exports, "nodeJobFailureSchema", { enumerable: true, get: function () { return nodes_1.nodeJobFailureSchema; } });
+Object.defineProperty(exports, "nodeJobResultSchema", { enumerable: true, get: function () { return nodes_1.nodeJobResultSchema; } });
+Object.defineProperty(exports, "nodeVitalsCountersSchema", { enumerable: true, get: function () { return nodes_1.nodeVitalsCountersSchema; } });
+Object.defineProperty(exports, "nodeVitalsSchema", { enumerable: true, get: function () { return nodes_1.nodeVitalsSchema; } });
+Object.defineProperty(exports, "registerNodeSchema", { enumerable: true, get: function () { return nodes_1.registerNodeSchema; } });
+Object.defineProperty(exports, "renewLeaseSchema", { enumerable: true, get: function () { return nodes_1.renewLeaseSchema; } });
+/**
+ * The register body (`registerNodeSchema`).
+ *
+ * @stability experimental
+ */
+class RegisterNodeDto extends (0, nestjs_zod_1.createZodDto)(nodes_1.registerNodeSchema) {
+}
+exports.RegisterNodeDto = RegisterNodeDto;
+/**
+ * The heartbeat body (`heartbeatNodeSchema`).
+ *
+ * @stability experimental
+ */
+class HeartbeatNodeDto extends (0, nestjs_zod_1.createZodDto)(nodes_1.heartbeatNodeSchema) {
+}
+exports.HeartbeatNodeDto = HeartbeatNodeDto;
+/**
+ * The claim body (`claimJobsSchema`).
+ *
+ * @stability experimental
+ */
+class ClaimJobsDto extends (0, nestjs_zod_1.createZodDto)(nodes_1.claimJobsSchema) {
+}
+exports.ClaimJobsDto = ClaimJobsDto;
+/**
+ * The renew body (`renewLeaseSchema`).
+ *
+ * @stability experimental
+ */
+class RenewLeaseDto extends (0, nestjs_zod_1.createZodDto)(nodes_1.renewLeaseSchema) {
+}
+exports.RenewLeaseDto = RenewLeaseDto;
+/**
+ * The result body (`nodeJobResultSchema`).
+ *
+ * @stability experimental
+ */
+class NodeJobResultDto extends (0, nestjs_zod_1.createZodDto)(nodes_1.nodeJobResultSchema) {
+}
+exports.NodeJobResultDto = NodeJobResultDto;
+/**
+ * The failure body (`nodeJobFailureSchema`).
+ *
+ * @stability experimental
+ */
+class NodeJobFailureDto extends (0, nestjs_zod_1.createZodDto)(nodes_1.nodeJobFailureSchema) {
+}
+exports.NodeJobFailureDto = NodeJobFailureDto;
+//# sourceMappingURL=node-control-plane.dto.js.map

package/dist/nodes/dto/node-control-plane.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-control-plane.dto.js","sourceRoot":"","sources":["../../../src/nodes/dto/node-control-plane.dto.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,kEAAkE;AAClE,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,4FAA4F;AAC5F,sEAAsE;AACtE,gFAAgF;;;AAEhF,2CAA0C;AAC1C,+DAW6C;AAS3C,qGAnBA,4BAAoB,OAmBA;AACpB,wGAnBA,+BAAuB,OAmBA;AAKvB,gGAvBA,uBAAe,OAuBA;AADf,oGArBA,2BAAmB,OAqBA;AAInB,qGAxBA,4BAAoB,OAwBA;AADpB,oGAtBA,2BAAmB,OAsBA;AANnB,yGAfA,gCAAwB,OAeA;AACxB,iGAfA,wBAAgB,OAeA;AAChB,mGAfA,0BAAkB,OAeA;AAGlB,iGAjBA,wBAAgB,OAiBA;AASlB;;;;GAIG;AACH,MAAa,eAAgB,SAAQ,IAAA,yBAAY,EAAC,0BAAkB,CAAC;CAAG;AAAxE,0CAAwE;AACxE;;;;GAIG;AACH,MAAa,gBAAiB,SAAQ,IAAA,yBAAY,EAAC,2BAAmB,CAAC;CAAG;AAA1E,4CAA0E;AAC1E;;;;GAIG;AACH,MAAa,YAAa,SAAQ,IAAA,yBAAY,EAAC,uBAAe,CAAC;CAAG;AAAlE,oCAAkE;AAClE;;;;GAIG;AACH,MAAa,aAAc,SAAQ,IAAA,yBAAY,EAAC,wBAAgB,CAAC;CAAG;AAApE,sCAAoE;AACpE;;;;GAIG;AACH,MAAa,gBAAiB,SAAQ,IAAA,yBAAY,EAAC,2BAAmB,CAAC;CAAG;AAA1E,4CAA0E;AAC1E;;;;GAIG;AACH,MAAa,iBAAkB,SAAQ,IAAA,yBAAY,EAAC,4BAAoB,CAAC;CAAG;AAA5E,8CAA4E"}

package/dist/nodes/dto/node-credential-response.dto.d.ts

@@ -0,0 +1,61 @@
+import type { NodeCredentialCreated, NodeCredentialListItem } from '@marinoscar/platform-contract/nodes';
+/**
+ * The response to `POST /api/node-credentials` — THE ONLY PLACE `token` EVER
+ * APPEARS.
+ *
+ * There is deliberately no second DTO carrying `token`, and
+ * {@link NodeCredentialListItemDto} below does not have the field at all
+ * rather than having it typed `string | null`. That is the point: an
+ * accidental "just include the token in the list too" cannot be written
+ * without adding a property to a class whose absence is documented here, so
+ * the show-once contract is enforced by the type rather than by everyone
+ * remembering it. The row itself only ever stores a sha256 hash, so even a
+ * mistake at this layer could not surface the real value — but a DTO that
+ * cannot express it is the cheaper of the two guarantees.
+ *
+ * @stability experimental
+ */
+export declare class NodeCredentialCreatedResponseDto implements NodeCredentialCreated {
+    /** The raw `nod_…` token. */
+    token: string;
+    /** Credential ID (UUID) */
+    id: string;
+    /** Operator-chosen label for this credential */
+    name: string;
+    /** Non-secret display prefix (e.g. */
+    tokenPrefix: string;
+    /** ISO 8601 expiry timestamp, or `null` when this credential never expires (the default). */
+    expiresAt: string | null;
+    /** ISO 8601 creation timestamp */
+    createdAt: string;
+}
+/**
+ * One credential as it appears in `GET /api/node-credentials`.
+ *
+ * Note what is NOT here: `token` (see above) and `tokenHash`. The hash is
+ * omitted not because it is directly usable — it is not, a node authenticates
+ * with the preimage — but because publishing it hands an attacker an offline
+ * verification oracle: a stolen list would let them confirm a guessed token
+ * without ever touching this API, invisibly to any rate limit or audit trail
+ * here. The service's `select` is the enforcement point; this DTO is the
+ * documentation of it.
+ *
+ * @stability experimental
+ */
+export declare class NodeCredentialListItemDto implements NodeCredentialListItem {
+    /** Credential ID (UUID) */
+    id: string;
+    /** Operator-chosen label for this credential */
+    name: string;
+    /** Non-secret display prefix (e.g. */
+    tokenPrefix: string;
+    /** ISO 8601 expiry timestamp, or `null` when this credential never expires */
+    expiresAt: string | null;
+    /** ISO 8601 timestamp of the last successful authentication, or `null` if never used. */
+    lastUsedAt: string | null;
+    /** ISO 8601 creation timestamp */
+    createdAt: string;
+    /** ISO 8601 revocation timestamp, or `null` while the credential is active */
+    revokedAt: string | null;
+}
+//# sourceMappingURL=node-credential-response.dto.d.ts.map

package/dist/nodes/dto/node-credential-response.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-credential-response.dto.d.ts","sourceRoot":"","sources":["../../../src/nodes/dto/node-credential-response.dto.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,qCAAqC,CAAC;AAK7C;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,gCAAiC,YAAW,qBAAqB;IAC5E,6BAA6B;IAQ7B,KAAK,EAAG,MAAM,CAAC;IAEf,2BAA2B;IAE3B,EAAE,EAAG,MAAM,CAAC;IAEZ,gDAAgD;IAEhD,IAAI,EAAG,MAAM,CAAC;IAEd,sCAAsC;IAItC,WAAW,EAAG,MAAM,CAAC;IAErB,6FAA6F;IAQ7F,SAAS,EAAG,MAAM,GAAG,IAAI,CAAC;IAE1B,kCAAkC;IAElC,SAAS,EAAG,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,yBAA0B,YAAW,sBAAsB;IACtE,2BAA2B;IAE3B,EAAE,EAAG,MAAM,CAAC;IAEZ,gDAAgD;IAEhD,IAAI,EAAG,MAAM,CAAC;IAEd,sCAAsC;IAEtC,WAAW,EAAG,MAAM,CAAC;IAErB,8EAA8E;IAK9E,SAAS,EAAG,MAAM,GAAG,IAAI,CAAC;IAE1B,yFAAyF;IAQzF,UAAU,EAAG,MAAM,GAAG,IAAI,CAAC;IAE3B,kCAAkC;IAElC,SAAS,EAAG,MAAM,CAAC;IAEnB,8EAA8E;IAK9E,SAAS,EAAG,MAAM,GAAG,IAAI,CAAC;CAC3B"}

package/dist/nodes/dto/node-credential-response.dto.js

@@ -0,0 +1,152 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeCredentialListItemDto = exports.NodeCredentialCreatedResponseDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+// Both classes `implements` their contract type (`admin-schemas.ts`); see
+// `node-admin.dto.ts` for why the Swagger classes stay.
+/**
+ * The response to `POST /api/node-credentials` — THE ONLY PLACE `token` EVER
+ * APPEARS.
+ *
+ * There is deliberately no second DTO carrying `token`, and
+ * {@link NodeCredentialListItemDto} below does not have the field at all
+ * rather than having it typed `string | null`. That is the point: an
+ * accidental "just include the token in the list too" cannot be written
+ * without adding a property to a class whose absence is documented here, so
+ * the show-once contract is enforced by the type rather than by everyone
+ * remembering it. The row itself only ever stores a sha256 hash, so even a
+ * mistake at this layer could not surface the real value — but a DTO that
+ * cannot express it is the cheaper of the two guarantees.
+ *
+ * @stability experimental
+ */
+class NodeCredentialCreatedResponseDto {
+    /** The raw `nod_…` token. */
+    token;
+    /** Credential ID (UUID) */
+    id;
+    /** Operator-chosen label for this credential */
+    name;
+    /** Non-secret display prefix (e.g. */
+    tokenPrefix;
+    /** ISO 8601 expiry timestamp, or `null` when this credential never expires (the default). */
+    expiresAt;
+    /** ISO 8601 creation timestamp */
+    createdAt;
+}
+exports.NodeCredentialCreatedResponseDto = NodeCredentialCreatedResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'The raw `nod_…` token. Shown EXACTLY ONCE, in this response only — the ' +
+            'server stores a hash and can never display it again. Store it in the ' +
+            "node's configuration now; a lost token is replaced by revoking this " +
+            'credential and creating another.',
+    }),
+    __metadata("design:type", String)
+], NodeCredentialCreatedResponseDto.prototype, "token", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Credential ID (UUID)' }),
+    __metadata("design:type", String)
+], NodeCredentialCreatedResponseDto.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Operator-chosen label for this credential' }),
+    __metadata("design:type", String)
+], NodeCredentialCreatedResponseDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Non-secret display prefix (e.g. `nod_1a2b`) for telling credentials apart',
+    }),
+    __metadata("design:type", String)
+], NodeCredentialCreatedResponseDto.prototype, "tokenPrefix", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'ISO 8601 expiry timestamp, or `null` when this credential never expires ' +
+            '(the default). `null` is a supported, expected value here — a worker node ' +
+            'runs unattended, and revocation rather than a clock is the intended control.',
+        nullable: true,
+    }),
+    __metadata("design:type", Object)
+], NodeCredentialCreatedResponseDto.prototype, "expiresAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'ISO 8601 creation timestamp' }),
+    __metadata("design:type", String)
+], NodeCredentialCreatedResponseDto.prototype, "createdAt", void 0);
+/**
+ * One credential as it appears in `GET /api/node-credentials`.
+ *
+ * Note what is NOT here: `token` (see above) and `tokenHash`. The hash is
+ * omitted not because it is directly usable — it is not, a node authenticates
+ * with the preimage — but because publishing it hands an attacker an offline
+ * verification oracle: a stolen list would let them confirm a guessed token
+ * without ever touching this API, invisibly to any rate limit or audit trail
+ * here. The service's `select` is the enforcement point; this DTO is the
+ * documentation of it.
+ *
+ * @stability experimental
+ */
+class NodeCredentialListItemDto {
+    /** Credential ID (UUID) */
+    id;
+    /** Operator-chosen label for this credential */
+    name;
+    /** Non-secret display prefix (e.g. */
+    tokenPrefix;
+    /** ISO 8601 expiry timestamp, or `null` when this credential never expires */
+    expiresAt;
+    /** ISO 8601 timestamp of the last successful authentication, or `null` if never used. */
+    lastUsedAt;
+    /** ISO 8601 creation timestamp */
+    createdAt;
+    /** ISO 8601 revocation timestamp, or `null` while the credential is active */
+    revokedAt;
+}
+exports.NodeCredentialListItemDto = NodeCredentialListItemDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Credential ID (UUID)' }),
+    __metadata("design:type", String)
+], NodeCredentialListItemDto.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Operator-chosen label for this credential' }),
+    __metadata("design:type", String)
+], NodeCredentialListItemDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Non-secret display prefix (e.g. `nod_1a2b`)' }),
+    __metadata("design:type", String)
+], NodeCredentialListItemDto.prototype, "tokenPrefix", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'ISO 8601 expiry timestamp, or `null` when this credential never expires',
+        nullable: true,
+    }),
+    __metadata("design:type", Object)
+], NodeCredentialListItemDto.prototype, "expiresAt", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'ISO 8601 timestamp of the last successful authentication, or `null` if never ' +
+            'used. This is the operator-facing answer to "is this node still alive, or is ' +
+            'this credential safe to revoke".',
+        nullable: true,
+    }),
+    __metadata("design:type", Object)
+], NodeCredentialListItemDto.prototype, "lastUsedAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'ISO 8601 creation timestamp' }),
+    __metadata("design:type", String)
+], NodeCredentialListItemDto.prototype, "createdAt", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'ISO 8601 revocation timestamp, or `null` while the credential is active',
+        nullable: true,
+    }),
+    __metadata("design:type", Object)
+], NodeCredentialListItemDto.prototype, "revokedAt", void 0);
+//# sourceMappingURL=node-credential-response.dto.js.map

package/dist/nodes/dto/node-credential-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-credential-response.dto.js","sourceRoot":"","sources":["../../../src/nodes/dto/node-credential-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AAMnE,0EAA0E;AAC1E,wDAAwD;AAExD;;;;;;;;;;;;;;;GAeG;AACH,MAAa,gCAAgC;IAC3C,6BAA6B;IAQ7B,KAAK,CAAU;IAEf,2BAA2B;IAE3B,EAAE,CAAU;IAEZ,gDAAgD;IAEhD,IAAI,CAAU;IAEd,sCAAsC;IAItC,WAAW,CAAU;IAErB,6FAA6F;IAQ7F,SAAS,CAAiB;IAE1B,kCAAkC;IAElC,SAAS,CAAU;CACpB;AAtCD,4EAsCC;AA7BC;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,kCAAkC;KACrC,CAAC;;+DACa;AAIf;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;;4DACzC;AAIZ;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;8DAC5D;AAMd;IAHC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,2EAA2E;KACzF,CAAC;;qEACmB;AAUrB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,0EAA0E;YAC1E,4EAA4E;YAC5E,8EAA8E;QAChF,QAAQ,EAAE,IAAI;KACf,CAAC;;mEACwB;AAI1B;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;mEACzC;AAGrB;;;;;;;;;;;;GAYG;AACH,MAAa,yBAAyB;IACpC,2BAA2B;IAE3B,EAAE,CAAU;IAEZ,gDAAgD;IAEhD,IAAI,CAAU;IAEd,sCAAsC;IAEtC,WAAW,CAAU;IAErB,8EAA8E;IAK9E,SAAS,CAAiB;IAE1B,yFAAyF;IAQzF,UAAU,CAAiB;IAE3B,kCAAkC;IAElC,SAAS,CAAU;IAEnB,8EAA8E;IAK9E,SAAS,CAAiB;CAC3B;AAxCD,8DAwCC;AArCC;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;;qDACzC;AAIZ;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;uDAC5D;AAId;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;;8DACvD;AAOrB;IAJC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,yEAAyE;QACtF,QAAQ,EAAE,IAAI;KACf,CAAC;;4DACwB;AAU1B;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,+EAA+E;YAC/E,+EAA+E;YAC/E,kCAAkC;QACpC,QAAQ,EAAE,IAAI;KACf,CAAC;;6DACyB;AAI3B;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;4DACzC;AAOnB;IAJC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,yEAAyE;QACtF,QAAQ,EAAE,IAAI;KACf,CAAC;;4DACwB"}

package/dist/nodes/dto/node-data-plane.dto.d.ts

@@ -0,0 +1,80 @@
+import { nodeDownloadUrlSchema, nodeUploadUrlSchema } from '@marinoscar/platform-contract/nodes';
+export { nodeDownloadUrlSchema, nodeUploadUrlSchema, };
+declare const NodeDownloadUrlDto_base: import("nestjs-zod").ZodDto<import("zod").ZodDefault<import("zod").ZodObject<{
+    claimToken: import("zod").ZodOptional<import("zod").ZodUUID>;
+}, import("zod/v4/core").$strip>>, false>;
+/**
+ * The download-url body (`nodeDownloadUrlSchema`).
+ *
+ * @stability experimental
+ */
+export declare class NodeDownloadUrlDto extends NodeDownloadUrlDto_base {
+}
+declare const NodeUploadUrlDto_base: import("nestjs-zod").ZodDto<import("zod").ZodDefault<import("zod").ZodObject<{
+    contentType: import("zod").ZodOptional<import("zod").ZodString>;
+    claimToken: import("zod").ZodOptional<import("zod").ZodUUID>;
+}, import("zod/v4/core").$loose>>, false>;
+/**
+ * The upload-url body (`nodeUploadUrlSchema`).
+ *
+ * @stability experimental
+ */
+export declare class NodeUploadUrlDto extends NodeUploadUrlDto_base {
+}
+/**
+ * The response to `POST /nodes/:id/jobs/:jobId/download-url`.
+ *
+ * @stability experimental
+ */
+export declare class NodeDownloadUrlResponseDto {
+    /** A short-lived signed GET for this job’s input object. */
+    url: string;
+    /** Seconds until the URL stops working. */
+    expiresIn: number;
+    /** ISO 8601 timestamp the URL stops working — `expiresIn` as an absolute time. */
+    expiresAt: string;
+    /** The storage object this job names as its input, for correlation in the node’s own logs. */
+    objectId: string;
+    /** The object’s recorded size in bytes, as a decimal STRING (the column is a 64-bit integer and JSON has no such number). */
+    size: string;
+    /** The object’s recorded MIME type, for a node that decodes rather than streams. */
+    mimeType: string;
+}
+/**
+ * The response to `POST /nodes/:id/jobs/:jobId/upload-url`.
+ *
+ * @stability experimental
+ */
+export declare class NodeUploadUrlResponseDto {
+    /** A short-lived signed PUT accepting ONE request carrying the whole body. */
+    url: string;
+    /** The storage key the server chose for this output. */
+    key: string;
+    /** Seconds until the URL stops working. */
+    expiresIn: number;
+    /** ISO 8601 timestamp the URL stops working. */
+    expiresAt: string;
+}
+/**
+ * One node-eligible job type, with the contract its results must satisfy.
+ *
+ * @stability experimental
+ */
+export declare class NodeJobTypeDto {
+    /** The `Job.type` key — what a node registers and claims. */
+    type: string;
+    /** Display label for the type, falling back to the raw key when none is mapped. */
+    label: string;
+    /** JSON Schema (2020-12) for the `result` this type’s submissions must carry, generated from the server’s own Zod schema — so a client validates against the definition this server will actually... */
+    resultSchema: Record<string, unknown> | null;
+}
+/**
+ * The response to `GET /nodes/job-types`.
+ *
+ * @stability experimental
+ */
+export declare class NodeJobTypesResponseDto {
+    /** Every job type this server could accept a node-computed result for — derived from the handler registry, so a fork’s own types appear here with no list to edit. */
+    types: NodeJobTypeDto[];
+}
+//# sourceMappingURL=node-data-plane.dto.d.ts.map

package/dist/nodes/dto/node-data-plane.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-data-plane.dto.d.ts","sourceRoot":"","sources":["../../../src/nodes/dto/node-data-plane.dto.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,CAAC;;;;AAEF;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,uBAAmC;CAAG;;;;;AAC9E;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,qBAAiC;CAAG;AAM1E;;;;GAIG;AACH,qBAAa,0BAA0B;IACrC,4DAA4D;IAQ5D,GAAG,EAAG,MAAM,CAAC;IAEb,2CAA2C;IAM3C,SAAS,EAAG,MAAM,CAAC;IAEnB,kFAAkF;IAIlF,SAAS,EAAG,MAAM,CAAC;IAEnB,8FAA8F;IAK9F,QAAQ,EAAG,MAAM,CAAC;IAElB,6HAA6H;IAQ7H,IAAI,EAAG,MAAM,CAAC;IAEd,oFAAoF;IAIpF,QAAQ,EAAG,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,qBAAa,wBAAwB;IACnC,8EAA8E;IAO9E,GAAG,EAAG,MAAM,CAAC;IAEb,wDAAwD;IAOxD,GAAG,EAAG,MAAM,CAAC;IAEb,2CAA2C;IAE3C,SAAS,EAAG,MAAM,CAAC;IAEnB,gDAAgD;IAEhD,SAAS,EAAG,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,qBAAa,cAAc;IACzB,6DAA6D;IAE7D,IAAI,EAAG,MAAM,CAAC;IAEd,mFAAmF;IAKnF,KAAK,EAAG,MAAM,CAAC;IAEf,wMAAwM;IAUxM,YAAY,EAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC/C;AAED;;;;GAIG;AACH,qBAAa,uBAAuB;IAClC,sKAAsK;IAQtK,KAAK,EAAG,cAAc,EAAE,CAAC;CAC1B"}

package/dist/nodes/dto/node-data-plane.dto.js

@@ -0,0 +1,202 @@
+"use strict";
+// =============================================================================
+// The data plane's request and response bodies (issue #269, epic #254)
+//
+// The wire schemas, and the design notes that used to sit here, live in
+// `@marinoscar/platform-contract/nodes` since #734 (`schemas.ts`, section
+// "From node-data-plane.dto.ts"). This file wraps them with `createZodDto`, which is how
+// they reach the OpenAPI document and the global `ZodValidationPipe`.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeJobTypesResponseDto = exports.NodeJobTypeDto = exports.NodeUploadUrlResponseDto = exports.NodeDownloadUrlResponseDto = exports.NodeUploadUrlDto = exports.NodeDownloadUrlDto = exports.nodeUploadUrlSchema = exports.nodeDownloadUrlSchema = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const nestjs_zod_1 = require("nestjs-zod");
+const nodes_1 = require("@marinoscar/platform-contract/nodes");
+Object.defineProperty(exports, "nodeDownloadUrlSchema", { enumerable: true, get: function () { return nodes_1.nodeDownloadUrlSchema; } });
+Object.defineProperty(exports, "nodeUploadUrlSchema", { enumerable: true, get: function () { return nodes_1.nodeUploadUrlSchema; } });
+/**
+ * The download-url body (`nodeDownloadUrlSchema`).
+ *
+ * @stability experimental
+ */
+class NodeDownloadUrlDto extends (0, nestjs_zod_1.createZodDto)(nodes_1.nodeDownloadUrlSchema) {
+}
+exports.NodeDownloadUrlDto = NodeDownloadUrlDto;
+/**
+ * The upload-url body (`nodeUploadUrlSchema`).
+ *
+ * @stability experimental
+ */
+class NodeUploadUrlDto extends (0, nestjs_zod_1.createZodDto)(nodes_1.nodeUploadUrlSchema) {
+}
+exports.NodeUploadUrlDto = NodeUploadUrlDto;
+// =============================================================================
+// Responses
+// =============================================================================
+/**
+ * The response to `POST /nodes/:id/jobs/:jobId/download-url`.
+ *
+ * @stability experimental
+ */
+class NodeDownloadUrlResponseDto {
+    /** A short-lived signed GET for this job’s input object. */
+    url;
+    /** Seconds until the URL stops working. */
+    expiresIn;
+    /** ISO 8601 timestamp the URL stops working — `expiresIn` as an absolute time. */
+    expiresAt;
+    /** The storage object this job names as its input, for correlation in the node’s own logs. */
+    objectId;
+    /** The object’s recorded size in bytes, as a decimal STRING (the column is a 64-bit integer and JSON has no such number). */
+    size;
+    /** The object’s recorded MIME type, for a node that decodes rather than streams. */
+    mimeType;
+}
+exports.NodeDownloadUrlResponseDto = NodeDownloadUrlResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'A short-lived signed GET for this job’s input object. Fetch it DIRECTLY from the ' +
+            'storage provider — the bytes never pass through this API. Treat it as a secret: it ' +
+            'is a bearer capability for that one object until it expires, so do not log it, do ' +
+            'not write it to disk, and do not pass it to another process.',
+    }),
+    __metadata("design:type", String)
+], NodeDownloadUrlResponseDto.prototype, "url", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Seconds until the URL stops working. Bounded by the server and not negotiable; ask ' +
+            'again if a transfer needs longer, which is cheap while the lease is live.',
+    }),
+    __metadata("design:type", Number)
+], NodeDownloadUrlResponseDto.prototype, "expiresIn", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'ISO 8601 timestamp the URL stops working — `expiresIn` as an absolute time.',
+    }),
+    __metadata("design:type", String)
+], NodeDownloadUrlResponseDto.prototype, "expiresAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'The storage object this job names as its input, for correlation in the node’s own logs.',
+    }),
+    __metadata("design:type", String)
+], NodeDownloadUrlResponseDto.prototype, "objectId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'The object’s recorded size in bytes, as a decimal STRING (the column is a 64-bit ' +
+            'integer and JSON has no such number). `"0"` means the size was never recorded — a ' +
+            'simple upload leaves it 0 until post-processing — so it is a progress hint, never a ' +
+            'contract the node should verify against.',
+    }),
+    __metadata("design:type", String)
+], NodeDownloadUrlResponseDto.prototype, "size", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'The object’s recorded MIME type, for a node that decodes rather than streams.',
+    }),
+    __metadata("design:type", String)
+], NodeDownloadUrlResponseDto.prototype, "mimeType", void 0);
+/**
+ * The response to `POST /nodes/:id/jobs/:jobId/upload-url`.
+ *
+ * @stability experimental
+ */
+class NodeUploadUrlResponseDto {
+    /** A short-lived signed PUT accepting ONE request carrying the whole body. */
+    url;
+    /** The storage key the server chose for this output. */
+    key;
+    /** Seconds until the URL stops working. */
+    expiresIn;
+    /** ISO 8601 timestamp the URL stops working. */
+    expiresAt;
+}
+exports.NodeUploadUrlResponseDto = NodeUploadUrlResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'A short-lived signed PUT accepting ONE request carrying the whole body. Upload ' +
+            'DIRECTLY to the storage provider. If `contentType` was supplied, send exactly that ' +
+            '`Content-Type` header or the signature will not match. Treat the URL as a secret.',
+    }),
+    __metadata("design:type", String)
+], NodeUploadUrlResponseDto.prototype, "url", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'The storage key the server chose for this output. Report it back in the job’s result ' +
+            'if the handler needs to record where the bytes went — a node cannot choose this, and ' +
+            'sending a `key` in the request is refused with `400`.',
+    }),
+    __metadata("design:type", String)
+], NodeUploadUrlResponseDto.prototype, "key", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Seconds until the URL stops working.' }),
+    __metadata("design:type", Number)
+], NodeUploadUrlResponseDto.prototype, "expiresIn", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'ISO 8601 timestamp the URL stops working.' }),
+    __metadata("design:type", String)
+], NodeUploadUrlResponseDto.prototype, "expiresAt", void 0);
+/**
+ * One node-eligible job type, with the contract its results must satisfy.
+ *
+ * @stability experimental
+ */
+class NodeJobTypeDto {
+    /** The `Job.type` key — what a node registers and claims. */
+    type;
+    /** Display label for the type, falling back to the raw key when none is mapped. */
+    label;
+    /** JSON Schema (2020-12) for the `result` this type’s submissions must carry, generated from the server’s own Zod schema — so a client validates against the definition this server will actually... */
+    resultSchema;
+}
+exports.NodeJobTypeDto = NodeJobTypeDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'The `Job.type` key — what a node registers and claims.' }),
+    __metadata("design:type", String)
+], NodeJobTypeDto.prototype, "type", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Display label for the type, falling back to the raw key when none is mapped.',
+    }),
+    __metadata("design:type", String)
+], NodeJobTypeDto.prototype, "label", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'JSON Schema (2020-12) for the `result` this type’s submissions must carry, generated ' +
+            'from the server’s own Zod schema — so a client validates against the definition this ' +
+            'server will actually enforce, not a copy. `null` on the rare type whose schema has no ' +
+            'JSON Schema representation; validate server-side by submitting in that case.',
+        nullable: true,
+        type: Object,
+    }),
+    __metadata("design:type", Object)
+], NodeJobTypeDto.prototype, "resultSchema", void 0);
+/**
+ * The response to `GET /nodes/job-types`.
+ *
+ * @stability experimental
+ */
+class NodeJobTypesResponseDto {
+    /** Every job type this server could accept a node-computed result for — derived from the handler registry, so a fork’s own types appear here with no list to edit. */
+    types;
+}
+exports.NodeJobTypesResponseDto = NodeJobTypesResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Every job type this server could accept a node-computed result for — derived from the ' +
+            'handler registry, so a fork’s own types appear here with no list to edit. A type ' +
+            'absent from this list can never be claimed by a node, whatever the node registered.',
+        type: [NodeJobTypeDto],
+    }),
+    __metadata("design:type", Array)
+], NodeJobTypesResponseDto.prototype, "types", void 0);
+//# sourceMappingURL=node-data-plane.dto.js.map

package/dist/nodes/dto/node-data-plane.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-data-plane.dto.js","sourceRoot":"","sources":["../../../src/nodes/dto/node-data-plane.dto.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,uEAAuE;AACvE,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,yFAAyF;AACzF,sEAAsE;AACtE,gFAAgF;;;;;;;;;;;;AAEhF,6CAAmE;AACnE,2CAA0C;AAC1C,+DAG6C;AAK3C,sGAPA,6BAAqB,OAOA;AACrB,oGAPA,2BAAmB,OAOA;AAGrB;;;;GAIG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yBAAY,EAAC,6BAAqB,CAAC;CAAG;AAA9E,gDAA8E;AAC9E;;;;GAIG;AACH,MAAa,gBAAiB,SAAQ,IAAA,yBAAY,EAAC,2BAAmB,CAAC;CAAG;AAA1E,4CAA0E;AAE1E,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;;GAIG;AACH,MAAa,0BAA0B;IACrC,4DAA4D;IAQ5D,GAAG,CAAU;IAEb,2CAA2C;IAM3C,SAAS,CAAU;IAEnB,kFAAkF;IAIlF,SAAS,CAAU;IAEnB,8FAA8F;IAK9F,QAAQ,CAAU;IAElB,6HAA6H;IAQ7H,IAAI,CAAU;IAEd,oFAAoF;IAIpF,QAAQ,CAAU;CACnB;AA/CD,gEA+CC;AAtCC;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,mFAAmF;YACnF,qFAAqF;YACrF,oFAAoF;YACpF,8DAA8D;KACjE,CAAC;;uDACW;AAQb;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,qFAAqF;YACrF,2EAA2E;KAC9E,CAAC;;6DACiB;AAMnB;IAHC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,6EAA6E;KAC3F,CAAC;;6DACiB;AAOnB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,yFAAyF;KAC5F,CAAC;;4DACgB;AAUlB;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,mFAAmF;YACnF,oFAAoF;YACpF,sFAAsF;YACtF,0CAA0C;KAC7C,CAAC;;wDACY;AAMd;IAHC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,+EAA+E;KAC7F,CAAC;;4DACgB;AAGpB;;;;GAIG;AACH,MAAa,wBAAwB;IACnC,8EAA8E;IAO9E,GAAG,CAAU;IAEb,wDAAwD;IAOxD,GAAG,CAAU;IAEb,2CAA2C;IAE3C,SAAS,CAAU;IAEnB,gDAAgD;IAEhD,SAAS,CAAU;CACpB;AA1BD,4DA0BC;AAlBC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,iFAAiF;YACjF,qFAAqF;YACrF,mFAAmF;KACtF,CAAC;;qDACW;AASb;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,uFAAuF;YACvF,uFAAuF;YACvF,uDAAuD;KAC1D,CAAC;;qDACW;AAIb;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;;2DAClD;AAInB;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;2DACvD;AAGrB;;;;GAIG;AACH,MAAa,cAAc;IACzB,6DAA6D;IAE7D,IAAI,CAAU;IAEd,mFAAmF;IAKnF,KAAK,CAAU;IAEf,wMAAwM;IAUxM,YAAY,CAAkC;CAC/C;AAvBD,wCAuBC;AApBC;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,wDAAwD,EAAE,CAAC;;4CACzE;AAOd;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,8EAA8E;KACjF,CAAC;;6CACa;AAYf;IATC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,uFAAuF;YACvF,uFAAuF;YACvF,wFAAwF;YACxF,8EAA8E;QAChF,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,MAAM;KACb,CAAC;;oDAC4C;AAGhD;;;;GAIG;AACH,MAAa,uBAAuB;IAClC,sKAAsK;IAQtK,KAAK,CAAoB;CAC1B;AAVD,0DAUC;AADC;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,wFAAwF;YACxF,mFAAmF;YACnF,qFAAqF;QACvF,IAAI,EAAE,CAAC,cAAc,CAAC;KACvB,CAAC;;sDACuB"}

package/dist/nodes/dto/node-job-secret.dto.d.ts

@@ -0,0 +1,26 @@
+import { nodeJobSecretRequestSchema } from '@marinoscar/platform-contract/nodes';
+export { nodeJobSecretRequestSchema, };
+declare const NodeJobSecretRequestDto_base: import("nestjs-zod").ZodDto<import("zod").ZodDefault<import("zod").ZodObject<{
+    claimToken: import("zod").ZodOptional<import("zod").ZodUUID>;
+}, import("zod/v4/core").$loose>>, false>;
+/**
+ * The per-job secret body (`nodeJobSecretRequestSchema`).
+ *
+ * @stability experimental
+ */
+export declare class NodeJobSecretRequestDto extends NodeJobSecretRequestDto_base {
+}
+/**
+ * The response to `POST /nodes/:id/jobs/:jobId/secret`.
+ *
+ * @stability experimental
+ */
+export declare class NodeJobSecretResponseDto {
+    /** What KIND of credential this is — the broker’s own key, e.g. */
+    kind: string;
+    /** ISO 8601 timestamp the credential stops working. */
+    expiresAt: string;
+    /** The credential itself. */
+    material: Record<string, unknown>;
+}
+//# sourceMappingURL=node-job-secret.dto.d.ts.map

package/dist/nodes/dto/node-job-secret.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-job-secret.dto.d.ts","sourceRoot":"","sources":["../../../src/nodes/dto/node-job-secret.dto.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,0BAA0B,EAC3B,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EACL,0BAA0B,GAC3B,CAAC;;;;AAEF;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,4BAAwC;CAAG;AAExF;;;;GAIG;AACH,qBAAa,wBAAwB;IACnC,mEAAmE;IAOnE,IAAI,EAAG,MAAM,CAAC;IAEd,uDAAuD;IAOvD,SAAS,EAAG,MAAM,CAAC;IAEnB,6BAA6B;IAW7B,QAAQ,EAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC"}