@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/core/openapi/api-data-response.decorator.js

@@ -0,0 +1,133 @@
+"use strict";
+// =============================================================================
+// `@ApiDataResponse` (moved into `@marinoscar/platform-api/core` by #727 so
+// packaged controllers document the `{ data: … }` envelope the same way the
+// app's do). Unchanged; the app re-exports it from
+// apps/api/src/common/decorators/api-data-response.decorator.ts.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiDataResponse = ApiDataResponse;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const ITEMS = (model) => ({
+    type: 'array',
+    items: { $ref: (0, swagger_1.getSchemaPath)(model) },
+});
+const FLAT_COUNTS = {
+    total: { type: 'integer', description: 'Total matching rows across all pages.', example: 42 },
+    page: { type: 'integer', description: 'One-based page number.', example: 1 },
+    pageSize: { type: 'integer', example: 20 },
+    totalPages: { type: 'integer', example: 3 },
+};
+const NESTED_META_SCHEMA = {
+    type: 'object',
+    description: 'Pagination counts. Note this is nested inside `data` and is a different object from the ' +
+        'envelope\'s own `meta`, which carries the server timestamp. Note also that the total is ' +
+        'named `totalItems` here, where a flat list names it `total`.',
+    required: ['page', 'pageSize', 'totalItems', 'totalPages'],
+    properties: {
+        page: { type: 'integer', description: 'One-based page number.', example: 1 },
+        pageSize: { type: 'integer', example: 20 },
+        totalItems: { type: 'integer', example: 42 },
+        totalPages: { type: 'integer', example: 3 },
+    },
+};
+/**
+ * Documents a response that wraps its payload in the `{ data: … }` envelope the
+ * global `TransformInterceptor` produces.
+ *
+ * Exists because the two were routinely out of sync: a handler returning
+ * `{ data: { … } }` documented with `@ApiResponse({ type: Dto })` advertises the
+ * bare inner object, so a generated client, a Postman import, or anyone reading
+ * the sample gets a shape the server never sends. Declaring the envelope once,
+ * here, removes the opportunity to describe it wrongly.
+ *
+ * Most operations need nothing: `applyDataEnvelope` performs the same wrapping
+ * over the whole finished document. Reach for this decorator where the payload
+ * has no DTO to point at — the paginated lists, whose envelope contents are
+ * assembled in the service rather than declared by a type.
+ *
+ * @example
+ * ```ts
+ * // A flat paginated list, and a nested one.
+ * class Examples {
+ *   @ApiDataResponse(UserResponseDto, { pagination: 'flat', description: 'Paginated user list' })
+ *   users() {}
+ *
+ *   @ApiDataResponse(ObjectResponseDto, { pagination: 'nested' })
+ *   objects() {}
+ * }
+ * ```
+ *
+ * @param model - the payload's DTO class, or several for a `oneOf` union.
+ * @param options - status, description, array or pagination shape.
+ * @returns the composed `ApiExtraModels` + `ApiResponse` decorator.
+ *
+ * @stability stable
+ */
+function ApiDataResponse(model, options = {}) {
+    const { status = 200, description, isArray = false, pagination } = options;
+    // An ARRAY of models means the payload is one of several shapes, published as
+    // `oneOf`. It exists for a discriminated union — a handler whose honest answer
+    // has more than one shape, keyed by a literal field the client narrows on
+    // (`POST /admin/db-backup/runs/{id}/restore`'s `mode`, #286).
+    //
+    // ⚠ IT MUST GO THROUGH THIS DECORATOR RATHER THAN A BARE `@ApiResponse`.
+    // `openapi/data-envelope.ts` deliberately leaves composed schemas (`oneOf`,
+    // `allOf`, `anyOf`) alone rather than guessing at them, so a hand-written
+    // `oneOf` response would be published WITHOUT the `{ data: … }` envelope the
+    // global interceptor actually adds. Building the envelope here — as every
+    // other branch below already does — is what keeps the document truthful.
+    if (Array.isArray(model)) {
+        const models = model;
+        return (0, common_1.applyDecorators)((0, swagger_1.ApiExtraModels)(...models), (0, swagger_1.ApiResponse)({
+            status,
+            description,
+            schema: {
+                type: 'object',
+                required: ['data'],
+                properties: {
+                    data: { oneOf: models.map((m) => ({ $ref: (0, swagger_1.getSchemaPath)(m) })) },
+                },
+            },
+        }));
+    }
+    // `Array.isArray` does not narrow a union whose array member is `readonly`,
+    // so the single-model branches below take a locally-narrowed alias rather than
+    // repeating a cast at each of their five uses.
+    const single = model;
+    let dataSchema;
+    if (pagination === 'flat') {
+        dataSchema = {
+            type: 'object',
+            required: ['items', 'total', 'page', 'pageSize', 'totalPages'],
+            properties: { items: ITEMS(single), ...FLAT_COUNTS },
+        };
+    }
+    else if (pagination === 'nested') {
+        dataSchema = {
+            type: 'object',
+            required: ['items', 'meta'],
+            properties: { items: ITEMS(single), meta: NESTED_META_SCHEMA },
+        };
+    }
+    else if (isArray) {
+        dataSchema = ITEMS(single);
+    }
+    else {
+        dataSchema = { $ref: (0, swagger_1.getSchemaPath)(single) };
+    }
+    return (0, common_1.applyDecorators)((0, swagger_1.ApiExtraModels)(single), (0, swagger_1.ApiResponse)({
+        status,
+        description,
+        // Cast because `SchemaObject.properties` is typed against @nestjs/swagger's
+        // own node types, which the plain JSON-Schema literals above satisfy
+        // structurally but cannot be inferred as.
+        schema: {
+            type: 'object',
+            required: ['data'],
+            properties: { data: dataSchema },
+        },
+    }));
+}
+//# sourceMappingURL=api-data-response.decorator.js.map

package/dist/core/openapi/api-data-response.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-data-response.decorator.js","sourceRoot":"","sources":["../../../src/core/openapi/api-data-response.decorator.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,mDAAmD;AACnD,iEAAiE;AACjE,gFAAgF;;AA0GhF,0CA4EC;AApLD,2CAAuD;AACvD,6CAAsG;AA2CtG,MAAM,KAAK,GAAG,CAAC,KAAoB,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,EAAE,OAAgB;IACtB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAA,uBAAa,EAAC,KAAK,CAAC,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG;IAClB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,EAAE,EAAE;IAC7F,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,wBAAwB,EAAE,OAAO,EAAE,CAAC,EAAE;IAC5E,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IAC1C,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;CACnC,CAAC;AAEX,MAAM,kBAAkB,GAAG;IACzB,IAAI,EAAE,QAAQ;IACd,WAAW,EACT,0FAA0F;QAC1F,0FAA0F;QAC1F,8DAA8D;IAChE,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC;IAC1D,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,wBAAwB,EAAE,OAAO,EAAE,CAAC,EAAE;QAC5E,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;QAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;KAC5C;CACO,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,SAAgB,eAAe,CAC7B,KAA+C,EAC/C,UAAkC,EAAE;IAEpC,MAAM,EAAE,MAAM,GAAG,GAAG,EAAE,WAAW,EAAE,OAAO,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAE3E,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,8DAA8D;IAC9D,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,KAAiC,CAAC;QAEjD,OAAO,IAAA,wBAAe,EACpB,IAAA,wBAAc,EAAC,GAAG,MAAM,CAAC,EACzB,IAAA,qBAAW,EAAC;YACV,MAAM;YACN,WAAW;YACX,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,uBAAa,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;iBACjE;aACc;SAClB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,+CAA+C;IAC/C,MAAM,MAAM,GAAG,KAAsB,CAAC;IAEtC,IAAI,UAAmC,CAAC;IAExC,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,UAAU,GAAG;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC;YAC9D,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE;SACrD,CAAC;IACJ,CAAC;SAAM,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,UAAU,GAAG;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YAC3B,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE;SAC/D,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,EAAE,IAAI,EAAE,IAAA,uBAAa,EAAC,MAAM,CAAC,EAAE,CAAC;IAC/C,CAAC;IAED,OAAO,IAAA,wBAAe,EACpB,IAAA,wBAAc,EAAC,MAAM,CAAC,EACtB,IAAA,qBAAW,EAAC;QACV,MAAM;QACN,WAAW;QACX,4EAA4E;QAC5E,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SACjB;KAClB,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/core/openapi/openapi-tag.registry.d.ts

@@ -0,0 +1,80 @@
+import { type Registry } from '../registry/index';
+/**
+ * One OpenAPI tag: the name a controller passes to `@ApiTags(...)`, its
+ * sidebar description, and the sidebar group (`x-tagGroups`) it belongs to.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * const tag: OpenApiTag = { name: 'Jobs', description: 'Background job queue.', group: 'Operations' };
+ * ```
+ */
+export interface OpenApiTag {
+    /** Must match the controller's `@ApiTags(...)` argument byte-for-byte; the registry id. */
+    readonly name: string;
+    /** One or two sentences, rendered under the section heading in the sidebar. */
+    readonly description: string;
+    /** The sidebar section (`x-tagGroups` entry) the tag is listed under. */
+    readonly group: string;
+}
+/**
+ * One sidebar section of the published document, as emitted in
+ * `x-tagGroups`: a group name and its tag names, in registration order.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * const group: OpenApiTagGroup = { name: 'Operations', tags: ['Health', 'Jobs'] };
+ * ```
+ */
+export interface OpenApiTagGroup {
+    /** The group's name, as given in each member tag's `group`. */
+    readonly name: string;
+    /** Names of the group's tags, in registration order. */
+    readonly tags: readonly string[];
+}
+/**
+ * What an OpenAPI tag or group name looks like: words of letters and digits
+ * separated by single spaces, with `&`, `.`, `/`, `-`, `(` and `)` allowed
+ * inside (`'Authentication & Access'`, `'AI Administration'`). No leading or
+ * trailing space.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * OPENAPI_TAG_NAME_PATTERN.test('Personal Access Tokens'); // true
+ * ```
+ */
+export declare const OPENAPI_TAG_NAME_PATTERN: RegExp;
+/**
+ * The OpenAPI tag registry: every tag a controller of the application uses,
+ * registered at module scope before bootstrap (frozen by
+ * `RegistryFreezeService` after it). A duplicate name throws `DUPLICATE_ID`;
+ * an empty description, or a group that does not match
+ * {@link OPENAPI_TAG_NAME_PATTERN}, throws `INVALID_ENTRY`.
+ *
+ * @stability experimental
+ * @extensionPoint registry
+ * @example
+ * ```ts
+ * openApiTags.registerAll([
+ *   { name: 'Invoices', description: 'Billing documents.', group: 'Billing' },
+ * ]);
+ * ```
+ */
+export declare const openApiTags: Registry<OpenApiTag>;
+/**
+ * Group tags into sidebar sections: one group per distinct `group`, in the
+ * order each group first appears, each listing its tags in input order.
+ *
+ * @param tags - The tags to group; defaults to everything registered in
+ *   {@link openApiTags}, in registration order.
+ * @returns The groups, ready to emit as `x-tagGroups`.
+ * @stability experimental
+ * @example
+ * ```ts
+ * document['x-tagGroups'] = openApiTagGroups();
+ * ```
+ */
+export declare function openApiTagGroups(tags?: readonly OpenApiTag[]): OpenApiTagGroup[];
+//# sourceMappingURL=openapi-tag.registry.d.ts.map

package/dist/core/openapi/openapi-tag.registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-tag.registry.d.ts","sourceRoot":"","sources":["../../../src/core/openapi/openapi-tag.registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAsBlE;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAuD,CAAC;AAE7F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,UAAU,CAY3C,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,SAAS,UAAU,EAAuB,GAAG,eAAe,EAAE,CAQpG"}

package/dist/core/openapi/openapi-tag.registry.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openApiTags = exports.OPENAPI_TAG_NAME_PATTERN = void 0;
+exports.openApiTagGroups = openApiTagGroups;
+const index_1 = require("../registry/index");
+/**
+ * What an OpenAPI tag or group name looks like: words of letters and digits
+ * separated by single spaces, with `&`, `.`, `/`, `-`, `(` and `)` allowed
+ * inside (`'Authentication & Access'`, `'AI Administration'`). No leading or
+ * trailing space.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * OPENAPI_TAG_NAME_PATTERN.test('Personal Access Tokens'); // true
+ * ```
+ */
+exports.OPENAPI_TAG_NAME_PATTERN = /^[A-Za-z0-9(](?:[A-Za-z0-9 &./()-]*[A-Za-z0-9)])?$/;
+/**
+ * The OpenAPI tag registry: every tag a controller of the application uses,
+ * registered at module scope before bootstrap (frozen by
+ * `RegistryFreezeService` after it). A duplicate name throws `DUPLICATE_ID`;
+ * an empty description, or a group that does not match
+ * {@link OPENAPI_TAG_NAME_PATTERN}, throws `INVALID_ENTRY`.
+ *
+ * @stability experimental
+ * @extensionPoint registry
+ * @example
+ * ```ts
+ * openApiTags.registerAll([
+ *   { name: 'Invoices', description: 'Billing documents.', group: 'Billing' },
+ * ]);
+ * ```
+ */
+exports.openApiTags = (0, index_1.defineRegistry)({
+    name: 'openapi-tags',
+    idOf: (tag) => tag.name,
+    idPattern: exports.OPENAPI_TAG_NAME_PATTERN,
+    validate: (tag) => {
+        if (typeof tag.description !== 'string' || tag.description.trim().length === 0) {
+            throw new Error('description must be a non-empty string');
+        }
+        if (typeof tag.group !== 'string' || !exports.OPENAPI_TAG_NAME_PATTERN.test(tag.group)) {
+            throw new Error(`group must match ${String(exports.OPENAPI_TAG_NAME_PATTERN)}`);
+        }
+    },
+});
+/**
+ * Group tags into sidebar sections: one group per distinct `group`, in the
+ * order each group first appears, each listing its tags in input order.
+ *
+ * @param tags - The tags to group; defaults to everything registered in
+ *   {@link openApiTags}, in registration order.
+ * @returns The groups, ready to emit as `x-tagGroups`.
+ * @stability experimental
+ * @example
+ * ```ts
+ * document['x-tagGroups'] = openApiTagGroups();
+ * ```
+ */
+function openApiTagGroups(tags = exports.openApiTags.list()) {
+    const groups = new Map();
+    for (const tag of tags) {
+        const members = groups.get(tag.group);
+        if (members)
+            members.push(tag.name);
+        else
+            groups.set(tag.group, [tag.name]);
+    }
+    return [...groups].map(([name, members]) => ({ name, tags: members }));
+}
+//# sourceMappingURL=openapi-tag.registry.js.map

package/dist/core/openapi/openapi-tag.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-tag.registry.js","sourceRoot":"","sources":["../../../src/core/openapi/openapi-tag.registry.ts"],"names":[],"mappings":";;;AAmHA,4CAQC;AA3HD,6CAAkE;AA0DlE;;;;;;;;;;;GAWG;AACU,QAAA,wBAAwB,GAAG,oDAAoD,CAAC;AAE7F;;;;;;;;;;;;;;;GAeG;AACU,QAAA,WAAW,GAAyB,IAAA,sBAAc,EAAa;IAC1E,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI;IACvB,SAAS,EAAE,gCAAwB;IACnC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QAChB,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,gCAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,gCAAwB,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAAC,OAA8B,mBAAW,CAAC,IAAI,EAAE;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;;YAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC"}

package/dist/core/permissions/index.d.ts

@@ -0,0 +1,8 @@
+export { permissionIds, roleIds } from './permission-ids';
+export type { IdentifiedDeclaration } from './permission-ids';
+export { grantPermissions, permissionRegistry, registerPermissions, registerRoles, roleGrantRegistry, roleRegistry, } from './permission.registry';
+export type { RoleGrantEntry } from './permission.registry';
+export { buildPermissionCatalog, catalogGrants, composePermissionCatalog } from './permission-catalog';
+export type { CatalogGrant, DeclarationList, PermissionCatalog, PermissionCatalogDeclarations, PermissionCatalogEntry, PermissionCatalogSource, } from './permission-catalog';
+export type { Declarations, PermissionDeclaration, PermissionDeclarationMap, PermissionScope, RoleDeclaration, RoleDeclarationMap, RoleGrantDeclaration, } from './permission.types';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/permissions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/permissions/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC1D,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,YAAY,GACb,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACvG,YAAY,EACV,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC"}

package/dist/core/permissions/index.js

@@ -0,0 +1,23 @@
+"use strict";
+// The role and permission registries (issue #676, packaged by #866).
+// Documented in ../README.md ("Roles and permissions"). Framework-free: seeds
+// and generators import it with no Nest container. Importing it registers nothing; an app's manifest fills the
+// registries (the platform's part: `registerPlatformPermissions()` of
+// `@marinoscar/platform-api/manifest`).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.composePermissionCatalog = exports.catalogGrants = exports.buildPermissionCatalog = exports.roleRegistry = exports.roleGrantRegistry = exports.registerRoles = exports.registerPermissions = exports.permissionRegistry = exports.grantPermissions = exports.roleIds = exports.permissionIds = void 0;
+var permission_ids_1 = require("./permission-ids");
+Object.defineProperty(exports, "permissionIds", { enumerable: true, get: function () { return permission_ids_1.permissionIds; } });
+Object.defineProperty(exports, "roleIds", { enumerable: true, get: function () { return permission_ids_1.roleIds; } });
+var permission_registry_1 = require("./permission.registry");
+Object.defineProperty(exports, "grantPermissions", { enumerable: true, get: function () { return permission_registry_1.grantPermissions; } });
+Object.defineProperty(exports, "permissionRegistry", { enumerable: true, get: function () { return permission_registry_1.permissionRegistry; } });
+Object.defineProperty(exports, "registerPermissions", { enumerable: true, get: function () { return permission_registry_1.registerPermissions; } });
+Object.defineProperty(exports, "registerRoles", { enumerable: true, get: function () { return permission_registry_1.registerRoles; } });
+Object.defineProperty(exports, "roleGrantRegistry", { enumerable: true, get: function () { return permission_registry_1.roleGrantRegistry; } });
+Object.defineProperty(exports, "roleRegistry", { enumerable: true, get: function () { return permission_registry_1.roleRegistry; } });
+var permission_catalog_1 = require("./permission-catalog");
+Object.defineProperty(exports, "buildPermissionCatalog", { enumerable: true, get: function () { return permission_catalog_1.buildPermissionCatalog; } });
+Object.defineProperty(exports, "catalogGrants", { enumerable: true, get: function () { return permission_catalog_1.catalogGrants; } });
+Object.defineProperty(exports, "composePermissionCatalog", { enumerable: true, get: function () { return permission_catalog_1.composePermissionCatalog; } });
+//# sourceMappingURL=index.js.map

package/dist/core/permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/permissions/index.ts"],"names":[],"mappings":";AAAA,qEAAqE;AACrE,8EAA8E;AAC9E,+GAA+G;AAC/G,sEAAsE;AACtE,wCAAwC;;;AAExC,mDAA0D;AAAjD,+GAAA,aAAa,OAAA;AAAE,yGAAA,OAAO,OAAA;AAE/B,6DAO+B;AAN7B,uHAAA,gBAAgB,OAAA;AAChB,yHAAA,kBAAkB,OAAA;AAClB,0HAAA,mBAAmB,OAAA;AACnB,oHAAA,aAAa,OAAA;AACb,wHAAA,iBAAiB,OAAA;AACjB,mHAAA,YAAY,OAAA;AAGd,2DAAuG;AAA9F,4HAAA,sBAAsB,OAAA;AAAE,mHAAA,aAAa,OAAA;AAAE,8HAAA,wBAAwB,OAAA"}

package/dist/core/permissions/permission-catalog.d.ts

@@ -0,0 +1,135 @@
+import { type RoleGrantEntry } from './permission.registry';
+import type { Declarations, PermissionDeclaration, PermissionScope, RoleDeclaration, RoleGrantDeclaration } from './permission.types';
+/**
+ * One role or permission as a seed writes it.
+ *
+ * @stability stable
+ */
+export interface PermissionCatalogEntry {
+    /** The unique name (`admin`, `jobs:read`). */
+    name: string;
+    /** What it is for. */
+    description: string;
+    /** `'system'` or `'org'`. */
+    scope: PermissionScope;
+}
+/**
+ * What a seed upserts: roles, permissions and default role grants.
+ *
+ * @stability stable
+ */
+export interface PermissionCatalog {
+    /** Every registered role, in registration order, with its scope. */
+    roles: PermissionCatalogEntry[];
+    /** Every registered permission, in registration order, with its scope. */
+    permissions: PermissionCatalogEntry[];
+    /** Role to the permission ids it is granted by default, in permission registration order. Every role has a key. */
+    rolePermissions: Record<string, string[]>;
+}
+/**
+ * Where {@link buildPermissionCatalog} reads roles and permissions from: any
+ * pair of lists in registration order (the static registries by default).
+ *
+ * @stability stable
+ */
+export interface PermissionCatalogSource {
+    /** The roles, in registration order. */
+    readonly roles: DeclarationList<RoleDeclaration>;
+    /** The permissions, in registration order. */
+    readonly permissions: DeclarationList<PermissionDeclaration>;
+    /**
+     * The explicit role grants ({@link grantPermissions}), in registration order.
+     * Optional so a source built before grants existed keeps working.
+     */
+    readonly grants?: DeclarationList<RoleGrantEntry>;
+}
+/**
+ * Anything that lists declarations in registration order (a `Registry` does).
+ *
+ * @typeParam T - the declaration type.
+ *
+ * @stability stable
+ */
+export interface DeclarationList<T> {
+    /**
+     * The declarations.
+     *
+     * @returns them in registration order.
+     */
+    list(): readonly T[];
+}
+/**
+ * One default grant: a role and a permission it holds.
+ *
+ * @stability stable
+ */
+export interface CatalogGrant {
+    /** The role name. */
+    role: string;
+    /** The permission name. */
+    permission: string;
+}
+/**
+ * Builds the seed catalog from the registries as they are now.
+ *
+ * @param source - the registries to read; {@link roleRegistry} and {@link permissionRegistry} by default.
+ * @returns the catalog, every role keyed in `rolePermissions` (with `[]` when it holds nothing).
+ *
+ * @example
+ * ```ts
+ * import './permission.manifest'; // fills the registries first
+ * const catalog = buildPermissionCatalog();
+ * ```
+ *
+ * @stability stable
+ */
+export declare function buildPermissionCatalog(source?: PermissionCatalogSource): PermissionCatalog;
+/**
+ * Declarations to compose a catalog from, in registration order.
+ *
+ * @stability stable
+ */
+export interface PermissionCatalogDeclarations {
+    /** Batches of roles, registered first, in order. */
+    readonly roles: ReadonlyArray<Declarations<RoleDeclaration>>;
+    /** Batches of permissions, registered after every role, in order. */
+    readonly permissions: ReadonlyArray<Declarations<PermissionDeclaration>>;
+    /** Batches of explicit role grants, registered after every permission, in order. */
+    readonly grants?: ReadonlyArray<readonly RoleGrantDeclaration[]>;
+}
+/**
+ * Composes a catalog from declarations without touching the static
+ * registries: the same validation, duplicate rule and order as
+ * {@link registerRoles}, {@link registerPermissions} and
+ * {@link grantPermissions}, on detached registries. For a seed or a test that wants the catalog of a set of
+ * declarations, not of the process.
+ *
+ * @param declarations - role batches, then permission batches.
+ * @returns the catalog.
+ * @throws RegistryError exactly as registering the same batches would.
+ *
+ * @example
+ * ```ts
+ * const catalog = composePermissionCatalog({ roles: [IDENTITY_ROLES], permissions: [JOBS_PERMISSIONS, APP_PERMISSIONS] });
+ * ```
+ *
+ * @stability stable
+ */
+export declare function composePermissionCatalog(declarations: PermissionCatalogDeclarations): PermissionCatalog;
+/**
+ * The catalog's default grants as `{ role, permission }` pairs, in role
+ * order then permission order: the `grants` option of the identity
+ * conformance suite.
+ *
+ * @param catalog - a catalog.
+ * @returns one pair per default grant.
+ *
+ * @example
+ * ```ts
+ * identity: { rootModule: AppModule, permissions, roles, grants: catalogGrants(catalog) }
+ * ```
+ *
+ * @stability stable
+ */
+export declare function catalogGrants(catalog: Pick<PermissionCatalog, 'rolePermissions'>): CatalogGrant[];
+//# sourceMappingURL=permission-catalog.d.ts.map

package/dist/core/permissions/permission-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-catalog.d.ts","sourceRoot":"","sources":["../../../src/core/permissions/permission-catalog.ts"],"names":[],"mappings":"AAaA,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,KAAK,EAAE,eAAe,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,0EAA0E;IAC1E,WAAW,EAAE,sBAAsB,EAAE,CAAC;IACtC,mHAAmH;IACnH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAC3C;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IACjD,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,qBAAqB,CAAC,CAAC;IAC7D;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,cAAc,CAAC,CAAC;CACnD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC;;;;OAIG;IACH,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,GAAE,uBAA6G,GACpH,iBAAiB,CA+BnB;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7D,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACzE,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;CAClE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,6BAA6B,GAAG,iBAAiB,CAQvG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,YAAY,EAAE,CAIjG"}

package/dist/core/permissions/permission-catalog.js

@@ -0,0 +1,114 @@
+"use strict";
+// =============================================================================
+// The seed's view of the role and permission registries (issue #676; packaged #866)
+// =============================================================================
+//
+// Pure functions from declarations to the catalog a seed upserts: roles,
+// permissions and default grants, in registration order. The shape is
+// `PermissionCatalogSnapshot` of `@marinoscar/platform-db/seed`, so the result
+// goes straight into `platformSeedInputFrom()`. The reference app renders it
+// into `prisma/catalog/permissions.json` (its seed runs in an image without
+// `src/`); an app whose seed can import its packages may compose it directly.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPermissionCatalog = buildPermissionCatalog;
+exports.composePermissionCatalog = composePermissionCatalog;
+exports.catalogGrants = catalogGrants;
+const registry_1 = require("../registry/registry");
+const permission_registry_1 = require("./permission.registry");
+/**
+ * Builds the seed catalog from the registries as they are now.
+ *
+ * @param source - the registries to read; {@link roleRegistry} and {@link permissionRegistry} by default.
+ * @returns the catalog, every role keyed in `rolePermissions` (with `[]` when it holds nothing).
+ *
+ * @example
+ * ```ts
+ * import './permission.manifest'; // fills the registries first
+ * const catalog = buildPermissionCatalog();
+ * ```
+ *
+ * @stability stable
+ */
+function buildPermissionCatalog(source = { roles: permission_registry_1.roleRegistry, permissions: permission_registry_1.permissionRegistry, grants: permission_registry_1.roleGrantRegistry }) {
+    const roles = source.roles.list();
+    const permissions = source.permissions.list();
+    // A role's permissions are its default grants and its explicit grants, in
+    // permission registration order (so a role that gets nothing extra keeps
+    // exactly the list it always had).
+    const explicit = new Map();
+    for (const grant of source.grants?.list() ?? []) {
+        const set = explicit.get(grant.role) ?? new Set();
+        set.add(grant.permission);
+        explicit.set(grant.role, set);
+    }
+    const rolePermissions = {};
+    for (const role of roles)
+        rolePermissions[role.id] = [];
+    for (const permission of permissions) {
+        for (const role of permission.defaultGrants)
+            (rolePermissions[role] ??= []).push(permission.id);
+        for (const [role, held] of explicit) {
+            if (held.has(permission.id))
+                (rolePermissions[role] ??= []).push(permission.id);
+        }
+    }
+    return {
+        roles: roles.map((role) => ({ name: role.id, description: role.description, scope: role.scope })),
+        permissions: permissions.map((permission) => ({
+            name: permission.id,
+            description: permission.description,
+            scope: permission.scope,
+        })),
+        rolePermissions,
+    };
+}
+/**
+ * Composes a catalog from declarations without touching the static
+ * registries: the same validation, duplicate rule and order as
+ * {@link registerRoles}, {@link registerPermissions} and
+ * {@link grantPermissions}, on detached registries. For a seed or a test that wants the catalog of a set of
+ * declarations, not of the process.
+ *
+ * @param declarations - role batches, then permission batches.
+ * @returns the catalog.
+ * @throws RegistryError exactly as registering the same batches would.
+ *
+ * @example
+ * ```ts
+ * const catalog = composePermissionCatalog({ roles: [IDENTITY_ROLES], permissions: [JOBS_PERMISSIONS, APP_PERMISSIONS] });
+ * ```
+ *
+ * @stability stable
+ */
+function composePermissionCatalog(declarations) {
+    const roles = new registry_1.Registry((0, permission_registry_1.roleRegistryOptions)());
+    const permissions = new registry_1.Registry((0, permission_registry_1.permissionRegistryOptions)(roles));
+    const grants = new registry_1.Registry((0, permission_registry_1.grantRegistryOptions)(roles, permissions));
+    for (const batch of declarations.roles)
+        roles.registerAll((0, permission_registry_1.entriesOf)(batch));
+    for (const batch of declarations.permissions)
+        permissions.registerAll((0, permission_registry_1.entriesOf)(batch));
+    for (const batch of declarations.grants ?? [])
+        grants.registerAll((0, permission_registry_1.expandGrants)(batch));
+    return buildPermissionCatalog({ roles, permissions, grants });
+}
+/**
+ * The catalog's default grants as `{ role, permission }` pairs, in role
+ * order then permission order: the `grants` option of the identity
+ * conformance suite.
+ *
+ * @param catalog - a catalog.
+ * @returns one pair per default grant.
+ *
+ * @example
+ * ```ts
+ * identity: { rootModule: AppModule, permissions, roles, grants: catalogGrants(catalog) }
+ * ```
+ *
+ * @stability stable
+ */
+function catalogGrants(catalog) {
+    return Object.entries(catalog.rolePermissions).flatMap(([role, permissions]) => permissions.map((permission) => ({ role, permission })));
+}
+//# sourceMappingURL=permission-catalog.js.map

package/dist/core/permissions/permission-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-catalog.js","sourceRoot":"","sources":["../../../src/core/permissions/permission-catalog.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oFAAoF;AACpF,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;;AA8GhF,wDAiCC;AAkCD,4DAQC;AAiBD,sCAIC;AA5MD,mDAAgD;AAChD,+DAU+B;AAmF/B;;;;;;;;;;;;;GAaG;AACH,SAAgB,sBAAsB,CACpC,SAAkC,EAAE,KAAK,EAAE,kCAAY,EAAE,WAAW,EAAE,wCAAkB,EAAE,MAAM,EAAE,uCAAiB,EAAE;IAErH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAE9C,0EAA0E;IAC1E,yEAAyE;IACzE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,eAAe,GAA6B,EAAE,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;IACxD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,aAAa;YAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,UAAU,CAAC,EAAE;YACnB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,eAAe;KAChB,CAAC;AACJ,CAAC;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,wBAAwB,CAAC,YAA2C;IAClF,MAAM,KAAK,GAAG,IAAI,mBAAQ,CAAkB,IAAA,yCAAmB,GAAE,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,IAAI,mBAAQ,CAAwB,IAAA,+CAAyB,EAAC,KAAK,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAI,mBAAQ,CAAiB,IAAA,0CAAoB,EAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,KAAK;QAAE,KAAK,CAAC,WAAW,CAAC,IAAA,+BAAS,EAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,WAAW;QAAE,WAAW,CAAC,WAAW,CAAC,IAAA,+BAAS,EAAC,KAAK,CAAC,CAAC,CAAC;IACxF,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,MAAM,IAAI,EAAE;QAAE,MAAM,CAAC,WAAW,CAAC,IAAA,kCAAY,EAAC,KAAK,CAAC,CAAC,CAAC;IACvF,OAAO,sBAAsB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,aAAa,CAAC,OAAmD;IAC/E,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,CAC7E,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC"}

package/dist/core/permissions/permission-ids.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Anything with an id: a role or a permission declaration.
+ *
+ * @stability stable
+ */
+export interface IdentifiedDeclaration {
+    /** The role or permission id. */
+    readonly id: string;
+}
+/**
+ * Turns a declaration map into a map of its ids, keeping the literal types:
+ * `permissionIds({ JOBS_READ: { id: 'jobs:read', ... } })` is
+ * `{ readonly JOBS_READ: 'jobs:read' }`.
+ *
+ * Works for any map of `{ id }` entries (permissions and roles alike). Key
+ * order follows the map's own key order.
+ *
+ * @param map - a declaration map.
+ * @returns a frozen map from each key to its entry's `id`.
+ *
+ * @example
+ * ```ts
+ * export const PERMISSIONS = permissionIds(PLATFORM_PERMISSIONS); // { JOBS_READ: 'jobs:read', ... }
+ * ```
+ *
+ * @stability stable
+ */
+export declare function permissionIds<M extends Readonly<Record<string, IdentifiedDeclaration>>>(map: M): {
+    readonly [K in keyof M]: M[K]['id'];
+};
+/**
+ * Alias of {@link permissionIds} for role maps, so call sites read naturally.
+ *
+ * @example
+ * ```ts
+ * export const ROLES = roleIds(PLATFORM_ROLES); // { ADMIN: 'admin', ... }
+ * ```
+ *
+ * @stability stable
+ */
+export declare const roleIds: typeof permissionIds;
+//# sourceMappingURL=permission-ids.d.ts.map

package/dist/core/permissions/permission-ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-ids.d.ts","sourceRoot":"","sources":["../../../src/core/permissions/permission-ids.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,EACrF,GAAG,EAAE,CAAC,GACL;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;CAAE,CAIzC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,EAAE,OAAO,aAA6B,CAAC"}