@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.3

package/dist/core/host/platform-host.module.d.ts

@@ -0,0 +1,53 @@
+import { DynamicModule, ModuleMetadata } from '@nestjs/common';
+import { AuditSink, PortBinding, PrismaClientLike, SystemSettingsStore } from './ports';
+/**
+ * The app's adapters for the DI-time ports, plus the modules they need.
+ *
+ * @stability experimental
+ */
+export interface PlatformHostPorts {
+    /** Binds {@link AUDIT_SINK}. */
+    audit?: PortBinding<AuditSink>;
+    /** Binds {@link SYSTEM_SETTINGS_STORE}. */
+    settings?: PortBinding<SystemSettingsStore>;
+    /** Binds {@link PLATFORM_PRISMA}. */
+    prisma?: PortBinding<PrismaClientLike>;
+    /**
+     * Modules the adapters' own dependencies come from (a settings adapter that
+     * injects the app's settings service needs that service's module). Global
+     * modules (the app's Prisma module) need not be listed.
+     */
+    imports?: ModuleMetadata['imports'];
+}
+/**
+ * Binds the platform's DI-time host ports to the app's adapters.
+ *
+ * @stability experimental
+ */
+export declare class PlatformHostModule {
+    /**
+     * Global. Binds the DI-time ports to the app's adapters. Each port is
+     * optional; a slice that injects a missing port fails at boot with Nest's
+     * missing-provider error naming the token.
+     *
+     * @param ports - one binding per port the app supplies, and the modules the
+     *   adapters need.
+     * @returns a global dynamic module exporting every bound token.
+     * @throws Error when a binding names no provider shape, or more than one.
+     *
+     * @example
+     * ```ts
+     * PlatformHostModule.forRoot({
+     *   audit: { useClass: PrismaAuditSink },
+     *   settings: { useClass: SystemSettingsStoreAdapter },
+     *   prisma: { useExisting: PrismaService },
+     *   imports: [SettingsModule],
+     * });
+     * ```
+     *
+     * @extensionPoint option
+     * @stability experimental
+     */
+    static forRoot(ports?: PlatformHostPorts): DynamicModule;
+}
+//# sourceMappingURL=platform-host.module.d.ts.map

package/dist/core/host/platform-host.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-host.module.d.ts","sourceRoot":"","sources":["../../../src/core/host/platform-host.module.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,aAAa,EAAU,cAAc,EAAY,MAAM,gBAAgB,CAAC;AAEjF,OAAO,EAEL,SAAS,EAET,WAAW,EACX,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,SAAS,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,KAAK,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IAC/B,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAC5C,qCAAqC;IACrC,MAAM,CAAC,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACvC;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;CACrC;AAeD;;;;GAIG;AACH,qBACa,kBAAkB;IAC7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,CAAC,OAAO,CAAC,KAAK,GAAE,iBAAsB,GAAG,aAAa;CAqB7D"}

package/dist/core/host/platform-host.module.js

@@ -0,0 +1,90 @@
+"use strict";
+// =============================================================================
+// PlatformHostModule: binds the DI-time host ports once (issue #696, PP-2.7)
+// =============================================================================
+//
+// The app imports `PlatformHostModule.forRoot({...})` ONCE, in its root
+// module (`apps/api/src/platform/platform-host.module.ts`). The module is
+// global, so every packaged slice injects `AUDIT_SINK`, `SYSTEM_SETTINGS_STORE`
+// or `PLATFORM_PRISMA` without importing anything of the app.
+//
+// Every port is optional. A slice that injects a port the app did not bind
+// fails at boot with Nest's own missing-provider error, which names the token:
+// loud, early and specific, the same failure a missing app provider gives.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var PlatformHostModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PlatformHostModule = void 0;
+const common_1 = require("@nestjs/common");
+const ports_1 = require("./ports");
+function toProvider(token, name, binding) {
+    const shape = binding;
+    const kinds = shape && typeof shape === 'object' ? ['useExisting', 'useClass', 'useFactory'].filter((k) => k in shape) : [];
+    if (kinds.length !== 1) {
+        throw new Error(`PlatformHostModule.forRoot: the "${name}" port needs exactly one of useExisting, useClass or useFactory` +
+            (kinds.length > 1 ? ` (got ${kinds.join(', ')})` : '') +
+            '.');
+    }
+    return { provide: token, ...shape };
+}
+/**
+ * Binds the platform's DI-time host ports to the app's adapters.
+ *
+ * @stability experimental
+ */
+let PlatformHostModule = PlatformHostModule_1 = class PlatformHostModule {
+    /**
+     * Global. Binds the DI-time ports to the app's adapters. Each port is
+     * optional; a slice that injects a missing port fails at boot with Nest's
+     * missing-provider error naming the token.
+     *
+     * @param ports - one binding per port the app supplies, and the modules the
+     *   adapters need.
+     * @returns a global dynamic module exporting every bound token.
+     * @throws Error when a binding names no provider shape, or more than one.
+     *
+     * @example
+     * ```ts
+     * PlatformHostModule.forRoot({
+     *   audit: { useClass: PrismaAuditSink },
+     *   settings: { useClass: SystemSettingsStoreAdapter },
+     *   prisma: { useExisting: PrismaService },
+     *   imports: [SettingsModule],
+     * });
+     * ```
+     *
+     * @extensionPoint option
+     * @stability experimental
+     */
+    static forRoot(ports = {}) {
+        const providers = [];
+        const exported = [];
+        const bind = (token, name, binding) => {
+            if (binding === undefined)
+                return;
+            providers.push(toProvider(token, name, binding));
+            exported.push(token);
+        };
+        bind(ports_1.AUDIT_SINK, 'audit', ports.audit);
+        bind(ports_1.SYSTEM_SETTINGS_STORE, 'settings', ports.settings);
+        bind(ports_1.PLATFORM_PRISMA, 'prisma', ports.prisma);
+        return {
+            global: true,
+            module: PlatformHostModule_1,
+            imports: ports.imports ?? [],
+            providers,
+            exports: exported,
+        };
+    }
+};
+exports.PlatformHostModule = PlatformHostModule;
+exports.PlatformHostModule = PlatformHostModule = PlatformHostModule_1 = __decorate([
+    (0, common_1.Module)({})
+], PlatformHostModule);
+//# sourceMappingURL=platform-host.module.js.map

package/dist/core/host/platform-host.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-host.module.js","sourceRoot":"","sources":["../../../src/core/host/platform-host.module.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,gFAAgF;;;;;;;;;;AAEhF,2CAAiF;AAEjF,mCAQiB;AAsBjB,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,OAAgB;IAC/D,MAAM,KAAK,GAAG,OAAyC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5H,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,iEAAiE;YACvG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CACN,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAI,KAAgB,EAAc,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AAEI,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAC7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,CAAC,OAAO,CAAC,QAA2B,EAAE;QAC1C,MAAM,SAAS,GAAe,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,OAAgB,EAAE,EAAE;YAC7D,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO;YAClC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC;QAEF,IAAI,CAAC,kBAAU,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,6BAAqB,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,uBAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAE9C,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,oBAAkB;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;YAC5B,SAAS;YACT,OAAO,EAAE,QAAQ;SAClB,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,kBAAkB,CA6C9B"}

package/dist/core/host/ports.d.ts

@@ -0,0 +1,132 @@
+import type { Type } from '@nestjs/common';
+/**
+ * Injection token of the app's {@link AuditSink}.
+ *
+ * @example
+ * ```ts
+ * constructor(@Inject(AUDIT_SINK) private readonly audit: AuditSink) {}
+ * ```
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const AUDIT_SINK: unique symbol;
+/**
+ * One audit event, as a packaged slice reports it. Never carries secret
+ * material: `meta` holds scalars only.
+ *
+ * @stability experimental
+ */
+export interface AuditEventInput {
+    /** What happened, `<resource>.<verb>` (`settings.updated`). */
+    action: string;
+    /** Who did it; `null` for the system itself. */
+    actorUserId: string | null;
+    /** The kind of thing it happened to (`system_settings`). */
+    targetType: string;
+    /** Which one. */
+    targetId: string;
+    /** Small scalar facts about the event. Never secret material. */
+    meta?: Record<string, string | number | boolean | null>;
+}
+/**
+ * Where a packaged slice records audit events. The app persists them in its
+ * own audit table.
+ *
+ * @stability experimental
+ */
+export interface AuditSink {
+    /**
+     * Persists one audit event. Called after the triggering write commits.
+     * Never receives secret material.
+     */
+    record(event: AuditEventInput): Promise<void>;
+}
+/**
+ * Injection token of the app's {@link SystemSettingsStore}.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const SYSTEM_SETTINGS_STORE: unique symbol;
+/**
+ * One settings namespace and the version of the row it was read from.
+ *
+ * @stability experimental
+ */
+export interface SystemSettingsSnapshot {
+    /** The namespace's current value, as the app's namespace registry validated it. */
+    value: unknown;
+    /** The row version, for `If-Match` optimistic concurrency. */
+    version: number;
+}
+/**
+ * The app's deployment-wide settings, one namespace at a time. Validation,
+ * `If-Match` and the settings audit trail stay in the app.
+ *
+ * @stability experimental
+ */
+export interface SystemSettingsStore {
+    /**
+     * The current value of one settings namespace (validated by the app's
+     * namespace registry), plus the row version for If-Match.
+     */
+    read(namespace: string): Promise<SystemSettingsSnapshot>;
+    /**
+     * Patches one namespace with optimistic concurrency; audits through the
+     * app's own settings path. Rejects on a version mismatch (the app's 409).
+     */
+    patch(namespace: string, patch: Record<string, unknown>, ctx: {
+        actorUserId: string;
+        ifMatchVersion?: number;
+    }): Promise<SystemSettingsSnapshot>;
+}
+/**
+ * Injection token of the app's Prisma client, seen as a {@link PrismaClientLike}.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const PLATFORM_PRISMA: unique symbol;
+/**
+ * Schema-independent view of the app's generated client. Slices that own
+ * models narrow it with their own structural delegate types.
+ *
+ * @stability experimental
+ */
+export interface PrismaClientLike {
+    /** A tagged-template raw query. */
+    $queryRaw<T = unknown>(query: TemplateStringsArray, ...values: unknown[]): Promise<T>;
+    /** A tagged-template raw statement; resolves to the affected row count. */
+    $executeRaw(query: TemplateStringsArray, ...values: unknown[]): Promise<number>;
+    /** An interactive transaction. */
+    $transaction<T>(fn: (tx: unknown) => Promise<T>, options?: {
+        timeout?: number;
+    }): Promise<T>;
+    /** A client extension. */
+    $extends(extension: unknown): unknown;
+}
+/**
+ * How the app binds one port: an existing provider, a class, or a factory
+ * (Nest's own provider shapes, minus `provide`).
+ *
+ * @typeParam T - the port's interface.
+ *
+ * @stability experimental
+ */
+export type PortBinding<T> = {
+    /** Reuse a provider the app already has (a class, or a string or symbol token). */
+    useExisting: Type<T> | string | symbol;
+} | {
+    /** Instantiate this class (its own dependencies are injected). */
+    useClass: Type<T>;
+} | {
+    /**
+     * Build the port. Nest's own factory signature: dependencies arrive
+     * untyped, in `inject` order.
+     */
+    useFactory: (...deps: any[]) => T | Promise<T>;
+    /** The tokens whose instances `useFactory` receives. */
+    inject?: any[];
+};
+//# sourceMappingURL=ports.d.ts.map

package/dist/core/host/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../src/core/host/ports.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,EAAE,OAAO,MAAsD,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,MAAiE,CAAC;AAE7G;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,mFAAmF;IACnF,KAAK,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzD;;;OAGG;IACH,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GACpD,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACpC;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,OAAO,MAA2D,CAAC;AAEjG;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtF,2EAA2E;IAC3E,WAAW,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChF,kCAAkC;IAClC,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,0BAA0B;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IACrB;IACE,mFAAmF;IACnF,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC;CACxC,GACD;IACE,kEAAkE;IAClE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;CACnB,GACD;IACE;;;OAGG;IACH,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/C,wDAAwD;IACxD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;CAChB,CAAC"}

package/dist/core/host/ports.js

@@ -0,0 +1,48 @@
+"use strict";
+// =============================================================================
+// The DI-time host ports (issue #696, PP-2.7)
+// =============================================================================
+//
+// App-owned capabilities a packaged slice may need at runtime, reached through
+// injection tokens the app binds once with `PlatformHostModule.forRoot(...)`
+// (`apps/api/src/platform/platform-host.module.ts`). A slice injects a port by
+// token and never imports the app's services.
+//
+// The tokens are `Symbol.for(...)` keys, so two copies of this file (two
+// bundles, a test that loads the source next to the built package) still agree
+// on identity.
+//
+// No port for logging (packaged code uses `new Logger(Context)` from
+// `@nestjs/common`, which already routes to the app's logger through
+// `app.useLogger`) and none for metrics or spans (packaged code uses
+// `@opentelemetry/api`, a peer). See README.md next to this folder.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_PRISMA = exports.SYSTEM_SETTINGS_STORE = exports.AUDIT_SINK = void 0;
+/**
+ * Injection token of the app's {@link AuditSink}.
+ *
+ * @example
+ * ```ts
+ * constructor(@Inject(AUDIT_SINK) private readonly audit: AuditSink) {}
+ * ```
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.AUDIT_SINK = Symbol.for('@marinoscar/platform/AUDIT_SINK');
+/**
+ * Injection token of the app's {@link SystemSettingsStore}.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.SYSTEM_SETTINGS_STORE = Symbol.for('@marinoscar/platform/SYSTEM_SETTINGS_STORE');
+/**
+ * Injection token of the app's Prisma client, seen as a {@link PrismaClientLike}.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.PLATFORM_PRISMA = Symbol.for('@marinoscar/platform/PLATFORM_PRISMA');
+//# sourceMappingURL=ports.js.map

package/dist/core/host/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/host/ports.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,8CAA8C;AAC9C,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,8CAA8C;AAC9C,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,eAAe;AACf,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,oEAAoE;AACpE,gFAAgF;;;AAIhF;;;;;;;;;;GAUG;AACU,QAAA,UAAU,GAAkB,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAmCvF;;;;;GAKG;AACU,QAAA,qBAAqB,GAAkB,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;AAqC7G;;;;;GAKG;AACU,QAAA,eAAe,GAAkB,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC"}

package/dist/core/index.d.ts

@@ -0,0 +1,15 @@
+export * from './registry/index';
+export { RegistryFreezeService } from './registry/registry-freeze.service';
+export * from './host/index';
+export type { CredentialKind, GroupMembership, NodePrincipal, OrgMembership, Principal, PrincipalKind, Scope, SystemActor, TenancyMode, UserPrincipal, } from './principal/index';
+export { HttpExceptionFilter } from './errors/http-exception.filter';
+export { withVerbatimErrorBody, hasVerbatimErrorBody } from './errors/verbatim-error-body.exception';
+export { DatabaseSeedException } from './errors/database-seed.exception';
+export { ErrorDto } from './errors/error.dto';
+export { USER_CREDENTIAL_DOMAIN_PREFIX, assertEncryptionKeyConfigured, decryptSecret, deriveSigningKey, encryptSecret, isCanonicalUuid, userCredentialPurpose, } from './crypto/secret-cipher';
+export { verifyEncryptionKeyAtStartup } from './crypto/encryption-key-startup-check';
+export { OPENAPI_TAG_NAME_PATTERN, openApiTagGroups, openApiTags, } from './openapi/openapi-tag.registry';
+export type { OpenApiTag, OpenApiTagGroup } from './openapi/openapi-tag.registry';
+export { ScopedAccessError, asSystem, forUser, ownerFieldOf, ownerRelationOf, registerUserOwnedModels, userOwnedModelRegistry, userScopeExtension, } from './data-access/index';
+export type { ExportPolicy, ExtendableClient, PurgePolicy, UserOwnedModelDef, UserOwnedModelLookup, UserScopeExtension, } from './data-access/index';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AASA,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAK3E,cAAc,cAAc,CAAC;AAG7B,YAAY,EACV,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,SAAS,EACT,aAAa,EACb,KAAK,EACL,WAAW,EACX,WAAW,EACX,aAAa,GACd,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAM9C,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,WAAW,GACZ,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAMlF,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/core/index.js

@@ -0,0 +1,77 @@
+"use strict";
+// `@marinoscar/platform-api/core`: the primitives every other slice builds on
+// (issue #698): the typed registry primitive (issue #675, moved here by issue
+// #694) and the principal and scope contract (ADR 0001). Documented in
+// ./README.md. Explicit named exports below the registry barrel.
+//
+// `registry/index.ts` stays free of Nest so it can load where no container
+// exists (seeds, standalone scripts, import-time DTOs); `RegistryFreezeService`
+// is the one Nest-aware export and lives in its own file.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userScopeExtension = exports.userOwnedModelRegistry = exports.registerUserOwnedModels = exports.ownerRelationOf = exports.ownerFieldOf = exports.forUser = exports.asSystem = exports.ScopedAccessError = exports.openApiTags = exports.openApiTagGroups = exports.OPENAPI_TAG_NAME_PATTERN = exports.verifyEncryptionKeyAtStartup = exports.userCredentialPurpose = exports.isCanonicalUuid = exports.encryptSecret = exports.deriveSigningKey = exports.decryptSecret = exports.assertEncryptionKeyConfigured = exports.USER_CREDENTIAL_DOMAIN_PREFIX = exports.ErrorDto = exports.DatabaseSeedException = exports.hasVerbatimErrorBody = exports.withVerbatimErrorBody = exports.HttpExceptionFilter = exports.RegistryFreezeService = void 0;
+__exportStar(require("./registry/index"), exports);
+var registry_freeze_service_1 = require("./registry/registry-freeze.service");
+Object.defineProperty(exports, "RegistryFreezeService", { enumerable: true, get: function () { return registry_freeze_service_1.RegistryFreezeService; } });
+// The host ports (issue #696): the access port (`definePlatformHost`), the
+// DI-time ports (`AUDIT_SINK`, `SYSTEM_SETTINGS_STORE`, `PLATFORM_PRISMA`) and
+// `PlatformHostModule`, which binds them. Every packaged slice reuses them.
+__exportStar(require("./host/index"), exports);
+// Errors: the application-wide exception filter, the error envelope's
+// OpenAPI DTO and the two exceptions that go with it (issue #698).
+var http_exception_filter_1 = require("./errors/http-exception.filter");
+Object.defineProperty(exports, "HttpExceptionFilter", { enumerable: true, get: function () { return http_exception_filter_1.HttpExceptionFilter; } });
+var verbatim_error_body_exception_1 = require("./errors/verbatim-error-body.exception");
+Object.defineProperty(exports, "withVerbatimErrorBody", { enumerable: true, get: function () { return verbatim_error_body_exception_1.withVerbatimErrorBody; } });
+Object.defineProperty(exports, "hasVerbatimErrorBody", { enumerable: true, get: function () { return verbatim_error_body_exception_1.hasVerbatimErrorBody; } });
+var database_seed_exception_1 = require("./errors/database-seed.exception");
+Object.defineProperty(exports, "DatabaseSeedException", { enumerable: true, get: function () { return database_seed_exception_1.DatabaseSeedException; } });
+var error_dto_1 = require("./errors/error.dto");
+Object.defineProperty(exports, "ErrorDto", { enumerable: true, get: function () { return error_dto_1.ErrorDto; } });
+// Crypto: the AES-256-GCM secret cipher under every runtime-configured
+// credential, and its bootstrap check (issue #698), plus HMAC signing sub-keys
+// from the same master key (issue #822). The cipher reads
+// SECRETS_ENCRYPTION_KEY from the environment once and caches it.
+var secret_cipher_1 = require("./crypto/secret-cipher");
+Object.defineProperty(exports, "USER_CREDENTIAL_DOMAIN_PREFIX", { enumerable: true, get: function () { return secret_cipher_1.USER_CREDENTIAL_DOMAIN_PREFIX; } });
+Object.defineProperty(exports, "assertEncryptionKeyConfigured", { enumerable: true, get: function () { return secret_cipher_1.assertEncryptionKeyConfigured; } });
+Object.defineProperty(exports, "decryptSecret", { enumerable: true, get: function () { return secret_cipher_1.decryptSecret; } });
+Object.defineProperty(exports, "deriveSigningKey", { enumerable: true, get: function () { return secret_cipher_1.deriveSigningKey; } });
+Object.defineProperty(exports, "encryptSecret", { enumerable: true, get: function () { return secret_cipher_1.encryptSecret; } });
+Object.defineProperty(exports, "isCanonicalUuid", { enumerable: true, get: function () { return secret_cipher_1.isCanonicalUuid; } });
+Object.defineProperty(exports, "userCredentialPurpose", { enumerable: true, get: function () { return secret_cipher_1.userCredentialPurpose; } });
+var encryption_key_startup_check_1 = require("./crypto/encryption-key-startup-check");
+Object.defineProperty(exports, "verifyEncryptionKeyAtStartup", { enumerable: true, get: function () { return encryption_key_startup_check_1.verifyEncryptionKeyAtStartup; } });
+// OpenAPI tag registry: apps and slices register the @ApiTags names their
+// controllers use, with a description and a sidebar group (issue #698).
+var openapi_tag_registry_1 = require("./openapi/openapi-tag.registry");
+Object.defineProperty(exports, "OPENAPI_TAG_NAME_PATTERN", { enumerable: true, get: function () { return openapi_tag_registry_1.OPENAPI_TAG_NAME_PATTERN; } });
+Object.defineProperty(exports, "openApiTagGroups", { enumerable: true, get: function () { return openapi_tag_registry_1.openApiTagGroups; } });
+Object.defineProperty(exports, "openApiTags", { enumerable: true, get: function () { return openapi_tag_registry_1.openApiTags; } });
+// Scoped data access (issue #699; origin #688): the user-owned data registry,
+// the user-scoped client extension and the explicit unscoped escape. The app
+// fills the registry and injects its generated client; nothing here imports a
+// generated model type (`@prisma/client/extension` only).
+var index_1 = require("./data-access/index");
+Object.defineProperty(exports, "ScopedAccessError", { enumerable: true, get: function () { return index_1.ScopedAccessError; } });
+Object.defineProperty(exports, "asSystem", { enumerable: true, get: function () { return index_1.asSystem; } });
+Object.defineProperty(exports, "forUser", { enumerable: true, get: function () { return index_1.forUser; } });
+Object.defineProperty(exports, "ownerFieldOf", { enumerable: true, get: function () { return index_1.ownerFieldOf; } });
+Object.defineProperty(exports, "ownerRelationOf", { enumerable: true, get: function () { return index_1.ownerRelationOf; } });
+Object.defineProperty(exports, "registerUserOwnedModels", { enumerable: true, get: function () { return index_1.registerUserOwnedModels; } });
+Object.defineProperty(exports, "userOwnedModelRegistry", { enumerable: true, get: function () { return index_1.userOwnedModelRegistry; } });
+Object.defineProperty(exports, "userScopeExtension", { enumerable: true, get: function () { return index_1.userScopeExtension; } });
+//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,0DAA0D;;;;;;;;;;;;;;;;;AAE1D,mDAAiC;AACjC,8EAA2E;AAAlE,gIAAA,qBAAqB,OAAA;AAE9B,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,+CAA6B;AAgB7B,sEAAsE;AACtE,mEAAmE;AACnE,wEAAqE;AAA5D,4HAAA,mBAAmB,OAAA;AAC5B,wFAAqG;AAA5F,sIAAA,qBAAqB,OAAA;AAAE,qIAAA,oBAAoB,OAAA;AACpD,4EAAyE;AAAhE,gIAAA,qBAAqB,OAAA;AAC9B,gDAA8C;AAArC,qGAAA,QAAQ,OAAA;AAEjB,uEAAuE;AACvE,+EAA+E;AAC/E,0DAA0D;AAC1D,kEAAkE;AAClE,wDAQgC;AAP9B,8HAAA,6BAA6B,OAAA;AAC7B,8HAAA,6BAA6B,OAAA;AAC7B,8GAAA,aAAa,OAAA;AACb,iHAAA,gBAAgB,OAAA;AAChB,8GAAA,aAAa,OAAA;AACb,gHAAA,eAAe,OAAA;AACf,sHAAA,qBAAqB,OAAA;AAEvB,sFAAqF;AAA5E,4IAAA,4BAA4B,OAAA;AAErC,0EAA0E;AAC1E,wEAAwE;AACxE,uEAIwC;AAHtC,gIAAA,wBAAwB,OAAA;AACxB,wHAAA,gBAAgB,OAAA;AAChB,mHAAA,WAAW,OAAA;AAIb,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,0DAA0D;AAC1D,6CAS6B;AAR3B,0GAAA,iBAAiB,OAAA;AACjB,iGAAA,QAAQ,OAAA;AACR,gGAAA,OAAO,OAAA;AACP,qGAAA,YAAY,OAAA;AACZ,wGAAA,eAAe,OAAA;AACf,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,2GAAA,kBAAkB,OAAA"}

package/dist/core/openapi/openapi-tag.registry.d.ts

@@ -0,0 +1,80 @@
+import { type Registry } from '../registry/index';
+/**
+ * One OpenAPI tag: the name a controller passes to `@ApiTags(...)`, its
+ * sidebar description, and the sidebar group (`x-tagGroups`) it belongs to.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * const tag: OpenApiTag = { name: 'Jobs', description: 'Background job queue.', group: 'Operations' };
+ * ```
+ */
+export interface OpenApiTag {
+    /** Must match the controller's `@ApiTags(...)` argument byte-for-byte; the registry id. */
+    readonly name: string;
+    /** One or two sentences, rendered under the section heading in the sidebar. */
+    readonly description: string;
+    /** The sidebar section (`x-tagGroups` entry) the tag is listed under. */
+    readonly group: string;
+}
+/**
+ * One sidebar section of the published document, as emitted in
+ * `x-tagGroups`: a group name and its tag names, in registration order.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * const group: OpenApiTagGroup = { name: 'Operations', tags: ['Health', 'Jobs'] };
+ * ```
+ */
+export interface OpenApiTagGroup {
+    /** The group's name, as given in each member tag's `group`. */
+    readonly name: string;
+    /** Names of the group's tags, in registration order. */
+    readonly tags: readonly string[];
+}
+/**
+ * What an OpenAPI tag or group name looks like: words of letters and digits
+ * separated by single spaces, with `&`, `.`, `/`, `-`, `(` and `)` allowed
+ * inside (`'Authentication & Access'`, `'AI Administration'`). No leading or
+ * trailing space.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * OPENAPI_TAG_NAME_PATTERN.test('Personal Access Tokens'); // true
+ * ```
+ */
+export declare const OPENAPI_TAG_NAME_PATTERN: RegExp;
+/**
+ * The OpenAPI tag registry: every tag a controller of the application uses,
+ * registered at module scope before bootstrap (frozen by
+ * `RegistryFreezeService` after it). A duplicate name throws `DUPLICATE_ID`;
+ * an empty description, or a group that does not match
+ * {@link OPENAPI_TAG_NAME_PATTERN}, throws `INVALID_ENTRY`.
+ *
+ * @stability experimental
+ * @extensionPoint registry
+ * @example
+ * ```ts
+ * openApiTags.registerAll([
+ *   { name: 'Invoices', description: 'Billing documents.', group: 'Billing' },
+ * ]);
+ * ```
+ */
+export declare const openApiTags: Registry<OpenApiTag>;
+/**
+ * Group tags into sidebar sections: one group per distinct `group`, in the
+ * order each group first appears, each listing its tags in input order.
+ *
+ * @param tags - The tags to group; defaults to everything registered in
+ *   {@link openApiTags}, in registration order.
+ * @returns The groups, ready to emit as `x-tagGroups`.
+ * @stability experimental
+ * @example
+ * ```ts
+ * document['x-tagGroups'] = openApiTagGroups();
+ * ```
+ */
+export declare function openApiTagGroups(tags?: readonly OpenApiTag[]): OpenApiTagGroup[];
+//# sourceMappingURL=openapi-tag.registry.d.ts.map

package/dist/core/openapi/openapi-tag.registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-tag.registry.d.ts","sourceRoot":"","sources":["../../../src/core/openapi/openapi-tag.registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAsBlE;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAuD,CAAC;AAE7F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,UAAU,CAY3C,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,SAAS,UAAU,EAAuB,GAAG,eAAe,EAAE,CAQpG"}

package/dist/core/openapi/openapi-tag.registry.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openApiTags = exports.OPENAPI_TAG_NAME_PATTERN = void 0;
+exports.openApiTagGroups = openApiTagGroups;
+const index_1 = require("../registry/index");
+/**
+ * What an OpenAPI tag or group name looks like: words of letters and digits
+ * separated by single spaces, with `&`, `.`, `/`, `-`, `(` and `)` allowed
+ * inside (`'Authentication & Access'`, `'AI Administration'`). No leading or
+ * trailing space.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * OPENAPI_TAG_NAME_PATTERN.test('Personal Access Tokens'); // true
+ * ```
+ */
+exports.OPENAPI_TAG_NAME_PATTERN = /^[A-Za-z0-9(](?:[A-Za-z0-9 &./()-]*[A-Za-z0-9)])?$/;
+/**
+ * The OpenAPI tag registry: every tag a controller of the application uses,
+ * registered at module scope before bootstrap (frozen by
+ * `RegistryFreezeService` after it). A duplicate name throws `DUPLICATE_ID`;
+ * an empty description, or a group that does not match
+ * {@link OPENAPI_TAG_NAME_PATTERN}, throws `INVALID_ENTRY`.
+ *
+ * @stability experimental
+ * @extensionPoint registry
+ * @example
+ * ```ts
+ * openApiTags.registerAll([
+ *   { name: 'Invoices', description: 'Billing documents.', group: 'Billing' },
+ * ]);
+ * ```
+ */
+exports.openApiTags = (0, index_1.defineRegistry)({
+    name: 'openapi-tags',
+    idOf: (tag) => tag.name,
+    idPattern: exports.OPENAPI_TAG_NAME_PATTERN,
+    validate: (tag) => {
+        if (typeof tag.description !== 'string' || tag.description.trim().length === 0) {
+            throw new Error('description must be a non-empty string');
+        }
+        if (typeof tag.group !== 'string' || !exports.OPENAPI_TAG_NAME_PATTERN.test(tag.group)) {
+            throw new Error(`group must match ${String(exports.OPENAPI_TAG_NAME_PATTERN)}`);
+        }
+    },
+});
+/**
+ * Group tags into sidebar sections: one group per distinct `group`, in the
+ * order each group first appears, each listing its tags in input order.
+ *
+ * @param tags - The tags to group; defaults to everything registered in
+ *   {@link openApiTags}, in registration order.
+ * @returns The groups, ready to emit as `x-tagGroups`.
+ * @stability experimental
+ * @example
+ * ```ts
+ * document['x-tagGroups'] = openApiTagGroups();
+ * ```
+ */
+function openApiTagGroups(tags = exports.openApiTags.list()) {
+    const groups = new Map();
+    for (const tag of tags) {
+        const members = groups.get(tag.group);
+        if (members)
+            members.push(tag.name);
+        else
+            groups.set(tag.group, [tag.name]);
+    }
+    return [...groups].map(([name, members]) => ({ name, tags: members }));
+}
+//# sourceMappingURL=openapi-tag.registry.js.map

package/dist/core/openapi/openapi-tag.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-tag.registry.js","sourceRoot":"","sources":["../../../src/core/openapi/openapi-tag.registry.ts"],"names":[],"mappings":";;;AAmHA,4CAQC;AA3HD,6CAAkE;AA0DlE;;;;;;;;;;;GAWG;AACU,QAAA,wBAAwB,GAAG,oDAAoD,CAAC;AAE7F;;;;;;;;;;;;;;;GAeG;AACU,QAAA,WAAW,GAAyB,IAAA,sBAAc,EAAa;IAC1E,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI;IACvB,SAAS,EAAE,gCAAwB;IACnC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QAChB,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,gCAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,gCAAwB,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAAC,OAA8B,mBAAW,CAAC,IAAI,EAAE;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;;YAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC"}

package/dist/core/principal/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The org-aware principal and scope contract. Types only; see
+ * docs/adr/0001-org-aware-principal-and-scope.md.
+ */
+export type { TenancyMode, CredentialKind, PrincipalKind, OrgMembership, GroupMembership, UserPrincipal, NodePrincipal, Principal, Scope, SystemActor, } from './principal.types';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/principal/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/principal/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,YAAY,EACV,WAAW,EACX,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,aAAa,EACb,aAAa,EACb,SAAS,EACT,KAAK,EACL,WAAW,GACZ,MAAM,mBAAmB,CAAC"}

package/dist/core/principal/index.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=index.js.map

package/dist/core/principal/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/principal/index.ts"],"names":[],"mappings":""}