@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/core/host/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../src/core/host/ports.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,EAAE,OAAO,MAAsD,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,MAAiE,CAAC;AAE7G;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,mFAAmF;IACnF,KAAK,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzD;;;OAGG;IACH,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GACpD,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACpC;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,OAAO,MAA2D,CAAC;AAEjG;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtF,2EAA2E;IAC3E,WAAW,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChF,kCAAkC;IAClC,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,0BAA0B;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IACrB;IACE,mFAAmF;IACnF,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC;CACxC,GACD;IACE,kEAAkE;IAClE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;CACnB,GACD;IACE;;;OAGG;IACH,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/C,wDAAwD;IACxD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;CAChB,CAAC"}

package/dist/core/host/ports.js

@@ -0,0 +1,48 @@
+"use strict";
+// =============================================================================
+// The DI-time host ports (issue #696, PP-2.7)
+// =============================================================================
+//
+// App-owned capabilities a packaged slice may need at runtime, reached through
+// injection tokens the app binds once with `PlatformHostModule.forRoot(...)`
+// (`apps/api/src/platform/platform-host.module.ts`). A slice injects a port by
+// token and never imports the app's services.
+//
+// The tokens are `Symbol.for(...)` keys, so two copies of this file (two
+// bundles, a test that loads the source next to the built package) still agree
+// on identity.
+//
+// No port for logging (packaged code uses `new Logger(Context)` from
+// `@nestjs/common`, which is routed to the app's logger through
+// `app.useLogger` when it sets one) and none for metrics or spans (packaged code uses
+// `@opentelemetry/api`, a peer). See README.md next to this folder.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_PRISMA = exports.SYSTEM_SETTINGS_STORE = exports.AUDIT_SINK = void 0;
+/**
+ * Injection token of the app's {@link AuditSink}.
+ *
+ * @example
+ * ```ts
+ * constructor(@Inject(AUDIT_SINK) private readonly audit: AuditSink) {}
+ * ```
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.AUDIT_SINK = Symbol.for('@marinoscar/platform/AUDIT_SINK');
+/**
+ * Injection token of the app's {@link SystemSettingsStore}.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.SYSTEM_SETTINGS_STORE = Symbol.for('@marinoscar/platform/SYSTEM_SETTINGS_STORE');
+/**
+ * Injection token of the app's Prisma client, seen as a {@link PrismaClientLike}.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.PLATFORM_PRISMA = Symbol.for('@marinoscar/platform/PLATFORM_PRISMA');
+//# sourceMappingURL=ports.js.map

package/dist/core/host/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/host/ports.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,8CAA8C;AAC9C,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,8CAA8C;AAC9C,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,eAAe;AACf,EAAE;AACF,qEAAqE;AACrE,gEAAgE;AAChE,sFAAsF;AACtF,oEAAoE;AACpE,gFAAgF;;;AAIhF;;;;;;;;;;GAUG;AACU,QAAA,UAAU,GAAkB,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAmCvF;;;;;GAKG;AACU,QAAA,qBAAqB,GAAkB,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;AAqC7G;;;;;GAKG;AACU,QAAA,eAAe,GAAkB,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC"}

package/dist/core/index.d.ts

@@ -0,0 +1,93 @@
+export * from './registry/index';
+export { RegistryFreezeService } from './registry/registry-freeze.service';
+export * from './pluggable/index';
+export * from './host/index';
+export { buildPermissionCatalog, catalogGrants, composePermissionCatalog, grantPermissions, permissionIds, permissionRegistry, registerPermissions, registerRoles, roleGrantRegistry, roleIds, roleRegistry, } from './permissions/index';
+export type { CatalogGrant, DeclarationList, Declarations, IdentifiedDeclaration, PermissionCatalog, PermissionCatalogDeclarations, PermissionCatalogEntry, PermissionCatalogSource, PermissionDeclaration, PermissionDeclarationMap, PermissionScope, RoleDeclaration, RoleDeclarationMap, RoleGrantDeclaration, RoleGrantEntry, } from './permissions/index';
+export type { BuiltinCredentialKind, BuiltinPrincipalKind, CredentialKindDef, GroupMembership, NodePrincipal, OrgMembership, Principal, PrincipalKindDef, Scope, SystemActor, TenancyMode, UserPrincipal, } from './principal/index';
+export { KIND_ID_PATTERN, UnknownCredentialKindError, credentialKindRegistry, isCredentialKind, principalKindRegistry, registerCredentialKind, registerPrincipalKind, requireCredentialKind, } from './principal/index';
+/**
+ * The principal kinds the platform knows, as an augmentable interface: an app
+ * adds a key to type its own kind (`service`) and registers the same id with
+ * `registerPrincipalKind`. The value type is unused.
+ *
+ * Declared here, in the module `@marinoscar/platform-api/core` resolves to, so
+ * the app's `declare module` merges in any file order.
+ *
+ * @extensionPoint schema
+ * @stability experimental
+ * @example
+ * ```ts
+ * declare module '@marinoscar/platform-api/core' {
+ *   interface PrincipalKinds { service: true }
+ * }
+ * ```
+ */
+export interface PrincipalKinds {
+    /** A human caller. */
+    user: true;
+    /** An unattended worker node. */
+    node: true;
+}
+/**
+ * The credential kinds the platform knows, as an augmentable interface: an app
+ * adds a key to type its own kind (`'api-key'`) and registers the same id with
+ * `registerCredentialKind`, naming the principal kind it authenticates as.
+ * The value type is unused.
+ *
+ * @extensionPoint schema
+ * @stability experimental
+ * @example
+ * ```ts
+ * declare module '@marinoscar/platform-api/core' {
+ *   interface CredentialKinds { 'api-key': true }
+ * }
+ * ```
+ */
+export interface CredentialKinds {
+    /** A browser access JWT. */
+    session: true;
+    /** A device-flow access JWT. */
+    device: true;
+    /** A `pat_` personal access token. */
+    pat: true;
+    /** A `nod_` worker-node credential. */
+    node: true;
+}
+/**
+ * Every principal kind, built-in and augmented: `keyof PrincipalKinds`. The
+ * unaugmented type is exactly `'user' | 'node'`.
+ *
+ * @stability experimental
+ */
+export type PrincipalKind = keyof PrincipalKinds;
+/**
+ * Every credential kind, built-in and augmented: `keyof CredentialKinds`. The
+ * unaugmented type is exactly `'session' | 'device' | 'pat' | 'node'`. A run-time
+ * check (`isCredentialKind`, `requireCredentialKind`) is still needed for a
+ * value that arrives as a string.
+ *
+ * @stability experimental
+ */
+export type CredentialKind = keyof CredentialKinds;
+export { HTTP_EXCEPTION_FILTER_OPTIONS, HttpExceptionFilter } from './errors/http-exception.filter';
+export type { HttpExceptionFilterOptions } from './errors/http-exception.filter';
+export { BUILTIN_ERROR_CODES, ERROR_CODE_PATTERN, FALLBACK_ERROR_CODE, defaultErrorCodeForStatus, errorCodeRegistry, isErrorCodeForStatus, registerErrorCode, } from './errors/error-codes';
+export type { ErrorCodeDef, ErrorMapper } from './errors/error-codes';
+export { withVerbatimErrorBody, hasVerbatimErrorBody } from './errors/verbatim-error-body.exception';
+export { DatabaseSeedException } from './errors/database-seed.exception';
+export { ErrorDto } from './errors/error.dto';
+export { ORG_CREDENTIAL_DOMAIN_PREFIX, USER_CREDENTIAL_DOMAIN_PREFIX, assertEncryptionKeyConfigured, decryptSecret, deriveSigningKey, encryptSecret, isCanonicalUuid, orgCredentialPurpose, userCredentialPurpose, } from './crypto/secret-cipher';
+export { verifyEncryptionKeyAtStartup } from './crypto/encryption-key-startup-check';
+export { OPENAPI_TAG_NAME_PATTERN, openApiTagGroups, openApiTags, } from './openapi/openapi-tag.registry';
+export type { OpenApiTag, OpenApiTagGroup } from './openapi/openapi-tag.registry';
+export { ScopedAccessError, asSystem, forUser, ownerFieldOf, ownerRelationOf, registerUserOwnedModels, userOwnedModelRegistry, userScopeExtension, } from './data-access/index';
+export type { ExportPolicy, ExtendableClient, PurgePolicy, UserOwnedModelDef, UserOwnedModelLookup, UserScopeExtension, } from './data-access/index';
+export { BUILTIN_SYSTEM_ACCESS_REASONS, RLS_SETTINGS, SYSTEM_ACCESS_REASONS, SYSTEM_ACCESS_REASON_ID_PATTERN, forOrg, forScope, forSystem, isSystemAccessReason, modelOwnershipRegistry, modelsOfKind, orgColumnOf, orgFieldOf, orgScopeExtension, registerModelOwnership, registerSystemAccessReason, runAsSystem, runInOrg, runInScope, systemAccessReasonRegistry, systemScopeExtension, } from './data-access/index';
+export type { BuiltinSystemAccessReason, ModelOwnershipDef, OrgScope, OrgScopedClient, OwnershipKind, RlsBaseClient, RlsRunnableClient, RlsTransactionClient, RlsTransactionOptions, SystemAccessReason, SystemAccessReasonDef, } from './data-access/index';
+export { ALLOW_DURING_MAINTENANCE_KEY, AllowDuringMaintenance } from './maintenance/allow-during-maintenance.decorator';
+export { ApiDataResponse } from './openapi/api-data-response.decorator';
+export type { ApiDataResponseOptions, DataResponsePagination } from './openapi/api-data-response.decorator';
+export { buildDatabaseUrl } from './database-url';
+export type { DatabaseEnv } from './database-url';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AASA,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAM3E,cAAc,mBAAmB,CAAC;AAKlC,cAAc,cAAc,CAAC;AAO7B,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,OAAO,EACP,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAI7B,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,WAAW,EACX,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC7B,sBAAsB;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,iCAAiC;IACjC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,4BAA4B;IAC5B,OAAO,EAAE,IAAI,CAAC;IACd,gCAAgC;IAChC,MAAM,EAAE,IAAI,CAAC;IACb,sCAAsC;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,uCAAuC;IACvC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC;AAInD,OAAO,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACpG,YAAY,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAEjF,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAM9C,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,WAAW,GACZ,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAMlF,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,qBAAqB,EACrB,+BAA+B,EAC/B,MAAM,EACN,QAAQ,EACR,SAAS,EACT,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACZ,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,QAAQ,EACR,UAAU,EACV,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,yBAAyB,EACzB,iBAAiB,EACjB,QAAQ,EACR,eAAe,EACf,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAC;AACxH,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,YAAY,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAI5G,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/core/index.js

@@ -0,0 +1,157 @@
+"use strict";
+// `@marinoscar/platform-api/core`: the primitives every other slice builds on
+// (issue #698): the typed registry primitive (issue #675, moved here by issue
+// #694) and the principal and scope contract (ADR 0001). Documented in
+// ./README.md. Explicit named exports below the registry barrel.
+//
+// `registry/index.ts` stays free of Nest so it can load where no container
+// exists (seeds, standalone scripts, import-time DTOs); `RegistryFreezeService`
+// is the one Nest-aware export and lives in its own file.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ownerFieldOf = exports.forUser = exports.asSystem = exports.ScopedAccessError = exports.openApiTags = exports.openApiTagGroups = exports.OPENAPI_TAG_NAME_PATTERN = exports.verifyEncryptionKeyAtStartup = exports.userCredentialPurpose = exports.orgCredentialPurpose = exports.isCanonicalUuid = exports.encryptSecret = exports.deriveSigningKey = exports.decryptSecret = exports.assertEncryptionKeyConfigured = exports.USER_CREDENTIAL_DOMAIN_PREFIX = exports.ORG_CREDENTIAL_DOMAIN_PREFIX = exports.ErrorDto = exports.DatabaseSeedException = exports.hasVerbatimErrorBody = exports.withVerbatimErrorBody = exports.registerErrorCode = exports.isErrorCodeForStatus = exports.errorCodeRegistry = exports.defaultErrorCodeForStatus = exports.FALLBACK_ERROR_CODE = exports.ERROR_CODE_PATTERN = exports.BUILTIN_ERROR_CODES = exports.HttpExceptionFilter = exports.HTTP_EXCEPTION_FILTER_OPTIONS = exports.requireCredentialKind = exports.registerPrincipalKind = exports.registerCredentialKind = exports.principalKindRegistry = exports.isCredentialKind = exports.credentialKindRegistry = exports.UnknownCredentialKindError = exports.KIND_ID_PATTERN = exports.roleRegistry = exports.roleIds = exports.roleGrantRegistry = exports.registerRoles = exports.registerPermissions = exports.permissionRegistry = exports.permissionIds = exports.grantPermissions = exports.composePermissionCatalog = exports.catalogGrants = exports.buildPermissionCatalog = exports.RegistryFreezeService = void 0;
+exports.buildDatabaseUrl = exports.ApiDataResponse = exports.AllowDuringMaintenance = exports.ALLOW_DURING_MAINTENANCE_KEY = exports.systemScopeExtension = exports.systemAccessReasonRegistry = exports.runInScope = exports.runInOrg = exports.runAsSystem = exports.registerSystemAccessReason = exports.registerModelOwnership = exports.orgScopeExtension = exports.orgFieldOf = exports.orgColumnOf = exports.modelsOfKind = exports.modelOwnershipRegistry = exports.isSystemAccessReason = exports.forSystem = exports.forScope = exports.forOrg = exports.SYSTEM_ACCESS_REASON_ID_PATTERN = exports.SYSTEM_ACCESS_REASONS = exports.RLS_SETTINGS = exports.BUILTIN_SYSTEM_ACCESS_REASONS = exports.userScopeExtension = exports.userOwnedModelRegistry = exports.registerUserOwnedModels = exports.ownerRelationOf = void 0;
+__exportStar(require("./registry/index"), exports);
+var registry_freeze_service_1 = require("./registry/registry-freeze.service");
+Object.defineProperty(exports, "RegistryFreezeService", { enumerable: true, get: function () { return registry_freeze_service_1.RegistryFreezeService; } });
+// The pluggable-kind primitive (PP-14.5, issue #923): one registry of
+// implementations per kind, each with its own settings schema, defaults and
+// declared secrets, plus the descriptors a generated form renders. Framework-
+// free like the registry. The conformance kit is `@marinoscar/platform-api/core/testing`.
+__exportStar(require("./pluggable/index"), exports);
+// The host ports (issue #696): the access port (`definePlatformHost`), the
+// DI-time ports (`AUDIT_SINK`, `SYSTEM_SETTINGS_STORE`, `PLATFORM_PRISMA`) and
+// `PlatformHostModule`, which binds them. Every packaged slice reuses them.
+__exportStar(require("./host/index"), exports);
+// Roles and permissions (issue #676, packaged by #866): the role and
+// permission registries every slice declares into, the declaration types, and
+// the seed catalog built from them. Framework-free, like the registry
+// primitive. The platform's own declarations, in seed order, are
+// `@marinoscar/platform-api/manifest`.
+var index_1 = require("./permissions/index");
+Object.defineProperty(exports, "buildPermissionCatalog", { enumerable: true, get: function () { return index_1.buildPermissionCatalog; } });
+Object.defineProperty(exports, "catalogGrants", { enumerable: true, get: function () { return index_1.catalogGrants; } });
+Object.defineProperty(exports, "composePermissionCatalog", { enumerable: true, get: function () { return index_1.composePermissionCatalog; } });
+Object.defineProperty(exports, "grantPermissions", { enumerable: true, get: function () { return index_1.grantPermissions; } });
+Object.defineProperty(exports, "permissionIds", { enumerable: true, get: function () { return index_1.permissionIds; } });
+Object.defineProperty(exports, "permissionRegistry", { enumerable: true, get: function () { return index_1.permissionRegistry; } });
+Object.defineProperty(exports, "registerPermissions", { enumerable: true, get: function () { return index_1.registerPermissions; } });
+Object.defineProperty(exports, "registerRoles", { enumerable: true, get: function () { return index_1.registerRoles; } });
+Object.defineProperty(exports, "roleGrantRegistry", { enumerable: true, get: function () { return index_1.roleGrantRegistry; } });
+Object.defineProperty(exports, "roleIds", { enumerable: true, get: function () { return index_1.roleIds; } });
+Object.defineProperty(exports, "roleRegistry", { enumerable: true, get: function () { return index_1.roleRegistry; } });
+var index_2 = require("./principal/index");
+Object.defineProperty(exports, "KIND_ID_PATTERN", { enumerable: true, get: function () { return index_2.KIND_ID_PATTERN; } });
+Object.defineProperty(exports, "UnknownCredentialKindError", { enumerable: true, get: function () { return index_2.UnknownCredentialKindError; } });
+Object.defineProperty(exports, "credentialKindRegistry", { enumerable: true, get: function () { return index_2.credentialKindRegistry; } });
+Object.defineProperty(exports, "isCredentialKind", { enumerable: true, get: function () { return index_2.isCredentialKind; } });
+Object.defineProperty(exports, "principalKindRegistry", { enumerable: true, get: function () { return index_2.principalKindRegistry; } });
+Object.defineProperty(exports, "registerCredentialKind", { enumerable: true, get: function () { return index_2.registerCredentialKind; } });
+Object.defineProperty(exports, "registerPrincipalKind", { enumerable: true, get: function () { return index_2.registerPrincipalKind; } });
+Object.defineProperty(exports, "requireCredentialKind", { enumerable: true, get: function () { return index_2.requireCredentialKind; } });
+// Errors: the application-wide exception filter, the error envelope's
+// OpenAPI DTO and the two exceptions that go with it (issue #698).
+var http_exception_filter_1 = require("./errors/http-exception.filter");
+Object.defineProperty(exports, "HTTP_EXCEPTION_FILTER_OPTIONS", { enumerable: true, get: function () { return http_exception_filter_1.HTTP_EXCEPTION_FILTER_OPTIONS; } });
+Object.defineProperty(exports, "HttpExceptionFilter", { enumerable: true, get: function () { return http_exception_filter_1.HttpExceptionFilter; } });
+// The open error code vocabulary and the foreign-error mapper contract (PP-14.14).
+var error_codes_1 = require("./errors/error-codes");
+Object.defineProperty(exports, "BUILTIN_ERROR_CODES", { enumerable: true, get: function () { return error_codes_1.BUILTIN_ERROR_CODES; } });
+Object.defineProperty(exports, "ERROR_CODE_PATTERN", { enumerable: true, get: function () { return error_codes_1.ERROR_CODE_PATTERN; } });
+Object.defineProperty(exports, "FALLBACK_ERROR_CODE", { enumerable: true, get: function () { return error_codes_1.FALLBACK_ERROR_CODE; } });
+Object.defineProperty(exports, "defaultErrorCodeForStatus", { enumerable: true, get: function () { return error_codes_1.defaultErrorCodeForStatus; } });
+Object.defineProperty(exports, "errorCodeRegistry", { enumerable: true, get: function () { return error_codes_1.errorCodeRegistry; } });
+Object.defineProperty(exports, "isErrorCodeForStatus", { enumerable: true, get: function () { return error_codes_1.isErrorCodeForStatus; } });
+Object.defineProperty(exports, "registerErrorCode", { enumerable: true, get: function () { return error_codes_1.registerErrorCode; } });
+var verbatim_error_body_exception_1 = require("./errors/verbatim-error-body.exception");
+Object.defineProperty(exports, "withVerbatimErrorBody", { enumerable: true, get: function () { return verbatim_error_body_exception_1.withVerbatimErrorBody; } });
+Object.defineProperty(exports, "hasVerbatimErrorBody", { enumerable: true, get: function () { return verbatim_error_body_exception_1.hasVerbatimErrorBody; } });
+var database_seed_exception_1 = require("./errors/database-seed.exception");
+Object.defineProperty(exports, "DatabaseSeedException", { enumerable: true, get: function () { return database_seed_exception_1.DatabaseSeedException; } });
+var error_dto_1 = require("./errors/error.dto");
+Object.defineProperty(exports, "ErrorDto", { enumerable: true, get: function () { return error_dto_1.ErrorDto; } });
+// Crypto: the AES-256-GCM secret cipher under every runtime-configured
+// credential, and its bootstrap check (issue #698), plus HMAC signing sub-keys
+// from the same master key (issue #822). The cipher reads
+// SECRETS_ENCRYPTION_KEY from the environment once and caches it.
+var secret_cipher_1 = require("./crypto/secret-cipher");
+Object.defineProperty(exports, "ORG_CREDENTIAL_DOMAIN_PREFIX", { enumerable: true, get: function () { return secret_cipher_1.ORG_CREDENTIAL_DOMAIN_PREFIX; } });
+Object.defineProperty(exports, "USER_CREDENTIAL_DOMAIN_PREFIX", { enumerable: true, get: function () { return secret_cipher_1.USER_CREDENTIAL_DOMAIN_PREFIX; } });
+Object.defineProperty(exports, "assertEncryptionKeyConfigured", { enumerable: true, get: function () { return secret_cipher_1.assertEncryptionKeyConfigured; } });
+Object.defineProperty(exports, "decryptSecret", { enumerable: true, get: function () { return secret_cipher_1.decryptSecret; } });
+Object.defineProperty(exports, "deriveSigningKey", { enumerable: true, get: function () { return secret_cipher_1.deriveSigningKey; } });
+Object.defineProperty(exports, "encryptSecret", { enumerable: true, get: function () { return secret_cipher_1.encryptSecret; } });
+Object.defineProperty(exports, "isCanonicalUuid", { enumerable: true, get: function () { return secret_cipher_1.isCanonicalUuid; } });
+Object.defineProperty(exports, "orgCredentialPurpose", { enumerable: true, get: function () { return secret_cipher_1.orgCredentialPurpose; } });
+Object.defineProperty(exports, "userCredentialPurpose", { enumerable: true, get: function () { return secret_cipher_1.userCredentialPurpose; } });
+var encryption_key_startup_check_1 = require("./crypto/encryption-key-startup-check");
+Object.defineProperty(exports, "verifyEncryptionKeyAtStartup", { enumerable: true, get: function () { return encryption_key_startup_check_1.verifyEncryptionKeyAtStartup; } });
+// OpenAPI tag registry: apps and slices register the @ApiTags names their
+// controllers use, with a description and a sidebar group (issue #698).
+var openapi_tag_registry_1 = require("./openapi/openapi-tag.registry");
+Object.defineProperty(exports, "OPENAPI_TAG_NAME_PATTERN", { enumerable: true, get: function () { return openapi_tag_registry_1.OPENAPI_TAG_NAME_PATTERN; } });
+Object.defineProperty(exports, "openApiTagGroups", { enumerable: true, get: function () { return openapi_tag_registry_1.openApiTagGroups; } });
+Object.defineProperty(exports, "openApiTags", { enumerable: true, get: function () { return openapi_tag_registry_1.openApiTags; } });
+// Scoped data access (issue #699; origin #688): the user-owned data registry,
+// the user-scoped client extension and the explicit unscoped escape. The app
+// fills the registry and injects its generated client; nothing here imports a
+// generated model type (`@prisma/client/extension` only).
+var index_3 = require("./data-access/index");
+Object.defineProperty(exports, "ScopedAccessError", { enumerable: true, get: function () { return index_3.ScopedAccessError; } });
+Object.defineProperty(exports, "asSystem", { enumerable: true, get: function () { return index_3.asSystem; } });
+Object.defineProperty(exports, "forUser", { enumerable: true, get: function () { return index_3.forUser; } });
+Object.defineProperty(exports, "ownerFieldOf", { enumerable: true, get: function () { return index_3.ownerFieldOf; } });
+Object.defineProperty(exports, "ownerRelationOf", { enumerable: true, get: function () { return index_3.ownerRelationOf; } });
+Object.defineProperty(exports, "registerUserOwnedModels", { enumerable: true, get: function () { return index_3.registerUserOwnedModels; } });
+Object.defineProperty(exports, "userOwnedModelRegistry", { enumerable: true, get: function () { return index_3.userOwnedModelRegistry; } });
+Object.defineProperty(exports, "userScopeExtension", { enumerable: true, get: function () { return index_3.userScopeExtension; } });
+// Organisation scoping and row-level security (issue #725; ADR 0002 D5): the
+// transaction-local `forOrg` / `runInOrg` shapes, the bypass shapes for the
+// separate system client, and the model ownership registry.
+var index_4 = require("./data-access/index");
+Object.defineProperty(exports, "BUILTIN_SYSTEM_ACCESS_REASONS", { enumerable: true, get: function () { return index_4.BUILTIN_SYSTEM_ACCESS_REASONS; } });
+Object.defineProperty(exports, "RLS_SETTINGS", { enumerable: true, get: function () { return index_4.RLS_SETTINGS; } });
+Object.defineProperty(exports, "SYSTEM_ACCESS_REASONS", { enumerable: true, get: function () { return index_4.SYSTEM_ACCESS_REASONS; } });
+Object.defineProperty(exports, "SYSTEM_ACCESS_REASON_ID_PATTERN", { enumerable: true, get: function () { return index_4.SYSTEM_ACCESS_REASON_ID_PATTERN; } });
+Object.defineProperty(exports, "forOrg", { enumerable: true, get: function () { return index_4.forOrg; } });
+Object.defineProperty(exports, "forScope", { enumerable: true, get: function () { return index_4.forScope; } });
+Object.defineProperty(exports, "forSystem", { enumerable: true, get: function () { return index_4.forSystem; } });
+Object.defineProperty(exports, "isSystemAccessReason", { enumerable: true, get: function () { return index_4.isSystemAccessReason; } });
+Object.defineProperty(exports, "modelOwnershipRegistry", { enumerable: true, get: function () { return index_4.modelOwnershipRegistry; } });
+Object.defineProperty(exports, "modelsOfKind", { enumerable: true, get: function () { return index_4.modelsOfKind; } });
+Object.defineProperty(exports, "orgColumnOf", { enumerable: true, get: function () { return index_4.orgColumnOf; } });
+Object.defineProperty(exports, "orgFieldOf", { enumerable: true, get: function () { return index_4.orgFieldOf; } });
+Object.defineProperty(exports, "orgScopeExtension", { enumerable: true, get: function () { return index_4.orgScopeExtension; } });
+Object.defineProperty(exports, "registerModelOwnership", { enumerable: true, get: function () { return index_4.registerModelOwnership; } });
+Object.defineProperty(exports, "registerSystemAccessReason", { enumerable: true, get: function () { return index_4.registerSystemAccessReason; } });
+Object.defineProperty(exports, "runAsSystem", { enumerable: true, get: function () { return index_4.runAsSystem; } });
+Object.defineProperty(exports, "runInOrg", { enumerable: true, get: function () { return index_4.runInOrg; } });
+Object.defineProperty(exports, "runInScope", { enumerable: true, get: function () { return index_4.runInScope; } });
+Object.defineProperty(exports, "systemAccessReasonRegistry", { enumerable: true, get: function () { return index_4.systemAccessReasonRegistry; } });
+Object.defineProperty(exports, "systemScopeExtension", { enumerable: true, get: function () { return index_4.systemScopeExtension; } });
+// Cross-cutting decorators every packaged controller needs (issue #727): the
+// maintenance-window exemption the app's `MaintenanceGuard` reads, and the
+// `{ data: … }` envelope response documentation.
+var allow_during_maintenance_decorator_1 = require("./maintenance/allow-during-maintenance.decorator");
+Object.defineProperty(exports, "ALLOW_DURING_MAINTENANCE_KEY", { enumerable: true, get: function () { return allow_during_maintenance_decorator_1.ALLOW_DURING_MAINTENANCE_KEY; } });
+Object.defineProperty(exports, "AllowDuringMaintenance", { enumerable: true, get: function () { return allow_during_maintenance_decorator_1.AllowDuringMaintenance; } });
+var api_data_response_decorator_1 = require("./openapi/api-data-response.decorator");
+Object.defineProperty(exports, "ApiDataResponse", { enumerable: true, get: function () { return api_data_response_decorator_1.ApiDataResponse; } });
+// The PostgreSQL connection string from `POSTGRES_*` (issue #172; packaged by
+// #740 for the db-backup slice's dump, restore and admin connections).
+var database_url_1 = require("./database-url");
+Object.defineProperty(exports, "buildDatabaseUrl", { enumerable: true, get: function () { return database_url_1.buildDatabaseUrl; } });
+//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,0DAA0D;;;;;;;;;;;;;;;;;;AAE1D,mDAAiC;AACjC,8EAA2E;AAAlE,gIAAA,qBAAqB,OAAA;AAE9B,sEAAsE;AACtE,4EAA4E;AAC5E,8EAA8E;AAC9E,0FAA0F;AAC1F,oDAAkC;AAElC,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,+CAA6B;AAE7B,qEAAqE;AACrE,8EAA8E;AAC9E,sEAAsE;AACtE,iEAAiE;AACjE,uCAAuC;AACvC,6CAY6B;AAX3B,+GAAA,sBAAsB,OAAA;AACtB,sGAAA,aAAa,OAAA;AACb,iHAAA,wBAAwB,OAAA;AACxB,yGAAA,gBAAgB,OAAA;AAChB,sGAAA,aAAa,OAAA;AACb,2GAAA,kBAAkB,OAAA;AAClB,4GAAA,mBAAmB,OAAA;AACnB,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,gGAAA,OAAO,OAAA;AACP,qGAAA,YAAY,OAAA;AAoCd,2CAS2B;AARzB,wGAAA,eAAe,OAAA;AACf,mHAAA,0BAA0B,OAAA;AAC1B,+GAAA,sBAAsB,OAAA;AACtB,yGAAA,gBAAgB,OAAA;AAChB,8GAAA,qBAAqB,OAAA;AACrB,+GAAA,sBAAsB,OAAA;AACtB,8GAAA,qBAAqB,OAAA;AACrB,8GAAA,qBAAqB,OAAA;AAyEvB,sEAAsE;AACtE,mEAAmE;AACnE,wEAAoG;AAA3F,sIAAA,6BAA6B,OAAA;AAAE,4HAAA,mBAAmB,OAAA;AAE3D,mFAAmF;AACnF,oDAQ8B;AAP5B,kHAAA,mBAAmB,OAAA;AACnB,iHAAA,kBAAkB,OAAA;AAClB,kHAAA,mBAAmB,OAAA;AACnB,wHAAA,yBAAyB,OAAA;AACzB,gHAAA,iBAAiB,OAAA;AACjB,mHAAA,oBAAoB,OAAA;AACpB,gHAAA,iBAAiB,OAAA;AAGnB,wFAAqG;AAA5F,sIAAA,qBAAqB,OAAA;AAAE,qIAAA,oBAAoB,OAAA;AACpD,4EAAyE;AAAhE,gIAAA,qBAAqB,OAAA;AAC9B,gDAA8C;AAArC,qGAAA,QAAQ,OAAA;AAEjB,uEAAuE;AACvE,+EAA+E;AAC/E,0DAA0D;AAC1D,kEAAkE;AAClE,wDAUgC;AAT9B,6HAAA,4BAA4B,OAAA;AAC5B,8HAAA,6BAA6B,OAAA;AAC7B,8HAAA,6BAA6B,OAAA;AAC7B,8GAAA,aAAa,OAAA;AACb,iHAAA,gBAAgB,OAAA;AAChB,8GAAA,aAAa,OAAA;AACb,gHAAA,eAAe,OAAA;AACf,qHAAA,oBAAoB,OAAA;AACpB,sHAAA,qBAAqB,OAAA;AAEvB,sFAAqF;AAA5E,4IAAA,4BAA4B,OAAA;AAErC,0EAA0E;AAC1E,wEAAwE;AACxE,uEAIwC;AAHtC,gIAAA,wBAAwB,OAAA;AACxB,wHAAA,gBAAgB,OAAA;AAChB,mHAAA,WAAW,OAAA;AAIb,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,0DAA0D;AAC1D,6CAS6B;AAR3B,0GAAA,iBAAiB,OAAA;AACjB,iGAAA,QAAQ,OAAA;AACR,gGAAA,OAAO,OAAA;AACP,qGAAA,YAAY,OAAA;AACZ,wGAAA,eAAe,OAAA;AACf,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,2GAAA,kBAAkB,OAAA;AAWpB,6EAA6E;AAC7E,4EAA4E;AAC5E,4DAA4D;AAC5D,6CAqB6B;AApB3B,sHAAA,6BAA6B,OAAA;AAC7B,qGAAA,YAAY,OAAA;AACZ,8GAAA,qBAAqB,OAAA;AACrB,wHAAA,+BAA+B,OAAA;AAC/B,+FAAA,MAAM,OAAA;AACN,iGAAA,QAAQ,OAAA;AACR,kGAAA,SAAS,OAAA;AACT,6GAAA,oBAAoB,OAAA;AACpB,+GAAA,sBAAsB,OAAA;AACtB,qGAAA,YAAY,OAAA;AACZ,oGAAA,WAAW,OAAA;AACX,mGAAA,UAAU,OAAA;AACV,0GAAA,iBAAiB,OAAA;AACjB,+GAAA,sBAAsB,OAAA;AACtB,mHAAA,0BAA0B,OAAA;AAC1B,oGAAA,WAAW,OAAA;AACX,iGAAA,QAAQ,OAAA;AACR,mGAAA,UAAU,OAAA;AACV,mHAAA,0BAA0B,OAAA;AAC1B,6GAAA,oBAAoB,OAAA;AAgBtB,6EAA6E;AAC7E,2EAA2E;AAC3E,iDAAiD;AACjD,uGAAwH;AAA/G,kJAAA,4BAA4B,OAAA;AAAE,4IAAA,sBAAsB,OAAA;AAC7D,qFAAwE;AAA/D,8HAAA,eAAe,OAAA;AAGxB,8EAA8E;AAC9E,uEAAuE;AACvE,+CAAkD;AAAzC,gHAAA,gBAAgB,OAAA"}

package/dist/core/maintenance/allow-during-maintenance.decorator.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Reflector key stamped by {@link AllowDuringMaintenance}.
+ *
+ * @stability stable
+ */
+export declare const ALLOW_DURING_MAINTENANCE_KEY = "allowDuringMaintenance";
+/**
+ * Exempts a route (or a whole controller) from the maintenance window.
+ *
+ * WHAT THIS IS NOT: `@Public()`. That decorator answers "does this route need a
+ * token?"; this one answers "may this route be served while the application is
+ * deliberately out of service?". They are independent: `GET /api/auth/me` needs
+ * a token and must still answer during a window, while a public read endpoint
+ * must NOT be reachable merely because it is public.
+ *
+ * Read with `getAllAndOverride([handler, class])`, so a controller-level
+ * exemption covers its routes and a handler may not be un-exempted piecemeal.
+ * A missing exemption on a sign-in route locks every user out during a window,
+ * including the administrator who would end it.
+ *
+ * @returns a decorator for a handler or a controller class.
+ *
+ * @example
+ * ```ts
+ * @AllowDuringMaintenance()
+ * @Controller('health')
+ * export class HealthController {}
+ * ```
+ *
+ * @stability stable
+ */
+export declare const AllowDuringMaintenance: () => MethodDecorator & ClassDecorator;
+//# sourceMappingURL=allow-during-maintenance.decorator.d.ts.map

package/dist/core/maintenance/allow-during-maintenance.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-during-maintenance.decorator.d.ts","sourceRoot":"","sources":["../../../src/core/maintenance/allow-during-maintenance.decorator.ts"],"names":[],"mappings":"AAaA;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,sBAAsB,QAAO,eAAe,GAAG,cACX,CAAC"}

package/dist/core/maintenance/allow-during-maintenance.decorator.js

@@ -0,0 +1,48 @@
+"use strict";
+// =============================================================================
+// The maintenance-window exemption (issue #257; moved into
+// `@marinoscar/platform-api/core` by #727 so packaged controllers can carry it)
+// =============================================================================
+//
+// The app's `MaintenanceGuard` reads the metadata this stamps; a packaged
+// controller (the identity slice's sign-in routes) stamps it without importing
+// the app. The key string is unchanged, so the app's guard and every existing
+// route behave exactly as before.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AllowDuringMaintenance = exports.ALLOW_DURING_MAINTENANCE_KEY = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Reflector key stamped by {@link AllowDuringMaintenance}.
+ *
+ * @stability stable
+ */
+exports.ALLOW_DURING_MAINTENANCE_KEY = 'allowDuringMaintenance';
+/**
+ * Exempts a route (or a whole controller) from the maintenance window.
+ *
+ * WHAT THIS IS NOT: `@Public()`. That decorator answers "does this route need a
+ * token?"; this one answers "may this route be served while the application is
+ * deliberately out of service?". They are independent: `GET /api/auth/me` needs
+ * a token and must still answer during a window, while a public read endpoint
+ * must NOT be reachable merely because it is public.
+ *
+ * Read with `getAllAndOverride([handler, class])`, so a controller-level
+ * exemption covers its routes and a handler may not be un-exempted piecemeal.
+ * A missing exemption on a sign-in route locks every user out during a window,
+ * including the administrator who would end it.
+ *
+ * @returns a decorator for a handler or a controller class.
+ *
+ * @example
+ * ```ts
+ * @AllowDuringMaintenance()
+ * @Controller('health')
+ * export class HealthController {}
+ * ```
+ *
+ * @stability stable
+ */
+const AllowDuringMaintenance = () => (0, common_1.SetMetadata)(exports.ALLOW_DURING_MAINTENANCE_KEY, true);
+exports.AllowDuringMaintenance = AllowDuringMaintenance;
+//# sourceMappingURL=allow-during-maintenance.decorator.js.map

package/dist/core/maintenance/allow-during-maintenance.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-during-maintenance.decorator.js","sourceRoot":"","sources":["../../../src/core/maintenance/allow-during-maintenance.decorator.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,2DAA2D;AAC3D,gFAAgF;AAChF,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,kCAAkC;AAClC,gFAAgF;;;AAEhF,2CAA6C;AAE7C;;;;GAIG;AACU,QAAA,4BAA4B,GAAG,wBAAwB,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACI,MAAM,sBAAsB,GAAG,GAAqC,EAAE,CAC3E,IAAA,oBAAW,EAAC,oCAA4B,EAAE,IAAI,CAAC,CAAC;AADrC,QAAA,sBAAsB,0BACe"}

package/dist/core/openapi/api-data-response.decorator.d.ts

@@ -0,0 +1,72 @@
+import { Type } from '@nestjs/common';
+/**
+ * Which of this API's two list-body shapes an endpoint returns.
+ *
+ * Both are offset-paginated and both are wrapped in the `{ data: … }` envelope
+ * by the global interceptor; they differ in where the counts sit *inside*
+ * `data`. Note that neither puts `meta` as a SIBLING of `data` — the envelope's
+ * own `meta` carries only the server timestamp.
+ *
+ *  - `flat`   — `GET /api/users`, `GET /api/allowlist`:
+ *               `{ items, total, page, pageSize, totalPages }`
+ *  - `nested` — `GET /api/storage/objects`:
+ *               `{ items, meta: { page, pageSize, totalItems, totalPages } }`
+ *
+ * Two shapes for the same concept is a defect, not a design; it is described
+ * faithfully here (and in `info.description`) rather than smoothed over,
+ * because unifying them is a breaking change tracked separately and a client
+ * written against this document has to handle what the server sends today.
+ *
+ * @stability stable
+ */
+export type DataResponsePagination = 'flat' | 'nested';
+/**
+ * Options of {@link ApiDataResponse}.
+ *
+ * @stability stable
+ */
+export interface ApiDataResponseOptions {
+    /** The HTTP status documented; 200 by default. */
+    status?: number;
+    /** The response's description. */
+    description?: string;
+    /** Wrap the model in an array: `{ data: [T] }`. */
+    isArray?: boolean;
+    /** Describe `data` as a paginated list of the model in the given shape. */
+    pagination?: DataResponsePagination;
+}
+/**
+ * Documents a response that wraps its payload in the `{ data: … }` envelope the
+ * global `TransformInterceptor` produces.
+ *
+ * Exists because the two were routinely out of sync: a handler returning
+ * `{ data: { … } }` documented with `@ApiResponse({ type: Dto })` advertises the
+ * bare inner object, so a generated client, a Postman import, or anyone reading
+ * the sample gets a shape the server never sends. Declaring the envelope once,
+ * here, removes the opportunity to describe it wrongly.
+ *
+ * Most operations need nothing: `applyDataEnvelope` performs the same wrapping
+ * over the whole finished document. Reach for this decorator where the payload
+ * has no DTO to point at — the paginated lists, whose envelope contents are
+ * assembled in the service rather than declared by a type.
+ *
+ * @example
+ * ```ts
+ * // A flat paginated list, and a nested one.
+ * class Examples {
+ *   @ApiDataResponse(UserResponseDto, { pagination: 'flat', description: 'Paginated user list' })
+ *   users() {}
+ *
+ *   @ApiDataResponse(ObjectResponseDto, { pagination: 'nested' })
+ *   objects() {}
+ * }
+ * ```
+ *
+ * @param model - the payload's DTO class, or several for a `oneOf` union.
+ * @param options - status, description, array or pagination shape.
+ * @returns the composed `ApiExtraModels` + `ApiResponse` decorator.
+ *
+ * @stability stable
+ */
+export declare function ApiDataResponse(model: Type<unknown> | readonly Type<unknown>[], options?: ApiDataResponseOptions): <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;
+//# sourceMappingURL=api-data-response.decorator.d.ts.map

package/dist/core/openapi/api-data-response.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-data-response.decorator.d.ts","sourceRoot":"","sources":["../../../src/core/openapi/api-data-response.decorator.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,IAAI,EAAmB,MAAM,gBAAgB,CAAC;AAMvD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AA6BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,SAAS,IAAI,CAAC,OAAO,CAAC,EAAE,EAC/C,OAAO,GAAE,sBAA2B,+IA0ErC"}