@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.5

package/dist/identity/ports.d.ts

@@ -0,0 +1,396 @@
+import type { Logger } from '@nestjs/common';
+import type { AuthenticatedUser } from './auth/interfaces/authenticated-user.interface';
+export type { IdentityPrisma } from './data/identity-db';
+/**
+ * Injection token of the app's {@link IdentityNotifier}. The app binds it to
+ * its notification dispatcher, so identity does not import the notifications
+ * slice (identity sits above it in the dependency graph).
+ *
+ * @example
+ * ```ts
+ * IdentityModule.forRoot({ imports: [IdentityHostModule] });
+ * // IdentityHostModule: { provide: IDENTITY_NOTIFIER, useClass: NotificationsIdentityNotifier }
+ * ```
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const IDENTITY_NOTIFIER: unique symbol;
+/**
+ * A user's roles changed (a system administrator edited them, or an
+ * organization administrator changed the member's org role).
+ *
+ * @stability experimental
+ */
+export interface RoleChangedNotice {
+    /** The account whose roles changed. */
+    recipientEmail: string;
+    /** Roles held before the change, as stored. May be empty. */
+    previousRoles: string[];
+    /** Roles held after the change, as stored. May be empty. */
+    currentRoles: string[];
+    /** When the change was made. */
+    changedAt: Date;
+    /** Absolute URL of the application root, when `APP_URL` is configured. */
+    appUrl?: string;
+}
+/**
+ * A user record was created by a sign-in.
+ *
+ * @stability experimental
+ */
+export interface UserWelcomeNotice {
+    /** The address the account was created under. */
+    recipientEmail: string;
+    /** The provider's display name, when it supplied one. Attacker-influenced: escape it. */
+    recipientName?: string;
+    /** Roles the new account was given, as stored. */
+    roles: string[];
+    /** Absolute URL of the application root, when `APP_URL` is configured. */
+    appUrl?: string;
+}
+/**
+ * An administrator added an address to the allowlist.
+ *
+ * @stability experimental
+ */
+export interface AllowlistInvitationNotice {
+    /** The allowlisted address, the one they must sign in with. */
+    recipientEmail: string;
+    /** Who added them (display name or email), when known. Disclosed on purpose. */
+    invitedBy?: string;
+    /** Absolute URL of the sign-in page, when `APP_URL` is configured. */
+    signInUrl?: string;
+}
+/**
+ * An organization administrator invited an address to an organization.
+ *
+ * @stability experimental
+ */
+export interface OrgInvitationNotice {
+    /** The invited address, the one they must sign in with. */
+    recipientEmail: string;
+    /** The organization's display name. */
+    orgName: string;
+    /** The org role they will hold (`org_admin`, `contributor`, `viewer`). */
+    roleName: string;
+    /** Who invited them (display name or email), when known. Disclosed on purpose. */
+    invitedBy?: string;
+    /** Absolute URL of the sign-in page, when `APP_URL` is configured. */
+    signInUrl?: string;
+}
+/**
+ * Where identity raises the four notifications it owns. Every method is called
+ * AFTER the triggering write committed and outside any transaction, and must
+ * not throw for a delivery failure (the app's dispatcher records it).
+ *
+ * @stability experimental
+ */
+export interface IdentityNotifier {
+    /**
+     * A user's roles changed.
+     *
+     * @param userId - the user whose roles changed.
+     * @param notice - what changed.
+     */
+    roleChanged(userId: string, notice: RoleChangedNotice): Promise<void>;
+    /**
+     * A user record was created by a sign-in.
+     *
+     * @param userId - the new user.
+     * @param notice - the welcome content.
+     */
+    userWelcomed(userId: string, notice: UserWelcomeNotice): Promise<void>;
+    /**
+     * An address was allowlisted. Sent to an address, not a user: the person
+     * has no account yet.
+     *
+     * @param email - the allowlisted address.
+     * @param notice - the invitation content.
+     */
+    allowlistInvitation(email: string, notice: AllowlistInvitationNotice): Promise<void>;
+    /**
+     * An address was invited to an organization. Sent to an address.
+     *
+     * @param email - the invited address.
+     * @param notice - the invitation content.
+     */
+    orgInvitation(email: string, notice: OrgInvitationNotice): Promise<void>;
+}
+/**
+ * Injection token of the app's {@link UserDefaults}: what a new user's
+ * settings row holds at creation.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const USER_DEFAULTS: unique symbol;
+/**
+ * Defaults applied when identity creates a user (a first sign-in, or the
+ * test-auth login).
+ *
+ * @stability experimental
+ */
+export interface UserDefaults {
+    /**
+     * The `user_settings.value` a new user starts with. Called once per created
+     * user; return a fresh object.
+     */
+    userSettings(): Record<string, unknown>;
+}
+/**
+ * Injection token of the app's {@link IdentityProfileImages}: how a user's
+ * picture is resolved from their stored profile settings.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const IDENTITY_PROFILE_IMAGES: unique symbol;
+/**
+ * Profile pictures, as `/api/auth/me` and `/api/users` report them. The
+ * picture lives in the user's settings (`profile.imageSource`) and in object
+ * storage, which identity does not own.
+ *
+ * @stability experimental
+ */
+export interface IdentityProfileImages {
+    /**
+     * The picture representing the user, or `null`.
+     *
+     * @param user - the user's id and provider picture.
+     * @param storedProfile - the raw `profile` value of their settings, unvalidated.
+     */
+    resolveImageUrl(user: {
+        id: string;
+        providerProfileImageUrl: string | null;
+    }, storedProfile: unknown): string | null;
+    /**
+     * Whether an uploaded picture is stored, whichever source is selected.
+     *
+     * @param storedProfile - the raw `profile` value of their settings, unvalidated.
+     */
+    hasUploadedImage(storedProfile: unknown): boolean;
+}
+/**
+ * Injection token of the credential store a sign-in provider reads its secrets
+ * from (`AuthProviderContext.credentials`). The app binds it to its
+ * `CredentialsService` (`@marinoscar/platform-api/credentials`), which satisfies
+ * {@link AuthProviderCredentials}; identity does not import the credentials
+ * slice. Optional: without it every secret reads as absent, so a provider that
+ * keeps its secrets in the store is off (Google, which reads the environment, is
+ * unaffected).
+ *
+ * @example
+ * ```ts
+ * { provide: IDENTITY_AUTH_CREDENTIALS, useExisting: CredentialsService }
+ * ```
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const IDENTITY_AUTH_CREDENTIALS: unique symbol;
+export type { AuthProviderCredentials } from './auth/providers/auth-provider.registry';
+/**
+ * Injection token of the app's {@link IdentityMetrics}. Optional: without it
+ * identity records nothing.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const IDENTITY_METRICS: unique symbol;
+/**
+ * How a sign-in ended (`app.auth.logins` `outcome`), for any provider. Closed,
+ * bounded: a refusal by the allowlist, by the app's `SignInPolicy` or for an
+ * unverified provider address is `allowlist_rejected` (admission refused).
+ *
+ * @stability experimental
+ */
+export type IdentityLoginOutcome = 'success' | 'allowlist_rejected' | 'disabled' | 'no_organization';
+/**
+ * How a refresh-token rotation ended (`app.auth.refreshes` `outcome`). Closed, bounded.
+ *
+ * @stability experimental
+ */
+export type IdentityRefreshOutcome = 'success' | 'invalid' | 'expired' | 'reuse_detected' | 'user_inactive' | 'device_revoked' | 'no_organization';
+/**
+ * The app's metric instruments, as identity records into them. The reference
+ * app binds its `AppMetricsService` (same instruments, same labels as before
+ * the move: dashboards depend on them).
+ *
+ * @stability experimental
+ */
+export interface IdentityMetrics {
+    /**
+     * One sign-in attempt (`app.auth.logins`).
+     *
+     * @param outcome - how it ended.
+     * @param provider - the provider id; `'google'` by default.
+     */
+    authLogin(outcome: IdentityLoginOutcome, provider?: string): void;
+    /**
+     * One refresh-token rotation (`app.auth.refreshes`).
+     *
+     * @param outcome - how it ended.
+     */
+    authRefresh(outcome: IdentityRefreshOutcome): void;
+    /**
+     * Adds to a registered counter (`orgInvitesCreated`, `orgMembersRemoved`).
+     *
+     * @param key - the counter's registry key.
+     * @param value - the increment; 1 by default.
+     */
+    add(key: string, value?: number): void;
+}
+/**
+ * The metrics used when the app binds none: every call is a no-op.
+ *
+ * @stability experimental
+ */
+export declare const NOOP_IDENTITY_METRICS: IdentityMetrics;
+/**
+ * Injection token of the app's {@link IdentityJobsPort}.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const IDENTITY_JOBS: unique symbol;
+/**
+ * The columns of one queue job identity's handlers read.
+ *
+ * @stability experimental
+ */
+export interface IdentityJobRecord {
+    /** The job id. */
+    id: string;
+}
+/**
+ * An identity job type's handler, structurally the app's `JobHandler`. Both
+ * identity job types (`auth.token.cleanup`, `auth.device-code.cleanup`) are
+ * SERVER-ONLY: they delete credential rows, a privilege a worker node never
+ * holds, so they declare no `nodeResultSchema` and no `persistNodeResult`.
+ *
+ * @stability experimental
+ */
+export interface IdentityJobHandler {
+    /** The job type. Permanent once jobs of it exist. */
+    readonly type: string;
+    /**
+     * Runs one job; throws to fail it.
+     *
+     * @param job - the claimed job.
+     */
+    process(job: IdentityJobRecord): Promise<void>;
+}
+/**
+ * The app's job queue, as identity uses it: an enqueue-only cron and a handler
+ * registration.
+ *
+ * @stability experimental
+ */
+export interface IdentityJobsPort {
+    /**
+     * Queues one global housekeeping job of `type` unless one is pending or
+     * running. Never throws: a failure is logged on `logger`.
+     *
+     * @param options - the type, a lower-case phrase for the log line, and the caller's logger.
+     */
+    enqueueHousekeepingJob(options: {
+        type: string;
+        what: string;
+        logger: Logger;
+    }): Promise<void>;
+    /**
+     * Registers a handler with the queue's dispatcher. Called from `onModuleInit`.
+     *
+     * @param handler - the handler.
+     */
+    registerHandler(handler: IdentityJobHandler): void;
+}
+/**
+ * Injection token of the app's {@link IdentityNodeCredentials}: how a `nod_`
+ * bearer token is resolved. Must be bound by a GLOBAL module: `JwtAuthGuard`
+ * is instantiated in every module whose controllers use `@Auth()`.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const IDENTITY_NODE_CREDENTIALS: unique symbol;
+/**
+ * The app's worker-node credential store, as `JwtAuthGuard` uses it.
+ *
+ * @stability experimental
+ */
+export interface IdentityNodeCredentials {
+    /**
+     * The owner of a live `nod_` token, loaded as a request user, or `null` for
+     * an unknown, revoked or expired one.
+     *
+     * @param token - the raw `nod_...` token.
+     */
+    validateToken(token: string): Promise<AuthenticatedUser | null>;
+}
+/**
+ * Injection token of the app's cross-replica {@link IdentityEventBus}.
+ * Optional: without it the principal cache invalidates in this process only.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const IDENTITY_EVENT_BUS: unique symbol;
+/**
+ * Where a bus message came from.
+ *
+ * @stability experimental
+ */
+export interface IdentityEventBusMeta {
+    /** The publishing process's origin id. */
+    origin: string;
+    /** Whether this process published it. */
+    local: boolean;
+}
+/**
+ * The bus's health, as the `auth.principal-cache` Doctor check reports it.
+ *
+ * @stability experimental
+ */
+export interface IdentityEventBusHealth {
+    /** The adapter's name (`in-process`, `postgres`). */
+    adapter: string;
+    /** Whether it is connected. */
+    connected: boolean;
+    /** The last error, or `null`. */
+    lastError: string | null;
+    /** When it last connected (ISO 8601), or `null`. */
+    lastConnectedAt: string | null;
+    /** Publishes that failed. */
+    publishFailures: number;
+    /** Reconnections so far. */
+    reconnects: number;
+}
+/**
+ * The app's event bus, as the principal cache uses it: cross-replica
+ * invalidation on one channel. The reference app binds its `EVENT_BUS`.
+ *
+ * @stability experimental
+ */
+export interface IdentityEventBus {
+    /** The adapter's name (`in-process`, `postgres`). */
+    readonly adapter: string;
+    /**
+     * Publishes a JSON payload on a channel.
+     *
+     * @param channel - the channel (`auth.principal.invalidate`).
+     * @param payload - the payload; small.
+     */
+    publish<T>(channel: string, payload: T): Promise<void>;
+    /**
+     * Subscribes to a channel; returns the unsubscribe function.
+     *
+     * @param channel - the channel.
+     * @param handler - called once per message.
+     */
+    subscribe<T>(channel: string, handler: (payload: T, meta: IdentityEventBusMeta) => void | Promise<void>): () => void;
+    /** The bus's health. */
+    health(): IdentityEventBusHealth;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/identity/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../src/identity/ports.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AAIxF,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIzD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,EAAE,OAAO,MAA6D,CAAC;AAErG;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gCAAgC;IAChC,SAAS,EAAE,IAAI,CAAC;IAChB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,cAAc,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAC;IACvB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF;;;;;OAKG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAID;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,EAAE,OAAO,MAAkE,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAID;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,OAAO,MAAmE,CAAC;AAEjH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,eAAe,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IACrH;;;;OAIG;IACH,gBAAgB,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC;CACnD;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,EAAE,OAAO,MAAqE,CAAC;AAErH,YAAY,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAIvF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,MAA4D,CAAC;AAEnG;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,oBAAoB,GAAG,UAAU,GAAG,iBAAiB,CAAC;AAErG;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,SAAS,GACT,SAAS,GACT,gBAAgB,GAChB,eAAe,GACf,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClE;;;;OAIG;IACH,WAAW,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACnD;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,eAIlC,CAAC;AAIH;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,OAAO,MAAyD,CAAC;AAE7F;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,OAAO,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,sBAAsB,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F;;;;OAIG;IACH,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACpD;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,EAAE,OAAO,MAAqE,CAAC;AAErH;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;CACjE;AAID;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,OAAO,MAA8D,CAAC;AAEvG;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,iCAAiC;IACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oDAAoD;IACpD,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,6BAA6B;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;;OAKG;IACH,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC;IACrH,wBAAwB;IACxB,MAAM,IAAI,sBAAsB,CAAC;CAClC"}

package/dist/identity/ports.js

@@ -0,0 +1,126 @@
+"use strict";
+// =============================================================================
+// The identity slice's host ports (issue #727, PP-6.6)
+// =============================================================================
+//
+// Every capability identity needs from the application, as ONE injection token
+// per capability. The slice injects these and never imports an app service;
+// the app binds each token to an adapter of its own (the reference app:
+// `apps/api/src/platform/identity/identity-host.module.ts`), passed to
+// `IdentityModule.forRoot({ imports })`. Each interface is derived from the
+// exact calls identity makes; nothing wider.
+//
+// The database is the core port `PLATFORM_PRISMA` (`@marinoscar/platform-api/core`),
+// seen as the structural `IdentityPrisma` (`data/identity-db.ts`): identity
+// owns its models (the identity fragment of `@marinoscar/platform-db`) but
+// never depends on a generated client, not even its types.
+//
+// DIRECTION. Identity sits under every other slice (docs/specs/platform-packages.md,
+// "Dependency graph"), so it cannot import notifications, jobs or nodes. Each
+// of those reaches identity through a port the app binds, never the reverse.
+//
+// The tokens are `Symbol.for(...)` keys, so two copies of this file (two
+// bundles, a test that loads the source next to the built package) agree.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_EVENT_BUS = exports.IDENTITY_NODE_CREDENTIALS = exports.IDENTITY_JOBS = exports.NOOP_IDENTITY_METRICS = exports.IDENTITY_METRICS = exports.IDENTITY_AUTH_CREDENTIALS = exports.IDENTITY_PROFILE_IMAGES = exports.USER_DEFAULTS = exports.IDENTITY_NOTIFIER = void 0;
+// ---- notifications (the IDENTITY_NOTIFIER seam) -------------------------------------
+/**
+ * Injection token of the app's {@link IdentityNotifier}. The app binds it to
+ * its notification dispatcher, so identity does not import the notifications
+ * slice (identity sits above it in the dependency graph).
+ *
+ * @example
+ * ```ts
+ * IdentityModule.forRoot({ imports: [IdentityHostModule] });
+ * // IdentityHostModule: { provide: IDENTITY_NOTIFIER, useClass: NotificationsIdentityNotifier }
+ * ```
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.IDENTITY_NOTIFIER = Symbol.for('@marinoscar/platform/identity/NOTIFIER');
+// ---- user defaults (the USER_DEFAULTS seam) -----------------------------------------
+/**
+ * Injection token of the app's {@link UserDefaults}: what a new user's
+ * settings row holds at creation.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.USER_DEFAULTS = Symbol.for('@marinoscar/platform/identity/USER_DEFAULTS');
+// ---- profile images -----------------------------------------------------------------
+/**
+ * Injection token of the app's {@link IdentityProfileImages}: how a user's
+ * picture is resolved from their stored profile settings.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.IDENTITY_PROFILE_IMAGES = Symbol.for('@marinoscar/platform/identity/PROFILE_IMAGES');
+// ---- provider secrets (the IDENTITY_AUTH_CREDENTIALS seam) ----------------------------
+/**
+ * Injection token of the credential store a sign-in provider reads its secrets
+ * from (`AuthProviderContext.credentials`). The app binds it to its
+ * `CredentialsService` (`@marinoscar/platform-api/credentials`), which satisfies
+ * {@link AuthProviderCredentials}; identity does not import the credentials
+ * slice. Optional: without it every secret reads as absent, so a provider that
+ * keeps its secrets in the store is off (Google, which reads the environment, is
+ * unaffected).
+ *
+ * @example
+ * ```ts
+ * { provide: IDENTITY_AUTH_CREDENTIALS, useExisting: CredentialsService }
+ * ```
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.IDENTITY_AUTH_CREDENTIALS = Symbol.for('@marinoscar/platform/identity/AUTH_CREDENTIALS');
+// ---- metrics --------------------------------------------------------------------------
+/**
+ * Injection token of the app's {@link IdentityMetrics}. Optional: without it
+ * identity records nothing.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.IDENTITY_METRICS = Symbol.for('@marinoscar/platform/identity/METRICS');
+/**
+ * The metrics used when the app binds none: every call is a no-op.
+ *
+ * @stability experimental
+ */
+exports.NOOP_IDENTITY_METRICS = Object.freeze({
+    authLogin: () => undefined,
+    authRefresh: () => undefined,
+    add: () => undefined,
+});
+// ---- jobs -----------------------------------------------------------------------------
+/**
+ * Injection token of the app's {@link IdentityJobsPort}.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.IDENTITY_JOBS = Symbol.for('@marinoscar/platform/identity/JOBS');
+// ---- worker-node credentials ------------------------------------------------------------
+/**
+ * Injection token of the app's {@link IdentityNodeCredentials}: how a `nod_`
+ * bearer token is resolved. Must be bound by a GLOBAL module: `JwtAuthGuard`
+ * is instantiated in every module whose controllers use `@Auth()`.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.IDENTITY_NODE_CREDENTIALS = Symbol.for('@marinoscar/platform/identity/NODE_CREDENTIALS');
+// ---- event bus --------------------------------------------------------------------------
+/**
+ * Injection token of the app's cross-replica {@link IdentityEventBus}.
+ * Optional: without it the principal cache invalidates in this process only.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.IDENTITY_EVENT_BUS = Symbol.for('@marinoscar/platform/identity/EVENT_BUS');
+//# sourceMappingURL=ports.js.map

package/dist/identity/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../src/identity/ports.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,uDAAuD;AACvD,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,uEAAuE;AACvE,4EAA4E;AAC5E,6CAA6C;AAC7C,EAAE;AACF,qFAAqF;AACrF,4EAA4E;AAC5E,2EAA2E;AAC3E,2DAA2D;AAC3D,EAAE;AACF,qFAAqF;AACrF,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,gFAAgF;;;AAUhF,wFAAwF;AAExF;;;;;;;;;;;;;GAaG;AACU,QAAA,iBAAiB,GAAkB,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AA4GrG,wFAAwF;AAExF;;;;;;GAMG;AACU,QAAA,aAAa,GAAkB,MAAM,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;AAgBtG,wFAAwF;AAExF;;;;;;GAMG;AACU,QAAA,uBAAuB,GAAkB,MAAM,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;AAyBjH,0FAA0F;AAE1F;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,yBAAyB,GAAkB,MAAM,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;AAIrH,0FAA0F;AAE1F;;;;;;GAMG;AACU,QAAA,gBAAgB,GAAkB,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAuDnG;;;;GAIG;AACU,QAAA,qBAAqB,GAAoB,MAAM,CAAC,MAAM,CAAC;IAClE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;IAC1B,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS;IAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;CACrB,CAAC,CAAC;AAEH,0FAA0F;AAE1F;;;;;GAKG;AACU,QAAA,aAAa,GAAkB,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;AAqD7F,4FAA4F;AAE5F;;;;;;;GAOG;AACU,QAAA,yBAAyB,GAAkB,MAAM,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;AAiBrH,4FAA4F;AAE5F;;;;;;GAMG;AACU,QAAA,kBAAkB,GAAkB,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC"}

package/dist/identity/roles/dto/roles.dto.d.ts

@@ -0,0 +1,16 @@
+declare const RoleListQueryDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    scope: import("zod").ZodOptional<import("zod").ZodEnum<import("@marinoscar/platform-contract/identity").RoleScopeEnum>>;
+}, import("zod/v4/core").$strip>, false>;
+export declare class RoleListQueryDto extends RoleListQueryDto_base {
+}
+declare const RoleDescriptorDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    label: import("zod").ZodString;
+    description: import("zod").ZodString;
+    scope: import("zod").ZodEnum<import("@marinoscar/platform-contract/identity").RoleScopeEnum>;
+    assignable: import("zod").ZodBoolean;
+}, import("zod/v4/core").$strip>, false>;
+export declare class RoleDescriptorDto extends RoleDescriptorDto_base {
+}
+export {};
+//# sourceMappingURL=roles.dto.d.ts.map

package/dist/identity/roles/dto/roles.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/roles/dto/roles.dto.ts"],"names":[],"mappings":";;;AAKA,qBAAa,gBAAiB,SAAQ,qBAAiC;CAAG;;;;;;;;AAE1E,qBAAa,iBAAkB,SAAQ,sBAAkC;CAAG"}

package/dist/identity/roles/dto/roles.dto.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleDescriptorDto = exports.RoleListQueryDto = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const identity_1 = require("@marinoscar/platform-contract/identity");
+// The schemas are the contract's; the DTOs wrap them so the OpenAPI document is generated from them.
+class RoleListQueryDto extends (0, nestjs_zod_1.createZodDto)(identity_1.roleListQuerySchema) {
+}
+exports.RoleListQueryDto = RoleListQueryDto;
+class RoleDescriptorDto extends (0, nestjs_zod_1.createZodDto)(identity_1.roleDescriptorSchema) {
+}
+exports.RoleDescriptorDto = RoleDescriptorDto;
+//# sourceMappingURL=roles.dto.js.map

package/dist/identity/roles/dto/roles.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.dto.js","sourceRoot":"","sources":["../../../../src/identity/roles/dto/roles.dto.ts"],"names":[],"mappings":";;;AAAA,2CAA0C;AAC1C,qEAAmG;AAEnG,qGAAqG;AAErG,MAAa,gBAAiB,SAAQ,IAAA,yBAAY,EAAC,8BAAmB,CAAC;CAAG;AAA1E,4CAA0E;AAE1E,MAAa,iBAAkB,SAAQ,IAAA,yBAAY,EAAC,+BAAoB,CAAC;CAAG;AAA5E,8CAA4E"}

package/dist/identity/roles/index.d.ts

@@ -0,0 +1,3 @@
+export { assertAnyRoleAssignable, assertRoleAssignable, describeRole, isAppManagedRole, isRoleAssignable, listRoles, roleNotAssignable } from './role-catalog';
+export { RolesModule } from './roles.module';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/roles/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/roles/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC/J,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/identity/roles/index.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RolesModule = exports.roleNotAssignable = exports.listRoles = exports.isRoleAssignable = exports.isAppManagedRole = exports.describeRole = exports.assertRoleAssignable = exports.assertAnyRoleAssignable = void 0;
+// The role catalog and `GET /api/roles` (PP-14.15). Re-exported by ../index.ts.
+var role_catalog_1 = require("./role-catalog");
+Object.defineProperty(exports, "assertAnyRoleAssignable", { enumerable: true, get: function () { return role_catalog_1.assertAnyRoleAssignable; } });
+Object.defineProperty(exports, "assertRoleAssignable", { enumerable: true, get: function () { return role_catalog_1.assertRoleAssignable; } });
+Object.defineProperty(exports, "describeRole", { enumerable: true, get: function () { return role_catalog_1.describeRole; } });
+Object.defineProperty(exports, "isAppManagedRole", { enumerable: true, get: function () { return role_catalog_1.isAppManagedRole; } });
+Object.defineProperty(exports, "isRoleAssignable", { enumerable: true, get: function () { return role_catalog_1.isRoleAssignable; } });
+Object.defineProperty(exports, "listRoles", { enumerable: true, get: function () { return role_catalog_1.listRoles; } });
+Object.defineProperty(exports, "roleNotAssignable", { enumerable: true, get: function () { return role_catalog_1.roleNotAssignable; } });
+var roles_module_1 = require("./roles.module");
+Object.defineProperty(exports, "RolesModule", { enumerable: true, get: function () { return roles_module_1.RolesModule; } });
+//# sourceMappingURL=index.js.map

package/dist/identity/roles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/roles/index.ts"],"names":[],"mappings":";;;AAAA,gFAAgF;AAChF,+CAA+J;AAAtJ,uHAAA,uBAAuB,OAAA;AAAE,oHAAA,oBAAoB,OAAA;AAAE,4GAAA,YAAY,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAAE,yGAAA,SAAS,OAAA;AAAE,iHAAA,iBAAiB,OAAA;AACtI,+CAA6C;AAApC,2GAAA,WAAW,OAAA"}