@neohm/nestend 3.3.8 → 3.3.10

package/README.md

@@ -101,33 +101,33 @@ these are free to change without a breaking release.
 
 ## Feature Map
 
-| Area              | Key exports                                                                                                                          | Notes                                                                                                                                                                                                                                                                     |
-| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Entities          | `RootEntity`, `CommonEntity`, `CommonAdminEntity`, `UserEntity`, `AdminUserEntity`, `SystemRoleEntity`, `SystemAdminRoleEntity`, ... | uuid PK, soft deletes, `created_by`/`updated_by` (+ `creator`/`updater` relations), jsonb `attributes`; entity-level `findOneOrNew`, `hardDelete`, `restore`, `paginate` statics plus a row-wise `softDelete()`                                                                                                                           |
-| Migrations        | `MigrationUtility`, `SeederUtility` (the 28 table migrations ship in `dist/migrations` — glob them, they are not barrel exports)     | fluent `this.string()`, `this.numeric()`, `addRecord()` seeding                                                                                                                                                                                                           |
-| Queue             | `QueueModule`, `QueueModule.withConnection()`, `QueueService`, `CommonJob`                                                            | BullMQ `@Processor`/`WorkerHost` consumer; auto-discovered jobs, duplicate prevention, recurring schedulers, completed jobs cleared from Redis on success (1-day TTL on failures), `clearQueue()`, retries, failures persisted to `sys_failed_jobs`; connection from `BULL_REDIS_*` or supplied by the app — never register `BullModule.forRoot()` yourself, two roots race over the worker's connection |
-| Scheduled events  | `SystemScheduledTaskEntity`, `ScheduledEventEntity`, `ScheduleKind`, `ScheduleSpec`, `IsCronExpression`                              | schedule definitions in `sys_scheduled_tasks` → events in `sys_scheduled_events`; interval / cron / once specs with timezones, drift-free slots, horizon materialisation, catch-up + overlap policies, fire-once dispatch with backoff, cadence via `SCHEDULED_EVENT_MIN` |
-| Auth              | `AuthModule`, `AuthService.validateRole()`, `RoleTier`, `TenantRole`, `Auth`, `JwtMiddleware`                                                       | imperative auth (open by default); `<module>.<tier>` role hierarchy (manager > writer > viewer), with `global.admin` overriding every role check; JwtMiddleware resolves the user into `Auth`'s AsyncLocalStorage context per request; access + rotating refresh tokens; session-based logout invalidation (`sys_auth_sessions`); Google SSO via ID token at `POST /auth/google`; impersonation — a tenantless `has_global_access` user signs into one organization at `POST /auth/impersonation/login`         |
-| Admin auth        | `AdminAuthService.validateRole()`, `AdminAuth`, `AdminJwtMiddleware` (endpoints at `/admin/auth`)                                    | fully separate stack for back-office admins — own users table (`sys_admin_users`), own roles (`sys_admin_roles`/`sys_auser_roles`), own sessions/refresh tokens (shared tables, `is_admin` flag)                                                                          |
-| API keys          | `ApiKeyService`, `ApiKeyGuard` / `ApiKeyMiddleware`, `@ApiKeyScopes()`, `ApiKeyContext`                                               | hashed keys in `sys_api_keys` (admin-owned), one tenant per key, expiry/revocation, `x-api-key` header; `validateAccess(scope)` returns the tenant the key acts for                                                                                                        |
-| Scopes            | `ScopeService`, `AuthService.validateAccess()`, `ScopeEntity`, `TenantScopeEntity`, `ApiScopeEntity`                                  | one feature named once in `sys_scopes`, then granted per organization (`sys_tenant_scopes`) or per API key (`sys_api_scopes`) — never an array on the principal                                                                                                            |
-| Multi-tenancy     | `TenantModule`, `TenantEntity`, `CommonTenantEntity`, `TenantContextService`, `TenantContextMiddleware`                              | AsyncLocalStorage tenant context; resolve by header, slug, or domain; tenants are onboarded by admins (`TenantEntity.creator` → `AdminUserEntity`)                                                                                                                        |
-| Admin             | `AdminModule` (its controllers, DTOs and processors are internal — import the module and hit the endpoints), `GlobalAdminRoles`      | back-office APIs: tenant onboarding, client/admin/system user registration (single + bulk), the `has_global_access` grant that enables impersonation, tenant + scheduled-task listing; 4-tier `GlobalAdminRoles` gate over `sys_admin_roles`; Swagger at `/docs` (hidden in production)                                  |
-| Notifications     | `NotificationModule`, `NotificationService`, `FcmPushNotificationService`                                                            | in-app rows + FCM push (optional `firebase-admin`); device token registry                                                                                                                                                                                                 |
-| Email (SES)       | `EmailNotificationService`, `ProcessEmailNotification`, `EmailTemplateEntity`, `EmailNotificationLogEntity`                          | templates in `sys_email_templates` rendered by a remote service, dispatched via SES per recipient (to/cc/bcc); logged to `sys_email_notification_logs` outside production; dispatch skipped when `AWS_SES_FROM_ADDRESS` unset                                             |
-| Audit             | `AuditService`                                                                                                                       | `saveAuditLog(old, new)` with changed-value diffing into `sys_audit_logs`                                                                                                                                                                                                 |
-| Cache             | `CacheService`                                                                                                                       | Redis, TTL objects (`{days, hours, min}`), transparent encryption                                                                                                                                                                                                         |
-| Encryption        | `EncryptionService`                                                                                                                  | AES-256-GCM, scrypt-derived keys                                                                                                                                                                                                                                          |
-| System properties | `SystemPropertyModule`, `SystemPropertyService`                                                                                      | cached + optionally encrypted key/value settings in `sys_properties`                                                                                                                                                                                                      |
-| Documents         | `DocumentModule`, `DocumentService`, `S3BucketDocumentService`, `MinioBucketDocumentService`                                         | `POST /api/documents/upload` (multipart) or `uploadDocument(multerFiles) → links[]`; driver chosen via `DOCUMENT_STORAGE_DRIVER`                                                                                                                                                                                      |
-| PDF generation    | `PdfService`, `PdfRenderOptions`                                                                                                     | `renderHtmlToPdf(html) → Buffer` via headless Chromium; honours the document's own `@page` rules and paginates to any length; optional peer dep `puppeteer`                                                                                                               |
-| HTTP              | `CommonController`, `GlobalExceptionFilter`, common DTOs                                                                             | health endpoint base controller, uniform error envelope                                                                                                                                                                                                                   |
-| Raw SQL           | `SqlService`, `SqlTarget`                                                                                                            | named `:key` placeholders always bound as driver params, `:...key` array expansion; runs on the read replica (`DB_READ_*`) with transparent primary fallback; `fetchOne`/`fetchScalar`/`exists`/`count`/`paginate` helpers                                                |
-| List endpoints    | `CommonListProcessor`, `CommonListFilterDto`, `FilterDto`, `CommonListFilterConfig`                                                  | allowlisted columns, parameterised operators (`eq`…`isNull`), typed value casting (`str`/`num`/`date`/`bool`/`null`), multi-sort + paginated on the read replica                                                                                                          |
-| Outbound HTTP     | `RemoteRequestService`, `ApiRequestTypeEnum`, `ApiContentTypeEnum`                                                                   | injectable `fetch` wrapper (global via `CommonModule`); `getApiResponse<T>()` parses JSON/text and throws `OperationException` on non-2xx, `getApiRawResponse()` returns the raw `Response`; JSON + form-urlencoded body serialisation                                    |
-| Observability     | `LoggingInterceptor`, `MonitoringInterceptor`, `MonitoringService`                                                                   | Sentry auto-registers when `@sentry/node` + `SENTRY_DSN` present; pluggable `MonitoringAdapter`                                                                                                                                                                           |
-| Jobs/Events       | `CommonJob`, `CommonSubscriber`, `CommonDataProcessor`                                                                               | dispatch/handle separation, discovery-based registration, worker-event lifecycle, column-change detection, `created_by`/`updated_by` stamped from the `Auth` context in `beforeInsert`/`beforeUpdate`, field error collection                                                                                                                                         |
-| Constants & maps  | `baseEntityConstants`, `baseJobConstants`, `baseEntityMaps`, `baseJobMaps`                                                           | centralised dotted identifiers (`as const`) plus identifier → class maps of every concrete entity and job (abstract bases excluded); map keys are computed from the constants, so renames propagate at compile time                                                       |
+| Area              | Key exports                                                                                                                          | Notes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Entities          | `RootEntity`, `CommonEntity`, `CommonAdminEntity`, `UserEntity`, `AdminUserEntity`, `SystemRoleEntity`, `SystemAdminRoleEntity`, ... | uuid PK, soft deletes, `created_by`/`updated_by` (+ `creator`/`updater` relations), jsonb `attributes`; entity-level `findOneOrNew`, `hardDelete`, `restore`, `paginate` statics plus a row-wise `softDelete()`                                                                                                                                                                                                                                                                                         |
+| Migrations        | `MigrationUtility`, `SeederUtility` (the 29 table migrations ship in `dist/migrations` — glob them, they are not barrel exports)     | fluent `this.string()`, `this.numeric()`, `addRecord()` seeding                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Queue             | `QueueModule`, `QueueModule.withConnection()`, `QueueService`, `CommonJob`                                                           | BullMQ `@Processor`/`WorkerHost` consumer; auto-discovered jobs, duplicate prevention, recurring schedulers, completed jobs cleared from Redis on success (1-day TTL on failures), `clearQueue()`, retries, failures persisted to `sys_failed_jobs`; connection from `BULL_REDIS_*` or supplied by the app — never register `BullModule.forRoot()` yourself, two roots race over the worker's connection                                                                                                |
+| Scheduled events  | `SystemScheduledTaskEntity`, `ScheduledEventEntity`, `ScheduleKind`, `ScheduleSpec`, `IsCronExpression`                              | schedule definitions in `sys_scheduled_tasks` → events in `sys_scheduled_events`; interval / cron / once specs with timezones, drift-free slots, horizon materialisation, catch-up + overlap policies, fire-once dispatch with backoff, cadence via `SCHEDULED_EVENT_MIN`                                                                                                                                                                                                                               |
+| Auth              | `AuthModule`, `AuthService.validateRole()`, `RoleTier`, `TenantRole`, `Auth`, `JwtMiddleware`                                        | imperative auth (open by default); `<module>.<tier>` role hierarchy (manager > writer > viewer), with `global.admin` overriding every role check; JwtMiddleware resolves the user into `Auth`'s AsyncLocalStorage context per request; access + rotating refresh tokens; session-based logout invalidation (`sys_auth_sessions`); Google SSO via ID token at `POST /auth/google`; impersonation — a tenantless `has_global_access` user signs into one organization at `POST /auth/impersonation/login` |
+| Admin auth        | `AdminAuthService.validateRole()`, `AdminAuth`, `AdminJwtMiddleware` (endpoints at `/admin/auth`)                                    | fully separate stack for back-office admins — own users table (`sys_admin_users`), own roles (`sys_admin_roles`/`sys_auser_roles`), own sessions/refresh tokens (shared tables, `is_admin` flag)                                                                                                                                                                                                                                                                                                        |
+| API keys          | `ApiKeyService`, `ApiKeyGuard` / `ApiKeyMiddleware`, `@ApiKeyScopes()`, `ApiKeyContext`                                              | hashed keys in `sys_api_keys` (admin-owned), one tenant per key, expiry/revocation, `x-api-key` header; `validateAccess(scope)` returns the tenant the key acts for                                                                                                                                                                                                                                                                                                                                     |
+| Scopes            | `ScopeService`, `AuthService.validateAccess()`, `ScopeEntity`, `TenantScopeEntity`, `ApiScopeEntity`                                 | one feature named once in `sys_scopes`, then granted per organization (`sys_tenant_scopes`) or per API key (`sys_api_scopes`) — never an array on the principal                                                                                                                                                                                                                                                                                                                                         |
+| Multi-tenancy     | `TenantModule`, `TenantEntity`, `CommonTenantEntity`, `TenantContextService`, `TenantContextMiddleware`                              | AsyncLocalStorage tenant context; resolve by header, slug, or domain; tenants are onboarded by admins (`TenantEntity.creator` → `AdminUserEntity`)                                                                                                                                                                                                                                                                                                                                                      |
+| Admin             | `AdminModule` (its controllers, DTOs and processors are internal — import the module and hit the endpoints), `GlobalAdminRoles`      | back-office APIs: tenant onboarding, client/admin/system user registration (single + bulk), the `has_global_access` grant that enables impersonation, tenant + scheduled-task listing, the email/PDF template catalogues (read at content-reader, written at content-manager, deleted at global admin); 4-tier `GlobalAdminRoles` gate over `sys_admin_roles`; Swagger at `/docs` (hidden in production)                                                                                                                                                                                                                 |
+| Notifications     | `NotificationModule`, `NotificationService`, `FcmPushNotificationService`                                                            | in-app rows + FCM push (optional `firebase-admin`); device token registry                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Email (SES)       | `EmailNotificationService`, `ProcessEmailNotification`, `EmailTemplateEntity`, `EmailNotificationLogEntity`                          | templates in `sys_email_templates` (managed from the admin surface) rendered by a remote service, dispatched via SES per recipient (to/cc/bcc); logged to `sys_email_notification_logs` outside production; dispatch skipped when `AWS_SES_FROM_ADDRESS` unset                                                                                                                                                                                                                                                                           |
+| Audit             | `AuditService`                                                                                                                       | `saveAuditLog(old, new)` with changed-value diffing into `sys_audit_logs`                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Cache             | `CacheService`                                                                                                                       | Redis, TTL objects (`{days, hours, min}`), transparent encryption                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| Encryption        | `EncryptionService`                                                                                                                  | AES-256-GCM, scrypt-derived keys                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| System properties | `SystemPropertyModule`, `SystemPropertyService`                                                                                      | cached + optionally encrypted key/value settings in `sys_properties`                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| Documents         | `DocumentModule`, `DocumentService`, `S3BucketDocumentService`, `MinioBucketDocumentService`                                         | `POST /api/documents/upload` (multipart) or `uploadDocument(multerFiles) → links[]`; driver chosen via `DOCUMENT_STORAGE_DRIVER`; `sys_document_uploads` is the file, `sys_documents` the link to one of your records (`system_generated` marks the ones the backend produced itself)                                                                                                                                                                                                                    |
+| PDF documents     | `PdfService`, `PdfTemplateService`, `ProcessPdfDocument`, `PdfTemplateEntity`, `PdfRenderOptions`                                     | templates in `sys_pdf_templates` rendered to HTML by a remote service, rasterized by headless Chromium (`renderHtmlToPdf(html) → Buffer`, honours the document's own `@page` rules and paginates to any length), then stored — `ProcessPdfDocument` writes both rows and flags the `sys_documents` one `system_generated`; optional peer dep `puppeteer`                                                                                                                                                  |
+| HTTP              | `CommonController`, `GlobalExceptionFilter`, common DTOs                                                                             | health endpoint base controller, uniform error envelope                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| Raw SQL           | `SqlService`, `SqlTarget`                                                                                                            | named `:key` placeholders always bound as driver params, `:...key` array expansion; runs on the read replica (`DB_READ_*`) with transparent primary fallback; `fetchOne`/`fetchScalar`/`exists`/`count`/`paginate` helpers                                                                                                                                                                                                                                                                              |
+| List endpoints    | `CommonListProcessor`, `CommonListFilterDto`, `FilterDto`, `CommonListFilterConfig`                                                  | allowlisted columns, parameterised operators (`eq`…`isNull`), typed value casting (`str`/`num`/`date`/`bool`/`null`), multi-sort + paginated on the read replica                                                                                                                                                                                                                                                                                                                                        |
+| Outbound HTTP     | `RemoteRequestService`, `ApiRequestTypeEnum`, `ApiContentTypeEnum`                                                                   | injectable `fetch` wrapper (global via `CommonModule`); `getApiResponse<T>()` parses JSON/text and throws `OperationException` on non-2xx, `getApiRawResponse()` returns the raw `Response`; JSON + form-urlencoded body serialisation                                                                                                                                                                                                                                                                  |
+| Observability     | `LoggingInterceptor`, `MonitoringInterceptor`, `MonitoringService`                                                                   | Sentry auto-registers when `@sentry/node` + `SENTRY_DSN` present; pluggable `MonitoringAdapter`                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Jobs/Events       | `CommonJob`, `CommonSubscriber`, `CommonDataProcessor`                                                                               | dispatch/handle separation, discovery-based registration, worker-event lifecycle, column-change detection, `created_by`/`updated_by` stamped from the `Auth` context in `beforeInsert`/`beforeUpdate`, field error collection                                                                                                                                                                                                                                                                           |
+| Constants & maps  | `baseEntityConstants`, `baseJobConstants`, `baseEntityMaps`, `baseJobMaps`                                                           | centralised dotted identifiers (`as const`) plus identifier → class maps of every concrete entity and job (abstract bases excluded); map keys are computed from the constants, so renames propagate at compile time                                                                                                                                                                                                                                                                                     |
 
 ## Environment Variables
 
@@ -209,7 +209,10 @@ sold to them?" and "is this person allowed to use it?" in that order.
 
 ```ts
 const { user } = await this.authService.validateAccess('billing.invoices');
-const { user } = await this.authService.validateAccess('billing.invoices', 'invoice.writer');
+const { user } = await this.authService.validateAccess(
+  'billing.invoices',
+  'invoice.writer',
+);
 ```
 
 `AuthController` (mounted at `/auth`) exposes the ready-made flows: `POST
@@ -308,8 +311,8 @@ admin with the `admin` role can grant `sys_admin_roles` to other admins via
 
 ### Encryption
 
-| Variable            | Default | Description                                                                           |
-| ------------------- | ------- | ------------------------------------------------------------------------------------- |
+| Variable            | Default | Description                                                                                                                                   |
+| ------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
 | `ENCRYPTION_SECRET` | —       | **Required** when `EncryptionService` is used — which now includes issuing API keys (`key_encrypted`). AES-256-GCM key material. Min 32 chars |
 
 ### Cache (Redis)
@@ -323,21 +326,21 @@ admin with the `admin` role can grant `sys_admin_roles` to other admins via
 
 ### Queue (BullMQ / Redis)
 
-| Variable                            | Default       | Description                                                                                         |
-| ----------------------------------- | ------------- | --------------------------------------------------------------------------------------------------- |
-| `BULL_REDIS_HOST`                   | `localhost`   | Redis host for BullMQ                                                                               |
-| `BULL_REDIS_PORT`                   | `6379`        | Redis port                                                                                          |
-| `BULL_REDIS_PASSWORD`               | _(empty)_     | Redis password                                                                                      |
-| `BULL_REDIS_DB`                     | `0`           | Redis DB index                                                                                      |
-| `BULL_QUEUE_NAME`                   | `myapp-queue` | Name of the BullMQ queue                                                                            |
-| `BULL_WORKERS`                      | `2`           | Concurrent worker threads per process                                                               |
-| `BULL_QUEUE_WORKER`                 | `false`       | Set `true` on consumer instances only — API servers should leave this `false`                       |
+| Variable                            | Default       | Description                                                                                                                           |
+| ----------------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| `BULL_REDIS_HOST`                   | `localhost`   | Redis host for BullMQ                                                                                                                 |
+| `BULL_REDIS_PORT`                   | `6379`        | Redis port                                                                                                                            |
+| `BULL_REDIS_PASSWORD`               | _(empty)_     | Redis password                                                                                                                        |
+| `BULL_REDIS_DB`                     | `0`           | Redis DB index                                                                                                                        |
+| `BULL_QUEUE_NAME`                   | `myapp-queue` | Name of the BullMQ queue                                                                                                              |
+| `BULL_WORKERS`                      | `2`           | Concurrent worker threads per process                                                                                                 |
+| `BULL_QUEUE_WORKER`                 | `false`       | Set `true` on consumer instances only — API servers should leave this `false`                                                         |
 | `BULL_JOB_TTL_SECONDS`              | `86400`       | Retention (seconds) for **failed** jobs before removal from the queue + Redis (default 1 day); completed jobs are removed immediately |
-| `MAX_JOB_RETRIES`                   | `3`           | Max attempts per job (BullMQ `attempts` default) and the scheduled-event retry ceiling              |
-| `SCHEDULED_EVENT_MIN`               | `0`           | `SetScheduledEventJob` cadence in minutes (every N minutes); `0`/unset disables self-scheduling     |
-| `SCHEDULED_EVENT_HORIZON_MIN`       | _(derived)_   | How far ahead occurrences are materialised; defaults to 2× the cadence, floored at one minute       |
-| `SCHEDULED_EVENT_BATCH`             | `500`         | Occurrences dispatched per pass                                                                     |
-| `ENABLE_SCHEDULED_EVENTS_EXECUTION` | _unset_       | Must be exactly `true` to arm scheduled-event materialisation and dispatch                          |
+| `MAX_JOB_RETRIES`                   | `3`           | Max attempts per job (BullMQ `attempts` default) and the scheduled-event retry ceiling                                                |
+| `SCHEDULED_EVENT_MIN`               | `0`           | `SetScheduledEventJob` cadence in minutes (every N minutes); `0`/unset disables self-scheduling                                       |
+| `SCHEDULED_EVENT_HORIZON_MIN`       | _(derived)_   | How far ahead occurrences are materialised; defaults to 2× the cadence, floored at one minute                                         |
+| `SCHEDULED_EVENT_BATCH`             | `500`         | Occurrences dispatched per pass                                                                                                       |
+| `ENABLE_SCHEDULED_EVENTS_EXECUTION` | _unset_       | Must be exactly `true` to arm scheduled-event materialisation and dispatch                                                            |
 
 #### Jobs
 
@@ -493,7 +496,7 @@ jitter lands on the occurrence, never on the cursor, so it cannot accumulate.
 ##### Creating and editing a task
 
 `POST /api/admin/scheduled-tasks` is an upsert. `AddScheduledTaskDto` extends
-`CommonPayloadDto`, so it carries an optional `id`: send one to edit that task, omit
+`CommonDataDto`, so it carries an optional `id`: send one to edit that task, omit
 it to create. `identifier`, `name` and `schedule` are required by the DTO either way;
 `identifier` uniqueness is checked in the processor, excluding the row being edited.
 
@@ -571,12 +574,12 @@ a subscriber only starts firing once something constructs it.
 
 ### Document Storage
 
-| Variable                                | Default | Description                                |
-| --------------------------------------- | ------- | ------------------------------------------ |
-| `DOCUMENT_STORAGE_DRIVER`               | `minio` | Active driver: `s3` or `minio`             |
-| `DOCUMENT_PRESIGNED_URL_EXPIRY_SECONDS` | `3600`  | Presigned download URL validity in seconds |
+| Variable                                | Default | Description                                    |
+| --------------------------------------- | ------- | ---------------------------------------------- |
+| `DOCUMENT_STORAGE_DRIVER`               | `minio` | Active driver: `s3` or `minio`                 |
+| `DOCUMENT_PRESIGNED_URL_EXPIRY_SECONDS` | `3600`  | Presigned download URL validity in seconds     |
 | `DOCUMENT_MAX_UPLOAD_FILES`             | `10`    | Files per `POST /api/documents/upload` request |
-| `DOCUMENT_MAX_UPLOAD_SIZE_MB`           | `25`    | Per-file size ceiling on that endpoint     |
+| `DOCUMENT_MAX_UPLOAD_SIZE_MB`           | `25`    | Per-file size ceiling on that endpoint         |
 
 **S3 driver** (`DOCUMENT_STORAGE_DRIVER=s3`):
 
@@ -602,12 +605,12 @@ a subscriber only starts firing once something constructs it.
 | `MINIO_BUCKET`     | `documents`  | Bucket name (auto-created if missing)       |
 | `MINIO_PUBLIC_URL` | _(empty)_    | CDN base URL when MinIO sits behind a proxy |
 
-### PDF Generation
+### PDF Documents
 
 Requires the optional peer dependency `puppeteer`.
 
-| Variable                  | Default   | Description                                                                        |
-| ------------------------- | --------- | ---------------------------------------------------------------------------------- |
+| Variable                  | Default   | Description                                                                         |
+| ------------------------- | --------- | ----------------------------------------------------------------------------------- |
 | `PDF_CHROMIUM_PATH`       | _(empty)_ | Path to an existing Chromium/Chrome binary; falls back to puppeteer's bundled one   |
 | `PDF_CHROMIUM_NO_SANDBOX` | `false`   | `true` passes `--no-sandbox`. Needed in most containers; only use with trusted HTML |
 | `PDF_RENDER_TIMEOUT_MS`   | `30000`   | Per-render page load timeout in milliseconds                                        |
@@ -634,10 +637,10 @@ Requires the optional peer dependency `puppeteer`.
 
 ### API Keys
 
-| Variable              | Default     | Description                                                      |
-| --------------------- | ----------- | ---------------------------------------------------------------- |
-| `API_KEY_HEADER_NAME` | `x-api-key` | Request header carrying the API key                              |
-| `ENCRYPTION_SECRET`   | —           | **Required to issue keys** — `key_encrypted` is AES-256-GCM      |
+| Variable              | Default     | Description                                                 |
+| --------------------- | ----------- | ----------------------------------------------------------- |
+| `API_KEY_HEADER_NAME` | `x-api-key` | Request header carrying the API key                         |
+| `ENCRYPTION_SECRET`   | —           | **Required to issue keys** — `key_encrypted` is AES-256-GCM |
 
 A key is stored three ways: its sha256 hash in `key_hash` (what lookups match), a
 short visible prefix in `key_prefix`, and the key itself encrypted in
@@ -691,17 +694,28 @@ Requires the optional peer dependency `firebase-admin`. Provide **one** of:
 Storage is split across two tables. `sys_document_uploads` (`DocumentUploadEntity`)
 is the stored object — name, mime type, size, driver, path, url, `is_public` — and
 every upload writes one row automatically. `sys_documents` (`DocumentEntity`) is just
-the link to one of your records: `upload_id` + `source_type` + `source_id`, no file
-metadata. So one file can hang off several records, and a file can exist before
-anything owns it.
+the link to one of your records: `upload_id` + `source_type` + `source_id` +
+`system_generated`, no file metadata. So one file can hang off several records, and a
+file can exist before anything owns it.
+
+`system_generated` answers a question the two tables otherwise cannot: whether anybody
+uploaded this file. A generated invoice and an uploaded scan of one are the same pair of
+rows, so the flag is what lets a listing tell them apart — and what lets a regeneration
+know which of its records it may replace. It is set through
+`setDocument(dto, { systemGenerated: true })`, which is how
+[`ProcessPdfDocument`](#pdf-documents-pdfservice-pdftemplateservice-processpdfdocument)
+marks what it produces; it is deliberately absent from `SetDocumentDto`, so the HTTP
+endpoint cannot claim it.
 
 `DocumentModule` ships two endpoints. `POST /api/documents/upload` is multipart: it
 takes the files in a `files` field, uploads them through the active driver and returns
 the saved `sys_document_uploads` row of each. `POST /api/documents/set` then attaches
 one of those uploads to a record of yours — `{ upload_id, source_type, source_id }` —
 and returns the `sys_documents` link row, re-sending an existing link rather than
-duplicating it. In code that pairing is `documentService.setDocument(uploadId, {
-sourceType, sourceId })`.
+duplicating it. `documentService.deleteDocument(id)` soft deletes such a link —
+no endpoint, since detaching belongs to the flow that owns the record — and leaves the
+upload and its object alone. `DocumentSubscriber` records who did it under
+`attributes.deleted_by`, as `sys_documents` has no such column.
 
 Callers do not choose the folder. They send a `path_identifier` (`invoice`,
 `avatar`, ...) which resolves through the `document.path.<path_identifier>` system
@@ -739,40 +753,105 @@ async upload(@UploadedFiles() files: Express.Multer.File[], @CurrentUser() user:
 Set `DOCUMENT_STORAGE_DRIVER=minio` for a local MinIO bucket (auto-created) or
 `DOCUMENT_STORAGE_DRIVER=s3` for Amazon S3. Switching drivers requires no code change.
 
-## PDF Generation (PdfService)
+Because uploading and attaching are separate steps, a file can end up claimed by
+nothing. `CleanOrphanDocumentsJob` (`clean.orphan.documents.job`) sweeps those. Run
+with no payload it collects every upload that has no `sys_documents` row and is more
+than a day old, then re-dispatches itself as `{ id }` per row; each of those deletes
+that object from the bucket and soft deletes its row, so one unreachable file retries
+alone instead of stalling the sweep. Schedule it with a `sys_scheduled_tasks` row under
+that identifier — the module registers the handler but never dispatches it.
+
+## PDF Documents (PdfService, PdfTemplateService, ProcessPdfDocument)
+
+The `/pdfs` counterpart of [Templated Email](#templated-email-aws-ses), and it reuses
+that pipeline's shape exactly: a catalogue row names a template, a remote service
+renders it, a processor drives the whole thing. What differs is the last mile — mail is
+handed to SES, a document is rasterized and stored.
+
+Three pieces, split along the one line that matters — where the browser binary lives:
 
-`PdfService` (exported by `DocumentModule`) turns an HTML document into PDF
-bytes using a headless Chromium.
+- **`PdfTemplateService`** — resolves a `sys_pdf_templates` row by `identifier` and
+  POSTs your `data` to the remote template service, returning print-ready HTML. Exactly
+  `EmailNotificationService.getEmailBody()`, for documents.
+- **`PdfService`** — turns that HTML into PDF bytes with a headless Chromium. Knows
+  nothing about templates or storage.
+- **`ProcessPdfDocument`** — the entry point. Validates, renders, rasterizes, stores,
+  and returns the `sys_documents` row with its `upload` relation attached.
 
-It is the backend half of the document rendering service: that service serves
-print-ready, A4-locked HTML at `POST /pdfs/<version>/<path>/<template>`, and
-this service rasterizes it. The split keeps the template service free of a
-browser binary and puts the PDF bytes next to the storage and delivery code
-that needs them.
+All three are exported by `DocumentModule`.
+
+### The whole thing in one call
 
 ```ts
-// 1. Fetch the rendered document from the template service.
-const html = await this.remoteRequestService.getApiResponse<string>({
-  url: `${templateBaseUrl}/pdfs/v1/business/summary-report`,
-  requestType: ApiRequestTypeEnum.POST,
-  contentType: ApiContentTypeEnum.APPLICATION_JSON,
-  headers: { 'x-client-key': clientKey },
-  body: reportPayload,
+const processor = new ProcessPdfDocument(
+  this.pdfTemplateService,
+  this.pdfService,
+  this.documentService,
+);
+
+const document = await processor.process({
+  identifier: 'purchase-order',        // a sys_pdf_templates row
+  metadata: {
+    fileName: 'po-10432.pdf',
+    mimeType: 'application/pdf',       // default
+    pathIdentifier: 'purchase.order',  // → the document.path.purchase.order property
+    isPublic: false,                   // default
+  },
+  source: {                            // becomes the sys_documents row
+    source_type: 'purchase.order',
+    source_id: purchaseOrder.id,
+  },
+  data: { order: purchaseOrder, lines },  // payload for the remote renderer
 });
 
-// 2. Rasterize it.
+const link = await this.documentService.getDocumentLink(document.upload);
+```
+
+Four steps, in order:
+
+1. `PdfTemplateService.getPdfHtml()` — loads the template (`OperationException` if the
+   identifier is unknown), builds the URL as the `pdf.template.base.url` system
+   property + `template.path` + `identifier`, and POSTs `data` to it. The URL is a
+   plain concatenation, so the property and `path` carry their own trailing slashes —
+   same contract as `email.template.base.url`.
+2. `PdfService.renderHtmlToUploadableFile()` — the bytes, named (`.pdf` appended when
+   the file name lacks it).
+3. `DocumentService.uploadSingleDocument()` — the object goes to the active driver and
+   one `sys_document_uploads` row records it. `pathIdentifier` is resolved through
+   `resolvePathPrefix()` first, so the destination folder is a `document.path.*` system
+   property rather than a caller-supplied path.
+4. `DocumentService.setDocument(…, { systemGenerated: true })` — the `sys_documents`
+   row linking that upload to your record.
+
+The upload is deliberately made _without_ `sourceType`/`sourceId` and linked in a
+separate call: those options attach the document as an ordinary upload, and
+`system_generated` is only settable on the explicit `setDocument()` — never from
+`SetDocumentDto`, so the HTTP endpoint cannot claim it.
+
+**Seed the catalogue.** A `sys_pdf_templates` row per document, plus the
+`pdf.template.base.url` property; without either, `getPdfHtml()` raises. Manage them
+through [the admin surface](#admin-module) — content manager to define or edit, global
+admin to delete. There is no `PdfTemplateIdentifier` enum: the library dispatches no
+documents of its own, so name yours in an enum in your app rather than inline.
+
+### Using PdfService on its own
+
+Skip the processor when you already have the HTML, or want the bytes rather than a
+stored document:
+
+```ts
 const pdf: Buffer = await this.pdfService.renderHtmlToPdf(html);
 
 // …or go straight to bucket storage.
-const file = await this.pdfService.renderHtmlToUploadableFile(html, 'summary-report.pdf');
+const file = await this.pdfService.renderHtmlToUploadableFile(html, 'report.pdf');
 const [link] = await this.documentService.uploadDocument([file], {
   pathPrefix: 'reports',
 });
 ```
 
-**Install puppeteer.** It is an *optional* peer dependency — nothing imports it
-until a PDF is actually requested, so apps that never generate one skip the
-~170MB Chromium download entirely:
+**Install puppeteer.** It is an _optional_ peer dependency — nothing imports it until a
+PDF is actually requested, so apps that never generate one skip the ~170MB Chromium
+download entirely:
 
 ```bash
 yarn add puppeteer
@@ -784,7 +863,7 @@ yarn add puppeteer
 
 - **The template owns the page setup.** `preferCssPageSize` defaults to `true`,
   so an `@page { size: A4; margin: … }` rule in the HTML wins over the `format`
-  option. Page *count* is never specified by anyone — Chromium paginates and
+  option. Page _count_ is never specified by anyone — Chromium paginates and
   emits as many pages as the content needs, which is what lets an A4-width
   template grow to any length.
 - **Print media is emulated**, so `@media screen` blocks (the sheet shadow a
@@ -799,11 +878,11 @@ yarn add puppeteer
 
 ### Configuration
 
-| Variable                  | Default   | Description                                                                          |
-| ------------------------- | --------- | ------------------------------------------------------------------------------------ |
-| `PDF_CHROMIUM_PATH`       | _(empty)_ | Path to an existing Chromium/Chrome binary; falls back to puppeteer's bundled one     |
-| `PDF_CHROMIUM_NO_SANDBOX` | `false`   | `true` passes `--no-sandbox`. Needed in most containers; only use with trusted HTML   |
-| `PDF_RENDER_TIMEOUT_MS`   | `30000`   | Per-render page load timeout                                                          |
+| Variable                  | Default   | Description                                                                         |
+| ------------------------- | --------- | ----------------------------------------------------------------------------------- |
+| `PDF_CHROMIUM_PATH`       | _(empty)_ | Path to an existing Chromium/Chrome binary; falls back to puppeteer's bundled one   |
+| `PDF_CHROMIUM_NO_SANDBOX` | `false`   | `true` passes `--no-sandbox`. Needed in most containers; only use with trusted HTML |
+| `PDF_RENDER_TIMEOUT_MS`   | `30000`   | Per-render page load timeout                                                        |
 
 ## Raw SQL (SqlService)
 
@@ -862,9 +941,15 @@ await new ProcessEmailNotification(emailNotificationService).process({
 });
 ```
 
+The catalogue is managed from [the admin surface](#admin-module) —
+`POST /admin/email-templates` and friends — and `EmailTemplateEntity` extends
+`CommonAdminEntity` for that reason: a row is authored from the back office, never by a
+tenant user.
+
 The templates the library itself dispatches are named by the
 `EmailTemplateIdentifier` enum — seed a matching `sys_email_templates` row for each
-one you want delivered:
+one you want delivered, and note that these two are exactly the rows a delete must not
+reach:
 
 | Identifier              | Sent by                   | Recipient          | `data` keys                                                                 |
 | ----------------------- | ------------------------- | ------------------ | --------------------------------------------------------------------------- |
@@ -937,7 +1022,8 @@ SQL runs. Results come back as `{ records, total, page, limit, total_pages }`.
 ## Admin Module
 
 `AdminModule` is the back-office surface — tenant onboarding, client/admin user
-registration, tenant listing and scheduled-task management. It uses the same
+registration, tenant listing, scheduled-task management and the email/PDF template
+catalogues. It uses the same
 imperative auth model as the rest of the app: controllers are open by default and
 gate each action through `AdminAccessService` before handing the work to a
 processor.
@@ -963,42 +1049,73 @@ pass the actor to a processor.
 
 ### Endpoints
 
-| Route                                    | Min. role       | Handler                                                     |
-| ---------------------------------------- | --------------- | ----------------------------------------------------------- |
-| `POST /admin/tenants`                    | super admin     | `TenantDataProcessor` (upsert — send `id` to update)        |
-| `POST /admin/tenants/list`               | content reader  | `TenantListProcessor`                                       |
-| `GET  /admin/tenants/:id`                | content reader  | the row plus its `scopes`                                   |
-| `POST /admin/tenants/:id/delete`         | super admin     | `TenantDeleteProcessor`                                     |
-| `POST /admin/tenant-users`               | admin           | `ClientUserDataProcessor`                                   |
-| `POST /admin/tenant-users/bulk`          | admin           | `BulkUserDataProcessor`                                     |
-| `POST /admin/tenant-users/list`          | content reader  | `ClientUserListProcessor`                                   |
-| `GET  /admin/tenant-users/:id`           | content reader  | the row                                                     |
-| `POST /admin/tenant-users/:id/delete`    | admin           | `ClientUserDeleteProcessor`                                 |
-| `POST /admin/users`                      | super admin     | `AdminUserDataProcessor`                                    |
-| `POST /admin/users/list`                 | content reader  | `AdminUserListProcessor`                                    |
-| `GET  /admin/users/:id`                  | content reader  | the row                                                     |
-| `POST /admin/users/:id/delete`           | super admin     | `AdminUserDeleteProcessor`                                  |
-| `POST /admin/roles/list`                 | admin           | `AdminRoleListProcessor`                                    |
-| `POST /admin/roles/tenant/list`          | admin           | `RoleListProcessor`                                         |
-| `POST /admin/scheduled-tasks`            | content manager | `ScheduledTaskDataProcessor` (upsert — send `id` to update) |
-| `POST /admin/scheduled-tasks/list`       | content reader  | `ScheduledTaskListProcessor`                                |
-| `GET  /admin/scheduled-tasks/:id`        | content reader  | the row                                                     |
-| `POST /admin/scheduled-tasks/:id/delete` | content manager | `ScheduledTaskDeleteProcessor`                              |
-| `POST /admin/scopes`                     | content manager | `ScopeDataProcessor` (upsert — send `id` to update)         |
-| `POST /admin/scopes/list`                | content reader  | `ScopeListProcessor`                                        |
-| `GET  /admin/scopes/:id`                 | content reader  | the row                                                     |
-| `POST /admin/scopes/:id/delete`          | content manager | `ScopeService.deleteScope` (cascades to every grant)        |
-| `POST /admin/api-keys`                   | admin           | `ApiKeyDataProcessor` — returns `{ raw_key, api_key }`      |
-| `POST /admin/api-keys/list`              | content reader  | `ApiKeyListProcessor`                                       |
-| `GET  /admin/api-keys/:id`               | content reader  | the row, its `scopes`, and `key` from admin up              |
-| `POST /admin/api-keys/:id/disable`       | admin           | `ApiKeyService.disableApiKey` (reversible)                   |
-| `POST /admin/api-keys/:id/delete`        | admin           | `ApiKeyService.deleteApiKey` (soft, and revokes)             |
+| Route                                | Min. role       | Handler                                                         |
+| ------------------------------------ | --------------- | --------------------------------------------------------------- |
+| `POST   /admin/tenants`              | super admin     | `TenantDataProcessor` (upsert — send `id` to update)            |
+| `POST   /admin/tenants/list`         | content reader  | `TenantListProcessor`                                           |
+| `GET    /admin/tenants/:id`          | content reader  | the row plus its `scopes`                                       |
+| `DELETE /admin/tenants/:id`          | super admin     | `TenantDeleteProcessor` (cascades to users, keys, grants)       |
+| `POST   /admin/tenant-users`         | admin           | `ClientUserDataProcessor`                                       |
+| `POST   /admin/tenant-users/bulk`    | admin           | `BulkUserDataProcessor`                                         |
+| `POST   /admin/tenant-users/list`    | content reader  | `ClientUserListProcessor`                                       |
+| `GET    /admin/tenant-users/:id`     | content reader  | the row                                                         |
+| `DELETE /admin/tenant-users/:id`     | admin           | `ClientUserDeleteProcessor`                                     |
+| `POST   /admin/system-users`         | super admin     | `SystemUserDataProcessor` (upsert — send `id` to update)        |
+| `POST   /admin/system-users/list`    | content reader  | `SystemUserListProcessor` (scoped to `user_type = system.user`) |
+| `GET    /admin/system-users/:id`     | content reader  | the row                                                         |
+| `DELETE /admin/system-users/:id`     | super admin     | `SystemUserService.delete` (revokes live sessions)              |
+| `POST   /admin/users`                | super admin     | `AdminUserDataProcessor`                                        |
+| `POST   /admin/users/list`           | content reader  | `AdminUserListProcessor`                                        |
+| `GET    /admin/users/:id`            | content reader  | the row                                                         |
+| `DELETE /admin/users/:id`            | super admin     | `AdminUserDeleteProcessor`                                      |
+| `POST   /admin/roles/list`           | admin           | `AdminRoleListProcessor` — picker feed (`sys_admin_roles`)      |
+| `POST   /admin/roles/tenant/list`    | admin           | `RoleListProcessor` — picker feed (`sys_roles`)                 |
+| `POST   /admin/system-roles`         | content manager | `SystemRoleDataProcessor` (upsert — send `id` to update)        |
+| `POST   /admin/system-roles/list`    | content reader  | `RoleListProcessor`                                             |
+| `GET    /admin/system-roles/:id`     | content reader  | the row                                                         |
+| `DELETE /admin/system-roles/:id`     | content manager | `RoleService.deleteRole` (cascades to every grant)              |
+| `POST   /admin/scheduled-tasks`      | content manager | `ScheduledTaskDataProcessor` (upsert — send `id` to update)     |
+| `POST   /admin/scheduled-tasks/list` | content reader  | `ScheduledTaskListProcessor`                                    |
+| `GET    /admin/scheduled-tasks/:id`  | content reader  | the row                                                         |
+| `DELETE /admin/scheduled-tasks/:id`  | content manager | `ScheduledTaskDeleteProcessor`                                  |
+| `POST   /admin/email-templates`      | content manager | `EmailTemplateDataProcessor` (upsert — send `id` to update)     |
+| `POST   /admin/email-templates/list` | content reader  | `EmailTemplateListProcessor`                                    |
+| `GET    /admin/email-templates/:id`  | content reader  | the row                                                         |
+| `DELETE /admin/email-templates/:id`  | **admin**       | `TemplateService.deleteEmailTemplate`                           |
+| `POST   /admin/pdf-templates`        | content manager | `PdfTemplateDataProcessor` (upsert — send `id` to update)       |
+| `POST   /admin/pdf-templates/list`   | content reader  | `PdfTemplateListProcessor`                                      |
+| `GET    /admin/pdf-templates/:id`    | content reader  | the row                                                         |
+| `DELETE /admin/pdf-templates/:id`    | **admin**       | `TemplateService.deletePdfTemplate`                             |
+| `POST   /admin/scopes`               | content manager | `ScopeDataProcessor` (upsert — send `id` to update)             |
+| `POST   /admin/scopes/list`          | content reader  | `ScopeListProcessor`                                            |
+| `GET    /admin/scopes/:id`           | content reader  | the row                                                         |
+| `DELETE /admin/scopes/:id`           | content manager | `ScopeService.deleteScope` (cascades to every grant)            |
+| `POST   /admin/api-keys`             | admin           | `ApiKeyDataProcessor` — returns `{ raw_key, api_key }`          |
+| `POST   /admin/api-keys/list`        | content reader  | `ApiKeyListProcessor`                                           |
+| `GET    /admin/api-keys/:id`         | content reader  | the row, its `scopes`, and `key` from admin up                  |
+| `POST   /admin/api-keys/:id/disable` | admin           | `ApiKeyService.disableApiKey` (reversible)                      |
+| `DELETE /admin/api-keys/:id`         | admin           | `ApiKeyService.deleteApiKey` (soft, and revokes)                |
 
 List endpoints are `POST .../list` with the filter payload in the body (a
 `CommonListFilterDto`) — see [List Endpoints & Filtering](#list-endpoints--filtering).
 Deletes and the API-key disable are single-action, so they sit on the domain service
 rather than in a processor; processors are for the writes that validate a payload.
 
+**Template catalogues.** `sys_email_templates` and `sys_pdf_templates` are the same
+surface across two controllers — same routes, same DTO, and a PDF template simply has
+no `subject` because a document has no envelope to address. Neither row holds markup:
+`path` + `identifier` are appended to a base-URL system property to reach the remote
+template service, so the catalogue is a table of pointers.
+
+Reading is content-reader work and writing content-manager work, the same split scopes
+get. **Deleting sits one level higher, at global admin** — the one place these differ
+from every other catalogue. An identifier is named by _code_
+(`EmailTemplateIdentifier.TENANT_ONBOARDED`, whatever `ProcessPdfDocument` asks for),
+so deleting a row does not change what a flow says, it stops the flow rendering at all
+— and only at send/generate time, as an `OperationException`. Nothing cascades: the
+remote template, every mail already sent and every document already generated are left
+exactly as they are.
+
 **Scopes and grants.** A scope is defined once in `sys_scopes` (content manager),
 then granted to the principals that hold it. `AddTenantDto.scope_ids` carries the
 tenant's whole scope set — `setScopes()` grants what is new and soft-removes what is
@@ -1035,7 +1152,7 @@ registration deliberately sends nothing.
 
 ##### Create vs. update
 
-Creation DTOs extend `CommonPayloadDto`, which carries an optional UUID `id`. Where a
+Creation DTOs extend `CommonDataDto`, which carries an optional UUID `id`. Where a
 processor supports it, sending an `id` turns the same `POST` into an update.
 
 The processor loads the row when an `id` is present, falls back to `Entity.create()`

package/dist/admin/admin.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.module.d.ts","sourceRoot":"","sources":["../../src/admin/admin.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,gBAAgB,CAAC;AAIvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAY9D,qBAMa,WAAW;IACtB,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAE,kBAAuB,GAAG,aAAa;CAcjE"}
+{"version":3,"file":"admin.module.d.ts","sourceRoot":"","sources":["../../src/admin/admin.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,gBAAgB,CAAC;AAIvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAa9D,qBAMa,WAAW;IACtB,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAE,kBAAuB,GAAG,aAAa;CAcjE"}

package/dist/admin/admin.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.module.js","sourceRoot":"","sources":["../../src/admin/admin.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAuD;AACvD,qDAAiD;AACjD,2DAAuD;AACvD,+CAA2C;AAE3C,6EAAyE;AACzE,6EAAwE;AAmBjE,IAAM,WAAW,mBAAjB,MAAM,WAAW;IACtB,MAAM,CAAC,QAAQ,CAAC,UAA8B,EAAE;QAC9C,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,OAAO,EAAE;gBACP,wBAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5B,4BAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC9B,wCAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACpC,6CAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC;aACvC;YACD,WAAW,EAAE,CAAC,GAAG,wBAAU,CAAC,WAAW,CAAC;YACxC,SAAS,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;YACnC,OAAO,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;SAClC,CAAC;IACJ,CAAC;CACF,CAAA;AAfY,kCAAW;sBAAX,WAAW;IANvB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,wBAAU,EAAE,4BAAY,EAAE,wCAAkB,EAAE,6CAAoB,CAAC;QAC7E,WAAW,EAAE,CAAC,GAAG,wBAAU,CAAC,WAAW,CAAC;QACxC,SAAS,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;KAClC,CAAC;GACW,WAAW,CAevB"}
+{"version":3,"file":"admin.module.js","sourceRoot":"","sources":["../../src/admin/admin.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAuD;AACvD,qDAAiD;AACjD,2DAAuD;AACvD,+CAA2C;AAE3C,6EAAyE;AACzE,6EAAwE;AAoBjE,IAAM,WAAW,mBAAjB,MAAM,WAAW;IACtB,MAAM,CAAC,QAAQ,CAAC,UAA8B,EAAE;QAC9C,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,OAAO,EAAE;gBACP,wBAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5B,4BAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC9B,wCAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACpC,6CAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC;aACvC;YACD,WAAW,EAAE,CAAC,GAAG,wBAAU,CAAC,WAAW,CAAC;YACxC,SAAS,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;YACnC,OAAO,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;SAClC,CAAC;IACJ,CAAC;CACF,CAAA;AAfY,kCAAW;sBAAX,WAAW;IANvB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,wBAAU,EAAE,4BAAY,EAAE,wCAAkB,EAAE,6CAAoB,CAAC;QAC7E,WAAW,EAAE,CAAC,GAAG,wBAAU,CAAC,WAAW,CAAC;QACxC,SAAS,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;KAClC,CAAC;GACW,WAAW,CAevB"}

package/dist/admin/controllers/admin.api.key.controller.js

@@ -98,7 +98,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], AdminApiKeyController.prototype, "disable", null);
 __decorate([
-    (0, common_1.Post)(':id/delete'),
+    (0, common_1.Delete)(':id'),
     (0, swagger_1.ApiOperation)({
         summary: 'Delete an API key.',
         description: 'Soft delete: the row keeps its data with `deleted_at` set and drops out of every listing. It is revoked in the same transaction, along with its scope grants — key validation matches on `is_active`/`revoked_at`, so a row that only left the listings would keep authenticating requests. Requires at least the global admin role.',

package/dist/admin/controllers/admin.api.key.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.api.key.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoE;AACpE,6CAAuE;AACvE,mEAA+D;AAC/D,yEAAoE;AACpE,sFAA4E;AAC5E,2EAAsE;AACtE,2EAAsE;AACtE,gFAA0E;AAC1E,gFAA0E;AAC1E,6DAAuD;AACvD,+DAAyD;AAUlD,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YACmB,kBAAsC,EACtC,aAA4B,EAC5B,UAAsB;QAFtB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,kBAAa,GAAb,aAAa,CAAe;QAC5B,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAQE,AAAN,KAAK,CAAC,KAAK,CAAS,GAAiB;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,4CAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAkB;QACnC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,4CAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,YAAY,CACjD,MAAM,EACN,0CAAgB,CAAC,YAAY,CAC9B,CAAC;QAEF,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAQK,AAAN,KAAK,CAAC,OAAO,CAAU,EAAE,EAAE,EAAmB;QAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AAlEY,sDAAqB;AAa1B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,0MAA0M;KAC7M,CAAC;IACW,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,8BAAY;;kDAGpC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,uKAAuK;KAC1K,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,gCAAa;;iDAGpC;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,mWAAmW;KACtW,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAQ5C;AAQK;IANL,IAAA,aAAI,EAAC,aAAa,CAAC;IACnB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,sLAAsL;KACzL,CAAC;IACa,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;oDAG7C;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,sUAAsU;KACzU,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAG5C;gCAjEU,qBAAqB;IAHjC,IAAA,iBAAO,EAAC,kBAAkB,CAAC;IAC3B,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,oBAAoB,CAAC;qCAGQ,yCAAkB;QACvB,+BAAa;QAChB,wBAAU;GAJ9B,qBAAqB,CAkEjC"}
+{"version":3,"file":"admin.api.key.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4E;AAC5E,6CAAuE;AACvE,mEAA+D;AAC/D,yEAAoE;AACpE,sFAA4E;AAC5E,2EAAsE;AACtE,2EAAsE;AACtE,gFAA0E;AAC1E,gFAA0E;AAC1E,6DAAuD;AACvD,+DAAyD;AAUlD,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YACmB,kBAAsC,EACtC,aAA4B,EAC5B,UAAsB;QAFtB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,kBAAa,GAAb,aAAa,CAAe;QAC5B,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAQE,AAAN,KAAK,CAAC,KAAK,CAAS,GAAiB;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,4CAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAkB;QACnC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,4CAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,YAAY,CACjD,MAAM,EACN,0CAAgB,CAAC,YAAY,CAC9B,CAAC;QAEF,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAQK,AAAN,KAAK,CAAC,OAAO,CAAU,EAAE,EAAE,EAAmB;QAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AAlEY,sDAAqB;AAa1B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,0MAA0M;KAC7M,CAAC;IACW,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,8BAAY;;kDAGpC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,uKAAuK;KAC1K,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,gCAAa;;iDAGpC;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,mWAAmW;KACtW,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAQ5C;AAQK;IANL,IAAA,aAAI,EAAC,aAAa,CAAC;IACnB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,sLAAsL;KACzL,CAAC;IACa,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;oDAG7C;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,sUAAsU;KACzU,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAG5C;gCAjEU,qBAAqB;IAHjC,IAAA,iBAAO,EAAC,kBAAkB,CAAC;IAC3B,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,oBAAoB,CAAC;qCAGQ,yCAAkB;QACvB,+BAAa;QAChB,wBAAU;GAJ9B,qBAAqB,CAkEjC"}