@openbrf/plugin-sdk 0.0.0-stage → 1.2.0

package/dist/recipients.d.ts

@@ -0,0 +1,139 @@
+import { z } from "zod";
+/**
+ * An `https` origin: the scheme, the host and a port only where it is not 443.
+ *
+ * Written as the WHATWG URL parser writes an origin, so one place has one
+ * spelling: `https://API.example.com:443/` and `https://api.example.com` are the
+ * same recipient, and only the second is accepted. No path, because the board
+ * consents to a party and not to one of its endpoints; no credentials, because
+ * a manifest is published; and nothing but `https`, because what crosses the
+ * connection is the association's data. The host is a name: not an IP literal
+ * or `localhost`, which name no party the board can recognise, and not a name
+ * with a trailing dot, which is the same host under a second spelling.
+ */
+export declare const recipientOriginSchema: z.ZodString;
+/** The host a recipient's origin names, which is what a board recognises. */
+export declare function recipientHost(origin: string): string;
+/**
+ * The hosts of the declared recipients that receive personal data, joined.
+ *
+ * The answer a declaration gives to who receives the data (GDPR art.
+ * 30(1)(d)): what the consent screen fills its recipient field with and what
+ * the record of processing activities lists. A recipient receiving none is a
+ * place the plugin connects to, not a recipient in the sense of art. 4(9), so
+ * it is left out; an empty string when none receives any.
+ */
+export declare function receivingHosts(recipients: readonly Pick<PluginRecipient, "origin" | "personalData">[]): string;
+/**
+ * The longest `receivingHosts` can be: every recipient the declaration may
+ * hold, each at the longest origin less its `https://`. A field the answer is
+ * written to has to take at least this, or a valid declaration fills in an
+ * answer the field then refuses.
+ */
+export declare const RECEIVING_HOSTS_MAX_LENGTH: number;
+export declare const pluginRecipientSchema: z.ZodObject<{
+    id: z.ZodString;
+    origin: z.ZodString;
+    purpose: z.ZodObject<{
+        sv: z.ZodString;
+        en: z.ZodString;
+    }, z.core.$strict>;
+    personalData: z.ZodArray<z.ZodEnum<{
+        account: "account";
+        apartment: "apartment";
+        auditTrail: "auditTrail";
+        email: "email";
+        financial: "financial";
+        freeText: "freeText";
+        health: "health";
+        name: "name";
+        personalIdentityNumber: "personalIdentityNumber";
+        phone: "phone";
+        photograph: "photograph";
+        postalAddress: "postalAddress";
+        protected: "protected";
+        residency: "residency";
+    }>>;
+}, z.core.$strip>;
+export type PluginRecipient = z.infer<typeof pluginRecipientSchema>;
+/**
+ * The declared recipients over a given reading of one recipient.
+ *
+ * The manifest reads a recipient as `pluginRecipientSchema` does and the
+ * catalog index reads the same fields strictly, as it reads everything. Both
+ * keep the rules below, which is why the list is built here rather than
+ * written twice.
+ *
+ * An id appears once and an origin appears once. Two declarations of one id
+ * would leave the consent snapshot and the board's screen naming different
+ * things by it; two of one origin would let a plugin state a narrow purpose
+ * and a wide one for the same party, and a board reading the first would have
+ * consented to the second.
+ *
+ * Undefaulted, on the terms of `declaredActionsSchema`: a manifest and a
+ * catalog entry add `.default([])`, and the install request does not, so an
+ * echo that left the field out is not read as consent to none.
+ */
+export declare function declaredRecipientsSchema<T extends z.ZodType<{
+    id: string;
+    origin: string;
+}>>(recipient: T): z.ZodArray<T>;
+export declare const pluginRecipientsSchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    origin: z.ZodString;
+    purpose: z.ZodObject<{
+        sv: z.ZodString;
+        en: z.ZodString;
+    }, z.core.$strict>;
+    personalData: z.ZodArray<z.ZodEnum<{
+        account: "account";
+        apartment: "apartment";
+        auditTrail: "auditTrail";
+        email: "email";
+        financial: "financial";
+        freeText: "freeText";
+        health: "health";
+        name: "name";
+        personalIdentityNumber: "personalIdentityNumber";
+        phone: "phone";
+        photograph: "photograph";
+        postalAddress: "postalAddress";
+        protected: "protected";
+        residency: "residency";
+    }>>;
+}, z.core.$strip>>;
+/**
+ * The canonical string a recipient is consented to and compared by.
+ *
+ * The id, the origin and the categories: what the plugin may reach and what
+ * goes there. The purpose is the plugin's words for it and is shown, not
+ * compared, so a republished version that rewords one is not refused for it.
+ */
+export declare function canonicalRecipient(recipient: Pick<PluginRecipient, "id" | "origin" | "personalData">): string;
+/**
+ * The declared recipients a consent given to `consented`, as
+ * `canonicalRecipient` wrote it, does not cover.
+ *
+ * A recipient is covered by a consented one with the same id and origin that
+ * received every category it now receives. Fewer categories are covered: the
+ * plugin's data reaching that party narrowed, and the board agreed to more.
+ * One more, a new id or an id moved to another origin is not.
+ */
+export declare function recipientsBeyondConsent<T extends Pick<PluginRecipient, "id" | "origin" | "personalData">>(declared: readonly T[], consented: readonly string[]): T[];
+/** Whether two declarations name the same recipients, as multisets. */
+export declare function sameRecipientDeclaration(left: readonly Pick<PluginRecipient, "id" | "origin" | "personalData">[], right: readonly Pick<PluginRecipient, "id" | "origin" | "personalData">[]): boolean;
+/**
+ * The recipients' categories that are not among the ones the plugin declares
+ * it handles, as issues at the path of each.
+ *
+ * What a recipient receives is part of what the plugin handles. One naming a
+ * category the plugin does not declare would put it on the consent screen, and
+ * into the record of who receives what, without the record of processing
+ * activities hearing of it. The manifest and the catalog entry repeat the same
+ * two fields, so both refuse it with this rule.
+ */
+export declare function recipientCategoryIssues(recipients: readonly Pick<PluginRecipient, "personalData">[], handled: readonly string[]): {
+    path: (string | number)[];
+    message: string;
+}[];
+//# sourceMappingURL=recipients.d.ts.map

package/dist/recipients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../src/recipients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA4BxB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,aAO9B,CAAC;AAqDL,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,SAAS,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,cAAc,CAAC,EAAE,GACtE,MAAM,CAKR;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAEO,CAAC;AAE/C,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAoBhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EACnD,SAAS,EAAE,CAAC,iBA0Bb;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;kBAElC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,QAAQ,GAAG,cAAc,CAAC,GACjE,MAAM,CAMR;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,CAAC,SAAS,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,QAAQ,GAAG,cAAc,CAAC,EACjE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,EAAE,CAiB3D;AAED,uEAAuE;AACvE,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,SAAS,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,QAAQ,GAAG,cAAc,CAAC,EAAE,EACxE,KAAK,EAAE,SAAS,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,QAAQ,GAAG,cAAc,CAAC,EAAE,GACxE,OAAO,CAIT;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,SAAS,IAAI,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,EAC5D,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB;IAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CAclD"}

package/dist/recipients.js

@@ -0,0 +1,223 @@
+import { z } from "zod";
+import { localizedTextSchema } from "./localized-text.js";
+import { PLUGIN_PERSONAL_DATA_CATEGORIES } from "./permissions.js";
+/**
+ * Where a plugin connects to outside the instance (ADR 0037).
+ *
+ * Declared in the manifest, and repeated in the catalog entry, for the reason
+ * actions are: the board reads it on the install consent screen before anything
+ * has been downloaded, and it is what the screen's question about where the
+ * plugin sends personal data is answered from.
+ *
+ * A declaration rather than a fence. A backend plugin runs at full process
+ * privilege (ADR 0003), so nothing here stops one opening a connection it did
+ * not declare; the catalog's reading of the server bundle is what holds a
+ * listed plugin to it.
+ */
+/** The longest origin a recipient may name. */
+const RECIPIENT_ORIGIN_MAX_LENGTH = 200;
+/** How many recipients a plugin may declare. */
+const MAX_RECIPIENTS = 8;
+/** What the joined hosts separate them with. */
+const HOST_SEPARATOR = ", ";
+/**
+ * An `https` origin: the scheme, the host and a port only where it is not 443.
+ *
+ * Written as the WHATWG URL parser writes an origin, so one place has one
+ * spelling: `https://API.example.com:443/` and `https://api.example.com` are the
+ * same recipient, and only the second is accepted. No path, because the board
+ * consents to a party and not to one of its endpoints; no credentials, because
+ * a manifest is published; and nothing but `https`, because what crosses the
+ * connection is the association's data. The host is a name: not an IP literal
+ * or `localhost`, which name no party the board can recognise, and not a name
+ * with a trailing dot, which is the same host under a second spelling.
+ */
+export const recipientOriginSchema = z
+    .string()
+    .min(1)
+    .max(RECIPIENT_ORIGIN_MAX_LENGTH)
+    .refine(isCanonicalHttpsOrigin, {
+    error: 'must be an https origin as a browser writes it, such as "https://api.example.com": lowercase, with no path, no trailing slash, no port 443, and a host name that is not an IP address, localhost or written with a trailing dot',
+});
+const WhatwgUrl = globalThis.URL;
+function isCanonicalHttpsOrigin(value) {
+    let parsed;
+    try {
+        parsed = new WhatwgUrl(value);
+    }
+    catch {
+        return false;
+    }
+    return (parsed.protocol === "https:" &&
+        parsed.username === "" &&
+        parsed.password === "" &&
+        parsed.origin === value &&
+        isNamedHost(parsed.hostname));
+}
+/**
+ * Whether a host is a registered-style name: not a trailing-dot spelling, an
+ * IPv6 literal, a dotted IPv4 address or `localhost`. The parser has already
+ * turned any other IPv4 spelling (`0x7f.1`, `2130706433`) into the dotted one.
+ */
+function isNamedHost(hostname) {
+    return !(hostname.endsWith(".") ||
+        hostname.startsWith("[") ||
+        /^\d+\.\d+\.\d+\.\d+$/.test(hostname) ||
+        hostname === "localhost" ||
+        hostname.endsWith(".localhost"));
+}
+/** The host a recipient's origin names, which is what a board recognises. */
+export function recipientHost(origin) {
+    return new WhatwgUrl(origin).host;
+}
+/**
+ * The hosts of the declared recipients that receive personal data, joined.
+ *
+ * The answer a declaration gives to who receives the data (GDPR art.
+ * 30(1)(d)): what the consent screen fills its recipient field with and what
+ * the record of processing activities lists. A recipient receiving none is a
+ * place the plugin connects to, not a recipient in the sense of art. 4(9), so
+ * it is left out; an empty string when none receives any.
+ */
+export function receivingHosts(recipients) {
+    return recipients
+        .filter((recipient) => recipient.personalData.length > 0)
+        .map((recipient) => recipientHost(recipient.origin))
+        .join(HOST_SEPARATOR);
+}
+/**
+ * The longest `receivingHosts` can be: every recipient the declaration may
+ * hold, each at the longest origin less its `https://`. A field the answer is
+ * written to has to take at least this, or a valid declaration fills in an
+ * answer the field then refuses.
+ */
+export const RECEIVING_HOSTS_MAX_LENGTH = MAX_RECIPIENTS * (RECIPIENT_ORIGIN_MAX_LENGTH - "https://".length) +
+    (MAX_RECIPIENTS - 1) * HOST_SEPARATOR.length;
+export const pluginRecipientSchema = z.object({
+    /** Unique in the manifest. Lowercase letters, digits and single hyphens. */
+    id: z
+        .string()
+        .min(2)
+        .max(32)
+        .regex(/^[a-z][a-z0-9]*(-[a-z0-9]+)*$/, "must be lowercase letters, digits and single hyphens, starting with a letter"),
+    origin: recipientOriginSchema,
+    /** What the plugin connects there for, in Swedish and English. */
+    purpose: localizedTextSchema,
+    /**
+     * The personal-data categories this recipient receives, from the plugin's
+     * own `personalData`. Empty for a connection that carries none, such as
+     * fetching a list of models or the day's exchange rates: it is declared all
+     * the same, because the board is shown every place the plugin connects to.
+     */
+    personalData: z.array(z.enum(PLUGIN_PERSONAL_DATA_CATEGORIES)).max(16),
+});
+/**
+ * The declared recipients over a given reading of one recipient.
+ *
+ * The manifest reads a recipient as `pluginRecipientSchema` does and the
+ * catalog index reads the same fields strictly, as it reads everything. Both
+ * keep the rules below, which is why the list is built here rather than
+ * written twice.
+ *
+ * An id appears once and an origin appears once. Two declarations of one id
+ * would leave the consent snapshot and the board's screen naming different
+ * things by it; two of one origin would let a plugin state a narrow purpose
+ * and a wide one for the same party, and a board reading the first would have
+ * consented to the second.
+ *
+ * Undefaulted, on the terms of `declaredActionsSchema`: a manifest and a
+ * catalog entry add `.default([])`, and the install request does not, so an
+ * echo that left the field out is not read as consent to none.
+ */
+export function declaredRecipientsSchema(recipient) {
+    return z
+        .array(recipient)
+        .max(MAX_RECIPIENTS)
+        .superRefine((recipients, ctx) => {
+        const ids = new Set();
+        const origins = new Set();
+        for (const [index, declared] of recipients.entries()) {
+            if (ids.has(declared.id)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: [index, "id"],
+                    message: `two recipients are declared with the id "${declared.id}"`,
+                });
+            }
+            if (origins.has(declared.origin)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: [index, "origin"],
+                    message: `two recipients are declared with the origin "${declared.origin}"`,
+                });
+            }
+            ids.add(declared.id);
+            origins.add(declared.origin);
+        }
+    });
+}
+export const pluginRecipientsSchema = declaredRecipientsSchema(pluginRecipientSchema);
+/**
+ * The canonical string a recipient is consented to and compared by.
+ *
+ * The id, the origin and the categories: what the plugin may reach and what
+ * goes there. The purpose is the plugin's words for it and is shown, not
+ * compared, so a republished version that rewords one is not refused for it.
+ */
+export function canonicalRecipient(recipient) {
+    return [
+        recipient.id,
+        recipient.origin,
+        [...recipient.personalData].sort().join("|"),
+    ].join(" ");
+}
+/**
+ * The declared recipients a consent given to `consented`, as
+ * `canonicalRecipient` wrote it, does not cover.
+ *
+ * A recipient is covered by a consented one with the same id and origin that
+ * received every category it now receives. Fewer categories are covered: the
+ * plugin's data reaching that party narrowed, and the board agreed to more.
+ * One more, a new id or an id moved to another origin is not.
+ */
+export function recipientsBeyondConsent(declared, consented) {
+    const agreed = new Map();
+    for (const canonical of consented) {
+        // Neither an id nor a canonical origin has a space in it.
+        const [id, origin, categories = ""] = canonical.split(" ");
+        agreed.set(`${id} ${origin}`, new Set(categories === "" ? [] : categories.split("|")));
+    }
+    return declared.filter((recipient) => {
+        const categories = agreed.get(`${recipient.id} ${recipient.origin}`);
+        return (categories === undefined ||
+            recipient.personalData.some((category) => !categories.has(category)));
+    });
+}
+/** Whether two declarations name the same recipients, as multisets. */
+export function sameRecipientDeclaration(left, right) {
+    const a = left.map(canonicalRecipient).sort();
+    const b = right.map(canonicalRecipient).sort();
+    return a.length === b.length && a.every((value, index) => value === b[index]);
+}
+/**
+ * The recipients' categories that are not among the ones the plugin declares
+ * it handles, as issues at the path of each.
+ *
+ * What a recipient receives is part of what the plugin handles. One naming a
+ * category the plugin does not declare would put it on the consent screen, and
+ * into the record of who receives what, without the record of processing
+ * activities hearing of it. The manifest and the catalog entry repeat the same
+ * two fields, so both refuse it with this rule.
+ */
+export function recipientCategoryIssues(recipients, handled) {
+    const declared = new Set(handled);
+    return recipients.flatMap((recipient, index) => recipient.personalData.flatMap((category, at) => declared.has(category)
+        ? []
+        : [
+            {
+                path: ["recipients", index, "personalData", at],
+                message: `"${category}" is not among the plugin's own personalData; a recipient receives only what the plugin declares it handles`,
+            },
+        ]));
+}
+//# sourceMappingURL=recipients.js.map

package/dist/recipients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipients.js","sourceRoot":"","sources":["../src/recipients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;;;;;;;;;;GAYG;AAEH,+CAA+C;AAC/C,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC,gDAAgD;AAChD,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,gDAAgD;AAChD,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,2BAA2B,CAAC;KAChC,MAAM,CAAC,sBAAsB,EAAE;IAC9B,KAAK,EACH,iOAAiO;CACpO,CAAC,CAAC;AAkBL,MAAM,SAAS,GACb,UACD,CAAC,GAAG,CAAC;AAEN,SAAS,sBAAsB,CAAC,KAAa;IAC3C,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,QAAQ,KAAK,EAAE;QACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;QACtB,MAAM,CAAC,MAAM,KAAK,KAAK;QACvB,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,CAAC,CACN,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QACxB,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACrC,QAAQ,KAAK,WAAW;QACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAuE;IAEvE,OAAO,UAAU;SACd,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;SACnD,IAAI,CAAC,cAAc,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,cAAc,GAAG,CAAC,2BAA2B,GAAG,UAAU,CAAC,MAAM,CAAC;IAClE,CAAC,cAAc,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC;AAE/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,4EAA4E;IAC5E,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CACJ,+BAA+B,EAC/B,8EAA8E,CAC/E;IACH,MAAM,EAAE,qBAAqB;IAC7B,kEAAkE;IAClE,OAAO,EAAE,mBAAmB;IAC5B;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACvE,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CAEtC,SAAY;IACZ,OAAO,CAAC;SACL,KAAK,CAAC,SAAS,CAAC;SAChB,GAAG,CAAC,cAAc,CAAC;SACnB,WAAW,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC;oBACnB,OAAO,EAAE,4CAA4C,QAAQ,CAAC,EAAE,GAAG;iBACpE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;oBACvB,OAAO,EAAE,gDAAgD,QAAQ,CAAC,MAAM,GAAG;iBAC5E,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAC5D,qBAAqB,CACtB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAkE;IAElE,OAAO;QACL,SAAS,CAAC,EAAE;QACZ,SAAS,CAAC,MAAM;QAChB,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;KAC7C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAErC,QAAsB,EAAE,SAA4B;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,0DAA0D;QAC1D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,GAAG,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CACR,GAAG,EAAE,IAAI,MAAM,EAAE,EACjB,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,OAAO,CACL,UAAU,KAAK,SAAS;YACxB,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CACrE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB,CACtC,IAAwE,EACxE,KAAyE;IAEzE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAA4D,EAC5D,OAA0B;IAE1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,OAAO,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAC7C,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAC9C,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;gBAC/C,OAAO,EAAE,IAAI,QAAQ,6GAA6G;aACnI;SACF,CACN,CACF,CAAC;AACJ,CAAC"}

package/dist/records.d.ts

@@ -0,0 +1,130 @@
+/**
+ * A plugin's own records (ADR 0033).
+ *
+ * A small keyed store: JSON values under a collection and a key, belonging to
+ * the plugin and to nothing else. It is for what a plugin has of its own to
+ * remember and cannot fit into a settings form - a list of screens, each with
+ * its own layout and rotation - and never for people. The data subject access
+ * report, purging, erasure and restriction all read the core's own tables, and
+ * a plugin's JSON is opaque to every one of them, so a name, an email address
+ * or anything copied out of the register kept here would be data the
+ * association holds and cannot report, purge or restrict. The host cannot tell
+ * a name from a label, so the rule is declared rather than enforced, with one
+ * exception: a personal identity number is refused on every write.
+ *
+ * The errors below are thrown by the host's copy of this package. A plugin
+ * imports the SDK for its types only, so it tells them apart by `name` rather
+ * than with `instanceof`.
+ */
+/** A value JSON can carry. */
+export type JsonValue = null | boolean | number | string | readonly JsonValue[] | {
+    readonly [key: string]: JsonValue;
+};
+/**
+ * A collection: lowercase letters, digits and single hyphens, at most 32
+ * characters, starting and ending with a letter or a digit.
+ */
+export declare const PLUGIN_RECORD_COLLECTION_PATTERN: RegExp;
+/** A key: 1 to 128 letters, digits, `.`, `_`, `:` or `-`. */
+export declare const PLUGIN_RECORD_KEY_PATTERN: RegExp;
+/** What one plugin may hold, and the most one call reads. */
+export declare const PLUGIN_RECORD_LIMITS: {
+    /** Bytes of one value, serialised as JSON in UTF-8. */
+    readonly valueBytes: number;
+    /** Records per plugin, across every collection. */
+    readonly records: 10000;
+    /** Bytes per plugin, across every collection, counted as for one value. */
+    readonly totalBytes: number;
+    /** Records one `list` returns, and its default. */
+    readonly listLimit: 200;
+    /**
+     * Writes of one plugin the host holds at once, the one under way and those
+     * waiting for their turn. A write sent past it is refused, not held.
+     */
+    readonly queuedWrites: 100;
+};
+export interface PluginRecord<Value extends JsonValue = JsonValue> {
+    readonly collection: string;
+    readonly key: string;
+    readonly value: Value;
+    /**
+     * A counter, 1 when the record is written first and one more on every write
+     * after that. Not `updatedAt`, because two writes inside one millisecond
+     * carry the same time.
+     */
+    readonly revision: number;
+    /** When the record was last written, as an ISO 8601 instant. */
+    readonly updatedAt: string;
+}
+/**
+ * The plugin's own records. Needs no permission, and refuses while the plugin
+ * is switched off, as every host service does.
+ *
+ * A collection or a key outside its pattern is refused with a RangeError, and a
+ * value JSON cannot carry exactly - `undefined`, a function, `NaN`, a `Date`, a
+ * class instance, a lone surrogate or a NUL character - with a TypeError.
+ */
+export interface PluginRecords {
+    get<Value extends JsonValue>(collection: string, key: string): Promise<PluginRecord<Value> | null>;
+    /**
+     * In key order, from after `after` when it is given. At most 200 per call,
+     * which is also the default.
+     */
+    list<Value extends JsonValue>(collection: string, options?: {
+        after?: string;
+        limit?: number;
+    }): Promise<readonly PluginRecord<Value>[]>;
+    /**
+     * Writes a value. With `expectedRevision`, only over that revision, and
+     * `null` means only where there is no record yet; otherwise it throws
+     * PluginRecordConflictError.
+     *
+     * A value carrying a personal identity number, in a string, a property name
+     * or a number, is refused with PluginRecordIdentityNumberError. A value
+     * over 64 KiB, and a write that would take the plugin past 10 000 records
+     * or 16 MiB, is refused with PluginRecordLimitError, and so is any write,
+     * an overwrite too, sent while 100 of the plugin's writes are already held,
+     * the one under way and those waiting.
+     */
+    put<Value extends JsonValue>(collection: string, key: string, value: Value, options?: {
+        expectedRevision?: number | null;
+    }): Promise<PluginRecord<Value>>;
+    /**
+     * True when there was a record to delete. With `expectedRevision`, only that
+     * revision is deleted, and another one throws PluginRecordConflictError; no
+     * record at all is still `false`.
+     */
+    delete(collection: string, key: string, options?: {
+        expectedRevision?: number;
+    }): Promise<boolean>;
+}
+/** A write's `expectedRevision` did not match the record it found. */
+export declare class PluginRecordConflictError extends Error {
+    readonly pluginId: string;
+    /** The revision the store holds, or null when it holds no record. */
+    readonly actualRevision: number | null;
+    constructor(pluginId: string, 
+    /** The revision the store holds, or null when it holds no record. */
+    actualRevision: number | null);
+}
+export type PluginRecordLimit = "valueBytes" | "records" | "totalBytes" | "queuedWrites";
+/**
+ * A write, or a delete queued behind the writes, was past one of
+ * {@link PLUGIN_RECORD_LIMITS}, and nothing was changed.
+ */
+export declare class PluginRecordLimitError extends Error {
+    readonly pluginId: string;
+    readonly limit: PluginRecordLimit;
+    constructor(pluginId: string, limit: PluginRecordLimit);
+}
+/**
+ * A write carried a personal identity number.
+ *
+ * Neither the collection, the key nor the number is in the message: the error
+ * reaches the log, and the number is what the refusal is keeping out of it.
+ */
+export declare class PluginRecordIdentityNumberError extends Error {
+    readonly pluginId: string;
+    constructor(pluginId: string);
+}
+//# sourceMappingURL=records.d.ts.map

package/dist/records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../src/records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,8BAA8B;AAC9B,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,SAAS,EAAE,GACpB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,gCAAgC,QACH,CAAC;AAE3C,6DAA6D;AAC7D,eAAO,MAAM,yBAAyB,QAA6B,CAAC;AAEpE,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB;IAC/B,uDAAuD;aACvD,UAAU;IACV,mDAAmD;aACnD,OAAO,EAAE,KAAM;IACf,2EAA2E;aAC3E,UAAU;IACV,mDAAmD;aACnD,SAAS,EAAE,GAAG;IACd;;;OAGG;aACH,YAAY,EAAE,GAAG;CACT,CAAC;AAEX,MAAM,WAAW,YAAY,CAAC,KAAK,SAAS,SAAS,GAAG,SAAS;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,KAAK,SAAS,SAAS,EACzB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAEvC;;;OAGG;IACH,IAAI,CAAC,KAAK,SAAS,SAAS,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,SAAS,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE3C;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,KAAK,SAAS,SAAS,EACzB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAC7C,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAEhC;;;;OAIG;IACH,MAAM,CACJ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACtC,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED,sEAAsE;AACtE,qBAAa,yBAA0B,SAAQ,KAAK;IAEhD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAHxC,YACW,QAAQ,EAAE,MAAM;IACzB,qEAAqE;IAC5D,cAAc,EAAE,MAAM,GAAG,IAAI,EAMvC;CACF;AAED,MAAM,MAAM,iBAAiB,GAC3B,YAAY,GAAG,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAE3D;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAE7C,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,KAAK,EAAE,iBAAiB;IAFnC,YACW,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,iBAAiB,EAOlC;CACF;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAArC,YAAqB,QAAQ,EAAE,MAAM,EAMpC;CACF"}

package/dist/records.js

@@ -0,0 +1,85 @@
+/**
+ * A plugin's own records (ADR 0033).
+ *
+ * A small keyed store: JSON values under a collection and a key, belonging to
+ * the plugin and to nothing else. It is for what a plugin has of its own to
+ * remember and cannot fit into a settings form - a list of screens, each with
+ * its own layout and rotation - and never for people. The data subject access
+ * report, purging, erasure and restriction all read the core's own tables, and
+ * a plugin's JSON is opaque to every one of them, so a name, an email address
+ * or anything copied out of the register kept here would be data the
+ * association holds and cannot report, purge or restrict. The host cannot tell
+ * a name from a label, so the rule is declared rather than enforced, with one
+ * exception: a personal identity number is refused on every write.
+ *
+ * The errors below are thrown by the host's copy of this package. A plugin
+ * imports the SDK for its types only, so it tells them apart by `name` rather
+ * than with `instanceof`.
+ */
+/**
+ * A collection: lowercase letters, digits and single hyphens, at most 32
+ * characters, starting and ending with a letter or a digit.
+ */
+export const PLUGIN_RECORD_COLLECTION_PATTERN = /^(?=.{1,32}$)[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** A key: 1 to 128 letters, digits, `.`, `_`, `:` or `-`. */
+export const PLUGIN_RECORD_KEY_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+/** What one plugin may hold, and the most one call reads. */
+export const PLUGIN_RECORD_LIMITS = {
+    /** Bytes of one value, serialised as JSON in UTF-8. */
+    valueBytes: 64 * 1024,
+    /** Records per plugin, across every collection. */
+    records: 10_000,
+    /** Bytes per plugin, across every collection, counted as for one value. */
+    totalBytes: 16 * 1024 * 1024,
+    /** Records one `list` returns, and its default. */
+    listLimit: 200,
+    /**
+     * Writes of one plugin the host holds at once, the one under way and those
+     * waiting for their turn. A write sent past it is refused, not held.
+     */
+    queuedWrites: 100,
+};
+/** A write's `expectedRevision` did not match the record it found. */
+export class PluginRecordConflictError extends Error {
+    pluginId;
+    actualRevision;
+    constructor(pluginId, 
+    /** The revision the store holds, or null when it holds no record. */
+    actualRevision) {
+        super(`Plugin "${pluginId}" wrote a record over a revision it no longer has.`);
+        this.pluginId = pluginId;
+        this.actualRevision = actualRevision;
+        this.name = "PluginRecordConflictError";
+    }
+}
+/**
+ * A write, or a delete queued behind the writes, was past one of
+ * {@link PLUGIN_RECORD_LIMITS}, and nothing was changed.
+ */
+export class PluginRecordLimitError extends Error {
+    pluginId;
+    limit;
+    constructor(pluginId, limit) {
+        super(`Plugin "${pluginId}" was refused a record operation past its ${limit} ` +
+            `limit of ${String(PLUGIN_RECORD_LIMITS[limit])}.`);
+        this.pluginId = pluginId;
+        this.limit = limit;
+        this.name = "PluginRecordLimitError";
+    }
+}
+/**
+ * A write carried a personal identity number.
+ *
+ * Neither the collection, the key nor the number is in the message: the error
+ * reaches the log, and the number is what the refusal is keeping out of it.
+ */
+export class PluginRecordIdentityNumberError extends Error {
+    pluginId;
+    constructor(pluginId) {
+        super(`Plugin "${pluginId}" wrote a record carrying a personal identity ` +
+            "number, which a plugin's records may not hold.");
+        this.pluginId = pluginId;
+        this.name = "PluginRecordIdentityNumberError";
+    }
+}
+//# sourceMappingURL=records.js.map

package/dist/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../src/records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAWH;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAC3C,wCAAwC,CAAC;AAE3C,6DAA6D;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAEpE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,uDAAuD;IACvD,UAAU,EAAE,EAAE,GAAG,IAAI;IACrB,mDAAmD;IACnD,OAAO,EAAE,MAAM;IACf,2EAA2E;IAC3E,UAAU,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC5B,mDAAmD;IACnD,SAAS,EAAE,GAAG;IACd;;;OAGG;IACH,YAAY,EAAE,GAAG;CACT,CAAC;AAsEX,sEAAsE;AACtE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEvC,QAAQ;IAER,cAAc;IAHzB,YACW,QAAgB;IACzB,qEAAqE;IAC5D,cAA6B;QAEtC,KAAK,CACH,WAAW,QAAQ,oDAAoD,CACxE,CAAC;wBANO,QAAQ;8BAER,cAAc;QAKvB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAKD;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAEpC,QAAQ;IACR,KAAK;IAFhB,YACW,QAAgB,EAChB,KAAwB;QAEjC,KAAK,CACH,WAAW,QAAQ,6CAA6C,KAAK,GAAG;YACtE,YAAY,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,GAAG,CACrD,CAAC;wBANO,QAAQ;qBACR,KAAK;QAMd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACnC,QAAQ;IAA7B,YAAqB,QAAgB;QACnC,KAAK,CACH,WAAW,QAAQ,gDAAgD;YACjE,gDAAgD,CACnD,CAAC;wBAJiB,QAAQ;QAK3B,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF"}

package/dist/require-capability.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Raising a plugin route above the capability floor the host gives it.
+ *
+ * The host reads one metadata key off a controller and off each of its routes,
+ * and answers a request only for a person who holds every capability listed
+ * there. A plugin's controllers get a floor from the plugin's own permissions
+ * (see "Routes" in the plugin contract); `RequireCapability` is how a route
+ * asks for more.
+ *
+ * Written without `@nestjs/common` on purpose, for the reason `definePlugin` is
+ * an identity function: the SDK is bundled into the plugin, and an import of
+ * its own would have to be resolved from the data volume. NestJS's
+ * `SetMetadata` does no more than this, on the same global `Reflect` the host's
+ * copy of NestJS writes to.
+ */
+/** The metadata key the host reads a route's or a controller's capabilities from. */
+export declare const REQUIRED_CAPABILITIES_KEY = "openbrf:required-capabilities";
+/**
+ * Every capability name the host knows, which is what a route may require.
+ *
+ * Listed here, not derived, because the SDK cannot import the host. The host
+ * checks the list against its own capabilities in a test, so a capability
+ * added there is not missing here for long; until the SDK is released with it,
+ * a plugin that needs the new name is a type error rather than a typo caught
+ * at request time.
+ */
+export declare const PLUGIN_ROUTE_CAPABILITIES: readonly ["association:manage", "association:read", "addressBook:read", "addressBook:write", "memberRegister:read", "apartmentRegister:read", "protectedData:reveal", "registerReport:export", "invitation:send", "signupRequest:decide", "self:manage", "residentDirectory:read", "issues:handle", "issues:report", "issues:configure", "documents:manage", "site:manage", "news:comment", "boardPosition:manage", "bookings:book", "bookings:manage", "bookings:configure", "events:manage", "events:attend", "systemRole:manage", "motions:submit", "motions:handle", "meetings:manage", "memberCharges:manage", "fees:manage", "dataProtection:manage", "boardMailbox:handle", "sublets:apply", "sublets:handle", "keyOrders:place", "keyOrders:handle", "chat:participate", "chat:moderate", "apartmentBinder:manage"];
+/** A capability name a plugin route may require. */
+export type PluginRouteCapability = (typeof PLUGIN_ROUTE_CAPABILITIES)[number];
+/**
+ * Declares the capabilities a route requires. Several are combined with AND.
+ *
+ * Applied to a controller it covers every route in it. It can only add to the
+ * floor the host gives the plugin: a route cannot require less.
+ */
+export declare function RequireCapability(...capabilities: PluginRouteCapability[]): MethodDecorator & ClassDecorator;
+//# sourceMappingURL=require-capability.d.ts.map

package/dist/require-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-capability.d.ts","sourceRoot":"","sources":["../src/require-capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,YACpC,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,wBAAwB,CAChB,CAAC;AAEX,oDAAoD;AACpD,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAO/E;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,YAAY,EAAE,qBAAqB,EAAE,GACvC,eAAe,GAAG,cAAc,CAmBlC"}