@pattern-stack/codegen 0.15.0 → 0.15.2

package/dist/runtime/base-classes/metadata-entity-service.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../runtime/base-classes/lifecycle-events.ts","../../../runtime/base-classes/base-service.ts","../../../runtime/base-classes/metadata-entity-service.ts"],"sourcesContent":["/**\n * Lifecycle event emission for BaseService.\n *\n * Ported from pattern-stack/atoms/patterns/services/base.py — the Python\n * BaseService emits LIFECYCLE and CHANGE events on every CRUD operation.\n * This module provides the same capability for the TypeScript codegen stack.\n *\n * Design:\n *   - Fire-and-forget: event emission never fails the CRUD operation.\n *   - IEventBus is optional: if no EVENT_BUS is injected, emission is silently\n *     skipped. This means base classes work in projects that haven't installed\n *     the events subsystem.\n *   - LIFECYCLE events carry an entity snapshot in payload.\n *   - CHANGE events carry per-field old/new diffs.\n *   - Controlled per-entity via `emitLifecycleEvents` flag (default: true).\n *\n * @deprecated EVT-7 — Lifecycle events are untyped and emit outside of the\n *   CRUD transaction. New work should declare an `emits:` block on the entity\n *   and publish typed domain events from use-cases via TYPED_EVENT_BUS inside\n *   the same Drizzle transaction. See `docs/specs/EVT-7.md`. This helper is\n *   retained for BaseService backward compatibility until all entities have\n *   migrated to typed emits.\n */\n\nimport { randomUUID } from 'crypto';\nimport type { IEventBus, DomainEvent } from '../subsystems/events/event-bus.protocol';\n\n// ============================================================================\n// Event categories (subset of pattern-stack's EventCategory)\n// ============================================================================\n\nexport type EventCategory = 'lifecycle' | 'change';\n\n// ============================================================================\n// Helpers\n// ============================================================================\n\n/** System fields excluded from entity snapshots and change diffs. */\nconst SYSTEM_FIELDS = new Set([\n\t'id',\n\t'createdAt',\n\t'updatedAt',\n\t'deletedAt',\n]);\n\n/**\n * Snapshot an entity's field values, excluding system fields.\n * Mirrors pattern-stack's `_get_entity_snapshot()`.\n */\nexport function entitySnapshot(entity: Record<string, unknown>): Record<string, unknown> {\n\tconst snap: Record<string, unknown> = {};\n\tfor (const [key, value] of Object.entries(entity)) {\n\t\tif (!SYSTEM_FIELDS.has(key)) {\n\t\t\tsnap[key] = value;\n\t\t}\n\t}\n\treturn snap;\n}\n\n/**\n * Diff two entity snapshots, returning per-field old/new pairs.\n * Only includes fields that actually changed.\n */\nexport function diffSnapshots(\n\tbefore: Record<string, unknown>,\n\tafter: Record<string, unknown>,\n): Array<{ field: string; oldValue: unknown; newValue: unknown }> {\n\tconst changes: Array<{ field: string; oldValue: unknown; newValue: unknown }> = [];\n\tconst allKeys = new Set([...Object.keys(before), ...Object.keys(after)]);\n\n\tfor (const key of allKeys) {\n\t\tif (SYSTEM_FIELDS.has(key)) continue;\n\t\tconst oldVal = before[key];\n\t\tconst newVal = after[key];\n\t\t// Simple equality — good enough for primitives and nulls.\n\t\t// For deep objects, JSON.stringify comparison.\n\t\tif (oldVal !== newVal && JSON.stringify(oldVal) !== JSON.stringify(newVal)) {\n\t\t\tchanges.push({ field: key, oldValue: oldVal, newValue: newVal });\n\t\t}\n\t}\n\n\treturn changes;\n}\n\n// ============================================================================\n// Event builders\n// ============================================================================\n\nexport function buildLifecycleEvent(\n\tentityName: string,\n\taction: 'created' | 'updated' | 'deleted',\n\tentityId: string,\n\tsnapshot?: Record<string, unknown>,\n): DomainEvent {\n\treturn {\n\t\tid: randomUUID(),\n\t\ttype: `${entityName}.${action}`,\n\t\taggregateId: entityId,\n\t\taggregateType: entityName,\n\t\tpayload: snapshot ? { snapshot } : {},\n\t\toccurredAt: new Date(),\n\t\tmetadata: { category: 'lifecycle' as EventCategory },\n\t};\n}\n\nexport function buildChangeEvents(\n\tentityName: string,\n\tentityId: string,\n\tchanges: Array<{ field: string; oldValue: unknown; newValue: unknown }>,\n): DomainEvent[] {\n\treturn changes.map((c) => ({\n\t\tid: randomUUID(),\n\t\ttype: `${entityName}.field_changed`,\n\t\taggregateId: entityId,\n\t\taggregateType: entityName,\n\t\tpayload: {\n\t\t\tfieldName: c.field,\n\t\t\toldValue: c.oldValue,\n\t\t\tnewValue: c.newValue,\n\t\t},\n\t\toccurredAt: new Date(),\n\t\tmetadata: { category: 'change' as EventCategory },\n\t}));\n}\n\n// ============================================================================\n// Emission helper (fire-and-forget)\n// ============================================================================\n\n/**\n * Emit events to the bus, swallowing errors.\n * Mirrors pattern-stack's `_emit_lifecycle_event()` try/except.\n */\nexport async function emitSafely(\n\teventBus: IEventBus | undefined,\n\tevents: DomainEvent[],\n): Promise<void> {\n\tif (!eventBus || events.length === 0) return;\n\ttry {\n\t\tif (events.length === 1) {\n\t\t\tconst only = events[0];\n\t\t\tif (!only) return;\n\t\t\tawait eventBus.publish(only);\n\t\t} else {\n\t\t\tawait eventBus.publishMany(events);\n\t\t}\n\t} catch {\n\t\t// Log but never fail the CRUD operation.\n\t\t// In production, this would use a structured logger.\n\t\tconsole.warn(`[lifecycle-events] failed to emit ${events.length} event(s)`);\n\t}\n}\n","/**\n * BaseService<TRepo, TEntity>\n *\n * Abstract base class providing 8 CRUD pass-through methods delegating to\n * an injected repository. Every generated service extends this class.\n *\n * Lifecycle event emission (LIFECYCLE + CHANGE categories) is built into\n * create/update/delete — matching pattern-stack's BaseService. Events are\n * fire-and-forget: emission never fails the CRUD operation. If no IEventBus\n * is injected (eventBus is undefined), emission is silently skipped.\n *\n * Generated services set `entityName` and optionally inject `eventBus` via\n * NestJS property injection (@Inject(EVENT_BUS) @Optional()).\n *\n * Note: @Injectable() is applied on concrete services (not here) so that\n * NestJS DI metadata is emitted at the concrete class level. This matches\n * the pattern established by BaseRepository.\n */\n\nimport type { IEventBus } from '../subsystems/events/event-bus.protocol';\nimport {\n  entitySnapshot,\n  diffSnapshots,\n  buildLifecycleEvent,\n  buildChangeEvents,\n  emitSafely,\n} from './lifecycle-events';\n\n// ============================================================================\n// IBaseRepository interface\n// ============================================================================\n\n/**\n * Structural interface that BaseRepository satisfies.\n * Use this as the TRepo constraint so BaseService is not coupled to the\n * concrete Drizzle-backed BaseRepository.\n */\nexport interface IBaseRepository<TEntity> {\n  findById(id: string): Promise<TEntity | null>;\n  findByIds(ids: string[]): Promise<TEntity[]>;\n  list(options?: unknown): Promise<TEntity[]>;\n  count(where?: unknown): Promise<number>;\n  exists(id: string): Promise<boolean>;\n  create(input: Partial<TEntity>, tx?: unknown): Promise<TEntity>;\n  update(id: string, input: Partial<TEntity>, tx?: unknown): Promise<TEntity>;\n  delete(id: string, tx?: unknown): Promise<void>;\n}\n\n// ============================================================================\n// BaseService\n// ============================================================================\n\nexport abstract class BaseService<TRepo extends IBaseRepository<TEntity>, TEntity> {\n  /**\n   * Entity name for event types (e.g., 'account' → 'account.created').\n   * Set by generated services. If empty, lifecycle events are skipped.\n   */\n  protected entityName?: string;\n\n  /**\n   * Event bus for lifecycle/change event emission.\n   * Injected via @Inject(EVENT_BUS) @Optional() on generated services.\n   * If undefined (no events subsystem installed), emission is silently skipped.\n   */\n  protected eventBus?: IEventBus;\n\n  /**\n   * Whether to emit lifecycle events. Default: true.\n   * Override to false in entity YAML via behaviors or in the service class.\n   */\n  protected emitLifecycleEvents = true;\n\n  constructor(protected readonly repository: TRepo) {}\n\n  /**\n   * Find a single entity by its primary key.\n   * Returns null if not found.\n   */\n  findById(id: string): Promise<TEntity | null> {\n    return this.repository.findById(id);\n  }\n\n  /**\n   * Find multiple entities by their primary keys.\n   */\n  findByIds(ids: string[]): Promise<TEntity[]> {\n    return this.repository.findByIds(ids);\n  }\n\n  /**\n   * List entities with optional filtering/pagination options.\n   */\n  list(options?: unknown): Promise<TEntity[]> {\n    return this.repository.list(options);\n  }\n\n  /**\n   * Count entities matching an optional filter.\n   */\n  count(where?: unknown): Promise<number> {\n    return this.repository.count(where);\n  }\n\n  /**\n   * Check whether an entity with the given id exists.\n   */\n  exists(id: string): Promise<boolean> {\n    return this.repository.exists(id);\n  }\n\n  /**\n   * Insert a new entity.\n   * Emits a LIFECYCLE 'created' event with entity snapshot.\n   */\n  async create(input: Partial<TEntity>, tx?: unknown): Promise<TEntity> {\n    const result = await this.repository.create(input, tx);\n\n    if (this._shouldEmit()) {\n      const snap = entitySnapshot(result as Record<string, unknown>);\n      const id = (result as Record<string, unknown>).id as string;\n      const event = buildLifecycleEvent(this.entityName!, 'created', id, snap);\n      void emitSafely(this.eventBus, [event]);\n    }\n\n    return result;\n  }\n\n  /**\n   * Update an existing entity by id.\n   * Emits a LIFECYCLE 'updated' event + CHANGE events for each modified field.\n   */\n  async update(id: string, input: Partial<TEntity>, tx?: unknown): Promise<TEntity> {\n    // Snapshot before for change diffing\n    let before: Record<string, unknown> | undefined;\n    if (this._shouldEmit()) {\n      const existing = await this.repository.findById(id);\n      if (existing) {\n        before = entitySnapshot(existing as Record<string, unknown>);\n      }\n    }\n\n    const result = await this.repository.update(id, input, tx);\n\n    if (this._shouldEmit()) {\n      const after = entitySnapshot(result as Record<string, unknown>);\n      const events = [\n        buildLifecycleEvent(this.entityName!, 'updated', id, after),\n      ];\n      // Append per-field CHANGE events\n      if (before) {\n        const changes = diffSnapshots(before, after);\n        if (changes.length > 0) {\n          events.push(...buildChangeEvents(this.entityName!, id, changes));\n        }\n      }\n      void emitSafely(this.eventBus, events);\n    }\n\n    return result;\n  }\n\n  /**\n   * Delete an entity by id.\n   * Emits a LIFECYCLE 'deleted' event.\n   */\n  async delete(id: string, tx?: unknown): Promise<void> {\n    await this.repository.delete(id, tx);\n\n    if (this._shouldEmit()) {\n      const event = buildLifecycleEvent(this.entityName!, 'deleted', id);\n      void emitSafely(this.eventBus, [event]);\n    }\n  }\n\n  /** Check whether lifecycle event emission is active. */\n  private _shouldEmit(): boolean {\n    return Boolean(\n      this.emitLifecycleEvents &&\n      this.entityName &&\n      this.eventBus,\n    );\n  }\n}\n","/**\n * MetadataEntityService<TRepo, TEntity>\n *\n * Family-specific base service for metadata entities.\n * Delegates to a metadata repository that provides entity-scoped\n * lookups, history, and bulk upsert.\n */\nimport { BaseService, type IBaseRepository } from './base-service';\n\nexport interface IMetadataEntityRepository<TEntity> extends IBaseRepository<TEntity> {\n  findByEntityIdAndType(entityId: string, entityType: string): Promise<TEntity[]>;\n  listByEntityId(entityId: string): Promise<TEntity[]>;\n  listHistoryByEntityId(entityId: string): Promise<TEntity[]>;\n  upsertMany(inputs: Array<Partial<TEntity>>, tx?: unknown, options?: { conflictTarget?: string }): Promise<TEntity[]>;\n}\n\nexport abstract class MetadataEntityService<\n  TRepo extends IMetadataEntityRepository<TEntity>,\n  TEntity,\n> extends BaseService<TRepo, TEntity> {\n  /**\n   * Find metadata records by entity ID and entity type (EAV polymorphic lookup).\n   */\n  findByEntityIdAndType(entityId: string, entityType: string): Promise<TEntity[]> {\n    return this.repository.findByEntityIdAndType(entityId, entityType);\n  }\n\n  /**\n   * List all metadata records for an entity.\n   */\n  listByEntity(entityId: string): Promise<TEntity[]> {\n    return this.repository.listByEntityId(entityId);\n  }\n\n  /**\n   * List metadata history for an entity, ordered by validFrom desc.\n   */\n  listHistory(entityId: string): Promise<TEntity[]> {\n    return this.repository.listHistoryByEntityId(entityId);\n  }\n\n  /**\n   * Bulk upsert metadata values.\n   */\n  upsertValues(inputs: Array<Partial<TEntity>>, conflictTarget: string, tx?: unknown): Promise<TEntity[]> {\n    return this.repository.upsertMany(inputs, tx, { conflictTarget });\n  }\n}\n"],"mappings":";AAwBA,SAAS,kBAAkB;AAc3B,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAMM,SAAS,eAAe,QAA0D;AACxF,QAAM,OAAgC,CAAC;AACvC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,QAAI,CAAC,cAAc,IAAI,GAAG,GAAG;AAC5B,WAAK,GAAG,IAAI;AAAA,IACb;AAAA,EACD;AACA,SAAO;AACR;AAMO,SAAS,cACf,QACA,OACiE;AACjE,QAAM,UAA0E,CAAC;AACjF,QAAM,UAAU,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC;AAEvE,aAAW,OAAO,SAAS;AAC1B,QAAI,cAAc,IAAI,GAAG,EAAG;AAC5B,UAAM,SAAS,OAAO,GAAG;AACzB,UAAM,SAAS,MAAM,GAAG;AAGxB,QAAI,WAAW,UAAU,KAAK,UAAU,MAAM,MAAM,KAAK,UAAU,MAAM,GAAG;AAC3E,cAAQ,KAAK,EAAE,OAAO,KAAK,UAAU,QAAQ,UAAU,OAAO,CAAC;AAAA,IAChE;AAAA,EACD;AAEA,SAAO;AACR;AAMO,SAAS,oBACf,YACA,QACA,UACA,UACc;AACd,SAAO;AAAA,IACN,IAAI,WAAW;AAAA,IACf,MAAM,GAAG,UAAU,IAAI,MAAM;AAAA,IAC7B,aAAa;AAAA,IACb,eAAe;AAAA,IACf,SAAS,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,IACpC,YAAY,oBAAI,KAAK;AAAA,IACrB,UAAU,EAAE,UAAU,YAA6B;AAAA,EACpD;AACD;AAEO,SAAS,kBACf,YACA,UACA,SACgB;AAChB,SAAO,QAAQ,IAAI,CAAC,OAAO;AAAA,IAC1B,IAAI,WAAW;AAAA,IACf,MAAM,GAAG,UAAU;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,IACf,SAAS;AAAA,MACR,WAAW,EAAE;AAAA,MACb,UAAU,EAAE;AAAA,MACZ,UAAU,EAAE;AAAA,IACb;AAAA,IACA,YAAY,oBAAI,KAAK;AAAA,IACrB,UAAU,EAAE,UAAU,SAA0B;AAAA,EACjD,EAAE;AACH;AAUA,eAAsB,WACrB,UACA,QACgB;AAChB,MAAI,CAAC,YAAY,OAAO,WAAW,EAAG;AACtC,MAAI;AACH,QAAI,OAAO,WAAW,GAAG;AACxB,YAAM,OAAO,OAAO,CAAC;AACrB,UAAI,CAAC,KAAM;AACX,YAAM,SAAS,QAAQ,IAAI;AAAA,IAC5B,OAAO;AACN,YAAM,SAAS,YAAY,MAAM;AAAA,IAClC;AAAA,EACD,QAAQ;AAGP,YAAQ,KAAK,qCAAqC,OAAO,MAAM,WAAW;AAAA,EAC3E;AACD;;;ACnGO,IAAe,cAAf,MAA4E;AAAA,EAoBjF,YAA+B,YAAmB;AAAnB;AAAA,EAAoB;AAAA,EAApB;AAAA;AAAA;AAAA;AAAA;AAAA,EAfrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhC,SAAS,IAAqC;AAC5C,WAAO,KAAK,WAAW,SAAS,EAAE;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,UAAU,KAAmC;AAC3C,WAAO,KAAK,WAAW,UAAU,GAAG;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,KAAK,SAAuC;AAC1C,WAAO,KAAK,WAAW,KAAK,OAAO;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAkC;AACtC,WAAO,KAAK,WAAW,MAAM,KAAK;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,IAA8B;AACnC,WAAO,KAAK,WAAW,OAAO,EAAE;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,OAAyB,IAAgC;AACpE,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,OAAO,EAAE;AAErD,QAAI,KAAK,YAAY,GAAG;AACtB,YAAM,OAAO,eAAe,MAAiC;AAC7D,YAAM,KAAM,OAAmC;AAC/C,YAAM,QAAQ,oBAAoB,KAAK,YAAa,WAAW,IAAI,IAAI;AACvE,WAAK,WAAW,KAAK,UAAU,CAAC,KAAK,CAAC;AAAA,IACxC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,IAAY,OAAyB,IAAgC;AAEhF,QAAI;AACJ,QAAI,KAAK,YAAY,GAAG;AACtB,YAAM,WAAW,MAAM,KAAK,WAAW,SAAS,EAAE;AAClD,UAAI,UAAU;AACZ,iBAAS,eAAe,QAAmC;AAAA,MAC7D;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,IAAI,OAAO,EAAE;AAEzD,QAAI,KAAK,YAAY,GAAG;AACtB,YAAM,QAAQ,eAAe,MAAiC;AAC9D,YAAM,SAAS;AAAA,QACb,oBAAoB,KAAK,YAAa,WAAW,IAAI,KAAK;AAAA,MAC5D;AAEA,UAAI,QAAQ;AACV,cAAM,UAAU,cAAc,QAAQ,KAAK;AAC3C,YAAI,QAAQ,SAAS,GAAG;AACtB,iBAAO,KAAK,GAAG,kBAAkB,KAAK,YAAa,IAAI,OAAO,CAAC;AAAA,QACjE;AAAA,MACF;AACA,WAAK,WAAW,KAAK,UAAU,MAAM;AAAA,IACvC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,IAAY,IAA6B;AACpD,UAAM,KAAK,WAAW,OAAO,IAAI,EAAE;AAEnC,QAAI,KAAK,YAAY,GAAG;AACtB,YAAM,QAAQ,oBAAoB,KAAK,YAAa,WAAW,EAAE;AACjE,WAAK,WAAW,KAAK,UAAU,CAAC,KAAK,CAAC;AAAA,IACxC;AAAA,EACF;AAAA;AAAA,EAGQ,cAAuB;AAC7B,WAAO;AAAA,MACL,KAAK,uBACL,KAAK,cACL,KAAK;AAAA,IACP;AAAA,EACF;AACF;;;ACtKO,IAAe,wBAAf,cAGG,YAA4B;AAAA;AAAA;AAAA;AAAA,EAIpC,sBAAsB,UAAkB,YAAwC;AAC9E,WAAO,KAAK,WAAW,sBAAsB,UAAU,UAAU;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,UAAsC;AACjD,WAAO,KAAK,WAAW,eAAe,QAAQ;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,UAAsC;AAChD,WAAO,KAAK,WAAW,sBAAsB,QAAQ;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,QAAiC,gBAAwB,IAAkC;AACtG,WAAO,KAAK,WAAW,WAAW,QAAQ,IAAI,EAAE,eAAe,CAAC;AAAA,EAClE;AACF;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/runtime/base-classes/tenant-context.js

@@ -1,39 +1,13 @@
-// runtime/base-classes/tenant-context.ts
-import { AsyncLocalStorage } from "async_hooks";
-var als = new AsyncLocalStorage();
-function withRequester(ctx, fn) {
-  return als.run(ctx, fn);
-}
-function requireRequester() {
-  const ctx = als.getStore();
-  if (!ctx) {
-    throw new Error(
-      "No requester context active. Wrap the entry point in withRequester({ userId, organizationId }, fn). See tenant-context.ts."
-    );
-  }
-  return ctx;
-}
-function tryGetRequester() {
-  return als.getStore();
-}
-function requireRequesterScope() {
-  return requireRequester().scope ?? "user";
-}
-function withUserScope(userId, organizationId, fn) {
-  return withRequester({ userId, organizationId, scope: "user" }, fn);
-}
-function withOrgScope(userId, organizationId, orgUserIds, fn) {
-  return withRequester(
-    { userId, organizationId, scope: "org", orgUserIds },
-    fn
-  );
-}
-function withSuperuserScope(userId, fn) {
-  return withRequester(
-    { userId, organizationId: null, scope: "superuser" },
-    fn
-  );
-}
+import {
+  requireRequester,
+  requireRequesterScope,
+  tryGetRequester,
+  withOrgScope,
+  withRequester,
+  withSuperuserScope,
+  withUserScope
+} from "../../chunk-ZUKFQL6E.js";
+import "../../chunk-2E224ZSN.js";
 export {
   requireRequester,
   requireRequesterScope,

package/dist/runtime/base-classes/tenant-context.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../runtime/base-classes/tenant-context.ts"],"sourcesContent":["/**\n * Ambient requester context — AsyncLocalStorage-backed tenant scope.\n *\n * The alternative to threading `userId`/`organizationId` through every\n * repository/service signature. Set ONCE at each boundary the generated app\n * owns, read implicitly inside `BaseRepository` (see `scopePredicate`).\n *\n * ## Where to set it (boundaries)\n *\n *   - HTTP / tRPC handlers — from the authenticated `ctx.user`\n *   - OAuth callback controllers — from the authenticated session\n *   - Queue/worker `process()` — from the job's owning user after the\n *     job's record is loaded\n *\n * Each boundary wraps the rest of the request in `withRequester({ userId,\n * organizationId }, () => ...)`. The context propagates through every `await`\n * to all downstream repo/service calls without being passed explicitly.\n *\n * ## Where to read it\n *\n *   - `BaseRepository.scopePredicate()` reads it (via `tryGetRequester` in\n *     lenient mode, `requireRequester` in strict mode) and filters every read\n *     by the ambient scope when the repo declares `userTracking: true`.\n *\n * ## Why AsyncLocalStorage over an explicit parameter\n *\n * Threading `userId` (and later `organizationId`) through dozens of method\n * signatures is pure parameter pollution. Ambient context also lets a repo\n * make the \"I forgot to scope\" mistake impossible at runtime: in strict mode\n * `requireRequester()` throws when no context is active, surfacing a missing\n * boundary call loudly rather than silently leaking cross-tenant data.\n *\n * ## Not-found semantics\n *\n * When a row exists but belongs to a different requester, scoped reads return\n * `null`/`[]` — identical to \"truly doesn't exist\". No existence oracle;\n * callers throw NotFound uniformly. Standard security practice.\n *\n * ## Testing\n *\n * Tests that exercise scoped repos must wrap the call in `withRequester(...)`.\n * In strict mode an unwrapped call hitting `requireRequester()` throws — by\n * design. In lenient mode (the default) an unwrapped call is simply unscoped.\n */\nimport { AsyncLocalStorage } from 'node:async_hooks';\n\n/**\n * Data-visibility scope. The auth layer decides which scope a request is\n * allowed to claim; the repo trusts whatever the ambient context says.\n *\n * - `'user'`: filter every read by `user_id = ctx.userId`. Default.\n * - `'org'`: filter every read by membership in the requester's org, resolved\n *   via `user_id IN (ctx.orgUserIds)` rather than via a per-entity\n *   `organization_id` column. Works for every user-owned table and keeps repos\n *   single-table — the org member list is pre-resolved at the boundary.\n * - `'superuser'`: no scope filter. Engineering / internal-tools only.\n *\n * AUTHORIZATION (who is allowed to claim each scope) lives in boundary\n * middleware, not in the repo. The repo trusts the ambient context — same\n * trust model as a threaded `userId`.\n */\nexport type RequesterScope = 'user' | 'org' | 'superuser';\n\nexport interface RequesterContext {\n  /**\n   * The user making the request. Always present — even in `'org'` and\n   * `'superuser'` scopes it is the audit-trail \"who actually did this\".\n   */\n  readonly userId: string;\n  /**\n   * The organization the requester belongs to. Required when\n   * `scope === 'org'`; may be null for `'user'` (users with no org) and for\n   * `'superuser'` (cross-org reads).\n   */\n  readonly organizationId: string | null;\n  /**\n   * Data-visibility scope. Defaults to `'user'` when omitted.\n   */\n  readonly scope?: RequesterScope;\n  /**\n   * For `scope === 'org'`: the list of user IDs in the requester's org,\n   * pre-resolved by the boundary middleware that established the `'org'`\n   * scope (one `SELECT users.id WHERE organization_id = X` at the trust\n   * boundary). Repos use this as a literal `IN (...)` filter — they never\n   * JOIN to `users` themselves. Required when `scope === 'org'`.\n   */\n  readonly orgUserIds?: readonly string[];\n}\n\nconst als = new AsyncLocalStorage<RequesterContext>();\n\n/**\n * Set the ambient requester context for the duration of `fn`. The context\n * propagates through `await` boundaries to all downstream calls. Nesting is\n * fine — an inner `withRequester` overrides the outer for its callback.\n */\nexport function withRequester<T>(\n  ctx: RequesterContext,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return als.run(ctx, fn);\n}\n\n/**\n * Read the ambient requester context. Throws if no context is active — by\n * design. Used by repos in strict scope-enforcement mode; an unwrapped call\n * site is a missing boundary.\n */\nexport function requireRequester(): RequesterContext {\n  const ctx = als.getStore();\n  if (!ctx) {\n    throw new Error(\n      'No requester context active. Wrap the entry point in ' +\n        'withRequester({ userId, organizationId }, fn). See tenant-context.ts.',\n    );\n  }\n  return ctx;\n}\n\n/**\n * Read the ambient requester context without throwing. Returns `undefined`\n * when no context is active. Used by repos in lenient scope-enforcement mode\n * (the default) and by code paths that legitimately run outside a request.\n */\nexport function tryGetRequester(): RequesterContext | undefined {\n  return als.getStore();\n}\n\n/**\n * Resolve the effective scope for the ambient context, defaulting to `'user'`.\n */\nexport function requireRequesterScope(): RequesterScope {\n  return requireRequester().scope ?? 'user';\n}\n\n/**\n * Convenience helpers for setting scope explicitly. All three preserve\n * `userId` in the context (audit trail) regardless of scope.\n *\n * - `withUserScope`: regular end-user requests. Most call sites.\n * - `withOrgScope`: admin / org-shared resource access. The caller MUST verify\n *   the requester's role permits `'org'` before calling — the helper does not\n *   enforce authorization. `orgUserIds` is pre-resolved at the boundary.\n * - `withSuperuserScope`: engineering scripts / internal tools. `organizationId`\n *   is null (cross-org is the point). Same authorization caveat applies.\n */\nexport function withUserScope<T>(\n  userId: string,\n  organizationId: string | null,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return withRequester({ userId, organizationId, scope: 'user' }, fn);\n}\n\nexport function withOrgScope<T>(\n  userId: string,\n  organizationId: string,\n  orgUserIds: readonly string[],\n  fn: () => Promise<T>,\n): Promise<T> {\n  return withRequester(\n    { userId, organizationId, scope: 'org', orgUserIds },\n    fn,\n  );\n}\n\nexport function withSuperuserScope<T>(\n  userId: string,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return withRequester(\n    { userId, organizationId: null, scope: 'superuser' },\n    fn,\n  );\n}\n"],"mappings":";AA4CA,SAAS,yBAAyB;AA6ClC,IAAM,MAAM,IAAI,kBAAoC;AAO7C,SAAS,cACd,KACA,IACY;AACZ,SAAO,IAAI,IAAI,KAAK,EAAE;AACxB;AAOO,SAAS,mBAAqC;AACnD,QAAM,MAAM,IAAI,SAAS;AACzB,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,kBAAgD;AAC9D,SAAO,IAAI,SAAS;AACtB;AAKO,SAAS,wBAAwC;AACtD,SAAO,iBAAiB,EAAE,SAAS;AACrC;AAaO,SAAS,cACd,QACA,gBACA,IACY;AACZ,SAAO,cAAc,EAAE,QAAQ,gBAAgB,OAAO,OAAO,GAAG,EAAE;AACpE;AAEO,SAAS,aACd,QACA,gBACA,YACA,IACY;AACZ,SAAO;AAAA,IACL,EAAE,QAAQ,gBAAgB,OAAO,OAAO,WAAW;AAAA,IACnD;AAAA,EACF;AACF;AAEO,SAAS,mBACd,QACA,IACY;AACZ,SAAO;AAAA,IACL,EAAE,QAAQ,gBAAgB,MAAM,OAAO,YAAY;AAAA,IACnD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/runtime/base-classes/with-analytics.js

@@ -1,10 +1,7 @@
-// runtime/base-classes/with-analytics.ts
-function WithAnalytics(Base) {
-  class WithAnalyticsMixin extends Base {
-    analytics;
-  }
-  return WithAnalyticsMixin;
-}
+import {
+  WithAnalytics
+} from "../../chunk-IBGER4YK.js";
+import "../../chunk-2E224ZSN.js";
 export {
   WithAnalytics
 };

package/dist/runtime/base-classes/with-analytics.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../runtime/base-classes/with-analytics.ts"],"sourcesContent":["/**\n * WithAnalytics mixin\n *\n * Adds an optional `.analytics` property to the service class.\n * The analytics provider is a per-entity @Injectable (e.g., AccountAnalytics)\n * injected via @Optional() in the generated service constructor.\n *\n * Usage: class MyService extends WithAnalytics(BaseService<...>) { ... }\n *\n * The generated service adds:\n *   @Optional() @Inject(AccountAnalytics) override analytics?: AccountAnalytics\n */\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\ntype Constructor<T = {}> = abstract new (...args: any[]) => T;\n\nexport function WithAnalytics<TBase extends Constructor>(Base: TBase) {\n  abstract class WithAnalyticsMixin extends Base {\n    analytics?: any;\n  }\n  return WithAnalyticsMixin as TBase & typeof WithAnalyticsMixin;\n}\n"],"mappings":";AAgBO,SAAS,cAAyC,MAAa;AAAA,EACpE,MAAe,2BAA2B,KAAK;AAAA,IAC7C;AAAA,EACF;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/runtime/constants/tokens.js

@@ -1,6 +1,8 @@
-// runtime/constants/tokens.ts
-var DRIZZLE = "DRIZZLE";
-var EVENT_BUS = "EVENT_BUS";
+import {
+  DRIZZLE,
+  EVENT_BUS
+} from "../../chunk-U64T4YZE.js";
+import "../../chunk-2E224ZSN.js";
 export {
   DRIZZLE,
   EVENT_BUS

package/dist/runtime/constants/tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../runtime/constants/tokens.ts"],"sourcesContent":["/**\n * NestJS injection tokens\n *\n * Used with @Inject() decorator in concrete repository constructors.\n */\n\n/**\n * Injection token for the Drizzle ORM database client.\n *\n * Usage in concrete repositories:\n * ```typescript\n * constructor(@Inject(DRIZZLE) db: DrizzleClient) { super(db); }\n * ```\n */\nexport const DRIZZLE = 'DRIZZLE' as const;\n\n/**\n * Injection token for the event bus (IEventBus).\n *\n * Optional — only resolved when EventsModule.forRoot() is registered.\n * BaseService uses this with @Optional() to emit lifecycle events\n * without requiring the events subsystem to be installed.\n *\n * Usage in services/use cases:\n * ```typescript\n * @Optional() @Inject(EVENT_BUS) eventBus?: IEventBus\n * ```\n */\nexport const EVENT_BUS = 'EVENT_BUS' as const;\n"],"mappings":";AAcO,IAAM,UAAU;AAchB,IAAM,YAAY;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/runtime/eav-helpers.js

@@ -1,3 +1,5 @@
+import "../chunk-2E224ZSN.js";
+
 // runtime/eav-helpers.ts
 function toEavRows(entityId, entityType, userId, fields, fieldDefIds) {
   const rows = [];

package/dist/runtime/eav-helpers.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../runtime/eav-helpers.ts"],"sourcesContent":["/**\n * EAV helpers\n *\n * Small, pure utilities used by services that dual-write to the EAV value\n * table alongside their own table.\n *\n * - `toEavRows` builds value-table insert rows from a flat `{ key: value }`\n *   bag, resolving the `fieldDefinitionId` via a caller-supplied map.\n *   Callers own the field-definitions lookup / cache.\n * - `mergeEavRows` inverts: given value-table rows + a definition `id -> key`\n *   map, collapses them into a flat `{ key: value }` bag.\n *\n * Both are sync + allocation-light. They do not touch the DB.\n */\n\n/**\n * Map of field key -> field_definitions.id, scoped to a single entityType.\n */\nexport type FieldDefinitionIdMap = ReadonlyMap<string, string>;\n\n/**\n * Minimal shape of a value-table row accepted by toEavRows output. Consumers\n * pass their entity's `Insert` type; these are the columns the helper sets.\n */\nexport interface EavInsertShape {\n  entityId: string;\n  entityType: string;\n  userId: string;\n  fieldDefinitionId: string;\n  value: unknown;\n}\n\n/**\n * Build value-table insert rows from a flat field bag. Keys present in\n * `fields` but missing from `fieldDefIds` are skipped — caller is expected\n * to ensure the definitions exist (first-cut; auto-create is a later step).\n */\nexport function toEavRows(\n  entityId: string,\n  entityType: string,\n  userId: string,\n  fields: Record<string, unknown>,\n  fieldDefIds: FieldDefinitionIdMap,\n): EavInsertShape[] {\n  const rows: EavInsertShape[] = [];\n  for (const [key, value] of Object.entries(fields)) {\n    const fieldDefinitionId = fieldDefIds.get(key);\n    if (!fieldDefinitionId) continue;\n    rows.push({ entityId, entityType, userId, fieldDefinitionId, value });\n  }\n  return rows;\n}\n\n/**\n * Collapse EAV rows back into a flat `{ key: value }` bag.\n *\n * Accepts bare value-table rows plus a separate `id -> { key }` map. Later\n * rows win if the same key appears more than once. Call with temporal\n * filtering already applied (e.g. validTo IS NULL) — this function does not\n * interpret validFrom / validTo.\n */\nexport function mergeEavRows(\n  rows: Array<{ fieldDefinitionId: string | null; value: unknown }>,\n  defsById: ReadonlyMap<string, { key: string }>,\n): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const row of rows) {\n    if (!row.fieldDefinitionId) continue;\n    const def = defsById.get(row.fieldDefinitionId);\n    if (!def) continue;\n    out[def.key] = row.value;\n  }\n  return out;\n}\n"],"mappings":";AAqCO,SAAS,UACd,UACA,YACA,QACA,QACA,aACkB;AAClB,QAAM,OAAyB,CAAC;AAChC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAM,oBAAoB,YAAY,IAAI,GAAG;AAC7C,QAAI,CAAC,kBAAmB;AACxB,SAAK,KAAK,EAAE,UAAU,YAAY,QAAQ,mBAAmB,MAAM,CAAC;AAAA,EACtE;AACA,SAAO;AACT;AAUO,SAAS,aACd,MACA,UACyB;AACzB,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,IAAI,kBAAmB;AAC5B,UAAM,MAAM,SAAS,IAAI,IAAI,iBAAiB;AAC9C,QAAI,CAAC,IAAK;AACV,QAAI,IAAI,GAAG,IAAI,IAAI;AAAA,EACrB;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../runtime/eav-helpers.ts"],"sourcesContent":["/**\n * EAV helpers\n *\n * Small, pure utilities used by services that dual-write to the EAV value\n * table alongside their own table.\n *\n * - `toEavRows` builds value-table insert rows from a flat `{ key: value }`\n *   bag, resolving the `fieldDefinitionId` via a caller-supplied map.\n *   Callers own the field-definitions lookup / cache.\n * - `mergeEavRows` inverts: given value-table rows + a definition `id -> key`\n *   map, collapses them into a flat `{ key: value }` bag.\n *\n * Both are sync + allocation-light. They do not touch the DB.\n */\n\n/**\n * Map of field key -> field_definitions.id, scoped to a single entityType.\n */\nexport type FieldDefinitionIdMap = ReadonlyMap<string, string>;\n\n/**\n * Minimal shape of a value-table row accepted by toEavRows output. Consumers\n * pass their entity's `Insert` type; these are the columns the helper sets.\n */\nexport interface EavInsertShape {\n  entityId: string;\n  entityType: string;\n  userId: string;\n  fieldDefinitionId: string;\n  value: unknown;\n}\n\n/**\n * Build value-table insert rows from a flat field bag. Keys present in\n * `fields` but missing from `fieldDefIds` are skipped — caller is expected\n * to ensure the definitions exist (first-cut; auto-create is a later step).\n */\nexport function toEavRows(\n  entityId: string,\n  entityType: string,\n  userId: string,\n  fields: Record<string, unknown>,\n  fieldDefIds: FieldDefinitionIdMap,\n): EavInsertShape[] {\n  const rows: EavInsertShape[] = [];\n  for (const [key, value] of Object.entries(fields)) {\n    const fieldDefinitionId = fieldDefIds.get(key);\n    if (!fieldDefinitionId) continue;\n    rows.push({ entityId, entityType, userId, fieldDefinitionId, value });\n  }\n  return rows;\n}\n\n/**\n * Collapse EAV rows back into a flat `{ key: value }` bag.\n *\n * Accepts bare value-table rows plus a separate `id -> { key }` map. Later\n * rows win if the same key appears more than once. Call with temporal\n * filtering already applied (e.g. validTo IS NULL) — this function does not\n * interpret validFrom / validTo.\n */\nexport function mergeEavRows(\n  rows: Array<{ fieldDefinitionId: string | null; value: unknown }>,\n  defsById: ReadonlyMap<string, { key: string }>,\n): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const row of rows) {\n    if (!row.fieldDefinitionId) continue;\n    const def = defsById.get(row.fieldDefinitionId);\n    if (!def) continue;\n    out[def.key] = row.value;\n  }\n  return out;\n}\n"],"mappings":";;;AAqCO,SAAS,UACd,UACA,YACA,QACA,QACA,aACkB;AAClB,QAAM,OAAyB,CAAC;AAChC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAM,oBAAoB,YAAY,IAAI,GAAG;AAC7C,QAAI,CAAC,kBAAmB;AACxB,SAAK,KAAK,EAAE,UAAU,YAAY,QAAQ,mBAAmB,MAAM,CAAC;AAAA,EACtE;AACA,SAAO;AACT;AAUO,SAAS,aACd,MACA,UACyB;AACzB,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,IAAI,kBAAmB;AAC5B,UAAM,MAAM,SAAS,IAAI,IAAI,iBAAiB;AAC9C,QAAI,CAAC,IAAK;AACV,QAAI,IAAI,GAAG,IAAI,IAAI;AAAA,EACrB;AACA,SAAO;AACT;","names":[]}

package/dist/runtime/pipes/zod-validation.pipe.js

@@ -1,13 +1,6 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __decorateClass = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp(target, key, result);
-  return result;
-};
+import {
+  __decorateClass
+} from "../../chunk-2E224ZSN.js";
 
 // runtime/pipes/zod-validation.pipe.ts
 import {

package/dist/runtime/pipes/zod-validation.pipe.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../runtime/pipes/zod-validation.pipe.ts"],"sourcesContent":["/**\n * ZodValidationPipe\n *\n * Validates an incoming request body (or any decorated value) against a\n * Zod schema at the controller boundary. Intended for use with Nest's\n * `@Body(new ZodValidationPipe(MySchema))` pattern so generated\n * controllers get runtime validation without relying on a global pipe\n * that every consumer would have to opt into.\n *\n * Why a pipe (vs. validating inside the use case): validation is a\n * presentation-layer concern (ADR-003). The use case should receive a\n * type-safe, already-validated DTO; surfacing a `ZodError` at the pipe\n * stage produces the standard 400 BadRequest response shape that HTTP\n * clients expect.\n *\n * On success: returns parsed, coerced data.\n * On failure: throws BadRequestException with a structured `issues` array\n * (path / code / message) — richer than `.flatten()` for API consumers.\n *\n * One pipe instance per route (cheap — instantiated at module load). Keeps\n * validation explicit in the generated code; no metadata/reflection magic.\n *\n * Vendored into consumer projects at `src/shared/pipes/zod-validation.pipe.ts`\n * via `codegen project init` (see init-scaffold's VENDORED_RUNTIME_FILES).\n */\nimport {\n  BadRequestException,\n  Injectable,\n  PipeTransform,\n  type ArgumentMetadata,\n} from '@nestjs/common';\nimport type { ZodIssue, ZodSchema } from 'zod';\n\n@Injectable()\nexport class ZodValidationPipe<TSchema extends ZodSchema = ZodSchema>\n  implements PipeTransform\n{\n  constructor(private readonly schema: TSchema) {}\n\n  transform(value: unknown, _metadata: ArgumentMetadata): unknown {\n    const result = this.schema.safeParse(value);\n    if (result.success) {\n      return result.data;\n    }\n    throw new BadRequestException({\n      statusCode: 400,\n      error: 'Bad Request',\n      message: 'Validation failed',\n      issues: formatIssues(result.error.issues),\n    });\n  }\n}\n\nfunction formatIssues(issues: readonly ZodIssue[]): Array<{\n  path: string;\n  code: string;\n  message: string;\n}> {\n  return issues.map((issue) => ({\n    path: issue.path.join('.'),\n    code: issue.code,\n    message: issue.message,\n  }));\n}\n"],"mappings":";;;;;;;;;;;;AAyBA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAIA,IAAM,oBAAN,MAEP;AAAA,EACE,YAA6B,QAAiB;AAAjB;AAAA,EAAkB;AAAA,EAAlB;AAAA,EAE7B,UAAU,OAAgB,WAAsC;AAC9D,UAAM,SAAS,KAAK,OAAO,UAAU,KAAK;AAC1C,QAAI,OAAO,SAAS;AAClB,aAAO,OAAO;AAAA,IAChB;AACA,UAAM,IAAI,oBAAoB;AAAA,MAC5B,YAAY;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,aAAa,OAAO,MAAM,MAAM;AAAA,IAC1C,CAAC;AAAA,EACH;AACF;AAjBa,oBAAN;AAAA,EADN,WAAW;AAAA,GACC;AAmBb,SAAS,aAAa,QAInB;AACD,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,MAAM,MAAM,KAAK,KAAK,GAAG;AAAA,IACzB,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM;AAAA,EACjB,EAAE;AACJ;","names":[]}
+{"version":3,"sources":["../../../runtime/pipes/zod-validation.pipe.ts"],"sourcesContent":["/**\n * ZodValidationPipe\n *\n * Validates an incoming request body (or any decorated value) against a\n * Zod schema at the controller boundary. Intended for use with Nest's\n * `@Body(new ZodValidationPipe(MySchema))` pattern so generated\n * controllers get runtime validation without relying on a global pipe\n * that every consumer would have to opt into.\n *\n * Why a pipe (vs. validating inside the use case): validation is a\n * presentation-layer concern (ADR-003). The use case should receive a\n * type-safe, already-validated DTO; surfacing a `ZodError` at the pipe\n * stage produces the standard 400 BadRequest response shape that HTTP\n * clients expect.\n *\n * On success: returns parsed, coerced data.\n * On failure: throws BadRequestException with a structured `issues` array\n * (path / code / message) — richer than `.flatten()` for API consumers.\n *\n * One pipe instance per route (cheap — instantiated at module load). Keeps\n * validation explicit in the generated code; no metadata/reflection magic.\n *\n * Vendored into consumer projects at `src/shared/pipes/zod-validation.pipe.ts`\n * via `codegen project init` (see init-scaffold's VENDORED_RUNTIME_FILES).\n */\nimport {\n  BadRequestException,\n  Injectable,\n  PipeTransform,\n  type ArgumentMetadata,\n} from '@nestjs/common';\nimport type { ZodIssue, ZodSchema } from 'zod';\n\n@Injectable()\nexport class ZodValidationPipe<TSchema extends ZodSchema = ZodSchema>\n  implements PipeTransform\n{\n  constructor(private readonly schema: TSchema) {}\n\n  transform(value: unknown, _metadata: ArgumentMetadata): unknown {\n    const result = this.schema.safeParse(value);\n    if (result.success) {\n      return result.data;\n    }\n    throw new BadRequestException({\n      statusCode: 400,\n      error: 'Bad Request',\n      message: 'Validation failed',\n      issues: formatIssues(result.error.issues),\n    });\n  }\n}\n\nfunction formatIssues(issues: readonly ZodIssue[]): Array<{\n  path: string;\n  code: string;\n  message: string;\n}> {\n  return issues.map((issue) => ({\n    path: issue.path.join('.'),\n    code: issue.code,\n    message: issue.message,\n  }));\n}\n"],"mappings":";;;;;AAyBA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAIA,IAAM,oBAAN,MAEP;AAAA,EACE,YAA6B,QAAiB;AAAjB;AAAA,EAAkB;AAAA,EAAlB;AAAA,EAE7B,UAAU,OAAgB,WAAsC;AAC9D,UAAM,SAAS,KAAK,OAAO,UAAU,KAAK;AAC1C,QAAI,OAAO,SAAS;AAClB,aAAO,OAAO;AAAA,IAChB;AACA,UAAM,IAAI,oBAAoB;AAAA,MAC5B,YAAY;AAAA,MACZ,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,aAAa,OAAO,MAAM,MAAM;AAAA,IAC1C,CAAC;AAAA,EACH;AACF;AAjBa,oBAAN;AAAA,EADN,WAAW;AAAA,GACC;AAmBb,SAAS,aAAa,QAInB;AACD,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,MAAM,MAAM,KAAK,KAAK,GAAG;AAAA,IACzB,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM;AAAA,EACjB,EAAE;AACJ;","names":[]}

package/dist/runtime/shared/openapi/error-response.dto.js

@@ -1,11 +1,8 @@
-// runtime/shared/openapi/error-response.dto.ts
-import { z } from "zod";
-var errorResponseSchema = z.object({
-  statusCode: z.number().int(),
-  message: z.union([z.string(), z.array(z.string())]),
-  error: z.string().optional()
-});
-var ERROR_RESPONSE_SCHEMA_NAME = "ErrorResponseDto";
+import {
+  ERROR_RESPONSE_SCHEMA_NAME,
+  errorResponseSchema
+} from "../../../chunk-SOVM2VEK.js";
+import "../../../chunk-2E224ZSN.js";
 export {
   ERROR_RESPONSE_SCHEMA_NAME,
   errorResponseSchema

package/dist/runtime/shared/openapi/error-response.dto.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../runtime/shared/openapi/error-response.dto.ts"],"sourcesContent":["/**\n * Shared error response schema (OPENAPI-3).\n *\n * Generated controllers `@ApiResponse(...)` decorators reference this\n * schema by `$ref` (name `ErrorResponseDto`) for non-success status codes\n * (400, 401, 404, etc.). Shape matches NestJS's default `HttpException`\n * JSON body — see `packages/common/src/exceptions/http.exception.ts`.\n *\n * The registry auto-registers this schema on construction so every\n * consumer project exposes `components.schemas.ErrorResponseDto` on\n * `/docs-json` without per-entity duplication.\n */\nimport { z } from 'zod';\n\nexport const errorResponseSchema = z.object({\n  statusCode: z.number().int(),\n  message: z.union([z.string(), z.array(z.string())]),\n  error: z.string().optional(),\n});\n\nexport type ErrorResponseDto = z.infer<typeof errorResponseSchema>;\n\n/** Canonical name used across `$ref` URIs in generated controllers. */\nexport const ERROR_RESPONSE_SCHEMA_NAME = 'ErrorResponseDto';\n"],"mappings":";AAYA,SAAS,SAAS;AAEX,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAKM,IAAM,6BAA6B;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/runtime/shared/openapi/errors.js

@@ -1,22 +1,8 @@
-// runtime/shared/openapi/errors.ts
-var OpenApiPeerDepMissingError = class extends Error {
-  name = "OpenApiPeerDepMissingError";
-  constructor(message) {
-    super(
-      message ?? "OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi"
-    );
-  }
-};
-var DuplicateSchemaError = class extends Error {
-  constructor(schemaName) {
-    super(
-      `DuplicateSchemaError: schema '${schemaName}' is already registered. Each schema name must be unique within the OpenApiRegistry.`
-    );
-    this.schemaName = schemaName;
-  }
-  schemaName;
-  name = "DuplicateSchemaError";
-};
+import {
+  DuplicateSchemaError,
+  OpenApiPeerDepMissingError
+} from "../../../chunk-YSLTTQLC.js";
+import "../../../chunk-2E224ZSN.js";
 export {
   DuplicateSchemaError,
   OpenApiPeerDepMissingError

package/dist/runtime/shared/openapi/errors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../runtime/shared/openapi/errors.ts"],"sourcesContent":["/**\n * Typed errors for the OpenAPI registry (OPENAPI-1).\n *\n * Same shape as `runtime/subsystems/bridge/bridge-errors.ts` so consumers\n * can catch them with the same exception-filter pattern used elsewhere.\n */\n\n/**\n * Thrown by `OpenApiRegistry.build()` when `@anatine/zod-openapi` is not\n * resolvable. The peer is declared optional (`peerDependenciesMeta`) so\n * consumer apps that don't care about OpenAPI still boot; the cost is a\n * deferred failure here on first `build()`.\n */\nexport class OpenApiPeerDepMissingError extends Error {\n  override readonly name = 'OpenApiPeerDepMissingError';\n  constructor(message?: string) {\n    super(\n      message ??\n        'OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi',\n    );\n  }\n}\n\n/**\n * Thrown by `OpenApiRegistry.registerSchema(name, ...)` when `name` is\n * already registered. Silent overwrite would make debugging\n * double-registration bugs (e.g. two entity pipelines both emitting a\n * `User` DTO) painful; loud failure lets the mismatch surface at module\n * init where the stack trace is clear.\n */\nexport class DuplicateSchemaError extends Error {\n  override readonly name = 'DuplicateSchemaError';\n  constructor(public readonly schemaName: string) {\n    super(\n      `DuplicateSchemaError: schema '${schemaName}' is already registered. ` +\n        `Each schema name must be unique within the OpenApiRegistry.`,\n    );\n  }\n}\n"],"mappings":";AAaO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAClC,OAAO;AAAA,EACzB,YAAY,SAAkB;AAC5B;AAAA,MACE,WACE;AAAA,IACJ;AAAA,EACF;AACF;AASO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAE9C,YAA4B,YAAoB;AAC9C;AAAA,MACE,iCAAiC,UAAU;AAAA,IAE7C;AAJ0B;AAAA,EAK5B;AAAA,EAL4B;AAAA,EADV,OAAO;AAO3B;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/runtime/shared/openapi/index.js

@@ -1,109 +1,18 @@
-// runtime/shared/openapi/error-response.dto.ts
-import { z } from "zod";
-var errorResponseSchema = z.object({
-  statusCode: z.number().int(),
-  message: z.union([z.string(), z.array(z.string())]),
-  error: z.string().optional()
-});
-var ERROR_RESPONSE_SCHEMA_NAME = "ErrorResponseDto";
-
-// runtime/shared/openapi/errors.ts
-var OpenApiPeerDepMissingError = class extends Error {
-  name = "OpenApiPeerDepMissingError";
-  constructor(message) {
-    super(
-      message ?? "OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi"
-    );
-  }
-};
-var DuplicateSchemaError = class extends Error {
-  constructor(schemaName) {
-    super(
-      `DuplicateSchemaError: schema '${schemaName}' is already registered. Each schema name must be unique within the OpenApiRegistry.`
-    );
-    this.schemaName = schemaName;
-  }
-  schemaName;
-  name = "DuplicateSchemaError";
-};
-
-// runtime/shared/openapi/registry.ts
-var OpenApiRegistry = class {
-  zodSchemas = /* @__PURE__ */ new Map();
-  pathEntries = /* @__PURE__ */ new Map();
-  peer = null;
-  constructor() {
-    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);
-  }
-  registerSchema(name, schema) {
-    if (this.zodSchemas.has(name)) {
-      throw new DuplicateSchemaError(name);
-    }
-    this.zodSchemas.set(name, schema);
-  }
-  registerPath(path, method, spec) {
-    let methods = this.pathEntries.get(path);
-    if (!methods) {
-      methods = /* @__PURE__ */ new Map();
-      this.pathEntries.set(path, methods);
-    }
-    methods.set(method, spec);
-  }
-  /**
-   * Emit the full OpenAPI document. Lazy-imports `@anatine/zod-openapi`
-   * on first call; failure to resolve raises `OpenApiPeerDepMissingError`
-   * (matches the `CubeAnalyticsBackend.onModuleInit` precedent).
-   *
-   * OpenAPI version is pinned to `3.0.3` — Swagger UI tooling is most
-   * stable on 3.0.x (see OPENAPI-PHASE-1-PLAN §Four locked decisions).
-   */
-  async build(info) {
-    const peer = await this.loadPeer();
-    const schemas = {};
-    for (const [name, zodSchema] of this.zodSchemas) {
-      schemas[name] = peer.generateSchema(zodSchema, false, "3.0");
-    }
-    const paths = {};
-    for (const [path, methods] of this.pathEntries) {
-      const methodMap = {};
-      for (const [method, spec] of methods) {
-        methodMap[method] = spec;
-      }
-      paths[path] = methodMap;
-    }
-    return {
-      openapi: "3.0.3",
-      info,
-      paths,
-      components: { schemas }
-    };
-  }
-  /**
-   * Test helper — clears registered schemas and paths, then re-seeds the
-   * core `ErrorResponseDto` entry so post-reset state matches the
-   * invariant established in the constructor.
-   */
-  reset() {
-    this.zodSchemas.clear();
-    this.pathEntries.clear();
-    this.peer = null;
-    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);
-  }
-  async loadPeer() {
-    if (this.peer) return this.peer;
-    try {
-      const specifier = "@anatine/zod-openapi";
-      const mod = await import(specifier);
-      this.peer = mod;
-      return mod;
-    } catch {
-      throw new OpenApiPeerDepMissingError();
-    }
-  }
-};
-
-// runtime/shared/openapi/registry.tokens.ts
-var OPENAPI_REGISTRY = "OPENAPI_REGISTRY";
+import {
+  OPENAPI_REGISTRY
+} from "../../../chunk-PSXUNOVU.js";
+import {
+  OpenApiRegistry
+} from "../../../chunk-Y7GDG744.js";
+import {
+  ERROR_RESPONSE_SCHEMA_NAME,
+  errorResponseSchema
+} from "../../../chunk-SOVM2VEK.js";
+import {
+  DuplicateSchemaError,
+  OpenApiPeerDepMissingError
+} from "../../../chunk-YSLTTQLC.js";
+import "../../../chunk-2E224ZSN.js";
 export {
   DuplicateSchemaError,
   ERROR_RESPONSE_SCHEMA_NAME,

package/dist/runtime/shared/openapi/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../runtime/shared/openapi/error-response.dto.ts","../../../../runtime/shared/openapi/errors.ts","../../../../runtime/shared/openapi/registry.ts","../../../../runtime/shared/openapi/registry.tokens.ts"],"sourcesContent":["/**\n * Shared error response schema (OPENAPI-3).\n *\n * Generated controllers `@ApiResponse(...)` decorators reference this\n * schema by `$ref` (name `ErrorResponseDto`) for non-success status codes\n * (400, 401, 404, etc.). Shape matches NestJS's default `HttpException`\n * JSON body — see `packages/common/src/exceptions/http.exception.ts`.\n *\n * The registry auto-registers this schema on construction so every\n * consumer project exposes `components.schemas.ErrorResponseDto` on\n * `/docs-json` without per-entity duplication.\n */\nimport { z } from 'zod';\n\nexport const errorResponseSchema = z.object({\n  statusCode: z.number().int(),\n  message: z.union([z.string(), z.array(z.string())]),\n  error: z.string().optional(),\n});\n\nexport type ErrorResponseDto = z.infer<typeof errorResponseSchema>;\n\n/** Canonical name used across `$ref` URIs in generated controllers. */\nexport const ERROR_RESPONSE_SCHEMA_NAME = 'ErrorResponseDto';\n","/**\n * Typed errors for the OpenAPI registry (OPENAPI-1).\n *\n * Same shape as `runtime/subsystems/bridge/bridge-errors.ts` so consumers\n * can catch them with the same exception-filter pattern used elsewhere.\n */\n\n/**\n * Thrown by `OpenApiRegistry.build()` when `@anatine/zod-openapi` is not\n * resolvable. The peer is declared optional (`peerDependenciesMeta`) so\n * consumer apps that don't care about OpenAPI still boot; the cost is a\n * deferred failure here on first `build()`.\n */\nexport class OpenApiPeerDepMissingError extends Error {\n  override readonly name = 'OpenApiPeerDepMissingError';\n  constructor(message?: string) {\n    super(\n      message ??\n        'OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi',\n    );\n  }\n}\n\n/**\n * Thrown by `OpenApiRegistry.registerSchema(name, ...)` when `name` is\n * already registered. Silent overwrite would make debugging\n * double-registration bugs (e.g. two entity pipelines both emitting a\n * `User` DTO) painful; loud failure lets the mismatch surface at module\n * init where the stack trace is clear.\n */\nexport class DuplicateSchemaError extends Error {\n  override readonly name = 'DuplicateSchemaError';\n  constructor(public readonly schemaName: string) {\n    super(\n      `DuplicateSchemaError: schema '${schemaName}' is already registered. ` +\n        `Each schema name must be unique within the OpenApiRegistry.`,\n    );\n  }\n}\n","/**\n * OpenApiRegistry — collects Zod schemas and path specs, emits a\n * complete `OpenAPIObject` on `build()` (OPENAPI-1).\n *\n * Wraps `@anatine/zod-openapi` as an **optional peer dependency** using\n * the lazy-import pattern from `runtime/subsystems/analytics/cube-backend.ts`\n * — consumer apps that never call `build()` still boot even if\n * `@anatine/zod-openapi` isn't installed.\n *\n * The registry is the single source of truth consumed by OPENAPI-2\n * (generated DTOs register their Zod schemas at module init), OPENAPI-3\n * (controller decorators reference those schemas), and OPENAPI-4\n * (Swagger UI bootstrap calls `build()` once at startup).\n */\nimport type { z } from 'zod';\n\nimport { ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema } from './error-response.dto';\nimport { OpenApiPeerDepMissingError, DuplicateSchemaError } from './errors';\n\nexport type HttpMethod = 'get' | 'post' | 'patch' | 'delete' | 'put';\n\n/**\n * OpenAPI path spec. Structurally compatible with `openapi3-ts`'s\n * `OperationObject` but typed loosely here because the peer type package\n * isn't installed as a direct dep — consumers supply whatever their\n * codegen emits.\n */\nexport interface PathSpec {\n  summary?: string;\n  description?: string;\n  operationId?: string;\n  tags?: string[];\n  parameters?: unknown[];\n  requestBody?: unknown;\n  responses?: Record<string, unknown>;\n  security?: unknown[];\n  [key: string]: unknown;\n}\n\nexport interface OpenAPIInfo {\n  title: string;\n  version: string;\n  description?: string;\n}\n\n/**\n * Minimal OpenAPIObject shape. We redeclare rather than pull\n * `openapi3-ts` types through the peer — the peer's `generateSchema`\n * returns a `SchemaObject`, but the final document assembly is ours.\n */\nexport interface OpenAPIObject {\n  openapi: string;\n  info: OpenAPIInfo;\n  paths: Record<string, Record<string, PathSpec>>;\n  components: {\n    schemas: Record<string, unknown>;\n  };\n}\n\ninterface PeerModule {\n  generateSchema: (zodRef: unknown, useOutput?: boolean, version?: '3.0' | '3.1') => unknown;\n}\n\nexport class OpenApiRegistry {\n  private zodSchemas = new Map<string, z.ZodType>();\n  private pathEntries = new Map<string, Map<HttpMethod, PathSpec>>();\n  private peer: PeerModule | null = null;\n\n  constructor() {\n    // Auto-register the shared error response schema so controllers that\n    // reference `#/components/schemas/ErrorResponseDto` always resolve\n    // (OPENAPI-3). Consumers can `reset()` + re-register in tests.\n    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);\n  }\n\n  registerSchema(name: string, schema: z.ZodType): void {\n    if (this.zodSchemas.has(name)) {\n      throw new DuplicateSchemaError(name);\n    }\n    this.zodSchemas.set(name, schema);\n  }\n\n  registerPath(path: string, method: HttpMethod, spec: PathSpec): void {\n    let methods = this.pathEntries.get(path);\n    if (!methods) {\n      methods = new Map();\n      this.pathEntries.set(path, methods);\n    }\n    methods.set(method, spec);\n  }\n\n  /**\n   * Emit the full OpenAPI document. Lazy-imports `@anatine/zod-openapi`\n   * on first call; failure to resolve raises `OpenApiPeerDepMissingError`\n   * (matches the `CubeAnalyticsBackend.onModuleInit` precedent).\n   *\n   * OpenAPI version is pinned to `3.0.3` — Swagger UI tooling is most\n   * stable on 3.0.x (see OPENAPI-PHASE-1-PLAN §Four locked decisions).\n   */\n  async build(info: OpenAPIInfo): Promise<OpenAPIObject> {\n    const peer = await this.loadPeer();\n\n    const schemas: Record<string, unknown> = {};\n    for (const [name, zodSchema] of this.zodSchemas) {\n      schemas[name] = peer.generateSchema(zodSchema, false, '3.0');\n    }\n\n    const paths: Record<string, Record<string, PathSpec>> = {};\n    for (const [path, methods] of this.pathEntries) {\n      const methodMap: Record<string, PathSpec> = {};\n      for (const [method, spec] of methods) {\n        methodMap[method] = spec;\n      }\n      paths[path] = methodMap;\n    }\n\n    return {\n      openapi: '3.0.3',\n      info,\n      paths,\n      components: { schemas },\n    };\n  }\n\n  /**\n   * Test helper — clears registered schemas and paths, then re-seeds the\n   * core `ErrorResponseDto` entry so post-reset state matches the\n   * invariant established in the constructor.\n   */\n  reset(): void {\n    this.zodSchemas.clear();\n    this.pathEntries.clear();\n    this.peer = null;\n    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);\n  }\n\n  protected async loadPeer(): Promise<PeerModule> {\n    if (this.peer) return this.peer;\n    try {\n      // Computed specifier: prevents tsc from resolving this import at\n      // typecheck time. Consumers vendor this file but may not install\n      // @anatine/zod-openapi (optional peer).\n      const specifier: string = '@anatine/zod-openapi';\n      const mod = (await import(specifier)) as PeerModule;\n      this.peer = mod;\n      return mod;\n    } catch {\n      throw new OpenApiPeerDepMissingError();\n    }\n  }\n}\n","/**\n * Injection token for the OpenAPI registry (OPENAPI-1).\n *\n * String constant (not a Symbol) so it matches by value across import\n * boundaries — same convention as `ANALYTICS_QUERY` in analytics and\n * `EVENT_BUS` / `BRIDGE_DELIVERY_REPO` in events / bridge. The OPENAPI-1\n * spec sketched a Symbol, but the repo-wide convention wins — codebase\n * consistency matters more than the spec's initial guess.\n *\n * Consumed by generated DTO providers (OPENAPI-2), controllers\n * (OPENAPI-3), and the Swagger bootstrap (OPENAPI-4).\n */\nexport const OPENAPI_REGISTRY = 'OPENAPI_REGISTRY' as const;\n"],"mappings":";AAYA,SAAS,SAAS;AAEX,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAKM,IAAM,6BAA6B;;;ACVnC,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAClC,OAAO;AAAA,EACzB,YAAY,SAAkB;AAC5B;AAAA,MACE,WACE;AAAA,IACJ;AAAA,EACF;AACF;AASO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAE9C,YAA4B,YAAoB;AAC9C;AAAA,MACE,iCAAiC,UAAU;AAAA,IAE7C;AAJ0B;AAAA,EAK5B;AAAA,EAL4B;AAAA,EADV,OAAO;AAO3B;;;ACyBO,IAAM,kBAAN,MAAsB;AAAA,EACnB,aAAa,oBAAI,IAAuB;AAAA,EACxC,cAAc,oBAAI,IAAuC;AAAA,EACzD,OAA0B;AAAA,EAElC,cAAc;AAIZ,SAAK,WAAW,IAAI,4BAA4B,mBAAmB;AAAA,EACrE;AAAA,EAEA,eAAe,MAAc,QAAyB;AACpD,QAAI,KAAK,WAAW,IAAI,IAAI,GAAG;AAC7B,YAAM,IAAI,qBAAqB,IAAI;AAAA,IACrC;AACA,SAAK,WAAW,IAAI,MAAM,MAAM;AAAA,EAClC;AAAA,EAEA,aAAa,MAAc,QAAoB,MAAsB;AACnE,QAAI,UAAU,KAAK,YAAY,IAAI,IAAI;AACvC,QAAI,CAAC,SAAS;AACZ,gBAAU,oBAAI,IAAI;AAClB,WAAK,YAAY,IAAI,MAAM,OAAO;AAAA,IACpC;AACA,YAAQ,IAAI,QAAQ,IAAI;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,MAAM,MAA2C;AACrD,UAAM,OAAO,MAAM,KAAK,SAAS;AAEjC,UAAM,UAAmC,CAAC;AAC1C,eAAW,CAAC,MAAM,SAAS,KAAK,KAAK,YAAY;AAC/C,cAAQ,IAAI,IAAI,KAAK,eAAe,WAAW,OAAO,KAAK;AAAA,IAC7D;AAEA,UAAM,QAAkD,CAAC;AACzD,eAAW,CAAC,MAAM,OAAO,KAAK,KAAK,aAAa;AAC9C,YAAM,YAAsC,CAAC;AAC7C,iBAAW,CAAC,QAAQ,IAAI,KAAK,SAAS;AACpC,kBAAU,MAAM,IAAI;AAAA,MACtB;AACA,YAAM,IAAI,IAAI;AAAA,IAChB;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,YAAY,EAAE,QAAQ;AAAA,IACxB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAc;AACZ,SAAK,WAAW,MAAM;AACtB,SAAK,YAAY,MAAM;AACvB,SAAK,OAAO;AACZ,SAAK,WAAW,IAAI,4BAA4B,mBAAmB;AAAA,EACrE;AAAA,EAEA,MAAgB,WAAgC;AAC9C,QAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,QAAI;AAIF,YAAM,YAAoB;AAC1B,YAAM,MAAO,MAAM,OAAO;AAC1B,WAAK,OAAO;AACZ,aAAO;AAAA,IACT,QAAQ;AACN,YAAM,IAAI,2BAA2B;AAAA,IACvC;AAAA,EACF;AACF;;;AC1IO,IAAM,mBAAmB;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/runtime/shared/openapi/registry.js

@@ -1,106 +1,9 @@
-// runtime/shared/openapi/error-response.dto.ts
-import { z } from "zod";
-var errorResponseSchema = z.object({
-  statusCode: z.number().int(),
-  message: z.union([z.string(), z.array(z.string())]),
-  error: z.string().optional()
-});
-var ERROR_RESPONSE_SCHEMA_NAME = "ErrorResponseDto";
-
-// runtime/shared/openapi/errors.ts
-var OpenApiPeerDepMissingError = class extends Error {
-  name = "OpenApiPeerDepMissingError";
-  constructor(message) {
-    super(
-      message ?? "OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi"
-    );
-  }
-};
-var DuplicateSchemaError = class extends Error {
-  constructor(schemaName) {
-    super(
-      `DuplicateSchemaError: schema '${schemaName}' is already registered. Each schema name must be unique within the OpenApiRegistry.`
-    );
-    this.schemaName = schemaName;
-  }
-  schemaName;
-  name = "DuplicateSchemaError";
-};
-
-// runtime/shared/openapi/registry.ts
-var OpenApiRegistry = class {
-  zodSchemas = /* @__PURE__ */ new Map();
-  pathEntries = /* @__PURE__ */ new Map();
-  peer = null;
-  constructor() {
-    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);
-  }
-  registerSchema(name, schema) {
-    if (this.zodSchemas.has(name)) {
-      throw new DuplicateSchemaError(name);
-    }
-    this.zodSchemas.set(name, schema);
-  }
-  registerPath(path, method, spec) {
-    let methods = this.pathEntries.get(path);
-    if (!methods) {
-      methods = /* @__PURE__ */ new Map();
-      this.pathEntries.set(path, methods);
-    }
-    methods.set(method, spec);
-  }
-  /**
-   * Emit the full OpenAPI document. Lazy-imports `@anatine/zod-openapi`
-   * on first call; failure to resolve raises `OpenApiPeerDepMissingError`
-   * (matches the `CubeAnalyticsBackend.onModuleInit` precedent).
-   *
-   * OpenAPI version is pinned to `3.0.3` — Swagger UI tooling is most
-   * stable on 3.0.x (see OPENAPI-PHASE-1-PLAN §Four locked decisions).
-   */
-  async build(info) {
-    const peer = await this.loadPeer();
-    const schemas = {};
-    for (const [name, zodSchema] of this.zodSchemas) {
-      schemas[name] = peer.generateSchema(zodSchema, false, "3.0");
-    }
-    const paths = {};
-    for (const [path, methods] of this.pathEntries) {
-      const methodMap = {};
-      for (const [method, spec] of methods) {
-        methodMap[method] = spec;
-      }
-      paths[path] = methodMap;
-    }
-    return {
-      openapi: "3.0.3",
-      info,
-      paths,
-      components: { schemas }
-    };
-  }
-  /**
-   * Test helper — clears registered schemas and paths, then re-seeds the
-   * core `ErrorResponseDto` entry so post-reset state matches the
-   * invariant established in the constructor.
-   */
-  reset() {
-    this.zodSchemas.clear();
-    this.pathEntries.clear();
-    this.peer = null;
-    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);
-  }
-  async loadPeer() {
-    if (this.peer) return this.peer;
-    try {
-      const specifier = "@anatine/zod-openapi";
-      const mod = await import(specifier);
-      this.peer = mod;
-      return mod;
-    } catch {
-      throw new OpenApiPeerDepMissingError();
-    }
-  }
-};
+import {
+  OpenApiRegistry
+} from "../../../chunk-Y7GDG744.js";
+import "../../../chunk-SOVM2VEK.js";
+import "../../../chunk-YSLTTQLC.js";
+import "../../../chunk-2E224ZSN.js";
 export {
   OpenApiRegistry
 };

package/dist/runtime/shared/openapi/registry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../runtime/shared/openapi/error-response.dto.ts","../../../../runtime/shared/openapi/errors.ts","../../../../runtime/shared/openapi/registry.ts"],"sourcesContent":["/**\n * Shared error response schema (OPENAPI-3).\n *\n * Generated controllers `@ApiResponse(...)` decorators reference this\n * schema by `$ref` (name `ErrorResponseDto`) for non-success status codes\n * (400, 401, 404, etc.). Shape matches NestJS's default `HttpException`\n * JSON body — see `packages/common/src/exceptions/http.exception.ts`.\n *\n * The registry auto-registers this schema on construction so every\n * consumer project exposes `components.schemas.ErrorResponseDto` on\n * `/docs-json` without per-entity duplication.\n */\nimport { z } from 'zod';\n\nexport const errorResponseSchema = z.object({\n  statusCode: z.number().int(),\n  message: z.union([z.string(), z.array(z.string())]),\n  error: z.string().optional(),\n});\n\nexport type ErrorResponseDto = z.infer<typeof errorResponseSchema>;\n\n/** Canonical name used across `$ref` URIs in generated controllers. */\nexport const ERROR_RESPONSE_SCHEMA_NAME = 'ErrorResponseDto';\n","/**\n * Typed errors for the OpenAPI registry (OPENAPI-1).\n *\n * Same shape as `runtime/subsystems/bridge/bridge-errors.ts` so consumers\n * can catch them with the same exception-filter pattern used elsewhere.\n */\n\n/**\n * Thrown by `OpenApiRegistry.build()` when `@anatine/zod-openapi` is not\n * resolvable. The peer is declared optional (`peerDependenciesMeta`) so\n * consumer apps that don't care about OpenAPI still boot; the cost is a\n * deferred failure here on first `build()`.\n */\nexport class OpenApiPeerDepMissingError extends Error {\n  override readonly name = 'OpenApiPeerDepMissingError';\n  constructor(message?: string) {\n    super(\n      message ??\n        'OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi',\n    );\n  }\n}\n\n/**\n * Thrown by `OpenApiRegistry.registerSchema(name, ...)` when `name` is\n * already registered. Silent overwrite would make debugging\n * double-registration bugs (e.g. two entity pipelines both emitting a\n * `User` DTO) painful; loud failure lets the mismatch surface at module\n * init where the stack trace is clear.\n */\nexport class DuplicateSchemaError extends Error {\n  override readonly name = 'DuplicateSchemaError';\n  constructor(public readonly schemaName: string) {\n    super(\n      `DuplicateSchemaError: schema '${schemaName}' is already registered. ` +\n        `Each schema name must be unique within the OpenApiRegistry.`,\n    );\n  }\n}\n","/**\n * OpenApiRegistry — collects Zod schemas and path specs, emits a\n * complete `OpenAPIObject` on `build()` (OPENAPI-1).\n *\n * Wraps `@anatine/zod-openapi` as an **optional peer dependency** using\n * the lazy-import pattern from `runtime/subsystems/analytics/cube-backend.ts`\n * — consumer apps that never call `build()` still boot even if\n * `@anatine/zod-openapi` isn't installed.\n *\n * The registry is the single source of truth consumed by OPENAPI-2\n * (generated DTOs register their Zod schemas at module init), OPENAPI-3\n * (controller decorators reference those schemas), and OPENAPI-4\n * (Swagger UI bootstrap calls `build()` once at startup).\n */\nimport type { z } from 'zod';\n\nimport { ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema } from './error-response.dto';\nimport { OpenApiPeerDepMissingError, DuplicateSchemaError } from './errors';\n\nexport type HttpMethod = 'get' | 'post' | 'patch' | 'delete' | 'put';\n\n/**\n * OpenAPI path spec. Structurally compatible with `openapi3-ts`'s\n * `OperationObject` but typed loosely here because the peer type package\n * isn't installed as a direct dep — consumers supply whatever their\n * codegen emits.\n */\nexport interface PathSpec {\n  summary?: string;\n  description?: string;\n  operationId?: string;\n  tags?: string[];\n  parameters?: unknown[];\n  requestBody?: unknown;\n  responses?: Record<string, unknown>;\n  security?: unknown[];\n  [key: string]: unknown;\n}\n\nexport interface OpenAPIInfo {\n  title: string;\n  version: string;\n  description?: string;\n}\n\n/**\n * Minimal OpenAPIObject shape. We redeclare rather than pull\n * `openapi3-ts` types through the peer — the peer's `generateSchema`\n * returns a `SchemaObject`, but the final document assembly is ours.\n */\nexport interface OpenAPIObject {\n  openapi: string;\n  info: OpenAPIInfo;\n  paths: Record<string, Record<string, PathSpec>>;\n  components: {\n    schemas: Record<string, unknown>;\n  };\n}\n\ninterface PeerModule {\n  generateSchema: (zodRef: unknown, useOutput?: boolean, version?: '3.0' | '3.1') => unknown;\n}\n\nexport class OpenApiRegistry {\n  private zodSchemas = new Map<string, z.ZodType>();\n  private pathEntries = new Map<string, Map<HttpMethod, PathSpec>>();\n  private peer: PeerModule | null = null;\n\n  constructor() {\n    // Auto-register the shared error response schema so controllers that\n    // reference `#/components/schemas/ErrorResponseDto` always resolve\n    // (OPENAPI-3). Consumers can `reset()` + re-register in tests.\n    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);\n  }\n\n  registerSchema(name: string, schema: z.ZodType): void {\n    if (this.zodSchemas.has(name)) {\n      throw new DuplicateSchemaError(name);\n    }\n    this.zodSchemas.set(name, schema);\n  }\n\n  registerPath(path: string, method: HttpMethod, spec: PathSpec): void {\n    let methods = this.pathEntries.get(path);\n    if (!methods) {\n      methods = new Map();\n      this.pathEntries.set(path, methods);\n    }\n    methods.set(method, spec);\n  }\n\n  /**\n   * Emit the full OpenAPI document. Lazy-imports `@anatine/zod-openapi`\n   * on first call; failure to resolve raises `OpenApiPeerDepMissingError`\n   * (matches the `CubeAnalyticsBackend.onModuleInit` precedent).\n   *\n   * OpenAPI version is pinned to `3.0.3` — Swagger UI tooling is most\n   * stable on 3.0.x (see OPENAPI-PHASE-1-PLAN §Four locked decisions).\n   */\n  async build(info: OpenAPIInfo): Promise<OpenAPIObject> {\n    const peer = await this.loadPeer();\n\n    const schemas: Record<string, unknown> = {};\n    for (const [name, zodSchema] of this.zodSchemas) {\n      schemas[name] = peer.generateSchema(zodSchema, false, '3.0');\n    }\n\n    const paths: Record<string, Record<string, PathSpec>> = {};\n    for (const [path, methods] of this.pathEntries) {\n      const methodMap: Record<string, PathSpec> = {};\n      for (const [method, spec] of methods) {\n        methodMap[method] = spec;\n      }\n      paths[path] = methodMap;\n    }\n\n    return {\n      openapi: '3.0.3',\n      info,\n      paths,\n      components: { schemas },\n    };\n  }\n\n  /**\n   * Test helper — clears registered schemas and paths, then re-seeds the\n   * core `ErrorResponseDto` entry so post-reset state matches the\n   * invariant established in the constructor.\n   */\n  reset(): void {\n    this.zodSchemas.clear();\n    this.pathEntries.clear();\n    this.peer = null;\n    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);\n  }\n\n  protected async loadPeer(): Promise<PeerModule> {\n    if (this.peer) return this.peer;\n    try {\n      // Computed specifier: prevents tsc from resolving this import at\n      // typecheck time. Consumers vendor this file but may not install\n      // @anatine/zod-openapi (optional peer).\n      const specifier: string = '@anatine/zod-openapi';\n      const mod = (await import(specifier)) as PeerModule;\n      this.peer = mod;\n      return mod;\n    } catch {\n      throw new OpenApiPeerDepMissingError();\n    }\n  }\n}\n"],"mappings":";AAYA,SAAS,SAAS;AAEX,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAKM,IAAM,6BAA6B;;;ACVnC,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAClC,OAAO;AAAA,EACzB,YAAY,SAAkB;AAC5B;AAAA,MACE,WACE;AAAA,IACJ;AAAA,EACF;AACF;AASO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAE9C,YAA4B,YAAoB;AAC9C;AAAA,MACE,iCAAiC,UAAU;AAAA,IAE7C;AAJ0B;AAAA,EAK5B;AAAA,EAL4B;AAAA,EADV,OAAO;AAO3B;;;ACyBO,IAAM,kBAAN,MAAsB;AAAA,EACnB,aAAa,oBAAI,IAAuB;AAAA,EACxC,cAAc,oBAAI,IAAuC;AAAA,EACzD,OAA0B;AAAA,EAElC,cAAc;AAIZ,SAAK,WAAW,IAAI,4BAA4B,mBAAmB;AAAA,EACrE;AAAA,EAEA,eAAe,MAAc,QAAyB;AACpD,QAAI,KAAK,WAAW,IAAI,IAAI,GAAG;AAC7B,YAAM,IAAI,qBAAqB,IAAI;AAAA,IACrC;AACA,SAAK,WAAW,IAAI,MAAM,MAAM;AAAA,EAClC;AAAA,EAEA,aAAa,MAAc,QAAoB,MAAsB;AACnE,QAAI,UAAU,KAAK,YAAY,IAAI,IAAI;AACvC,QAAI,CAAC,SAAS;AACZ,gBAAU,oBAAI,IAAI;AAClB,WAAK,YAAY,IAAI,MAAM,OAAO;AAAA,IACpC;AACA,YAAQ,IAAI,QAAQ,IAAI;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,MAAM,MAA2C;AACrD,UAAM,OAAO,MAAM,KAAK,SAAS;AAEjC,UAAM,UAAmC,CAAC;AAC1C,eAAW,CAAC,MAAM,SAAS,KAAK,KAAK,YAAY;AAC/C,cAAQ,IAAI,IAAI,KAAK,eAAe,WAAW,OAAO,KAAK;AAAA,IAC7D;AAEA,UAAM,QAAkD,CAAC;AACzD,eAAW,CAAC,MAAM,OAAO,KAAK,KAAK,aAAa;AAC9C,YAAM,YAAsC,CAAC;AAC7C,iBAAW,CAAC,QAAQ,IAAI,KAAK,SAAS;AACpC,kBAAU,MAAM,IAAI;AAAA,MACtB;AACA,YAAM,IAAI,IAAI;AAAA,IAChB;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,YAAY,EAAE,QAAQ;AAAA,IACxB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAc;AACZ,SAAK,WAAW,MAAM;AACtB,SAAK,YAAY,MAAM;AACvB,SAAK,OAAO;AACZ,SAAK,WAAW,IAAI,4BAA4B,mBAAmB;AAAA,EACrE;AAAA,EAEA,MAAgB,WAAgC;AAC9C,QAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,QAAI;AAIF,YAAM,YAAoB;AAC1B,YAAM,MAAO,MAAM,OAAO;AAC1B,WAAK,OAAO;AACZ,aAAO;AAAA,IACT,QAAQ;AACN,YAAM,IAAI,2BAA2B;AAAA,IACvC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/runtime/shared/openapi/registry.tokens.js

@@ -1,5 +1,7 @@
-// runtime/shared/openapi/registry.tokens.ts
-var OPENAPI_REGISTRY = "OPENAPI_REGISTRY";
+import {
+  OPENAPI_REGISTRY
+} from "../../../chunk-PSXUNOVU.js";
+import "../../../chunk-2E224ZSN.js";
 export {
   OPENAPI_REGISTRY
 };

package/dist/runtime/shared/openapi/registry.tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../runtime/shared/openapi/registry.tokens.ts"],"sourcesContent":["/**\n * Injection token for the OpenAPI registry (OPENAPI-1).\n *\n * String constant (not a Symbol) so it matches by value across import\n * boundaries — same convention as `ANALYTICS_QUERY` in analytics and\n * `EVENT_BUS` / `BRIDGE_DELIVERY_REPO` in events / bridge. The OPENAPI-1\n * spec sketched a Symbol, but the repo-wide convention wins — codebase\n * consistency matters more than the spec's initial guess.\n *\n * Consumed by generated DTO providers (OPENAPI-2), controllers\n * (OPENAPI-3), and the Swagger bootstrap (OPENAPI-4).\n */\nexport const OPENAPI_REGISTRY = 'OPENAPI_REGISTRY' as const;\n"],"mappings":";AAYO,IAAM,mBAAmB;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}