@pattern-stack/codegen 0.3.2 → 0.4.1

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.4.1] — 2026-04-21
+
+### Added
+- **`codegen project upgrade-openapi`** — surgical AST-based codemod that brings an existing consumer `src/app.module.ts` + `src/main.ts` up to the OPENAPI-4 shape `project init` emits on a fresh project. Merges `@nestjs/common` imports, adds `OpenApiModule` (the `@Global()` wrapper around `OPENAPI_REGISTRY`), wires it into `AppModule.imports`, injects the two-pass Swagger bootstrap into `main.ts`, and vendors `src/shared/openapi/*`. Idempotent; `--dry-run` and `--path` supported. Proof-of-concept for issue #188 (additive subsystem install, targeted for 0.5.0).
+- **`src/cli/shared/ast-patch.ts`** — ts-morph patching primitives (`ensureImport`, `ensureClassDeclaration`, `ensureModuleImportEntry`, `ensureMainSwaggerBlock`). Each is idempotent and bails cleanly on exotic shapes (factory-based modules, non-array `imports`, missing `@Module()` decorator).
+
+### Changed
+- **`project init` skip reasons** — when `app.module.ts` or `main.ts` exist, the skip message now points at `codegen project upgrade-openapi` as the automated path (previously instructed manual wiring only).
+
+### Dependencies
+- Added `ts-morph` (runtime dep; CLI-side) for AST manipulation.
+
+
+
 ### Added
 - **Noun-verb CLI** — Clipanion-based CLI replacing the legacy single-file handler. Commands: `entity`, `subsystem`, `project`, `dev`. Each noun has a summary pane with dynamic hints. (ADR-015)
 - **UI toolkit** — chalk theme tokens, icons with ASCII fallback, Ora spinners, pane/hints rendering, `--json` mode across all commands. (ADR-016)

package/README.md

@@ -96,12 +96,13 @@ codegen subsystem install cache      # key-value cache with TTL
 codegen subsystem install storage    # file storage (local filesystem)
 codegen subsystem install sync       # external-system sync engine (IChangeSource + orchestrator + audit log)
 codegen subsystem install bridge     # event-to-job bridge (durable async fanout via @JobHandler.triggers)
+codegen subsystem install openapi-config  # OpenAPI/Swagger — Zod DTOs as /docs-json + Swagger UI. See docs/CONSUMER-SETUP.md §OpenAPI
 codegen subsystem list               # show installed + available
 
 codegen events consumers <type>      # list all Tier 1/2/3 consumers of an event type
 ```
 
-Each subsystem generates a protocol (interface), Drizzle backend (Postgres), memory backend (tests), and a NestJS module with `forRoot({ backend })` factory.
+Each subsystem generates a protocol (interface), Drizzle backend (Postgres), memory backend (tests), and a NestJS module with `forRoot({ backend })` factory. The `openapi-config` subsystem is config-only — the runtime helpers ship with `codegen project init`.
 
 ### Project Commands
 

package/dist/runtime/shared/openapi/error-response.dto.d.ts

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+
+/**
+ * Shared error response schema (OPENAPI-3).
+ *
+ * Generated controllers `@ApiResponse(...)` decorators reference this
+ * schema by `$ref` (name `ErrorResponseDto`) for non-success status codes
+ * (400, 401, 404, etc.). Shape matches NestJS's default `HttpException`
+ * JSON body — see `packages/common/src/exceptions/http.exception.ts`.
+ *
+ * The registry auto-registers this schema on construction so every
+ * consumer project exposes `components.schemas.ErrorResponseDto` on
+ * `/docs-json` without per-entity duplication.
+ */
+
+declare const errorResponseSchema: z.ZodObject<{
+    statusCode: z.ZodNumber;
+    message: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>;
+    error: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    statusCode: number;
+    message: string | string[];
+    error?: string | undefined;
+}, {
+    statusCode: number;
+    message: string | string[];
+    error?: string | undefined;
+}>;
+type ErrorResponseDto = z.infer<typeof errorResponseSchema>;
+/** Canonical name used across `$ref` URIs in generated controllers. */
+declare const ERROR_RESPONSE_SCHEMA_NAME = "ErrorResponseDto";
+
+export { ERROR_RESPONSE_SCHEMA_NAME, type ErrorResponseDto, errorResponseSchema };

package/dist/runtime/shared/openapi/error-response.dto.js

@@ -0,0 +1,13 @@
+// runtime/shared/openapi/error-response.dto.ts
+import { z } from "zod";
+var errorResponseSchema = z.object({
+  statusCode: z.number().int(),
+  message: z.union([z.string(), z.array(z.string())]),
+  error: z.string().optional()
+});
+var ERROR_RESPONSE_SCHEMA_NAME = "ErrorResponseDto";
+export {
+  ERROR_RESPONSE_SCHEMA_NAME,
+  errorResponseSchema
+};
+//# sourceMappingURL=error-response.dto.js.map

package/dist/runtime/shared/openapi/error-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../runtime/shared/openapi/error-response.dto.ts"],"sourcesContent":["/**\n * Shared error response schema (OPENAPI-3).\n *\n * Generated controllers `@ApiResponse(...)` decorators reference this\n * schema by `$ref` (name `ErrorResponseDto`) for non-success status codes\n * (400, 401, 404, etc.). Shape matches NestJS's default `HttpException`\n * JSON body — see `packages/common/src/exceptions/http.exception.ts`.\n *\n * The registry auto-registers this schema on construction so every\n * consumer project exposes `components.schemas.ErrorResponseDto` on\n * `/docs-json` without per-entity duplication.\n */\nimport { z } from 'zod';\n\nexport const errorResponseSchema = z.object({\n  statusCode: z.number().int(),\n  message: z.union([z.string(), z.array(z.string())]),\n  error: z.string().optional(),\n});\n\nexport type ErrorResponseDto = z.infer<typeof errorResponseSchema>;\n\n/** Canonical name used across `$ref` URIs in generated controllers. */\nexport const ERROR_RESPONSE_SCHEMA_NAME = 'ErrorResponseDto';\n"],"mappings":";AAYA,SAAS,SAAS;AAEX,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAKM,IAAM,6BAA6B;","names":[]}

package/dist/runtime/shared/openapi/errors.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Typed errors for the OpenAPI registry (OPENAPI-1).
+ *
+ * Same shape as `runtime/subsystems/bridge/bridge-errors.ts` so consumers
+ * can catch them with the same exception-filter pattern used elsewhere.
+ */
+/**
+ * Thrown by `OpenApiRegistry.build()` when `@anatine/zod-openapi` is not
+ * resolvable. The peer is declared optional (`peerDependenciesMeta`) so
+ * consumer apps that don't care about OpenAPI still boot; the cost is a
+ * deferred failure here on first `build()`.
+ */
+declare class OpenApiPeerDepMissingError extends Error {
+    readonly name = "OpenApiPeerDepMissingError";
+    constructor(message?: string);
+}
+/**
+ * Thrown by `OpenApiRegistry.registerSchema(name, ...)` when `name` is
+ * already registered. Silent overwrite would make debugging
+ * double-registration bugs (e.g. two entity pipelines both emitting a
+ * `User` DTO) painful; loud failure lets the mismatch surface at module
+ * init where the stack trace is clear.
+ */
+declare class DuplicateSchemaError extends Error {
+    readonly schemaName: string;
+    readonly name = "DuplicateSchemaError";
+    constructor(schemaName: string);
+}
+
+export { DuplicateSchemaError, OpenApiPeerDepMissingError };

package/dist/runtime/shared/openapi/errors.js

@@ -0,0 +1,24 @@
+// runtime/shared/openapi/errors.ts
+var OpenApiPeerDepMissingError = class extends Error {
+  name = "OpenApiPeerDepMissingError";
+  constructor(message) {
+    super(
+      message ?? "OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi"
+    );
+  }
+};
+var DuplicateSchemaError = class extends Error {
+  constructor(schemaName) {
+    super(
+      `DuplicateSchemaError: schema '${schemaName}' is already registered. Each schema name must be unique within the OpenApiRegistry.`
+    );
+    this.schemaName = schemaName;
+  }
+  schemaName;
+  name = "DuplicateSchemaError";
+};
+export {
+  DuplicateSchemaError,
+  OpenApiPeerDepMissingError
+};
+//# sourceMappingURL=errors.js.map

package/dist/runtime/shared/openapi/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../runtime/shared/openapi/errors.ts"],"sourcesContent":["/**\n * Typed errors for the OpenAPI registry (OPENAPI-1).\n *\n * Same shape as `runtime/subsystems/bridge/bridge-errors.ts` so consumers\n * can catch them with the same exception-filter pattern used elsewhere.\n */\n\n/**\n * Thrown by `OpenApiRegistry.build()` when `@anatine/zod-openapi` is not\n * resolvable. The peer is declared optional (`peerDependenciesMeta`) so\n * consumer apps that don't care about OpenAPI still boot; the cost is a\n * deferred failure here on first `build()`.\n */\nexport class OpenApiPeerDepMissingError extends Error {\n  override readonly name = 'OpenApiPeerDepMissingError';\n  constructor(message?: string) {\n    super(\n      message ??\n        'OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi',\n    );\n  }\n}\n\n/**\n * Thrown by `OpenApiRegistry.registerSchema(name, ...)` when `name` is\n * already registered. Silent overwrite would make debugging\n * double-registration bugs (e.g. two entity pipelines both emitting a\n * `User` DTO) painful; loud failure lets the mismatch surface at module\n * init where the stack trace is clear.\n */\nexport class DuplicateSchemaError extends Error {\n  override readonly name = 'DuplicateSchemaError';\n  constructor(public readonly schemaName: string) {\n    super(\n      `DuplicateSchemaError: schema '${schemaName}' is already registered. ` +\n        `Each schema name must be unique within the OpenApiRegistry.`,\n    );\n  }\n}\n"],"mappings":";AAaO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAClC,OAAO;AAAA,EACzB,YAAY,SAAkB;AAC5B;AAAA,MACE,WACE;AAAA,IACJ;AAAA,EACF;AACF;AASO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAE9C,YAA4B,YAAoB;AAC9C;AAAA,MACE,iCAAiC,UAAU;AAAA,IAE7C;AAJ0B;AAAA,EAK5B;AAAA,EAL4B;AAAA,EADV,OAAO;AAO3B;","names":[]}

package/dist/runtime/shared/openapi/index.d.ts

@@ -0,0 +1,5 @@
+export { HttpMethod, OpenAPIInfo, OpenAPIObject, OpenApiRegistry, PathSpec } from './registry.js';
+export { OPENAPI_REGISTRY } from './registry.tokens.js';
+export { DuplicateSchemaError, OpenApiPeerDepMissingError } from './errors.js';
+export { ERROR_RESPONSE_SCHEMA_NAME, ErrorResponseDto, errorResponseSchema } from './error-response.dto.js';
+import 'zod';

package/dist/runtime/shared/openapi/index.js

@@ -0,0 +1,115 @@
+// runtime/shared/openapi/error-response.dto.ts
+import { z } from "zod";
+var errorResponseSchema = z.object({
+  statusCode: z.number().int(),
+  message: z.union([z.string(), z.array(z.string())]),
+  error: z.string().optional()
+});
+var ERROR_RESPONSE_SCHEMA_NAME = "ErrorResponseDto";
+
+// runtime/shared/openapi/errors.ts
+var OpenApiPeerDepMissingError = class extends Error {
+  name = "OpenApiPeerDepMissingError";
+  constructor(message) {
+    super(
+      message ?? "OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi"
+    );
+  }
+};
+var DuplicateSchemaError = class extends Error {
+  constructor(schemaName) {
+    super(
+      `DuplicateSchemaError: schema '${schemaName}' is already registered. Each schema name must be unique within the OpenApiRegistry.`
+    );
+    this.schemaName = schemaName;
+  }
+  schemaName;
+  name = "DuplicateSchemaError";
+};
+
+// runtime/shared/openapi/registry.ts
+var OpenApiRegistry = class {
+  zodSchemas = /* @__PURE__ */ new Map();
+  pathEntries = /* @__PURE__ */ new Map();
+  peer = null;
+  constructor() {
+    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);
+  }
+  registerSchema(name, schema) {
+    if (this.zodSchemas.has(name)) {
+      throw new DuplicateSchemaError(name);
+    }
+    this.zodSchemas.set(name, schema);
+  }
+  registerPath(path, method, spec) {
+    let methods = this.pathEntries.get(path);
+    if (!methods) {
+      methods = /* @__PURE__ */ new Map();
+      this.pathEntries.set(path, methods);
+    }
+    methods.set(method, spec);
+  }
+  /**
+   * Emit the full OpenAPI document. Lazy-imports `@anatine/zod-openapi`
+   * on first call; failure to resolve raises `OpenApiPeerDepMissingError`
+   * (matches the `CubeAnalyticsBackend.onModuleInit` precedent).
+   *
+   * OpenAPI version is pinned to `3.0.3` — Swagger UI tooling is most
+   * stable on 3.0.x (see OPENAPI-PHASE-1-PLAN §Four locked decisions).
+   */
+  async build(info) {
+    const peer = await this.loadPeer();
+    const schemas = {};
+    for (const [name, zodSchema] of this.zodSchemas) {
+      schemas[name] = peer.generateSchema(zodSchema, false, "3.0");
+    }
+    const paths = {};
+    for (const [path, methods] of this.pathEntries) {
+      const methodMap = {};
+      for (const [method, spec] of methods) {
+        methodMap[method] = spec;
+      }
+      paths[path] = methodMap;
+    }
+    return {
+      openapi: "3.0.3",
+      info,
+      paths,
+      components: { schemas }
+    };
+  }
+  /**
+   * Test helper — clears registered schemas and paths, then re-seeds the
+   * core `ErrorResponseDto` entry so post-reset state matches the
+   * invariant established in the constructor.
+   */
+  reset() {
+    this.zodSchemas.clear();
+    this.pathEntries.clear();
+    this.peer = null;
+    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);
+  }
+  async loadPeer() {
+    if (this.peer) return this.peer;
+    try {
+      const specifier = "@anatine/zod-openapi";
+      const mod = await import(specifier);
+      this.peer = mod;
+      return mod;
+    } catch {
+      throw new OpenApiPeerDepMissingError();
+    }
+  }
+};
+
+// runtime/shared/openapi/registry.tokens.ts
+var OPENAPI_REGISTRY = "OPENAPI_REGISTRY";
+export {
+  DuplicateSchemaError,
+  ERROR_RESPONSE_SCHEMA_NAME,
+  OPENAPI_REGISTRY,
+  OpenApiPeerDepMissingError,
+  OpenApiRegistry,
+  errorResponseSchema
+};
+//# sourceMappingURL=index.js.map

package/dist/runtime/shared/openapi/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../runtime/shared/openapi/error-response.dto.ts","../../../../runtime/shared/openapi/errors.ts","../../../../runtime/shared/openapi/registry.ts","../../../../runtime/shared/openapi/registry.tokens.ts"],"sourcesContent":["/**\n * Shared error response schema (OPENAPI-3).\n *\n * Generated controllers `@ApiResponse(...)` decorators reference this\n * schema by `$ref` (name `ErrorResponseDto`) for non-success status codes\n * (400, 401, 404, etc.). Shape matches NestJS's default `HttpException`\n * JSON body — see `packages/common/src/exceptions/http.exception.ts`.\n *\n * The registry auto-registers this schema on construction so every\n * consumer project exposes `components.schemas.ErrorResponseDto` on\n * `/docs-json` without per-entity duplication.\n */\nimport { z } from 'zod';\n\nexport const errorResponseSchema = z.object({\n  statusCode: z.number().int(),\n  message: z.union([z.string(), z.array(z.string())]),\n  error: z.string().optional(),\n});\n\nexport type ErrorResponseDto = z.infer<typeof errorResponseSchema>;\n\n/** Canonical name used across `$ref` URIs in generated controllers. */\nexport const ERROR_RESPONSE_SCHEMA_NAME = 'ErrorResponseDto';\n","/**\n * Typed errors for the OpenAPI registry (OPENAPI-1).\n *\n * Same shape as `runtime/subsystems/bridge/bridge-errors.ts` so consumers\n * can catch them with the same exception-filter pattern used elsewhere.\n */\n\n/**\n * Thrown by `OpenApiRegistry.build()` when `@anatine/zod-openapi` is not\n * resolvable. The peer is declared optional (`peerDependenciesMeta`) so\n * consumer apps that don't care about OpenAPI still boot; the cost is a\n * deferred failure here on first `build()`.\n */\nexport class OpenApiPeerDepMissingError extends Error {\n  override readonly name = 'OpenApiPeerDepMissingError';\n  constructor(message?: string) {\n    super(\n      message ??\n        'OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi',\n    );\n  }\n}\n\n/**\n * Thrown by `OpenApiRegistry.registerSchema(name, ...)` when `name` is\n * already registered. Silent overwrite would make debugging\n * double-registration bugs (e.g. two entity pipelines both emitting a\n * `User` DTO) painful; loud failure lets the mismatch surface at module\n * init where the stack trace is clear.\n */\nexport class DuplicateSchemaError extends Error {\n  override readonly name = 'DuplicateSchemaError';\n  constructor(public readonly schemaName: string) {\n    super(\n      `DuplicateSchemaError: schema '${schemaName}' is already registered. ` +\n        `Each schema name must be unique within the OpenApiRegistry.`,\n    );\n  }\n}\n","/**\n * OpenApiRegistry — collects Zod schemas and path specs, emits a\n * complete `OpenAPIObject` on `build()` (OPENAPI-1).\n *\n * Wraps `@anatine/zod-openapi` as an **optional peer dependency** using\n * the lazy-import pattern from `runtime/subsystems/analytics/cube-backend.ts`\n * — consumer apps that never call `build()` still boot even if\n * `@anatine/zod-openapi` isn't installed.\n *\n * The registry is the single source of truth consumed by OPENAPI-2\n * (generated DTOs register their Zod schemas at module init), OPENAPI-3\n * (controller decorators reference those schemas), and OPENAPI-4\n * (Swagger UI bootstrap calls `build()` once at startup).\n */\nimport type { z } from 'zod';\n\nimport { ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema } from './error-response.dto';\nimport { OpenApiPeerDepMissingError, DuplicateSchemaError } from './errors';\n\nexport type HttpMethod = 'get' | 'post' | 'patch' | 'delete' | 'put';\n\n/**\n * OpenAPI path spec. Structurally compatible with `openapi3-ts`'s\n * `OperationObject` but typed loosely here because the peer type package\n * isn't installed as a direct dep — consumers supply whatever their\n * codegen emits.\n */\nexport interface PathSpec {\n  summary?: string;\n  description?: string;\n  operationId?: string;\n  tags?: string[];\n  parameters?: unknown[];\n  requestBody?: unknown;\n  responses?: Record<string, unknown>;\n  security?: unknown[];\n  [key: string]: unknown;\n}\n\nexport interface OpenAPIInfo {\n  title: string;\n  version: string;\n  description?: string;\n}\n\n/**\n * Minimal OpenAPIObject shape. We redeclare rather than pull\n * `openapi3-ts` types through the peer — the peer's `generateSchema`\n * returns a `SchemaObject`, but the final document assembly is ours.\n */\nexport interface OpenAPIObject {\n  openapi: string;\n  info: OpenAPIInfo;\n  paths: Record<string, Record<string, PathSpec>>;\n  components: {\n    schemas: Record<string, unknown>;\n  };\n}\n\ninterface PeerModule {\n  generateSchema: (zodRef: unknown, useOutput?: boolean, version?: '3.0' | '3.1') => unknown;\n}\n\nexport class OpenApiRegistry {\n  private zodSchemas = new Map<string, z.ZodType>();\n  private pathEntries = new Map<string, Map<HttpMethod, PathSpec>>();\n  private peer: PeerModule | null = null;\n\n  constructor() {\n    // Auto-register the shared error response schema so controllers that\n    // reference `#/components/schemas/ErrorResponseDto` always resolve\n    // (OPENAPI-3). Consumers can `reset()` + re-register in tests.\n    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);\n  }\n\n  registerSchema(name: string, schema: z.ZodType): void {\n    if (this.zodSchemas.has(name)) {\n      throw new DuplicateSchemaError(name);\n    }\n    this.zodSchemas.set(name, schema);\n  }\n\n  registerPath(path: string, method: HttpMethod, spec: PathSpec): void {\n    let methods = this.pathEntries.get(path);\n    if (!methods) {\n      methods = new Map();\n      this.pathEntries.set(path, methods);\n    }\n    methods.set(method, spec);\n  }\n\n  /**\n   * Emit the full OpenAPI document. Lazy-imports `@anatine/zod-openapi`\n   * on first call; failure to resolve raises `OpenApiPeerDepMissingError`\n   * (matches the `CubeAnalyticsBackend.onModuleInit` precedent).\n   *\n   * OpenAPI version is pinned to `3.0.3` — Swagger UI tooling is most\n   * stable on 3.0.x (see OPENAPI-PHASE-1-PLAN §Four locked decisions).\n   */\n  async build(info: OpenAPIInfo): Promise<OpenAPIObject> {\n    const peer = await this.loadPeer();\n\n    const schemas: Record<string, unknown> = {};\n    for (const [name, zodSchema] of this.zodSchemas) {\n      schemas[name] = peer.generateSchema(zodSchema, false, '3.0');\n    }\n\n    const paths: Record<string, Record<string, PathSpec>> = {};\n    for (const [path, methods] of this.pathEntries) {\n      const methodMap: Record<string, PathSpec> = {};\n      for (const [method, spec] of methods) {\n        methodMap[method] = spec;\n      }\n      paths[path] = methodMap;\n    }\n\n    return {\n      openapi: '3.0.3',\n      info,\n      paths,\n      components: { schemas },\n    };\n  }\n\n  /**\n   * Test helper — clears registered schemas and paths, then re-seeds the\n   * core `ErrorResponseDto` entry so post-reset state matches the\n   * invariant established in the constructor.\n   */\n  reset(): void {\n    this.zodSchemas.clear();\n    this.pathEntries.clear();\n    this.peer = null;\n    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);\n  }\n\n  protected async loadPeer(): Promise<PeerModule> {\n    if (this.peer) return this.peer;\n    try {\n      // Computed specifier: prevents tsc from resolving this import at\n      // typecheck time. Consumers vendor this file but may not install\n      // @anatine/zod-openapi (optional peer).\n      const specifier: string = '@anatine/zod-openapi';\n      const mod = (await import(specifier)) as PeerModule;\n      this.peer = mod;\n      return mod;\n    } catch {\n      throw new OpenApiPeerDepMissingError();\n    }\n  }\n}\n","/**\n * Injection token for the OpenAPI registry (OPENAPI-1).\n *\n * String constant (not a Symbol) so it matches by value across import\n * boundaries — same convention as `ANALYTICS_QUERY` in analytics and\n * `EVENT_BUS` / `BRIDGE_DELIVERY_REPO` in events / bridge. The OPENAPI-1\n * spec sketched a Symbol, but the repo-wide convention wins — codebase\n * consistency matters more than the spec's initial guess.\n *\n * Consumed by generated DTO providers (OPENAPI-2), controllers\n * (OPENAPI-3), and the Swagger bootstrap (OPENAPI-4).\n */\nexport const OPENAPI_REGISTRY = 'OPENAPI_REGISTRY' as const;\n"],"mappings":";AAYA,SAAS,SAAS;AAEX,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAKM,IAAM,6BAA6B;;;ACVnC,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAClC,OAAO;AAAA,EACzB,YAAY,SAAkB;AAC5B;AAAA,MACE,WACE;AAAA,IACJ;AAAA,EACF;AACF;AASO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAE9C,YAA4B,YAAoB;AAC9C;AAAA,MACE,iCAAiC,UAAU;AAAA,IAE7C;AAJ0B;AAAA,EAK5B;AAAA,EAL4B;AAAA,EADV,OAAO;AAO3B;;;ACyBO,IAAM,kBAAN,MAAsB;AAAA,EACnB,aAAa,oBAAI,IAAuB;AAAA,EACxC,cAAc,oBAAI,IAAuC;AAAA,EACzD,OAA0B;AAAA,EAElC,cAAc;AAIZ,SAAK,WAAW,IAAI,4BAA4B,mBAAmB;AAAA,EACrE;AAAA,EAEA,eAAe,MAAc,QAAyB;AACpD,QAAI,KAAK,WAAW,IAAI,IAAI,GAAG;AAC7B,YAAM,IAAI,qBAAqB,IAAI;AAAA,IACrC;AACA,SAAK,WAAW,IAAI,MAAM,MAAM;AAAA,EAClC;AAAA,EAEA,aAAa,MAAc,QAAoB,MAAsB;AACnE,QAAI,UAAU,KAAK,YAAY,IAAI,IAAI;AACvC,QAAI,CAAC,SAAS;AACZ,gBAAU,oBAAI,IAAI;AAClB,WAAK,YAAY,IAAI,MAAM,OAAO;AAAA,IACpC;AACA,YAAQ,IAAI,QAAQ,IAAI;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,MAAM,MAA2C;AACrD,UAAM,OAAO,MAAM,KAAK,SAAS;AAEjC,UAAM,UAAmC,CAAC;AAC1C,eAAW,CAAC,MAAM,SAAS,KAAK,KAAK,YAAY;AAC/C,cAAQ,IAAI,IAAI,KAAK,eAAe,WAAW,OAAO,KAAK;AAAA,IAC7D;AAEA,UAAM,QAAkD,CAAC;AACzD,eAAW,CAAC,MAAM,OAAO,KAAK,KAAK,aAAa;AAC9C,YAAM,YAAsC,CAAC;AAC7C,iBAAW,CAAC,QAAQ,IAAI,KAAK,SAAS;AACpC,kBAAU,MAAM,IAAI;AAAA,MACtB;AACA,YAAM,IAAI,IAAI;AAAA,IAChB;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,YAAY,EAAE,QAAQ;AAAA,IACxB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAc;AACZ,SAAK,WAAW,MAAM;AACtB,SAAK,YAAY,MAAM;AACvB,SAAK,OAAO;AACZ,SAAK,WAAW,IAAI,4BAA4B,mBAAmB;AAAA,EACrE;AAAA,EAEA,MAAgB,WAAgC;AAC9C,QAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,QAAI;AAIF,YAAM,YAAoB;AAC1B,YAAM,MAAO,MAAM,OAAO;AAC1B,WAAK,OAAO;AACZ,aAAO;AAAA,IACT,QAAQ;AACN,YAAM,IAAI,2BAA2B;AAAA,IACvC;AAAA,EACF;AACF;;;AC1IO,IAAM,mBAAmB;","names":[]}

package/dist/runtime/shared/openapi/registry.d.ts

@@ -0,0 +1,82 @@
+import { z } from 'zod';
+
+/**
+ * OpenApiRegistry — collects Zod schemas and path specs, emits a
+ * complete `OpenAPIObject` on `build()` (OPENAPI-1).
+ *
+ * Wraps `@anatine/zod-openapi` as an **optional peer dependency** using
+ * the lazy-import pattern from `runtime/subsystems/analytics/cube-backend.ts`
+ * — consumer apps that never call `build()` still boot even if
+ * `@anatine/zod-openapi` isn't installed.
+ *
+ * The registry is the single source of truth consumed by OPENAPI-2
+ * (generated DTOs register their Zod schemas at module init), OPENAPI-3
+ * (controller decorators reference those schemas), and OPENAPI-4
+ * (Swagger UI bootstrap calls `build()` once at startup).
+ */
+
+type HttpMethod = 'get' | 'post' | 'patch' | 'delete' | 'put';
+/**
+ * OpenAPI path spec. Structurally compatible with `openapi3-ts`'s
+ * `OperationObject` but typed loosely here because the peer type package
+ * isn't installed as a direct dep — consumers supply whatever their
+ * codegen emits.
+ */
+interface PathSpec {
+    summary?: string;
+    description?: string;
+    operationId?: string;
+    tags?: string[];
+    parameters?: unknown[];
+    requestBody?: unknown;
+    responses?: Record<string, unknown>;
+    security?: unknown[];
+    [key: string]: unknown;
+}
+interface OpenAPIInfo {
+    title: string;
+    version: string;
+    description?: string;
+}
+/**
+ * Minimal OpenAPIObject shape. We redeclare rather than pull
+ * `openapi3-ts` types through the peer — the peer's `generateSchema`
+ * returns a `SchemaObject`, but the final document assembly is ours.
+ */
+interface OpenAPIObject {
+    openapi: string;
+    info: OpenAPIInfo;
+    paths: Record<string, Record<string, PathSpec>>;
+    components: {
+        schemas: Record<string, unknown>;
+    };
+}
+interface PeerModule {
+    generateSchema: (zodRef: unknown, useOutput?: boolean, version?: '3.0' | '3.1') => unknown;
+}
+declare class OpenApiRegistry {
+    private zodSchemas;
+    private pathEntries;
+    private peer;
+    constructor();
+    registerSchema(name: string, schema: z.ZodType): void;
+    registerPath(path: string, method: HttpMethod, spec: PathSpec): void;
+    /**
+     * Emit the full OpenAPI document. Lazy-imports `@anatine/zod-openapi`
+     * on first call; failure to resolve raises `OpenApiPeerDepMissingError`
+     * (matches the `CubeAnalyticsBackend.onModuleInit` precedent).
+     *
+     * OpenAPI version is pinned to `3.0.3` — Swagger UI tooling is most
+     * stable on 3.0.x (see OPENAPI-PHASE-1-PLAN §Four locked decisions).
+     */
+    build(info: OpenAPIInfo): Promise<OpenAPIObject>;
+    /**
+     * Test helper — clears registered schemas and paths, then re-seeds the
+     * core `ErrorResponseDto` entry so post-reset state matches the
+     * invariant established in the constructor.
+     */
+    reset(): void;
+    protected loadPeer(): Promise<PeerModule>;
+}
+
+export { type HttpMethod, type OpenAPIInfo, type OpenAPIObject, OpenApiRegistry, type PathSpec };

package/dist/runtime/shared/openapi/registry.js

@@ -0,0 +1,107 @@
+// runtime/shared/openapi/error-response.dto.ts
+import { z } from "zod";
+var errorResponseSchema = z.object({
+  statusCode: z.number().int(),
+  message: z.union([z.string(), z.array(z.string())]),
+  error: z.string().optional()
+});
+var ERROR_RESPONSE_SCHEMA_NAME = "ErrorResponseDto";
+
+// runtime/shared/openapi/errors.ts
+var OpenApiPeerDepMissingError = class extends Error {
+  name = "OpenApiPeerDepMissingError";
+  constructor(message) {
+    super(
+      message ?? "OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi"
+    );
+  }
+};
+var DuplicateSchemaError = class extends Error {
+  constructor(schemaName) {
+    super(
+      `DuplicateSchemaError: schema '${schemaName}' is already registered. Each schema name must be unique within the OpenApiRegistry.`
+    );
+    this.schemaName = schemaName;
+  }
+  schemaName;
+  name = "DuplicateSchemaError";
+};
+
+// runtime/shared/openapi/registry.ts
+var OpenApiRegistry = class {
+  zodSchemas = /* @__PURE__ */ new Map();
+  pathEntries = /* @__PURE__ */ new Map();
+  peer = null;
+  constructor() {
+    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);
+  }
+  registerSchema(name, schema) {
+    if (this.zodSchemas.has(name)) {
+      throw new DuplicateSchemaError(name);
+    }
+    this.zodSchemas.set(name, schema);
+  }
+  registerPath(path, method, spec) {
+    let methods = this.pathEntries.get(path);
+    if (!methods) {
+      methods = /* @__PURE__ */ new Map();
+      this.pathEntries.set(path, methods);
+    }
+    methods.set(method, spec);
+  }
+  /**
+   * Emit the full OpenAPI document. Lazy-imports `@anatine/zod-openapi`
+   * on first call; failure to resolve raises `OpenApiPeerDepMissingError`
+   * (matches the `CubeAnalyticsBackend.onModuleInit` precedent).
+   *
+   * OpenAPI version is pinned to `3.0.3` — Swagger UI tooling is most
+   * stable on 3.0.x (see OPENAPI-PHASE-1-PLAN §Four locked decisions).
+   */
+  async build(info) {
+    const peer = await this.loadPeer();
+    const schemas = {};
+    for (const [name, zodSchema] of this.zodSchemas) {
+      schemas[name] = peer.generateSchema(zodSchema, false, "3.0");
+    }
+    const paths = {};
+    for (const [path, methods] of this.pathEntries) {
+      const methodMap = {};
+      for (const [method, spec] of methods) {
+        methodMap[method] = spec;
+      }
+      paths[path] = methodMap;
+    }
+    return {
+      openapi: "3.0.3",
+      info,
+      paths,
+      components: { schemas }
+    };
+  }
+  /**
+   * Test helper — clears registered schemas and paths, then re-seeds the
+   * core `ErrorResponseDto` entry so post-reset state matches the
+   * invariant established in the constructor.
+   */
+  reset() {
+    this.zodSchemas.clear();
+    this.pathEntries.clear();
+    this.peer = null;
+    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);
+  }
+  async loadPeer() {
+    if (this.peer) return this.peer;
+    try {
+      const specifier = "@anatine/zod-openapi";
+      const mod = await import(specifier);
+      this.peer = mod;
+      return mod;
+    } catch {
+      throw new OpenApiPeerDepMissingError();
+    }
+  }
+};
+export {
+  OpenApiRegistry
+};
+//# sourceMappingURL=registry.js.map

package/dist/runtime/shared/openapi/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../runtime/shared/openapi/error-response.dto.ts","../../../../runtime/shared/openapi/errors.ts","../../../../runtime/shared/openapi/registry.ts"],"sourcesContent":["/**\n * Shared error response schema (OPENAPI-3).\n *\n * Generated controllers `@ApiResponse(...)` decorators reference this\n * schema by `$ref` (name `ErrorResponseDto`) for non-success status codes\n * (400, 401, 404, etc.). Shape matches NestJS's default `HttpException`\n * JSON body — see `packages/common/src/exceptions/http.exception.ts`.\n *\n * The registry auto-registers this schema on construction so every\n * consumer project exposes `components.schemas.ErrorResponseDto` on\n * `/docs-json` without per-entity duplication.\n */\nimport { z } from 'zod';\n\nexport const errorResponseSchema = z.object({\n  statusCode: z.number().int(),\n  message: z.union([z.string(), z.array(z.string())]),\n  error: z.string().optional(),\n});\n\nexport type ErrorResponseDto = z.infer<typeof errorResponseSchema>;\n\n/** Canonical name used across `$ref` URIs in generated controllers. */\nexport const ERROR_RESPONSE_SCHEMA_NAME = 'ErrorResponseDto';\n","/**\n * Typed errors for the OpenAPI registry (OPENAPI-1).\n *\n * Same shape as `runtime/subsystems/bridge/bridge-errors.ts` so consumers\n * can catch them with the same exception-filter pattern used elsewhere.\n */\n\n/**\n * Thrown by `OpenApiRegistry.build()` when `@anatine/zod-openapi` is not\n * resolvable. The peer is declared optional (`peerDependenciesMeta`) so\n * consumer apps that don't care about OpenAPI still boot; the cost is a\n * deferred failure here on first `build()`.\n */\nexport class OpenApiPeerDepMissingError extends Error {\n  override readonly name = 'OpenApiPeerDepMissingError';\n  constructor(message?: string) {\n    super(\n      message ??\n        'OpenApiRegistry requires @anatine/zod-openapi. Install it: bun add @anatine/zod-openapi',\n    );\n  }\n}\n\n/**\n * Thrown by `OpenApiRegistry.registerSchema(name, ...)` when `name` is\n * already registered. Silent overwrite would make debugging\n * double-registration bugs (e.g. two entity pipelines both emitting a\n * `User` DTO) painful; loud failure lets the mismatch surface at module\n * init where the stack trace is clear.\n */\nexport class DuplicateSchemaError extends Error {\n  override readonly name = 'DuplicateSchemaError';\n  constructor(public readonly schemaName: string) {\n    super(\n      `DuplicateSchemaError: schema '${schemaName}' is already registered. ` +\n        `Each schema name must be unique within the OpenApiRegistry.`,\n    );\n  }\n}\n","/**\n * OpenApiRegistry — collects Zod schemas and path specs, emits a\n * complete `OpenAPIObject` on `build()` (OPENAPI-1).\n *\n * Wraps `@anatine/zod-openapi` as an **optional peer dependency** using\n * the lazy-import pattern from `runtime/subsystems/analytics/cube-backend.ts`\n * — consumer apps that never call `build()` still boot even if\n * `@anatine/zod-openapi` isn't installed.\n *\n * The registry is the single source of truth consumed by OPENAPI-2\n * (generated DTOs register their Zod schemas at module init), OPENAPI-3\n * (controller decorators reference those schemas), and OPENAPI-4\n * (Swagger UI bootstrap calls `build()` once at startup).\n */\nimport type { z } from 'zod';\n\nimport { ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema } from './error-response.dto';\nimport { OpenApiPeerDepMissingError, DuplicateSchemaError } from './errors';\n\nexport type HttpMethod = 'get' | 'post' | 'patch' | 'delete' | 'put';\n\n/**\n * OpenAPI path spec. Structurally compatible with `openapi3-ts`'s\n * `OperationObject` but typed loosely here because the peer type package\n * isn't installed as a direct dep — consumers supply whatever their\n * codegen emits.\n */\nexport interface PathSpec {\n  summary?: string;\n  description?: string;\n  operationId?: string;\n  tags?: string[];\n  parameters?: unknown[];\n  requestBody?: unknown;\n  responses?: Record<string, unknown>;\n  security?: unknown[];\n  [key: string]: unknown;\n}\n\nexport interface OpenAPIInfo {\n  title: string;\n  version: string;\n  description?: string;\n}\n\n/**\n * Minimal OpenAPIObject shape. We redeclare rather than pull\n * `openapi3-ts` types through the peer — the peer's `generateSchema`\n * returns a `SchemaObject`, but the final document assembly is ours.\n */\nexport interface OpenAPIObject {\n  openapi: string;\n  info: OpenAPIInfo;\n  paths: Record<string, Record<string, PathSpec>>;\n  components: {\n    schemas: Record<string, unknown>;\n  };\n}\n\ninterface PeerModule {\n  generateSchema: (zodRef: unknown, useOutput?: boolean, version?: '3.0' | '3.1') => unknown;\n}\n\nexport class OpenApiRegistry {\n  private zodSchemas = new Map<string, z.ZodType>();\n  private pathEntries = new Map<string, Map<HttpMethod, PathSpec>>();\n  private peer: PeerModule | null = null;\n\n  constructor() {\n    // Auto-register the shared error response schema so controllers that\n    // reference `#/components/schemas/ErrorResponseDto` always resolve\n    // (OPENAPI-3). Consumers can `reset()` + re-register in tests.\n    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);\n  }\n\n  registerSchema(name: string, schema: z.ZodType): void {\n    if (this.zodSchemas.has(name)) {\n      throw new DuplicateSchemaError(name);\n    }\n    this.zodSchemas.set(name, schema);\n  }\n\n  registerPath(path: string, method: HttpMethod, spec: PathSpec): void {\n    let methods = this.pathEntries.get(path);\n    if (!methods) {\n      methods = new Map();\n      this.pathEntries.set(path, methods);\n    }\n    methods.set(method, spec);\n  }\n\n  /**\n   * Emit the full OpenAPI document. Lazy-imports `@anatine/zod-openapi`\n   * on first call; failure to resolve raises `OpenApiPeerDepMissingError`\n   * (matches the `CubeAnalyticsBackend.onModuleInit` precedent).\n   *\n   * OpenAPI version is pinned to `3.0.3` — Swagger UI tooling is most\n   * stable on 3.0.x (see OPENAPI-PHASE-1-PLAN §Four locked decisions).\n   */\n  async build(info: OpenAPIInfo): Promise<OpenAPIObject> {\n    const peer = await this.loadPeer();\n\n    const schemas: Record<string, unknown> = {};\n    for (const [name, zodSchema] of this.zodSchemas) {\n      schemas[name] = peer.generateSchema(zodSchema, false, '3.0');\n    }\n\n    const paths: Record<string, Record<string, PathSpec>> = {};\n    for (const [path, methods] of this.pathEntries) {\n      const methodMap: Record<string, PathSpec> = {};\n      for (const [method, spec] of methods) {\n        methodMap[method] = spec;\n      }\n      paths[path] = methodMap;\n    }\n\n    return {\n      openapi: '3.0.3',\n      info,\n      paths,\n      components: { schemas },\n    };\n  }\n\n  /**\n   * Test helper — clears registered schemas and paths, then re-seeds the\n   * core `ErrorResponseDto` entry so post-reset state matches the\n   * invariant established in the constructor.\n   */\n  reset(): void {\n    this.zodSchemas.clear();\n    this.pathEntries.clear();\n    this.peer = null;\n    this.zodSchemas.set(ERROR_RESPONSE_SCHEMA_NAME, errorResponseSchema);\n  }\n\n  protected async loadPeer(): Promise<PeerModule> {\n    if (this.peer) return this.peer;\n    try {\n      // Computed specifier: prevents tsc from resolving this import at\n      // typecheck time. Consumers vendor this file but may not install\n      // @anatine/zod-openapi (optional peer).\n      const specifier: string = '@anatine/zod-openapi';\n      const mod = (await import(specifier)) as PeerModule;\n      this.peer = mod;\n      return mod;\n    } catch {\n      throw new OpenApiPeerDepMissingError();\n    }\n  }\n}\n"],"mappings":";AAYA,SAAS,SAAS;AAEX,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAKM,IAAM,6BAA6B;;;ACVnC,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAClC,OAAO;AAAA,EACzB,YAAY,SAAkB;AAC5B;AAAA,MACE,WACE;AAAA,IACJ;AAAA,EACF;AACF;AASO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAE9C,YAA4B,YAAoB;AAC9C;AAAA,MACE,iCAAiC,UAAU;AAAA,IAE7C;AAJ0B;AAAA,EAK5B;AAAA,EAL4B;AAAA,EADV,OAAO;AAO3B;;;ACyBO,IAAM,kBAAN,MAAsB;AAAA,EACnB,aAAa,oBAAI,IAAuB;AAAA,EACxC,cAAc,oBAAI,IAAuC;AAAA,EACzD,OAA0B;AAAA,EAElC,cAAc;AAIZ,SAAK,WAAW,IAAI,4BAA4B,mBAAmB;AAAA,EACrE;AAAA,EAEA,eAAe,MAAc,QAAyB;AACpD,QAAI,KAAK,WAAW,IAAI,IAAI,GAAG;AAC7B,YAAM,IAAI,qBAAqB,IAAI;AAAA,IACrC;AACA,SAAK,WAAW,IAAI,MAAM,MAAM;AAAA,EAClC;AAAA,EAEA,aAAa,MAAc,QAAoB,MAAsB;AACnE,QAAI,UAAU,KAAK,YAAY,IAAI,IAAI;AACvC,QAAI,CAAC,SAAS;AACZ,gBAAU,oBAAI,IAAI;AAClB,WAAK,YAAY,IAAI,MAAM,OAAO;AAAA,IACpC;AACA,YAAQ,IAAI,QAAQ,IAAI;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,MAAM,MAA2C;AACrD,UAAM,OAAO,MAAM,KAAK,SAAS;AAEjC,UAAM,UAAmC,CAAC;AAC1C,eAAW,CAAC,MAAM,SAAS,KAAK,KAAK,YAAY;AAC/C,cAAQ,IAAI,IAAI,KAAK,eAAe,WAAW,OAAO,KAAK;AAAA,IAC7D;AAEA,UAAM,QAAkD,CAAC;AACzD,eAAW,CAAC,MAAM,OAAO,KAAK,KAAK,aAAa;AAC9C,YAAM,YAAsC,CAAC;AAC7C,iBAAW,CAAC,QAAQ,IAAI,KAAK,SAAS;AACpC,kBAAU,MAAM,IAAI;AAAA,MACtB;AACA,YAAM,IAAI,IAAI;AAAA,IAChB;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,YAAY,EAAE,QAAQ;AAAA,IACxB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAc;AACZ,SAAK,WAAW,MAAM;AACtB,SAAK,YAAY,MAAM;AACvB,SAAK,OAAO;AACZ,SAAK,WAAW,IAAI,4BAA4B,mBAAmB;AAAA,EACrE;AAAA,EAEA,MAAgB,WAAgC;AAC9C,QAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,QAAI;AAIF,YAAM,YAAoB;AAC1B,YAAM,MAAO,MAAM,OAAO;AAC1B,WAAK,OAAO;AACZ,aAAO;AAAA,IACT,QAAQ;AACN,YAAM,IAAI,2BAA2B;AAAA,IACvC;AAAA,EACF;AACF;","names":[]}

package/dist/runtime/shared/openapi/registry.tokens.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Injection token for the OpenAPI registry (OPENAPI-1).
+ *
+ * String constant (not a Symbol) so it matches by value across import
+ * boundaries — same convention as `ANALYTICS_QUERY` in analytics and
+ * `EVENT_BUS` / `BRIDGE_DELIVERY_REPO` in events / bridge. The OPENAPI-1
+ * spec sketched a Symbol, but the repo-wide convention wins — codebase
+ * consistency matters more than the spec's initial guess.
+ *
+ * Consumed by generated DTO providers (OPENAPI-2), controllers
+ * (OPENAPI-3), and the Swagger bootstrap (OPENAPI-4).
+ */
+declare const OPENAPI_REGISTRY: "OPENAPI_REGISTRY";
+
+export { OPENAPI_REGISTRY };

package/dist/runtime/shared/openapi/registry.tokens.js

@@ -0,0 +1,6 @@
+// runtime/shared/openapi/registry.tokens.ts
+var OPENAPI_REGISTRY = "OPENAPI_REGISTRY";
+export {
+  OPENAPI_REGISTRY
+};
+//# sourceMappingURL=registry.tokens.js.map

package/dist/runtime/shared/openapi/registry.tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../runtime/shared/openapi/registry.tokens.ts"],"sourcesContent":["/**\n * Injection token for the OpenAPI registry (OPENAPI-1).\n *\n * String constant (not a Symbol) so it matches by value across import\n * boundaries — same convention as `ANALYTICS_QUERY` in analytics and\n * `EVENT_BUS` / `BRIDGE_DELIVERY_REPO` in events / bridge. The OPENAPI-1\n * spec sketched a Symbol, but the repo-wide convention wins — codebase\n * consistency matters more than the spec's initial guess.\n *\n * Consumed by generated DTO providers (OPENAPI-2), controllers\n * (OPENAPI-3), and the Swagger bootstrap (OPENAPI-4).\n */\nexport const OPENAPI_REGISTRY = 'OPENAPI_REGISTRY' as const;\n"],"mappings":";AAYO,IAAM,mBAAmB;","names":[]}

package/dist/runtime/subsystems/sync/sync-audit.schema.d.ts

@@ -357,7 +357,7 @@ declare const syncRuns: drizzle_orm_pg_core.PgTableWithColumns<{
             tableName: "sync_runs";
             dataType: "string";
             columnType: "PgEnumColumn";
-            data: "success" | "no_changes" | "failed" | "running";
+            data: "success" | "failed" | "no_changes" | "running";
             driverParam: string;
             notNull: true;
             hasDefault: true;
@@ -639,7 +639,7 @@ declare const syncRunItems: drizzle_orm_pg_core.PgTableWithColumns<{
             tableName: "sync_run_items";
             dataType: "string";
             columnType: "PgEnumColumn";
-            data: "created" | "updated" | "deleted" | "noop";
+            data: "noop" | "created" | "updated" | "deleted";
             driverParam: string;
             notNull: true;
             hasDefault: false;