@pylonts/dsl 1.1.16 → 1.1.17

package/dist/convert.d.ts

@@ -1,12 +1,11 @@
 import type { CollectionSchemaBase, SchemaBase } from './dsl.js';
 import type { DtoMessage } from './dto.js';
-import type { TableSchema } from './db.js';
 import type { EntitySchema } from './entity.js';
 import type { FrontAppSchema, ProjectApiSchema } from './project.js';
-/** A source/target collection of a convert — dto, entity or table. Entity
- *  sources may carry aggregate fields (aggField), e.g. an aggregate result
- *  entity projected into a wire message. */
-export type ConvertSourceSchema = DtoMessage | TableSchema | EntitySchema;
+/** A source/target collection of a convert — dto or entity. Entity sources
+ *  may carry aggregate fields (aggField), e.g. an aggregate result entity
+ *  projected into a wire message. */
+export type ConvertSourceSchema = DtoMessage | EntitySchema;
 /** Method input for defineConvert: type/schema/name are set by the builder. */
 export type ConvertMethodDef = Omit<ConvertMethodSchema, 'type' | 'schema' | 'name'>;
 /** One conversion: multiple source collections → single target collection. */

package/dist/dto.d.ts

@@ -2,6 +2,7 @@ import { BaseField, CollectionSchemaBase, Field, Operator, SchemaBase } from './
 import { TableSchema } from './db.js';
 import type { EntitySchema } from './entity.js';
 import type { ImportBase } from './import-base.js';
+import type { TokenSchema } from './token.js';
 /** Re-export — Operator lives on the DSL level (see dsl.ts). */
 export type { Operator } from './dsl.js';
 /** Re-export — ImportBase lives on its own module (see import-base.ts). */
@@ -49,6 +50,10 @@ export declare class DtoField implements SchemaBase {
     default?: unknown;
     /** Optional reference to another DtoField — this field reuses the referenced field's type/constraints */
     ref?: DtoField;
+    /** Server-injection marker: this field is filled from the token at runtime
+     *  (client never sends it). Set by fromToken(); the driver renders it as an
+     *  Optional field inside a __inject base of the DTO. */
+    injectFrom?: TokenSchema;
     constructor(field: Field | DtoArrayFieldDef | DtoObjectFieldDef);
     setPattern(value: string): this;
     setDescription(value: string): this;
@@ -116,3 +121,11 @@ export type DtoFieldSource = TableSchema | DtoMessage | EntitySchema;
  *  entity) and wrap them as DTO fields (aligned with dto.from). Shared Field
  *  instances keep their original identity — the projection references them. */
 export declare function from(source: DtoFieldSource, fields: (Field | DtoArrayFieldDef | DtoObjectFieldDef)[]): Record<string, DtoField>;
+/** Project fields from a TokenSchema (security/identity segments) as
+ *  server-injected DTO fields. Unlike from(), the projection does NOT share
+ *  the token's DtoField instance — each field is a NEW DtoField wrapping the
+ *  same underlying Field, referencing the token field via setRef() so the DTO
+ *  write-back (buildMessage) never mutates the token's own fields. Every
+ *  produced field is marked injectFrom (rendered inside a __inject base:
+ *  Optional in the wire schema, filled from the token at runtime). */
+export declare function fromToken(token: TokenSchema, fields: DtoField[]): Record<string, DtoField>;

package/dist/dto.js

@@ -16,6 +16,10 @@ export class DtoField {
     default;
     /** Optional reference to another DtoField — this field reuses the referenced field's type/constraints */
     ref;
+    /** Server-injection marker: this field is filled from the token at runtime
+     *  (client never sends it). Set by fromToken(); the driver renders it as an
+     *  Optional field inside a __inject base of the DTO. */
+    injectFrom;
     constructor(field) {
         this.name = '';
         this.field = field;
@@ -251,3 +255,27 @@ export function from(source, fields) {
     }
     return out;
 }
+function ownsTokenField(token, field) {
+    return (Object.values(token.security).some((df) => df === field) ||
+        Object.values(token.identity).some((df) => df === field));
+}
+/** Project fields from a TokenSchema (security/identity segments) as
+ *  server-injected DTO fields. Unlike from(), the projection does NOT share
+ *  the token's DtoField instance — each field is a NEW DtoField wrapping the
+ *  same underlying Field, referencing the token field via setRef() so the DTO
+ *  write-back (buildMessage) never mutates the token's own fields. Every
+ *  produced field is marked injectFrom (rendered inside a __inject base:
+ *  Optional in the wire schema, filled from the token at runtime). */
+export function fromToken(token, fields) {
+    const out = {};
+    for (const field of fields) {
+        if (!ownsTokenField(token, field)) {
+            throw new Error(`dto.fromToken(${token.name}): field ${field.name} does not belong to this token`);
+        }
+        const df = dtoField(field.field);
+        df.setRef(field);
+        df.injectFrom = token;
+        out[field.name] = df;
+    }
+    return out;
+}

package/dist/index.d.ts

@@ -31,6 +31,7 @@ export * from './aggregate.js';
 export * from './repository.js';
 export * from './domain-event.js';
 export * from './third-service.js';
+export * from './token.js';
 export * from './field-rule.js';
 export * from './exception.js';
 export * from './page.js';

package/dist/index.js

@@ -31,6 +31,7 @@ export * from './aggregate.js';
 export * from './repository.js';
 export * from './domain-event.js';
 export * from './third-service.js';
+export * from './token.js';
 export * from './field-rule.js';
 export * from './exception.js';
 export * from './page.js';

package/dist/mysql-driver.js

@@ -45,9 +45,9 @@ function columnType(field) {
 function renderDefault(field) {
     if (field.default === undefined)
         return '';
-    // MySQL keyword expressions (CURRENT_TIMESTAMP, CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-    // NULL, etc.) — render bare, no quotes.
-    if (/^[A-Z]/.test(field.default))
+    // MySQL keyword expressions (CURRENT_TIMESTAMP / CURRENT_TIMESTAMP ON UPDATE
+    // CURRENT_TIMESTAMP) render bare; any other value is a literal and gets quoted.
+    if (field.default.startsWith(CURRENT_TIMESTAMP))
         return ` DEFAULT ${field.default}`;
     // Numeric columns take a bare literal, not a quoted one.
     if (field.type === 'integer' || field.type === 'bigint' || field.type === 'decimal' || field.type === 'rate' || field.type === 'boolean') {

package/dist/service.js

@@ -1,5 +1,8 @@
 import { exceptionEndNames } from './flow.js';
 export function defineService(options) {
+    if (!/(Service|Handler)$/.test(options.name)) {
+        throw new Error(`service ${options.name}: name must end with 'Service' (or 'Handler' for handler-style services)`);
+    }
     if (options.app && !options.api.apps.includes(options.app)) {
         throw new Error(`service ${options.name}: api '${options.api.name}' does not serve app '${options.app.name}'`);
     }

package/dist/third-service.d.ts

@@ -1,17 +1,30 @@
 import type { SchemaBase } from './dsl.js';
 import type { DtoMessage } from './dto.js';
 import type { ExceptionSchema } from './exception.js';
-import type { ThirdApiSchema } from './project.js';
+import type { ProjectApiSchema, ThirdApiSchema } from './project.js';
 /** A third-party integration service (e.g. tenpay wechat pay).
  *  Distinct from ServiceSchema (backend service bound to an app) and
  *  ThirdApiSchema (project topology: the dir the integration lives in).
- *  Describes the adapter class contract: constructor config + methods. */
+ *  Describes the adapter class contract: constructor config + methods.
+ *  `callbacks` are the inbound half — push messages the third party sends to
+ *  this platform (e.g. audit-result notify), rendered as @Public controllers. */
+/** Wire data format of the third-party gateway. 'form' (urlencoded) and
+ *  'json' are built-in in @pylonts/sandbox; any other string is a custom
+ *  format the sandbox encoder parses itself. The client and the sandbox are
+ *  mirror images of one protocol — the format declared here is the single
+ *  source both generated sides read. */
+export type ThirdServiceFormat = 'form' | 'json' | string;
 export interface ThirdServiceSchema extends SchemaBase {
     type: 'thirdService';
     /** The third-party system this service integrates (topology reference). */
     schema: ThirdApiSchema;
+    /** Wire data format of the gateway (see ThirdServiceFormat). Default 'json'. */
+    format?: ThirdServiceFormat;
     /** Methods keyed by name — the map key is written back as the method name. */
     methods: Record<string, ThirdServiceMethodSchema>;
+    /** Callbacks (third-party push → platform) keyed by name. Empty when the
+     *  integration is outbound-only. */
+    callbacks: Record<string, ThirdCallbackSchema>;
 }
 /** A method of a third-party integration service. Same contract shape as
  *  ServiceMethodSchema minus flow — the implementation lives in the external
@@ -20,6 +33,11 @@ export interface ThirdServiceSchema extends SchemaBase {
 export interface ThirdServiceMethodSchema extends SchemaBase {
     type: 'method';
     schema: ThirdServiceSchema;
+    /** Wire service name sent to the third-party gateway. Defaults to the method
+     *  key — declare explicitly when the wire value differs (e.g. camelCase key
+     *  vs snake_case wire: uploadImage → 'pic_upload'). Both the client and the
+     *  sandbox read this field, so the mirror pair stays in sync. */
+    service?: string;
     /** Input message. */
     args: DtoMessage;
     /** Output message. */
@@ -29,9 +47,47 @@ export interface ThirdServiceMethodSchema extends SchemaBase {
 }
 /** Method input for defineThirdService: name/schema are set by the builder. */
 export type ThirdServiceMethodDef = Omit<ThirdServiceMethodSchema, 'type' | 'schema' | 'name'>;
+/** An inbound callback of a third-party service. The third party pushes a
+ *  payload (e.g. audit-result notify) to a platform endpoint; the platform
+ *  verifies the third party's own signature/decrypts (hand-written in the
+ *  generated controller body) and answers with `response`.
+ *  `api` selects the backend the endpoint is generated into:
+ *  {api}/src/modules/{thirdApi.name}/controller/ — the only module location
+ *  whitelisted for @Public (lint controller), because a third party never
+ *  holds an appKey. */
+export interface ThirdCallbackSchema extends SchemaBase {
+    type: 'thirdCallback';
+    schema: ThirdServiceSchema;
+    /** Backend API the callback controller is generated into. */
+    api: ProjectApiSchema;
+    /** The third-party push service name (e.g. 'apply_notify', 'alter_notify'). */
+    service: string;
+    /** Push message (third party → platform). */
+    payload: DtoMessage;
+    /** Platform answer message (platform → third party). */
+    response: DtoMessage;
+}
+/** Callback input for defineThirdService: name/schema are set by the builder. */
+export type ThirdCallbackDef = Omit<ThirdCallbackSchema, 'type' | 'schema' | 'name'>;
+/** Builds one callback entry for `defineThirdService({ callbacks })`. The
+ *  callback name (map key in the callbacks object) becomes the controller
+ *  method name; everything else is declared here. */
+export declare function defineThirdCallback(options: {
+    /** Backend API the callback controller is generated into. */
+    api: ProjectApiSchema;
+    /** The third-party push service name (e.g. 'apply_notify', 'alter_notify'). */
+    service: string;
+    /** Push message (third party → platform). */
+    payload: DtoMessage;
+    /** Platform answer message (platform → third party). */
+    response: DtoMessage;
+    description?: string;
+}): ThirdCallbackDef;
 export declare function defineThirdService(options: {
     schema: ThirdApiSchema;
     name: string;
+    format?: ThirdServiceFormat;
     methods: Record<string, ThirdServiceMethodDef>;
+    callbacks?: Record<string, ThirdCallbackDef>;
     description?: string;
 }): ThirdServiceSchema;

package/dist/third-service.js

@@ -1,10 +1,24 @@
+/** Builds one callback entry for `defineThirdService({ callbacks })`. The
+ *  callback name (map key in the callbacks object) becomes the controller
+ *  method name; everything else is declared here. */
+export function defineThirdCallback(options) {
+    return {
+        description: options.description,
+        api: options.api,
+        service: options.service,
+        payload: options.payload,
+        response: options.response,
+    };
+}
 export function defineThirdService(options) {
     const schema = {
         type: 'thirdService',
         name: options.name,
         description: options.description,
         schema: options.schema,
+        format: options.format,
         methods: {},
+        callbacks: {},
     };
     for (const key of Object.keys(options.methods)) {
         const method = options.methods[key];
@@ -13,10 +27,24 @@ export function defineThirdService(options) {
             name: key,
             description: method.description,
             schema,
+            service: method.service,
             args: method.args,
             results: method.results,
             throws: method.throws,
         };
     }
+    for (const key of Object.keys(options.callbacks ?? {})) {
+        const callback = options.callbacks[key];
+        schema.callbacks[key] = {
+            type: 'thirdCallback',
+            name: key,
+            description: callback.description,
+            schema,
+            api: callback.api,
+            service: callback.service,
+            payload: callback.payload,
+            response: callback.response,
+        };
+    }
     return schema;
 }

package/dist/token.d.ts

@@ -0,0 +1,39 @@
+import type { CollectionSchemaBase } from './dsl.js';
+import type { DtoField } from './dto.js';
+import type { FrontAppSchema, ProjectApiSchema } from './project.js';
+/** Session-credential columns the identity table must carry (hard constraint,
+ *  decision #13): the token system writes token + refresh_token + login_at to
+ *  the account table at login/refresh time. A table missing them cannot host
+ *  an identity. */
+export declare const TOKEN_CREDENTIAL_COLUMNS: readonly ['token', 'refresh_token', 'login_at'];
+/** Built-in security-section field names: secret (signing, required) and
+ *  cipher (channel encryption, optional). Generated at get-token time and
+ *  stored in the Redis object — never backed by a table. */
+export declare const TOKEN_SECURITY_FIELDS: readonly ['secret', 'cipher'];
+export interface TokenSchema extends CollectionSchemaBase {
+    type: 'token';
+    /** The backend api module this token belongs to (shared instance from
+     *  project.config.ts apis). Tokens are always backend-side. */
+    api: ProjectApiSchema;
+    /** The frontend app this token belongs to (shared instance from
+     *  project.config). Required — an identity always belongs to one module. */
+    app: FrontAppSchema;
+    /** Security materials (present from get-token on): built-in secret
+     *  (required, signing) + cipher (optional, channel encryption). Not backed
+     *  by any table. */
+    security: Record<string, DtoField>;
+    /** Identity data (attached at login): fields projected from table columns
+     *  via from(table, ...). Every source table must carry the session
+     *  credential columns (TOKEN_CREDENTIAL_COLUMNS). */
+    identity: Record<string, DtoField>;
+}
+export declare function defineToken(options: {
+    name: string;
+    api: ProjectApiSchema;
+    app: FrontAppSchema;
+    identity: Record<string, DtoField>;
+    description?: string;
+}): TokenSchema;
+/** Structural check — TokenSchema instances may come from a different module
+ *  copy, so instanceof is unreliable. */
+export declare function isTokenSchema(v: unknown): v is TokenSchema;

package/dist/token.js

@@ -0,0 +1,96 @@
+import { stringField } from './dsl.js';
+import { dtoField } from './dto.js';
+// Token = the server-side user identity object (login principal), a two-state
+// object: `security` (built-in secret/cipher, present from get-token on) +
+// `identity` (projected from table columns, attached at login). The client
+// holds a pure random hash token referencing this object — never the object
+// itself. Storage: token_schema/{api.name}/{app.name}/token/{name}.token.ts
+// (one token per file), same layout as service_schema / dao_schema.
+/** Session-credential columns the identity table must carry (hard constraint,
+ *  decision #13): the token system writes token + refresh_token + login_at to
+ *  the account table at login/refresh time. A table missing them cannot host
+ *  an identity. */
+export const TOKEN_CREDENTIAL_COLUMNS = ['token', 'refresh_token', 'login_at'];
+/** Built-in security-section field names: secret (signing, required) and
+ *  cipher (channel encryption, optional). Generated at get-token time and
+ *  stored in the Redis object — never backed by a table. */
+export const TOKEN_SECURITY_FIELDS = ['secret', 'cipher'];
+/** Built-in security section: secret (required) + cipher (optional). */
+function builtInSecurity() {
+    return {
+        secret: dtoField(stringField({ minLength: 32, maxLength: 64, optional: false, label: '签名密钥' })),
+        cipher: dtoField(stringField({ optional: true, label: '加密密钥' })),
+    };
+}
+function validateIdentityFields(tokenName, identity) {
+    const sourceTables = new Set();
+    for (const [key, f] of Object.entries(identity)) {
+        const source = f.field.schema;
+        if (source?.type !== 'table') {
+            throw new Error(`token ${tokenName}: identity field '${key}' must be projected from a table column (from(table, ...)), got a non-column field`);
+        }
+        if (TOKEN_SECURITY_FIELDS.includes(key)) {
+            throw new Error(`token ${tokenName}: identity field '${key}' collides with the built-in security field of the same name`);
+        }
+        sourceTables.add(source);
+    }
+    // Hard constraint (decision #13): every identity source table must carry
+    // the session credential columns — the token system writes them at
+    // login/refresh time, a table without them breaks the whole system.
+    for (const table of sourceTables) {
+        for (const col of TOKEN_CREDENTIAL_COLUMNS) {
+            if (table.columns[col] === undefined) {
+                throw new Error(`token ${tokenName}: identity table '${table.name}' must contain column '${col}' (hard constraint — the token system writes session credentials to the account table)`);
+            }
+        }
+        // Identity anchor (decision): every identity source table's primary key
+        // must be fully projected into identity — a partial key cannot uniquely
+        // locate the row (composite keys project every member).
+        const pkFields = table.primaryKey === undefined
+            ? []
+            : Array.isArray(table.primaryKey)
+                ? table.primaryKey
+                : [table.primaryKey];
+        for (const pk of pkFields) {
+            const projected = Object.values(identity).some((f) => f.field === pk);
+            if (!projected) {
+                throw new Error(`token ${tokenName}: identity must include the primary key column '${pk.name}' of table '${table.name}' (identity anchor — the user id is required)`);
+            }
+        }
+    }
+}
+/** Write back the DTO field name from the map key (same convention as
+ *  buildMessage — TokenSchema is a field container, consumers rely on
+ *  field.name). */
+function writeBackNames(segments) {
+    for (const segment of segments) {
+        for (const [key, df] of Object.entries(segment))
+            df.name = key;
+    }
+}
+export function defineToken(options) {
+    const { name, api, app, identity, description } = options;
+    if (!api.apps.includes(app)) {
+        throw new Error(`token ${name}: api '${api.name}' does not serve app '${app.name}'`);
+    }
+    validateIdentityFields(name, identity);
+    const security = builtInSecurity();
+    writeBackNames([security, identity]);
+    return {
+        type: 'token',
+        name,
+        description,
+        api,
+        app,
+        security,
+        identity,
+    };
+}
+/** Structural check — TokenSchema instances may come from a different module
+ *  copy, so instanceof is unreliable. */
+export function isTokenSchema(v) {
+    if (typeof v !== 'object' || v === null)
+        return false;
+    const vv = v;
+    return vv.type === 'token' && typeof vv.name === 'string';
+}

package/dist/typebox-driver.d.ts

@@ -1,4 +1,5 @@
 import { DtoMessage, ImportBase } from './dto.js';
+import type { TokenSchema } from './token.js';
 export type EnumResolver = (enumName: string) => ImportBase | undefined;
 /** Collect all imports needed to render a DTO: include() bases + enum references. */
 export declare function collectDtoImports(schema: DtoMessage, resolver: EnumResolver | undefined, out: Map<string, ImportBase>): void;
@@ -6,6 +7,18 @@ export declare function collectDtoImports(schema: DtoMessage, resolver: EnumReso
 export declare function renderDtoExport(schema: DtoMessage, resolver: EnumResolver | undefined): string;
 /** Render the Static type export for a DTO. */
 export declare function renderDtoTypeExport(name: string): string;
+/** Render one token export: a flat TypeBox object. Security fields keep
+ *  their declared optionality (secret required, cipher optional); identity
+ *  fields are Optional except the primary-key anchor — they only exist after
+ *  login (two-state object, flat runtime shape), while the PK is guaranteed
+ *  to be projected (token validation enforces it) and serves as the identity
+ *  anchor (e.g. the tenant key for tenant-scoped controllers). */
+export declare function renderTokenExport(token: TokenSchema, resolver: EnumResolver | undefined): string;
+/** Render the Static type export for a token. */
+export declare function renderTokenTypeExport(name: string): string;
+/** Collect all imports needed to render a token: enum references across
+ *  security + identity fields. */
+export declare function collectTokenImports(token: TokenSchema, resolver: EnumResolver | undefined, out: Map<string, ImportBase>): void;
 export declare function renderDtoMessage(schema: DtoMessage, options?: {
     resolver?: EnumResolver;
     source?: string;

package/dist/typebox-driver.js

@@ -16,6 +16,20 @@ function fieldDescription(field) {
 function dtoFieldDescription(f) {
     return f.description ?? fieldDescription(f.field);
 }
+/** Resolve a ref chain to its terminal field (the one without .ref).
+ *  Cycles are a DSL definition error — fail loudly at render time. */
+function resolveRefChain(f) {
+    const seen = new Set();
+    let cur = f;
+    while (cur.ref !== undefined) {
+        if (seen.has(cur.ref)) {
+            throw new Error(`dto field ${cur.name}: circular ref chain (field references itself)`);
+        }
+        seen.add(cur.ref);
+        cur = cur.ref;
+    }
+    return cur;
+}
 function renderBasic(field, pattern, defaultValue, resolver, indent = 0, description) {
     if (pattern !== undefined && field.type !== 'string') {
         throw new Error(`pattern is only supported on string fields, got ${field.type} (${field.name})`);
@@ -152,10 +166,35 @@ function renderObject(fields, indent, resolver, description) {
         : obj;
 }
 function renderField(f, indent, resolver) {
+    // Ref branch renders its own optional (referencing overrides + chain fallback).
+    if (f.ref !== undefined)
+        return renderValue(f, indent, resolver);
     const base = renderValue(f, indent, resolver);
     return f.isOptional() ? `Type.Optional(${base})` : base;
 }
+/** Render a ref-carrying field's bare type (no optional wrapper): resolve the
+ *  chain, inherit the terminal field's type/constraints, keep the referencing
+ *  field's own overrides (pattern / default / description). */
+function renderRefBase(f, indent, resolver) {
+    const target = resolveRefChain(f);
+    const targetField = target.field;
+    const pattern = f.pattern ?? target.pattern;
+    const defaultValue = f.default ?? target.default;
+    const desc = f.description ?? dtoFieldDescription(target);
+    return renderBasic(targetField, pattern, defaultValue, resolver, indent, desc);
+}
+/** Render a ref-carrying field with its optional wrapper: referencing
+ *  override first, then the chain's DtoField-level optional, then the bare
+ *  column optionality. */
+function renderRefField(f, indent, resolver) {
+    const target = resolveRefChain(f);
+    const optional = f.optional ?? target.optional ?? target.field.optional ?? false;
+    const base = renderRefBase(f, indent, resolver);
+    return optional ? `Type.Optional(${base})` : base;
+}
 function renderValue(f, indent, resolver) {
+    if (f.ref !== undefined)
+        return renderRefField(f, indent, resolver);
     if (f.field.type === 'array') {
         const items = f.field.items;
         const desc = dtoFieldDescription(f);
@@ -185,6 +224,10 @@ function renderValue(f, indent, resolver) {
     return renderBasic(f.field, f.pattern, f.default, resolver, indent, dtoFieldDescription(f));
 }
 function collectEnumImports(f, resolver, out) {
+    if (f.ref !== undefined) {
+        collectEnumImports(resolveRefChain(f), resolver, out);
+        return;
+    }
     if (f.field.type === 'array') {
         const items = f.field.items;
         if (isDtoMessage(items))
@@ -227,19 +270,91 @@ export function collectDtoImports(schema, resolver, out) {
     for (const f of Object.values(schema.fields))
         collectEnumImports(f, resolver, out);
 }
+/** Render the server-injection base: token-injected fields as Optional
+ *  properties of a TypeBox object, plus a non-enumerable __inject adapter
+ *  (same mechanism as hand-written bases, see pylon __inject docs) that fills
+ *  each field from the token at runtime. */
+function renderInjectBase(fields, resolver) {
+    const entries = Object.entries(fields).map(([name, f]) => {
+        const base = f.ref !== undefined ? renderRefBase(f, 1, resolver) : renderValue(f, 1, resolver);
+        return `  ${name}: Type.Optional(${base})`;
+    });
+    const inner = `Type.Object({\n${entries.join(',\n')}\n})`;
+    const assigns = Object.keys(fields)
+        .map((k) => `body.${k} = token.${k};`)
+        .join(' ');
+    return [
+        `Object.defineProperty(`,
+        `  ${inner},`,
+        `  '__inject',`,
+        `  { value: (body: Record<string, unknown>, token: Record<string, unknown>): void => { ${assigns} }, enumerable: false },`,
+        `)`,
+    ].join('\n');
+}
 /** Render one DTO export (const + type) — no file header, for file-level generation. */
 export function renderDtoExport(schema, resolver) {
-    const object = renderObject(schema.fields, 1, resolver, schema.description);
-    const bases = schema.bases ?? [];
-    const body = bases.length > 0
-        ? `Type.Intersect([${bases.map(renderBase).join(', ')}, ${object}])`
-        : object;
+    const injectFields = {};
+    const normalFields = {};
+    for (const [key, f] of Object.entries(schema.fields)) {
+        if (f.injectFrom !== undefined)
+            injectFields[key] = f;
+        else
+            normalFields[key] = f;
+    }
+    const parts = [];
+    if (Object.keys(injectFields).length > 0)
+        parts.push(renderInjectBase(injectFields, resolver));
+    parts.push(renderObject(normalFields, 1, resolver, schema.description));
+    for (const base of schema.bases ?? [])
+        parts.push(renderBase(base));
+    const body = parts.length > 1 ? `Type.Intersect([${parts.join(', ')}])` : parts[0];
     return `export const ${schema.name} = ${body};`;
 }
 /** Render the Static type export for a DTO. */
 export function renderDtoTypeExport(name) {
     return `export type ${name} = Static<typeof ${name}>;`;
 }
+/** Render one token export: a flat TypeBox object. Security fields keep
+ *  their declared optionality (secret required, cipher optional); identity
+ *  fields are Optional except the primary-key anchor — they only exist after
+ *  login (two-state object, flat runtime shape), while the PK is guaranteed
+ *  to be projected (token validation enforces it) and serves as the identity
+ *  anchor (e.g. the tenant key for tenant-scoped controllers). */
+export function renderTokenExport(token, resolver) {
+    const constName = `${token.name}Token`;
+    const entries = [
+        ...Object.entries(token.security).map(([name, f]) => `  ${name}: ${renderField(f, 1, resolver)}`),
+        ...Object.entries(token.identity).map(([name, f]) => isPrimaryKeyProjection(f) ? `  ${name}: ${renderValue(f, 1, resolver)}` : `  ${name}: Type.Optional(${renderValue(f, 1, resolver)})`),
+    ];
+    const desc = token.description !== undefined ? `, { description: ${renderString(token.description)} }` : '';
+    return `export const ${constName} = Type.Object({\n${entries.join(',\n')}\n}${desc});`;
+}
+/** True when the DTO field projects a primary-key column of its source table. */
+function isPrimaryKeyProjection(f) {
+    const tbl = f.field.schema;
+    if (tbl?.type !== 'table')
+        return false;
+    // A table-backed field is always a plain Field (only Field carries a table
+    // schema); array/object DTO fields reference messages, not tables.
+    const field = f.field;
+    const table = tbl;
+    const pk = table.primaryKey;
+    if (!pk)
+        return false;
+    const pks = Array.isArray(pk) ? pk : [pk];
+    return pks.includes(field);
+}
+/** Render the Static type export for a token. */
+export function renderTokenTypeExport(name) {
+    return `export type ${name}Token = Static<typeof ${name}Token>;`;
+}
+/** Collect all imports needed to render a token: enum references across
+ *  security + identity fields. */
+export function collectTokenImports(token, resolver, out) {
+    for (const f of [...Object.values(token.security), ...Object.values(token.identity)]) {
+        collectEnumImports(f, resolver, out);
+    }
+}
 export function renderDtoMessage(schema, options = {}) {
     const { resolver, source } = options;
     const imports = new Map();