@things-factory/shell 10.1.29 → 10.1.31

package/client/themes/dark.css

@@ -1,5 +1,6 @@
 /*
- * Accent-derived slots read `--brand-<slot>` so a product can set them from its own brand.css.
+ * Accent-derived slots read `--brand-<slot>` so a product can set them from its own accent theme
+ * file, named after the product (`plant-accent.css`) - never after a shell theme file.
  * Neutral slots read `--suite-<slot>`, set by the product suite (@things-factory/operato-suite) for the
  * apps that depend on it. Bundle order does not matter for a var(); the fallback is the shell value.
  * Error, shadow and scrim stay literal on purpose - nobody above the platform owns them.

package/client/themes/light.css

@@ -1,5 +1,6 @@
 /*
- * Accent-derived slots read `--brand-<slot>` so a product can set them from its own brand.css.
+ * Accent-derived slots read `--brand-<slot>` so a product can set them from its own accent theme
+ * file, named after the product (`plant-accent.css`) - never after a shell theme file.
  * Neutral slots read `--suite-<slot>`, set by the product suite (@things-factory/operato-suite) for the
  * apps that depend on it. Bundle order does not matter for a var(); the fallback is the shell value.
  * Error, shadow and scrim stay literal on purpose - nobody above the platform owns them.

package/client/themes/theme-base.css

@@ -12,7 +12,7 @@
  *
  * [넣는 것]  브랜드와 무관하게 항상 성립해야 하는 규칙(테마 스킴, 공통 접근성 기본값 등)
  * [넣지 않는 것]  브랜드 색값.
- *   Products set accent colours only, as `--brand-<slot>` in their own `brand.css`. The shell
+ *   Products set accent colours only, as `--brand-<slot>` in their own `<product>-accent.css`. The shell
  *   `light.css` / `dark.css` read the 26 accent-derived md-sys slots from those variables, the 17
  *   neutral slots from `--suite-<slot>` (the product suite's shared greys), and keep the last 6
  *   (error, shadow, scrim) literal. See tests/md-sys-slot-owners.test.ts.

package/dist-server/index.d.ts

@@ -8,6 +8,7 @@ export * from './middlewares/index.js';
 export * from './bootstrap-hooks.js';
 export * from './graphql-local-client.js';
 export * from './service/index.js';
+export * from './refusal/index.js';
 export * from './typeorm/long-text-column.js';
 export * from './typeorm/encrypt-transform.js';
 export * from './typeorm/encrypt-json-transform.js';

package/dist-server/index.js

@@ -11,6 +11,7 @@ tslib_1.__exportStar(require("./middlewares/index.js"), exports);
 tslib_1.__exportStar(require("./bootstrap-hooks.js"), exports);
 tslib_1.__exportStar(require("./graphql-local-client.js"), exports);
 tslib_1.__exportStar(require("./service/index.js"), exports);
+tslib_1.__exportStar(require("./refusal/index.js"), exports);
 tslib_1.__exportStar(require("./typeorm/long-text-column.js"), exports);
 tslib_1.__exportStar(require("./typeorm/encrypt-transform.js"), exports);
 tslib_1.__exportStar(require("./typeorm/encrypt-json-transform.js"), exports);

package/dist-server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../server/index.ts"],"names":[],"mappings":";;;AAAA,gEAAqC;AACrC,4EAAiD;AACjD,qEAA0C;AAC1C,2DAAgC;AAChC,sDAA2B;AAC3B,oEAAyC;AACzC,iEAAsC;AACtC,+DAAoC;AACpC,oEAAyC;AACzC,6DAAkC;AAElC,wEAA6C;AAC7C,yEAA8C;AAC9C,8EAAmD;AACnD,uEAA4C;AAC5C,uEAA4C","sourcesContent":["export * from './migrations/index.js'\nexport * from './initializers/naming-strategy.js'\nexport * from './initializers/database.js'\nexport * from './utils/index.js'\nexport * from './pubsub.js'\nexport * from './pubsub-log-transport.js'\nexport * from './middlewares/index.js'\nexport * from './bootstrap-hooks.js'\nexport * from './graphql-local-client.js'\nexport * from './service/index.js'\n\nexport * from './typeorm/long-text-column.js'\nexport * from './typeorm/encrypt-transform.js'\nexport * from './typeorm/encrypt-json-transform.js'\nexport * from './typeorm/json5-transform.js'\nexport * from './typeorm/round-transform.js'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../server/index.ts"],"names":[],"mappings":";;;AAAA,gEAAqC;AACrC,4EAAiD;AACjD,qEAA0C;AAC1C,2DAAgC;AAChC,sDAA2B;AAC3B,oEAAyC;AACzC,iEAAsC;AACtC,+DAAoC;AACpC,oEAAyC;AACzC,6DAAkC;AAClC,6DAAkC;AAElC,wEAA6C;AAC7C,yEAA8C;AAC9C,8EAAmD;AACnD,uEAA4C;AAC5C,uEAA4C","sourcesContent":["export * from './migrations/index.js'\nexport * from './initializers/naming-strategy.js'\nexport * from './initializers/database.js'\nexport * from './utils/index.js'\nexport * from './pubsub.js'\nexport * from './pubsub-log-transport.js'\nexport * from './middlewares/index.js'\nexport * from './bootstrap-hooks.js'\nexport * from './graphql-local-client.js'\nexport * from './service/index.js'\nexport * from './refusal/index.js'\n\nexport * from './typeorm/long-text-column.js'\nexport * from './typeorm/encrypt-transform.js'\nexport * from './typeorm/encrypt-json-transform.js'\nexport * from './typeorm/json5-transform.js'\nexport * from './typeorm/round-transform.js'\n"]}

package/dist-server/refusal/index.d.ts

@@ -0,0 +1 @@
+export * from './refusal.js';

package/dist-server/refusal/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./refusal.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist-server/refusal/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/refusal/index.ts"],"names":[],"mappings":";;;AAAA,uDAA4B","sourcesContent":["export * from './refusal.js'\n"]}

package/dist-server/refusal/refusal.d.ts

@@ -0,0 +1,70 @@
+import { GraphQLError } from 'graphql';
+import type { MiddlewareFn } from 'type-graphql';
+/**
+ * **A refusal the server knows and names** (ADR-0054).
+ *
+ * ── Why a gate does not throw a sentence ──────────────────────────────────
+ * A gate that throws an English sentence puts English on a Korean screen. A screen that translates
+ * it is then writing the reason itself, and the gate and the screen end up with two accounts of the
+ * same refusal. So the gate throws a name and values, and the sentence is made where the request's
+ * language is known.
+ *
+ * ── What gets stored is the name ──────────────────────────────────────────
+ * Never write the sentence onto an event or a work row. A sentence differs per reader and the wording
+ * changes later; a stored one freezes that day's language. The `code` is the contract, and it travels
+ * unchanged to the client (ADR-0042 - no mapping table on the way out).
+ *
+ * ── Two traps ─────────────────────────────────────────────────────────────
+ * ① `t(key, undefined)` loses the locale and answers in English, so `params` is always passed - the
+ *    spread below makes an object even when a refusal carries none.
+ * ② Never pass a **value** to `t` as a key: `:` reads as a namespace separator and cuts `urn:epc:…`
+ *    apart. Values travel in `params` only.
+ *
+ * ── Why it lives in the shell ─────────────────────────────────────────────
+ * operato-plant wrote this first and operato-warehouse copied it; worklist is the third consumer as
+ * the work-door screens move there (ADR-0069 decision 3). Everything it needs is `graphql`,
+ * `type-graphql` and the request's `t`, all of which sit at or below the shell, so this is the floor
+ * that every consumer already stands on. The translations stay with each module: `refusalKey` names
+ * `error.<code>` inside the caller's own namespace, and a module that does not declare the key falls
+ * back to the English sentence rather than printing the key.
+ */
+export declare class Refusal extends Error {
+    readonly code: string;
+    readonly params: RefusalParams;
+    /**
+     * @param code this refusal's name (kebab). It states **the gate's fact**; a screen does not pick its
+     *   own sentence from this name.
+     * @param params the values the sentence is built from.
+     * @param english the sentence used when the translation key is missing. An English sentence reads
+     *   better than the key printed raw.
+     */
+    constructor(code: string, params: RefusalParams, english: string);
+}
+/** Values a refusal sentence is built from. Scalars only: they travel in the GraphQL response as they are. */
+export type RefusalParams = Record<string, string | number | boolean | null>;
+export declare function refusalKey(code: string): string;
+type Translate = (key: string, options?: Record<string, unknown>) => string;
+/**
+ * **The one place a refusal becomes a sentence.** The resolver wrapper and the worklist callbacks both
+ * call this, so the two exits cannot drift apart.
+ *
+ * Apollo's own `extensions.code` gets `BAD_USER_INPUT`: a refusal is not a server error, and left empty
+ * Apollo would fill in `INTERNAL_SERVER_ERROR`. The name rides separately in `extensions.refusal`; its
+ * presence is what tells a client the server refused on purpose.
+ */
+export declare function speakRefusal(refusal: Refusal, context: {
+    t?: Translate;
+}): GraphQLError;
+/** Rethrow a refusal as a sentence in the caller's language; anything else passes through untouched. */
+export declare function rethrowSpoken(error: unknown, context: {
+    t?: Translate;
+}): never;
+/** A resolver class passes through this (`@UseMiddleware(SpeakRefusals)`). */
+export declare const SpeakRefusals: MiddlewareFn<any>;
+/**
+ * An activity callback runs inside a worklist mutation, not the module's own resolver, so
+ * `SpeakRefusals` never sees what it throws. Declarations wrap their callback in this: the same
+ * `speakRefusal`, the other exit.
+ */
+export declare function speaksRefusals(callback: (instance: any, addendum: any, context: any) => Promise<void>): (instance: any, addendum: any, context: any) => Promise<void>;
+export {};

package/dist-server/refusal/refusal.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SpeakRefusals = exports.Refusal = void 0;
+exports.refusalKey = refusalKey;
+exports.speakRefusal = speakRefusal;
+exports.rethrowSpoken = rethrowSpoken;
+exports.speaksRefusals = speaksRefusals;
+const graphql_1 = require("graphql");
+/**
+ * **A refusal the server knows and names** (ADR-0054).
+ *
+ * ── Why a gate does not throw a sentence ──────────────────────────────────
+ * A gate that throws an English sentence puts English on a Korean screen. A screen that translates
+ * it is then writing the reason itself, and the gate and the screen end up with two accounts of the
+ * same refusal. So the gate throws a name and values, and the sentence is made where the request's
+ * language is known.
+ *
+ * ── What gets stored is the name ──────────────────────────────────────────
+ * Never write the sentence onto an event or a work row. A sentence differs per reader and the wording
+ * changes later; a stored one freezes that day's language. The `code` is the contract, and it travels
+ * unchanged to the client (ADR-0042 - no mapping table on the way out).
+ *
+ * ── Two traps ─────────────────────────────────────────────────────────────
+ * ① `t(key, undefined)` loses the locale and answers in English, so `params` is always passed - the
+ *    spread below makes an object even when a refusal carries none.
+ * ② Never pass a **value** to `t` as a key: `:` reads as a namespace separator and cuts `urn:epc:…`
+ *    apart. Values travel in `params` only.
+ *
+ * ── Why it lives in the shell ─────────────────────────────────────────────
+ * operato-plant wrote this first and operato-warehouse copied it; worklist is the third consumer as
+ * the work-door screens move there (ADR-0069 decision 3). Everything it needs is `graphql`,
+ * `type-graphql` and the request's `t`, all of which sit at or below the shell, so this is the floor
+ * that every consumer already stands on. The translations stay with each module: `refusalKey` names
+ * `error.<code>` inside the caller's own namespace, and a module that does not declare the key falls
+ * back to the English sentence rather than printing the key.
+ */
+class Refusal extends Error {
+    /**
+     * @param code this refusal's name (kebab). It states **the gate's fact**; a screen does not pick its
+     *   own sentence from this name.
+     * @param params the values the sentence is built from.
+     * @param english the sentence used when the translation key is missing. An English sentence reads
+     *   better than the key printed raw.
+     */
+    constructor(code, params, english) {
+        super(english);
+        this.name = 'Refusal';
+        this.code = code;
+        this.params = params;
+    }
+}
+exports.Refusal = Refusal;
+function refusalKey(code) {
+    return `error.${code}`;
+}
+/**
+ * **The one place a refusal becomes a sentence.** The resolver wrapper and the worklist callbacks both
+ * call this, so the two exits cannot drift apart.
+ *
+ * Apollo's own `extensions.code` gets `BAD_USER_INPUT`: a refusal is not a server error, and left empty
+ * Apollo would fill in `INTERNAL_SERVER_ERROR`. The name rides separately in `extensions.refusal`; its
+ * presence is what tells a client the server refused on purpose.
+ */
+function speakRefusal(refusal, context) {
+    const sentence = context.t
+        ? /* Always pass params - `undefined` here loses the locale and answers in English. */
+            context.t(refusalKey(refusal.code), { ...refusal.params, defaultValue: refusal.message })
+        : refusal.message;
+    return new graphql_1.GraphQLError(sentence, {
+        originalError: refusal,
+        extensions: { code: 'BAD_USER_INPUT', refusal: { code: refusal.code, params: refusal.params } }
+    });
+}
+/** Rethrow a refusal as a sentence in the caller's language; anything else passes through untouched. */
+function rethrowSpoken(error, context) {
+    throw error instanceof Refusal ? speakRefusal(error, context) : error;
+}
+/** A resolver class passes through this (`@UseMiddleware(SpeakRefusals)`). */
+const SpeakRefusals = async ({ context }, next) => {
+    try {
+        return await next();
+    }
+    catch (error) {
+        rethrowSpoken(error, context);
+    }
+};
+exports.SpeakRefusals = SpeakRefusals;
+/**
+ * An activity callback runs inside a worklist mutation, not the module's own resolver, so
+ * `SpeakRefusals` never sees what it throws. Declarations wrap their callback in this: the same
+ * `speakRefusal`, the other exit.
+ */
+function speaksRefusals(callback) {
+    return async (instance, addendum, context) => {
+        try {
+            await callback(instance, addendum, context);
+        }
+        catch (error) {
+            rethrowSpoken(error, context);
+        }
+    };
+}
+//# sourceMappingURL=refusal.js.map

package/dist-server/refusal/refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../../server/refusal/refusal.ts"],"names":[],"mappings":";;;AAqDA,gCAEC;AAYD,oCAUC;AAGD,sCAEC;AAgBD,wCAUC;AA5GD,qCAAsC;AAGtC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAa,OAAQ,SAAQ,KAAK;IAIhC;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,MAAqB,EAAE,OAAe;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,SAAS,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAjBD,0BAiBC;AAKD,SAAgB,UAAU,CAAC,IAAY;IACrC,OAAO,SAAS,IAAI,EAAE,CAAA;AACxB,CAAC;AAID;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,OAAgB,EAAE,OAA0B;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC,oFAAoF;YACpF,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3F,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;IAEnB,OAAO,IAAI,sBAAY,CAAC,QAAQ,EAAE;QAChC,aAAa,EAAE,OAAO;QACtB,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;KAChG,CAAC,CAAA;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAgB,aAAa,CAAC,KAAc,EAAE,OAA0B;IACtE,MAAM,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AACvE,CAAC;AAED,8EAA8E;AACvE,MAAM,aAAa,GAAsB,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE;IAC1E,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAA;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC,CAAA;AANY,QAAA,aAAa,iBAMzB;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAC5B,QAAuE;IAEvE,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC,CAAA;AACH,CAAC","sourcesContent":["import { GraphQLError } from 'graphql'\nimport type { MiddlewareFn } from 'type-graphql'\n\n/**\n * **A refusal the server knows and names** (ADR-0054).\n *\n * ── Why a gate does not throw a sentence ──────────────────────────────────\n * A gate that throws an English sentence puts English on a Korean screen. A screen that translates\n * it is then writing the reason itself, and the gate and the screen end up with two accounts of the\n * same refusal. So the gate throws a name and values, and the sentence is made where the request's\n * language is known.\n *\n * ── What gets stored is the name ──────────────────────────────────────────\n * Never write the sentence onto an event or a work row. A sentence differs per reader and the wording\n * changes later; a stored one freezes that day's language. The `code` is the contract, and it travels\n * unchanged to the client (ADR-0042 - no mapping table on the way out).\n *\n * ── Two traps ─────────────────────────────────────────────────────────────\n * ① `t(key, undefined)` loses the locale and answers in English, so `params` is always passed - the\n *    spread below makes an object even when a refusal carries none.\n * ② Never pass a **value** to `t` as a key: `:` reads as a namespace separator and cuts `urn:epc:…`\n *    apart. Values travel in `params` only.\n *\n * ── Why it lives in the shell ─────────────────────────────────────────────\n * operato-plant wrote this first and operato-warehouse copied it; worklist is the third consumer as\n * the work-door screens move there (ADR-0069 decision 3). Everything it needs is `graphql`,\n * `type-graphql` and the request's `t`, all of which sit at or below the shell, so this is the floor\n * that every consumer already stands on. The translations stay with each module: `refusalKey` names\n * `error.<code>` inside the caller's own namespace, and a module that does not declare the key falls\n * back to the English sentence rather than printing the key.\n */\nexport class Refusal extends Error {\n  readonly code: string\n  readonly params: RefusalParams\n\n  /**\n   * @param code this refusal's name (kebab). It states **the gate's fact**; a screen does not pick its\n   *   own sentence from this name.\n   * @param params the values the sentence is built from.\n   * @param english the sentence used when the translation key is missing. An English sentence reads\n   *   better than the key printed raw.\n   */\n  constructor(code: string, params: RefusalParams, english: string) {\n    super(english)\n    this.name = 'Refusal'\n    this.code = code\n    this.params = params\n  }\n}\n\n/** Values a refusal sentence is built from. Scalars only: they travel in the GraphQL response as they are. */\nexport type RefusalParams = Record<string, string | number | boolean | null>\n\nexport function refusalKey(code: string): string {\n  return `error.${code}`\n}\n\ntype Translate = (key: string, options?: Record<string, unknown>) => string\n\n/**\n * **The one place a refusal becomes a sentence.** The resolver wrapper and the worklist callbacks both\n * call this, so the two exits cannot drift apart.\n *\n * Apollo's own `extensions.code` gets `BAD_USER_INPUT`: a refusal is not a server error, and left empty\n * Apollo would fill in `INTERNAL_SERVER_ERROR`. The name rides separately in `extensions.refusal`; its\n * presence is what tells a client the server refused on purpose.\n */\nexport function speakRefusal(refusal: Refusal, context: { t?: Translate }): GraphQLError {\n  const sentence = context.t\n    ? /* Always pass params - `undefined` here loses the locale and answers in English. */\n      context.t(refusalKey(refusal.code), { ...refusal.params, defaultValue: refusal.message })\n    : refusal.message\n\n  return new GraphQLError(sentence, {\n    originalError: refusal,\n    extensions: { code: 'BAD_USER_INPUT', refusal: { code: refusal.code, params: refusal.params } }\n  })\n}\n\n/** Rethrow a refusal as a sentence in the caller's language; anything else passes through untouched. */\nexport function rethrowSpoken(error: unknown, context: { t?: Translate }): never {\n  throw error instanceof Refusal ? speakRefusal(error, context) : error\n}\n\n/** A resolver class passes through this (`@UseMiddleware(SpeakRefusals)`). */\nexport const SpeakRefusals: MiddlewareFn<any> = async ({ context }, next) => {\n  try {\n    return await next()\n  } catch (error) {\n    rethrowSpoken(error, context)\n  }\n}\n\n/**\n * An activity callback runs inside a worklist mutation, not the module's own resolver, so\n * `SpeakRefusals` never sees what it throws. Declarations wrap their callback in this: the same\n * `speakRefusal`, the other exit.\n */\nexport function speaksRefusals(\n  callback: (instance: any, addendum: any, context: any) => Promise<void>\n): (instance: any, addendum: any, context: any) => Promise<void> {\n  return async (instance, addendum, context) => {\n    try {\n      await callback(instance, addendum, context)\n    } catch (error) {\n      rethrowSpoken(error, context)\n    }\n  }\n}\n"]}