nestjs-ddd-cli 3.2.1 → 3.3.0

package/dist/commands/recipes/platform-context.recipe.js

@@ -0,0 +1,229 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyPlatformContextRecipe = applyPlatformContextRecipe;
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+const file_utils_1 = require("../../utils/file.utils");
+async function applyPlatformContextRecipe(basePath) {
+    const contextPath = path.join(basePath, 'src/shared/platform-context');
+    const docsPath = path.join(basePath, 'docs/platform');
+    await (0, file_utils_1.ensureDir)(contextPath);
+    await (0, file_utils_1.ensureDir)(docsPath);
+    await (0, file_utils_1.writeFile)(path.join(contextPath, 'platform-context.types.ts'), typesContent);
+    await (0, file_utils_1.writeFile)(path.join(contextPath, 'platform-context.factory.ts'), factoryContent);
+    await (0, file_utils_1.writeFile)(path.join(contextPath, 'platform-context.service.ts'), serviceContent);
+    await (0, file_utils_1.writeFile)(path.join(contextPath, 'platform-context.module.ts'), moduleContent);
+    await (0, file_utils_1.writeFile)(path.join(contextPath, 'index.ts'), indexContent);
+    await (0, file_utils_1.writeFile)(path.join(docsPath, 'platform-context.md'), docsContent);
+    console.log(chalk_1.default.green('  ✓ Canonical actor and machine context contract'));
+    console.log(chalk_1.default.green('  ✓ Correlation, causation, and idempotency metadata'));
+    console.log(chalk_1.default.green('  ✓ Async request-context propagation'));
+    console.log(chalk_1.default.yellow('  Build this context only from a verified broker or service principal; never trust caller identity headers.'));
+}
+const typesContent = `export interface PlatformActorContext {
+  subjectId: string;
+  businessId?: string;
+  applicationId?: string;
+  sessionId?: string;
+  tokenId?: string;
+  authenticatedBy: string;
+}
+
+export interface PlatformMachineContext {
+  serviceName: string;
+  clientId?: string;
+  serviceInstanceId?: string;
+  grantId?: string;
+  credentialId?: string;
+}
+
+export interface VerifiedPlatformPrincipal {
+  actor?: PlatformActorContext;
+  machine?: PlatformMachineContext;
+}
+
+export interface PlatformRequestContext extends VerifiedPlatformPrincipal {
+  requestId: string;
+  correlationId: string;
+  causationId?: string;
+  idempotencyKey?: string;
+  receivedAt: string;
+}
+
+export interface PlatformActionContext {
+  service: string;
+  capability: string;
+  action: string;
+  resourceType?: string;
+  resourceId?: string;
+  businessId?: string;
+  applicationId?: string;
+}
+
+export interface PlatformAuthorizationInput {
+  request: PlatformRequestContext;
+  target: PlatformActionContext;
+}
+
+export interface PlatformAccessDecision {
+  authority: "service-access" | "parc" | "owner-service";
+  allowed: boolean;
+  decisionReference: string;
+  decisionId?: string;
+  decidedAt: string;
+  policyVersion?: string;
+  reasonCode?: string;
+}
+`;
+const factoryContent = `import { randomUUID } from "crypto";
+import {
+  PlatformRequestContext,
+  VerifiedPlatformPrincipal,
+} from "./platform-context.types";
+
+export interface CreatePlatformRequestContextInput {
+  principal: VerifiedPlatformPrincipal;
+  requestId?: string;
+  correlationId?: string;
+  causationId?: string;
+  idempotencyKey?: string;
+  receivedAt?: Date;
+}
+
+export function createPlatformRequestContext(
+  input: CreatePlatformRequestContextInput,
+): PlatformRequestContext {
+  assertVerifiedPrincipal(input.principal);
+
+  return {
+    ...input.principal,
+    requestId: input.requestId || randomUUID(),
+    correlationId: input.correlationId || randomUUID(),
+    causationId: cleanOptional(input.causationId),
+    idempotencyKey: cleanOptional(input.idempotencyKey),
+    receivedAt: (input.receivedAt || new Date()).toISOString(),
+  };
+}
+
+export function assertVerifiedPrincipal(principal: VerifiedPlatformPrincipal): void {
+  const actorSubject = cleanOptional(principal.actor?.subjectId);
+  const machineName = cleanOptional(principal.machine?.serviceName);
+
+  if (!actorSubject && !machineName) {
+    throw new Error("A verified actor or machine principal is required");
+  }
+
+  if (principal.actor && !cleanOptional(principal.actor.authenticatedBy)) {
+    throw new Error("Actor authentication provenance is required");
+  }
+}
+
+function cleanOptional(value: string | undefined): string | undefined {
+  const cleaned = value?.trim();
+  return cleaned || undefined;
+}
+`;
+const serviceContent = `import { Injectable } from "@nestjs/common";
+import { AsyncLocalStorage } from "async_hooks";
+import { PlatformRequestContext } from "./platform-context.types";
+
+@Injectable()
+export class PlatformContextService {
+  private readonly storage = new AsyncLocalStorage<PlatformRequestContext>();
+
+  run<T>(context: PlatformRequestContext, callback: () => T): T {
+    return this.storage.run(context, callback);
+  }
+
+  current(): PlatformRequestContext | undefined {
+    return this.storage.getStore();
+  }
+
+  required(): PlatformRequestContext {
+    const context = this.current();
+    if (!context) {
+      throw new Error("Platform request context is not available");
+    }
+    return context;
+  }
+}
+`;
+const moduleContent = `import { Global, Module } from "@nestjs/common";
+import { PlatformContextService } from "./platform-context.service";
+
+@Global()
+@Module({
+  providers: [PlatformContextService],
+  exports: [PlatformContextService],
+})
+export class PlatformContextModule {}
+`;
+const indexContent = `export * from "./platform-context.types";
+export * from "./platform-context.factory";
+export * from "./platform-context.service";
+export * from "./platform-context.module";
+`;
+const docsContent = `# Platform Request Context
+
+This contract carries trusted actor, business, application, and machine identity
+between authentication, Service Access, PARC, owner services, and Relay.
+
+## Authority
+
+- ZITADEL authenticates and issues the token.
+- Identity Manager resolves the canonical subject.
+- Business Entity resolves canonical business and membership context.
+- Service Access decides service and capability grants.
+- PARC decides action and resource permissions.
+- The owner service enforces its domain invariants and owns the mutation.
+
+## Trust Boundary
+
+Construct \`VerifiedPlatformPrincipal\` only after signature, issuer, audience,
+expiry, and subject validation. Do not populate actor, business, application, or
+machine identity from caller-selected query parameters or custom identity
+headers. Edge adapters may forward a signed internal context, but the receiving
+service must verify that signature and its intended audience before use.
+
+Both Service Access and PARC must allow privileged platform mutations. Their
+decision references and policy versions belong in the owner audit record. Correlation,
+causation, and idempotency metadata must continue into transactional outbox
+events and Relay delivery receipts.
+`;
+//# sourceMappingURL=platform-context.recipe.js.map

package/dist/commands/recipes/platform-context.recipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-context.recipe.js","sourceRoot":"","sources":["../../../src/commands/recipes/platform-context.recipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,gEAsBC;AA1BD,2CAA6B;AAC7B,kDAA0B;AAC1B,uDAA8D;AAEvD,KAAK,UAAU,0BAA0B,CAAC,QAAgB;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEtD,MAAM,IAAA,sBAAS,EAAC,WAAW,CAAC,CAAC;IAC7B,MAAM,IAAA,sBAAS,EAAC,QAAQ,CAAC,CAAC;IAE1B,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,2BAA2B,CAAC,EAAE,YAAY,CAAC,CAAC;IACnF,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,6BAA6B,CAAC,EAAE,cAAc,CAAC,CAAC;IACvF,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,6BAA6B,CAAC,EAAE,cAAc,CAAC,CAAC;IACvF,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,4BAA4B,CAAC,EAAE,aAAa,CAAC,CAAC;IACrF,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAAE,WAAW,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,MAAM,CACV,6GAA6G,CAC9G,CACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDpB,CAAC;AAEF,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CtB,CAAC;AAEF,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBtB,CAAC;AAEF,MAAM,aAAa,GAAG;;;;;;;;;CASrB,CAAC;AAEF,MAAM,YAAY,GAAG;;;;CAIpB,CAAC;AAEF,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BnB,CAAC"}

package/dist/commands/recipes/platform-parc-authorization.recipe.d.ts

@@ -0,0 +1 @@
+export declare function applyPlatformParcAuthorizationRecipe(basePath: string): Promise<void>;

package/dist/commands/recipes/platform-parc-authorization.recipe.js

@@ -0,0 +1,339 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyPlatformParcAuthorizationRecipe = applyPlatformParcAuthorizationRecipe;
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+const file_utils_1 = require("../../utils/file.utils");
+const platform_context_recipe_1 = require("./platform-context.recipe");
+async function applyPlatformParcAuthorizationRecipe(basePath) {
+    await (0, platform_context_recipe_1.applyPlatformContextRecipe)(basePath);
+    const authorizationPath = path.join(basePath, 'src/shared/authorization/platform-parc-authorization');
+    const docsPath = path.join(basePath, 'docs/platform');
+    await (0, file_utils_1.ensureDir)(authorizationPath);
+    await (0, file_utils_1.ensureDir)(docsPath);
+    await (0, file_utils_1.writeFile)(path.join(authorizationPath, 'parc-authorization.types.ts'), typesContent);
+    await (0, file_utils_1.writeFile)(path.join(authorizationPath, 'require-parc-authorization.decorator.ts'), decoratorContent);
+    await (0, file_utils_1.writeFile)(path.join(authorizationPath, 'parc-authorization.client.ts'), clientContent);
+    await (0, file_utils_1.writeFile)(path.join(authorizationPath, 'platform-parc-authorization.guard.ts'), guardContent);
+    await (0, file_utils_1.writeFile)(path.join(authorizationPath, 'platform-parc-authorization.module.ts'), moduleContent);
+    await (0, file_utils_1.writeFile)(path.join(authorizationPath, 'index.ts'), indexContent);
+    await (0, file_utils_1.writeFile)(path.join(docsPath, 'platform-parc-authorization.md'), docsContent);
+    const envExamplePath = path.join(basePath, '.env.example');
+    const fallbackExamplePath = path.join(basePath, '.env.platform-parc-authorization.example');
+    const targetExamplePath = (await (0, file_utils_1.fileExists)(envExamplePath))
+        ? fallbackExamplePath
+        : envExamplePath;
+    await (0, file_utils_1.writeFile)(targetExamplePath, envExampleContent);
+    console.log(chalk_1.default.green('  ✓ Platform request context contract'));
+    console.log(chalk_1.default.green('  ✓ PARC capability decorator and orchestration guard'));
+    console.log(chalk_1.default.green('  ✓ Fail-closed PARC decision client and audit receipt'));
+    console.log(chalk_1.default.yellow('  PARC authorizes the requested capability; owner services still enforce and transact their business invariants.'));
+}
+const typesContent = `import { PlatformRequestContext } from "../../platform-context";
+
+export interface ParcAuthorizationTarget {
+  service: string;
+  capability: string;
+  action?: string;
+  businessId?: string;
+  applicationId?: string;
+}
+
+export interface ParcDecisionCheckRequest {
+  subjectId: string;
+  businessId: string;
+  clientAppId: string;
+  service: string;
+  permission: string;
+  action?: string;
+}
+
+export interface ParcDecisionResponse {
+  allowed: boolean;
+  decisionReference: string;
+  decisionId?: string;
+}
+
+export interface ParcAccessDecisionReceipt extends ParcDecisionResponse {
+  authority: "parc";
+  allowed: true;
+  decidedAt: string;
+}
+
+export interface RequestWithParcAuthorization {
+  platformContext?: PlatformRequestContext;
+  parcAccessDecisionReceipt?: ParcAccessDecisionReceipt;
+}
+`;
+const decoratorContent = `import { SetMetadata } from "@nestjs/common";
+import { ParcAuthorizationTarget } from "./parc-authorization.types";
+
+export const PARC_AUTHORIZATION_TARGET = "platform:parc-authorization-target";
+
+export const RequireParcAuthorization = (target: ParcAuthorizationTarget) =>
+  SetMetadata(PARC_AUTHORIZATION_TARGET, Object.freeze({ ...target }));
+`;
+const clientContent = `import { ForbiddenException, Injectable } from "@nestjs/common";
+import {
+  ParcAccessDecisionReceipt,
+  ParcAuthorizationTarget,
+  ParcDecisionCheckRequest,
+  ParcDecisionResponse,
+  RequestWithParcAuthorization,
+} from "./parc-authorization.types";
+
+@Injectable()
+export class ParcAuthorizationClient {
+  async check(
+    request: RequestWithParcAuthorization,
+    target: ParcAuthorizationTarget,
+  ): Promise<ParcAccessDecisionReceipt> {
+    const actor = request.platformContext?.actor;
+    // IAM authority requires PARC's bound relationship path. This legacy
+    // endpoint cannot carry its realm, session or current relationship proof.
+    if (actor?.authenticatedBy === "iam-orchestrator") {
+      throw this.denied();
+    }
+    const authorizationRequest: ParcDecisionCheckRequest = {
+      subjectId: this.requiredString(actor?.subjectId),
+      businessId: this.requiredString(target.businessId ?? actor?.businessId),
+      clientAppId: this.requiredString(target.applicationId ?? actor?.applicationId),
+      service: this.requiredString(target.service),
+      permission: this.requiredString(target.capability),
+      action: this.optionalString(target.action),
+    };
+    const baseUrl = this.requiredConfig("PARC_URL").replace(/\\/+$/, "");
+    const internalApiKey = this.requiredConfig("PARC_INTERNAL_API_KEY");
+    const timeoutMs = this.timeoutMs();
+
+    try {
+      const response = await fetch(baseUrl + "/v1/decisions/check", {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json",
+          "x-internal-api-key": internalApiKey,
+        },
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify(authorizationRequest),
+      });
+
+      if (!response.ok) {
+        throw new Error("PARC decision request failed");
+      }
+
+      const decision = this.parseDecision(await response.json());
+      if (!decision.allowed) {
+        throw new Error("PARC denied the requested capability");
+      }
+
+      return {
+        authority: "parc",
+        allowed: true,
+        decisionReference: decision.decisionReference,
+        ...(decision.decisionId ? { decisionId: decision.decisionId } : {}),
+        decidedAt: new Date().toISOString(),
+      };
+    } catch {
+      throw this.denied();
+    }
+  }
+
+  private parseDecision(payload: unknown): ParcDecisionResponse {
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+      throw this.denied();
+    }
+
+    const record = payload as Record<string, unknown>;
+    if (typeof record.allowed !== "boolean") {
+      throw this.denied();
+    }
+
+    const decisionReference = this.requiredString(record.decisionReference);
+    let decisionId: string | undefined;
+    if (record.decisionId !== undefined) {
+      decisionId = this.requiredString(record.decisionId);
+    }
+
+    return {
+      allowed: record.allowed,
+      decisionReference,
+      ...(decisionId ? { decisionId } : {}),
+    };
+  }
+
+  private requiredConfig(name: "PARC_URL" | "PARC_INTERNAL_API_KEY"): string {
+    return this.requiredString(process.env[name]);
+  }
+
+  private timeoutMs(): number {
+    const configured = this.optionalString(process.env.PARC_TIMEOUT_MS);
+    if (!configured) {
+      return 3000;
+    }
+
+    const timeoutMs = Number(configured);
+    if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
+      throw this.denied();
+    }
+    return timeoutMs;
+  }
+
+  private requiredString(value: unknown): string {
+    if (typeof value !== "string" || !value.trim()) {
+      throw this.denied();
+    }
+    return value.trim();
+  }
+
+  private optionalString(value: unknown): string | undefined {
+    if (value === undefined) {
+      return undefined;
+    }
+    return this.requiredString(value);
+  }
+
+  private denied(): ForbiddenException {
+    return new ForbiddenException("PARC authorization denied");
+  }
+}
+`;
+const guardContent = `import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { ParcAuthorizationClient } from "./parc-authorization.client";
+import { PARC_AUTHORIZATION_TARGET } from "./require-parc-authorization.decorator";
+import {
+  ParcAuthorizationTarget,
+  RequestWithParcAuthorization,
+} from "./parc-authorization.types";
+
+@Injectable()
+export class PlatformParcAuthorizationGuard implements CanActivate {
+  constructor(
+    private readonly reflector: Reflector,
+    private readonly client: ParcAuthorizationClient,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest<RequestWithParcAuthorization>();
+    const target = this.reflector.getAllAndOverride<ParcAuthorizationTarget>(
+      PARC_AUTHORIZATION_TARGET,
+      [context.getHandler(), context.getClass()],
+    );
+
+    if (!target) {
+      throw new ForbiddenException("PARC authorization target is required");
+    }
+
+    const receipt = await this.client.check(request, target);
+    request.parcAccessDecisionReceipt = receipt;
+    return true;
+  }
+}
+`;
+const moduleContent = `import { Module } from "@nestjs/common";
+import { PlatformContextModule } from "../../platform-context";
+import { ParcAuthorizationClient } from "./parc-authorization.client";
+import { PlatformParcAuthorizationGuard } from "./platform-parc-authorization.guard";
+
+@Module({
+  imports: [PlatformContextModule],
+  providers: [ParcAuthorizationClient, PlatformParcAuthorizationGuard],
+  exports: [ParcAuthorizationClient, PlatformParcAuthorizationGuard],
+})
+export class PlatformParcAuthorizationModule {}
+`;
+const indexContent = `export * from "./parc-authorization.types";
+export * from "./require-parc-authorization.decorator";
+export * from "./parc-authorization.client";
+export * from "./platform-parc-authorization.guard";
+export * from "./platform-parc-authorization.module";
+`;
+const envExampleContent = `PARC_URL=
+PARC_INTERNAL_API_KEY=
+PARC_TIMEOUT_MS=3000
+`;
+const docsContent = `# Platform PARC Authorization
+
+Apply this guard only after trusted authentication and platform-context
+construction. The guard reads the decorator target, delegates the decision to
+PARC, and attaches the successful receipt at
+\`request.parcAccessDecisionReceipt\`. It does not read identity from headers or
+query parameters and it does not contain owner business rules.
+
+## Usage
+
+Import \`PlatformParcAuthorizationModule\`, then decorate a controller or handler:
+
+\`\`\`typescript
+@RequireParcAuthorization({
+  service: "owner-service",
+  capability: "records.write",
+  action: "create",
+})
+@UseGuards(PlatformParcAuthorizationGuard)
+\`\`\`
+
+The trusted actor subject comes from \`request.platformContext.actor.subjectId\`.
+This legacy decision transport rejects \`iam-orchestrator\` actors before sending
+any request. IAM authority requires PARC's bound decision integration with its
+realm, session and current relationship evidence; changing the actor label or
+falling back to this endpoint is not supported.
+The target may narrow business and application scope; otherwise the actor's
+trusted platform context supplies them. Missing context, required scope, PARC
+configuration, transport success, or a valid allow receipt denies access.
+
+## Ownership And Audit
+
+\`PARC_INTERNAL_API_KEY\` authenticates this service to PARC transport. It is not
+the user's authorization and must never be treated as an allow decision. PARC
+decides the requested service capability and optional action; it does not own
+business truth.
+
+Owner invariants still apply after PARC allows access. The owner service must
+record \`decisionReference\` in the same owner transaction as the protected
+mutation and its outbox/audit record. The optional \`decisionId\` is retained
+only for compatibility; \`decisionReference\` is the required audit reference.
+`;
+//# sourceMappingURL=platform-parc-authorization.recipe.js.map

package/dist/commands/recipes/platform-parc-authorization.recipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-parc-authorization.recipe.js","sourceRoot":"","sources":["../../../src/commands/recipes/platform-parc-authorization.recipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,oFA4CC;AAjDD,2CAA6B;AAC7B,kDAA0B;AAC1B,uDAA0E;AAC1E,uEAAuE;AAEhE,KAAK,UAAU,oCAAoC,CAAC,QAAgB;IACzE,MAAM,IAAA,oDAA0B,EAAC,QAAQ,CAAC,CAAC;IAE3C,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CACjC,QAAQ,EACR,sDAAsD,CACvD,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEtD,MAAM,IAAA,sBAAS,EAAC,iBAAiB,CAAC,CAAC;IACnC,MAAM,IAAA,sBAAS,EAAC,QAAQ,CAAC,CAAC;IAE1B,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3F,MAAM,IAAA,sBAAS,EACb,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,EACvE,gBAAgB,CACjB,CAAC;IACF,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,EAAE,aAAa,CAAC,CAAC;IAC7F,MAAM,IAAA,sBAAS,EACb,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,EACpE,YAAY,CACb,CAAC;IACF,MAAM,IAAA,sBAAS,EACb,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,EACrE,aAAa,CACd,CAAC;IACF,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IACxE,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gCAAgC,CAAC,EAAE,WAAW,CAAC,CAAC;IAEpF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC3D,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,0CAA0C,CAAC,CAAC;IAC5F,MAAM,iBAAiB,GAAG,CAAC,MAAM,IAAA,uBAAU,EAAC,cAAc,CAAC,CAAC;QAC1D,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,cAAc,CAAC;IACnB,MAAM,IAAA,sBAAS,EAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,MAAM,CACV,kHAAkH,CACnH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCpB,CAAC;AAEF,MAAM,gBAAgB,GAAG;;;;;;;CAOxB,CAAC;AAEF,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4HrB,CAAC;AAEF,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCpB,CAAC;AAEF,MAAM,aAAa,GAAG;;;;;;;;;;;CAWrB,CAAC;AAEF,MAAM,YAAY,GAAG;;;;;CAKpB,CAAC;AAEF,MAAM,iBAAiB,GAAG;;;CAGzB,CAAC;AAEF,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCnB,CAAC"}

package/dist/commands/recipes/platform-parc-bound-authorization.recipe.d.ts

@@ -0,0 +1 @@
+export declare function applyPlatformParcBoundAuthorizationRecipe(basePath: string, dryRun?: boolean): Promise<void>;

package/dist/commands/recipes/platform-parc-bound-authorization.recipe.js

@@ -0,0 +1,56 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyPlatformParcBoundAuthorizationRecipe = applyPlatformParcBoundAuthorizationRecipe;
+const path = __importStar(require("node:path"));
+const static_recipe_utils_1 = require("../../utils/static-recipe.utils");
+async function applyPlatformParcBoundAuthorizationRecipe(basePath, dryRun = false) {
+    const root = path.join(__dirname, '../../templates/recipes');
+    await (0, static_recipe_utils_1.applyStaticRecipePlan)(basePath, [
+        {
+            template: path.join(root, 'oauth2-token-introspection/http-client.ts.hbs'),
+            destination: 'src/shared/auth/oauth2-token-introspection/bounded-json-http.client.ts',
+        },
+        {
+            template: path.join(root, 'platform-parc-bound-authorization/client.ts.hbs'),
+            destination: 'src/shared/authorization/platform-parc-bound-authorization/parc-bound.client.ts',
+        },
+        {
+            template: path.join(root, 'platform-parc-bound-authorization/README.md.hbs'),
+            destination: 'docs/platform/parc-bound-authorization.md',
+        },
+    ], dryRun);
+}
+//# sourceMappingURL=platform-parc-bound-authorization.recipe.js.map

package/dist/commands/recipes/platform-parc-bound-authorization.recipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-parc-bound-authorization.recipe.js","sourceRoot":"","sources":["../../../src/commands/recipes/platform-parc-bound-authorization.recipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,8FAwBC;AA3BD,gDAAkC;AAClC,yEAAwE;AAEjE,KAAK,UAAU,yCAAyC,CAC7D,QAAgB,EAChB,MAAM,GAAG,KAAK;IAEd,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC7D,MAAM,IAAA,2CAAqB,EACzB,QAAQ,EACR;QACE;YACE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,+CAA+C,CAAC;YAC1E,WAAW,EAAE,wEAAwE;SACtF;QACD;YACE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iDAAiD,CAAC;YAC5E,WAAW,EACT,iFAAiF;SACpF;QACD;YACE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iDAAiD,CAAC;YAC5E,WAAW,EAAE,2CAA2C;SACzD;KACF,EACD,MAAM,CACP,CAAC;AACJ,CAAC"}

package/dist/commands/recipes/platform-service-access-request-context.recipe.d.ts

@@ -0,0 +1 @@
+export declare function applyPlatformServiceAccessRequestContextRecipe(basePath: string): Promise<void>;