nestjs-ddd-cli 3.2.2 → 3.3.1

package/dist/commands/recipes/platform-parc-bound-authorization.recipe.js

@@ -0,0 +1,56 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyPlatformParcBoundAuthorizationRecipe = applyPlatformParcBoundAuthorizationRecipe;
+const path = __importStar(require("node:path"));
+const static_recipe_utils_1 = require("../../utils/static-recipe.utils");
+async function applyPlatformParcBoundAuthorizationRecipe(basePath, dryRun = false) {
+    const root = path.join(__dirname, '../../templates/recipes');
+    await (0, static_recipe_utils_1.applyStaticRecipePlan)(basePath, [
+        {
+            template: path.join(root, 'oauth2-token-introspection/http-client.ts.hbs'),
+            destination: 'src/shared/auth/oauth2-token-introspection/bounded-json-http.client.ts',
+        },
+        {
+            template: path.join(root, 'platform-parc-bound-authorization/client.ts.hbs'),
+            destination: 'src/shared/authorization/platform-parc-bound-authorization/parc-bound.client.ts',
+        },
+        {
+            template: path.join(root, 'platform-parc-bound-authorization/README.md.hbs'),
+            destination: 'docs/platform/parc-bound-authorization.md',
+        },
+    ], dryRun);
+}
+//# sourceMappingURL=platform-parc-bound-authorization.recipe.js.map

package/dist/commands/recipes/platform-parc-bound-authorization.recipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-parc-bound-authorization.recipe.js","sourceRoot":"","sources":["../../../src/commands/recipes/platform-parc-bound-authorization.recipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,8FAwBC;AA3BD,gDAAkC;AAClC,yEAAwE;AAEjE,KAAK,UAAU,yCAAyC,CAC7D,QAAgB,EAChB,MAAM,GAAG,KAAK;IAEd,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC7D,MAAM,IAAA,2CAAqB,EACzB,QAAQ,EACR;QACE;YACE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,+CAA+C,CAAC;YAC1E,WAAW,EAAE,wEAAwE;SACtF;QACD;YACE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iDAAiD,CAAC;YAC5E,WAAW,EACT,iFAAiF;SACpF;QACD;YACE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iDAAiD,CAAC;YAC5E,WAAW,EAAE,2CAA2C;SACzD;KACF,EACD,MAAM,CACP,CAAC;AACJ,CAAC"}

package/dist/commands/recipes/platform-service-access-request-context.recipe.d.ts

@@ -0,0 +1 @@
+export declare function applyPlatformServiceAccessRequestContextRecipe(basePath: string): Promise<void>;

package/dist/commands/recipes/platform-service-access-request-context.recipe.js

@@ -0,0 +1,103 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyPlatformServiceAccessRequestContextRecipe = applyPlatformServiceAccessRequestContextRecipe;
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+const file_utils_1 = require("../../utils/file.utils");
+const platform_context_recipe_1 = require("./platform-context.recipe");
+const recipeTemplates = [
+    {
+        source: 'service-access-request-context.config.ts.hbs',
+        target: 'src/shared/auth/platform-service-access-request-context/service-access-request-context.config.ts',
+    },
+    {
+        source: 'request-context-introspection.types.ts.hbs',
+        target: 'src/shared/auth/platform-service-access-request-context/request-context-introspection.types.ts',
+    },
+    {
+        source: 'request-context-introspection.parser.ts.hbs',
+        target: 'src/shared/auth/platform-service-access-request-context/request-context-introspection.parser.ts',
+    },
+    {
+        source: 'request-context-headers.ts.hbs',
+        target: 'src/shared/auth/platform-service-access-request-context/request-context-headers.ts',
+    },
+    {
+        source: 'service-access-request-context.client.ts.hbs',
+        target: 'src/shared/auth/platform-service-access-request-context/service-access-request-context.client.ts',
+    },
+    {
+        source: 'service-access-request-context.guard.ts.hbs',
+        target: 'src/shared/auth/platform-service-access-request-context/service-access-request-context.guard.ts',
+    },
+    {
+        source: 'service-access-request-context.module.ts.hbs',
+        target: 'src/shared/auth/platform-service-access-request-context/service-access-request-context.module.ts',
+    },
+    {
+        source: 'index.ts.hbs',
+        target: 'src/shared/auth/platform-service-access-request-context/index.ts',
+    },
+    {
+        source: 'docs.md.hbs',
+        target: 'docs/platform/platform-service-access-request-context.md',
+    },
+];
+async function applyPlatformServiceAccessRequestContextRecipe(basePath) {
+    await (0, platform_context_recipe_1.applyPlatformContextRecipe)(basePath);
+    const templatePath = path.join(__dirname, '../../templates/recipes/platform-service-access-request-context');
+    for (const template of recipeTemplates) {
+        const content = await (0, file_utils_1.readTemplate)(path.join(templatePath, template.source));
+        await (0, file_utils_1.writeFile)(path.join(basePath, template.target), content);
+    }
+    const envExamplePath = path.join(basePath, '.env.example');
+    const fallbackExamplePath = path.join(basePath, '.env.platform-service-access-request-context.example');
+    const targetExamplePath = (await (0, file_utils_1.fileExists)(envExamplePath))
+        ? fallbackExamplePath
+        : envExamplePath;
+    const envContent = await (0, file_utils_1.readTemplate)(path.join(templatePath, 'env.example.hbs'));
+    await (0, file_utils_1.ensureDir)(path.dirname(targetExamplePath));
+    await (0, file_utils_1.writeFile)(targetExamplePath, envContent);
+    console.log(chalk_1.default.green('  ✓ Platform request context contract'));
+    console.log(chalk_1.default.green('  ✓ Service Access lease introspection client and guard'));
+    console.log(chalk_1.default.green('  ✓ Strict active-response, audience, and principal parsing'));
+    console.log(chalk_1.default.green('  ✓ Disabled, shadow, and enforce rollout modes'));
+    console.log(chalk_1.default.yellow('  Run this guard before route-specific PARC authorization; caller identity headers are never authority.'));
+}
+//# sourceMappingURL=platform-service-access-request-context.recipe.js.map

package/dist/commands/recipes/platform-service-access-request-context.recipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-service-access-request-context.recipe.js","sourceRoot":"","sources":["../../../src/commands/recipes/platform-service-access-request-context.recipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,wGAoCC;AA3FD,2CAA6B;AAC7B,kDAA0B;AAC1B,uDAAwF;AACxF,uEAAuE;AAOvE,MAAM,eAAe,GAA8B;IACjD;QACE,MAAM,EAAE,8CAA8C;QACtD,MAAM,EACJ,kGAAkG;KACrG;IACD;QACE,MAAM,EAAE,4CAA4C;QACpD,MAAM,EACJ,gGAAgG;KACnG;IACD;QACE,MAAM,EAAE,6CAA6C;QACrD,MAAM,EACJ,iGAAiG;KACpG;IACD;QACE,MAAM,EAAE,gCAAgC;QACxC,MAAM,EAAE,oFAAoF;KAC7F;IACD;QACE,MAAM,EAAE,8CAA8C;QACtD,MAAM,EACJ,kGAAkG;KACrG;IACD;QACE,MAAM,EAAE,6CAA6C;QACrD,MAAM,EACJ,iGAAiG;KACpG;IACD;QACE,MAAM,EAAE,8CAA8C;QACtD,MAAM,EACJ,kGAAkG;KACrG;IACD;QACE,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,kEAAkE;KAC3E;IACD;QACE,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,0DAA0D;KACnE;CACF,CAAC;AAEK,KAAK,UAAU,8CAA8C,CAClE,QAAgB;IAEhB,MAAM,IAAA,oDAA0B,EAAC,QAAQ,CAAC,CAAC;IAE3C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,SAAS,EACT,iEAAiE,CAClE,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,IAAA,yBAAY,EAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC3D,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CACnC,QAAQ,EACR,sDAAsD,CACvD,CAAC;IACF,MAAM,iBAAiB,GAAG,CAAC,MAAM,IAAA,uBAAU,EAAC,cAAc,CAAC,CAAC;QAC1D,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,cAAc,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,IAAA,yBAAY,EAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAClF,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjD,MAAM,IAAA,sBAAS,EAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAE/C,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,MAAM,CACV,yGAAyG,CAC1G,CACF,CAAC;AACJ,CAAC"}

package/dist/commands/recipes/platform-service-runtime.recipe.d.ts

@@ -0,0 +1 @@
+export declare function applyPlatformServiceRuntimeRecipe(basePath: string): Promise<void>;

package/dist/commands/recipes/platform-service-runtime.recipe.js

@@ -0,0 +1,415 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyPlatformServiceRuntimeRecipe = applyPlatformServiceRuntimeRecipe;
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+const file_utils_1 = require("../../utils/file.utils");
+const platform_context_recipe_1 = require("./platform-context.recipe");
+async function applyPlatformServiceRuntimeRecipe(basePath) {
+    const runtimePath = path.join(basePath, 'src/shared/platform-service-runtime');
+    const docsPath = path.join(basePath, 'docs/platform');
+    await (0, platform_context_recipe_1.applyPlatformContextRecipe)(basePath);
+    await (0, file_utils_1.ensureDir)(runtimePath);
+    await (0, file_utils_1.ensureDir)(docsPath);
+    await (0, file_utils_1.writeFile)(path.join(runtimePath, 'platform-service.types.ts'), typesContent);
+    await (0, file_utils_1.writeFile)(path.join(runtimePath, 'platform-service.manifest.ts'), manifestContent);
+    await (0, file_utils_1.writeFile)(path.join(runtimePath, 'platform-manifest.guard.ts'), manifestGuardContent);
+    await (0, file_utils_1.writeFile)(path.join(runtimePath, 'platform-service-manifest.controller.ts'), manifestControllerContent);
+    await (0, file_utils_1.writeFile)(path.join(runtimePath, 'platform-service-registration.client.ts'), registrationClientContent);
+    await (0, file_utils_1.writeFile)(path.join(runtimePath, 'platform-service.module.ts'), moduleContent);
+    await (0, file_utils_1.writeFile)(path.join(runtimePath, 'index.ts'), indexContent);
+    await (0, file_utils_1.writeFile)(path.join(docsPath, 'platform-service-runtime.md'), docsContent);
+    const envExamplePath = path.join(basePath, '.env.example');
+    const fallbackExamplePath = path.join(basePath, '.env.platform-service-runtime.example');
+    const targetExamplePath = (await (0, file_utils_1.fileExists)(envExamplePath))
+        ? fallbackExamplePath
+        : envExamplePath;
+    await (0, file_utils_1.writeFile)(targetExamplePath, envExampleContent);
+    console.log(chalk_1.default.green('  ✓ Platform service manifest and capability contract'));
+    console.log(chalk_1.default.green('  ✓ Authenticated Service Access catalog registration'));
+    console.log(chalk_1.default.green('  ✓ Private manifest endpoint and runtime heartbeat metadata'));
+    console.log(chalk_1.default.yellow('  Provision a per-service Service Access key and set PLATFORM_REGISTRATION_REQUIRED=true in shared environments.'));
+}
+const typesContent = `export type PlatformRuntimeKind = "nestjs" | "go-sidecar" | "laravel" | "rust" | "external";
+
+export const PLATFORM_SERVICE_MANIFEST = Symbol("PLATFORM_SERVICE_MANIFEST");
+
+export type PlatformServiceCriticality = "system" | "money" | "identity" | "compliance" | "ops" | "product";
+
+export interface PlatformServiceEndpoint {
+  name: string;
+  urlEnv: string;
+  healthPath?: string;
+  docsPath?: string;
+  internalOnly?: boolean;
+}
+
+export interface PlatformServiceAction {
+  name: string;
+  description: string;
+  owner: string;
+  requestContract?: string;
+  responseContract?: string;
+  idempotencyRequired?: boolean;
+  authRequired?: boolean;
+  timeoutMs?: number;
+}
+
+export interface PlatformServiceEvent {
+  name: string;
+  description: string;
+  schema?: string;
+  mandatoryForSubscribers?: boolean;
+  durable?: boolean;
+}
+
+export interface PlatformServiceDependency {
+  service: string;
+  reason: string;
+  required: boolean;
+  accessGrant?: string;
+  timeoutMs?: number;
+}
+
+export interface PlatformServiceManifest {
+  serviceName: string;
+  serviceSlug: string;
+  displayName: string;
+  description?: string;
+  companyName?: string;
+  productGroup: string;
+  runtime: PlatformRuntimeKind;
+  criticality: PlatformServiceCriticality;
+  ownerTeam?: string;
+  capabilities: string[];
+  endpoints: PlatformServiceEndpoint[];
+  actions: PlatformServiceAction[];
+  eventsProduced: PlatformServiceEvent[];
+  eventsConsumed: PlatformServiceEvent[];
+  dependencies: PlatformServiceDependency[];
+  requiredEnv: string[];
+  optionalEnv?: string[];
+  health: {
+    livePath: string;
+    readyPath: string;
+    metricsPath?: string;
+  };
+}
+
+export type PlatformRegistrationStatus = "registered" | "skipped" | "failed";
+
+export interface PlatformRegistrationResult {
+  status: PlatformRegistrationStatus;
+  serviceId?: string;
+  reason?: string;
+  correlationId: string;
+}
+`;
+const manifestContent = `import { PlatformServiceManifest } from "./platform-service.types";
+
+export const platformServiceManifest: PlatformServiceManifest = {
+  serviceName: process.env.APP_NAME ?? "replace-me-service",
+  serviceSlug: process.env.APP_SERVICE_SLUG ?? "replace-me-service",
+  displayName: process.env.APP_DISPLAY_NAME ?? "Replace Me Service",
+  description: process.env.APP_DESCRIPTION,
+  productGroup: "platform-core",
+  runtime: "nestjs",
+  criticality: "product",
+  capabilities: [],
+  endpoints: [
+    {
+      name: "api",
+      urlEnv: "PUBLIC_API_URL",
+      healthPath: "/api/v1/health",
+      docsPath: "/api/v1/docs",
+    },
+  ],
+  actions: [],
+  eventsProduced: [],
+  eventsConsumed: [],
+  dependencies: [],
+  requiredEnv: ["NODE_ENV", "DATABASE_URL", "INTERNAL_API_KEY"],
+  optionalEnv: ["SERVICE_ACCESS_URL", "LOG_LEVEL", "CORS_ORIGINS"],
+  health: {
+    livePath: "/api/v1/health/live",
+    readyPath: "/api/v1/health/ready",
+    metricsPath: "/metrics",
+  },
+};
+`;
+const manifestGuardContent = `import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from "@nestjs/common";
+import { timingSafeEqual } from "crypto";
+
+@Injectable()
+export class PlatformManifestGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest<{
+      headers: Record<string, string | string[] | undefined>;
+    }>();
+    const expected = process.env.PLATFORM_MANIFEST_READ_TOKEN;
+    const presented = request.headers.authorization;
+    const token = typeof presented === "string" && presented.startsWith("Bearer ")
+      ? presented.slice(7)
+      : undefined;
+
+    if (!expected || !token || !this.matches(token, expected)) {
+      throw new UnauthorizedException("Platform manifest authentication required");
+    }
+    return true;
+  }
+
+  private matches(presented: string, expected: string): boolean {
+    const left = Buffer.from(presented);
+    const right = Buffer.from(expected);
+    return left.length === right.length && timingSafeEqual(left, right);
+  }
+}
+`;
+const manifestControllerContent = `import { Controller, Get, UseGuards } from "@nestjs/common";
+import { platformServiceManifest } from "./platform-service.manifest";
+import { PlatformManifestGuard } from "./platform-manifest.guard";
+
+@Controller("internal/platform")
+@UseGuards(PlatformManifestGuard)
+export class PlatformServiceManifestController {
+  @Get("manifest")
+  manifest() {
+    return platformServiceManifest;
+  }
+}
+`;
+const registrationClientContent = `import { randomUUID } from "crypto";
+import { Inject, Injectable } from "@nestjs/common";
+import { PlatformContextService } from "../platform-context";
+import {
+  PLATFORM_SERVICE_MANIFEST,
+  PlatformRegistrationResult,
+  PlatformServiceManifest,
+} from "./platform-service.types";
+
+type RegistrationPhase = "registration" | "heartbeat";
+
+@Injectable()
+export class PlatformServiceRegistrationClient {
+  constructor(
+    @Inject(PLATFORM_SERVICE_MANIFEST)
+    private readonly manifest: PlatformServiceManifest,
+    private readonly context: PlatformContextService,
+  ) {}
+
+  register(): Promise<PlatformRegistrationResult> {
+    return this.sync("registration");
+  }
+
+  heartbeat(): Promise<PlatformRegistrationResult> {
+    return this.sync("heartbeat");
+  }
+
+  private async sync(phase: RegistrationPhase): Promise<PlatformRegistrationResult> {
+    const correlationId = this.context.current()?.correlationId || randomUUID();
+    const required = this.booleanEnv("PLATFORM_REGISTRATION_REQUIRED", false);
+    const baseUrl = this.clean(process.env.SERVICE_ACCESS_URL)?.replace(/\\/+$/, "");
+    const apiKey = this.clean(process.env.SERVICE_ACCESS_INTERNAL_API_KEY);
+    const revision = this.clean(process.env.APP_REVISION || process.env.CI_COMMIT_SHA);
+
+    if (!baseUrl || !apiKey || !revision) {
+      return this.unavailable(
+        required,
+        correlationId,
+        "SERVICE_ACCESS_URL, SERVICE_ACCESS_INTERNAL_API_KEY, and APP_REVISION or CI_COMMIT_SHA are required",
+      );
+    }
+
+    this.assertSlug(this.manifest.serviceSlug);
+    const now = new Date();
+    const idempotencyKey = this.idempotencyKey(phase, revision, now);
+    const timeoutMs = this.integerEnv("SERVICE_ACCESS_TIMEOUT_MS", 3000);
+
+    try {
+      const response = await fetch(baseUrl + "/registered-services/upsert", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json",
+          "x-internal-api-key": apiKey,
+          "Idempotency-Key": idempotencyKey,
+          "X-Correlation-ID": correlationId,
+        },
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify({
+          slug: this.manifest.serviceSlug,
+          display_name: this.manifest.displayName,
+          owner_type: "platform",
+          status: "active",
+          description: this.manifest.description,
+          metadata: {
+            manifest: this.manifest,
+            runtime: {
+              phase,
+              revision,
+              image: this.clean(process.env.APP_IMAGE),
+              environment: this.clean(process.env.NODE_ENV),
+              health: this.manifest.health,
+              heartbeatAt: now.toISOString(),
+            },
+            correlationId,
+          },
+        }),
+      });
+
+      if (!response.ok) {
+        throw new Error("Service Access registration failed with HTTP " + response.status);
+      }
+
+      const body = (await response.json()) as { id?: unknown };
+      return {
+        status: "registered",
+        serviceId: typeof body.id === "string" ? body.id : undefined,
+        correlationId,
+      };
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : "Service Access registration failed";
+      if (required) {
+        throw new Error(reason);
+      }
+      return { status: "failed", reason, correlationId };
+    }
+  }
+
+  private unavailable(
+    required: boolean,
+    correlationId: string,
+    reason: string,
+  ): PlatformRegistrationResult {
+    if (required) {
+      throw new Error(reason);
+    }
+    return { status: "skipped", reason, correlationId };
+  }
+
+  private idempotencyKey(phase: RegistrationPhase, revision: string, now: Date): string {
+    const suffix = phase === "heartbeat" ? ":" + now.toISOString().slice(0, 16) : "";
+    return "platform-runtime:" + this.manifest.serviceSlug + ":" + revision + suffix;
+  }
+
+  private assertSlug(value: string): void {
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,126}[a-z0-9])?$/.test(value)) {
+      throw new Error("Platform service slug must be lowercase kebab-case");
+    }
+  }
+
+  private booleanEnv(name: string, fallback: boolean): boolean {
+    const value = this.clean(process.env[name]);
+    return value ? value.toLowerCase() === "true" : fallback;
+  }
+
+  private integerEnv(name: string, fallback: number): number {
+    const value = Number(process.env[name]);
+    return Number.isInteger(value) && value > 0 ? value : fallback;
+  }
+
+  private clean(value: string | undefined): string | undefined {
+    const cleaned = value?.trim();
+    return cleaned || undefined;
+  }
+}
+`;
+const moduleContent = `import { Global, Module } from "@nestjs/common";
+import { PlatformContextModule } from "../platform-context";
+import { platformServiceManifest } from "./platform-service.manifest";
+import { PlatformManifestGuard } from "./platform-manifest.guard";
+import { PlatformServiceManifestController } from "./platform-service-manifest.controller";
+import { PlatformServiceRegistrationClient } from "./platform-service-registration.client";
+import { PLATFORM_SERVICE_MANIFEST } from "./platform-service.types";
+
+@Global()
+@Module({
+  imports: [PlatformContextModule],
+  controllers: [PlatformServiceManifestController],
+  providers: [
+    PlatformManifestGuard,
+    PlatformServiceRegistrationClient,
+    {
+      provide: PLATFORM_SERVICE_MANIFEST,
+      useValue: platformServiceManifest,
+    },
+  ],
+  exports: [PLATFORM_SERVICE_MANIFEST, PlatformServiceRegistrationClient],
+})
+export class PlatformServiceRuntimeModule {}
+`;
+const indexContent = `export * from "./platform-service.types";
+export * from "./platform-service.manifest";
+export * from "./platform-manifest.guard";
+export * from "./platform-service-manifest.controller";
+export * from "./platform-service-registration.client";
+export * from "./platform-service.module";
+`;
+const envExampleContent = `APP_SERVICE_SLUG=replace-me-service
+APP_DISPLAY_NAME=Replace Me Service
+APP_REVISION=local
+APP_IMAGE=
+SERVICE_ACCESS_URL=
+SERVICE_ACCESS_INTERNAL_API_KEY=
+SERVICE_ACCESS_TIMEOUT_MS=3000
+PLATFORM_REGISTRATION_REQUIRED=false
+PLATFORM_MANIFEST_READ_TOKEN=
+`;
+const docsContent = `# Platform Service Runtime
+
+The service manifest declares metadata and capabilities. Service Access remains
+the catalog and grant authority; this recipe does not create a second registry.
+
+Call \`PlatformServiceRegistrationClient.register()\` during application
+bootstrap and \`heartbeat()\` from a bounded scheduled job. Both operations
+upsert the service through Service Access and carry runtime revision, image,
+health, correlation, and idempotency metadata. A skipped or failed result is not
+a successful registration.
+
+Set \`PLATFORM_REGISTRATION_REQUIRED=true\` in shared staging and production
+after the per-service key is provisioned. Keep the manifest endpoint private and
+protect it with a dedicated read token. Never expose internal endpoints through
+the public gateway.
+`;
+//# sourceMappingURL=platform-service-runtime.recipe.js.map

package/dist/commands/recipes/platform-service-runtime.recipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-service-runtime.recipe.js","sourceRoot":"","sources":["../../../src/commands/recipes/platform-service-runtime.recipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,8EAsCC;AA3CD,2CAA6B;AAC7B,kDAA0B;AAC1B,uDAA0E;AAC1E,uEAAuE;AAEhE,KAAK,UAAU,iCAAiC,CAAC,QAAgB;IACtE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,qCAAqC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEtD,MAAM,IAAA,oDAA0B,EAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,IAAA,sBAAS,EAAC,WAAW,CAAC,CAAC;IAC7B,MAAM,IAAA,sBAAS,EAAC,QAAQ,CAAC,CAAC;IAE1B,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,2BAA2B,CAAC,EAAE,YAAY,CAAC,CAAC;IACnF,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,8BAA8B,CAAC,EAAE,eAAe,CAAC,CAAC;IACzF,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,4BAA4B,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC5F,MAAM,IAAA,sBAAS,EACb,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,yCAAyC,CAAC,EACjE,yBAAyB,CAC1B,CAAC;IACF,MAAM,IAAA,sBAAS,EACb,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,yCAAyC,CAAC,EACjE,yBAAyB,CAC1B,CAAC;IACF,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,4BAA4B,CAAC,EAAE,aAAa,CAAC,CAAC;IACrF,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,MAAM,IAAA,sBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,6BAA6B,CAAC,EAAE,WAAW,CAAC,CAAC;IAEjF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC3D,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAAC;IACzF,MAAM,iBAAiB,GAAG,CAAC,MAAM,IAAA,uBAAU,EAAC,cAAc,CAAC,CAAC;QAC1D,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,cAAc,CAAC;IACnB,MAAM,IAAA,sBAAS,EAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,MAAM,CACV,kHAAkH,CACnH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0EpB,CAAC;AAEF,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BvB,CAAC;AAEF,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgC5B,CAAC;AAEF,MAAM,yBAAyB,GAAG;;;;;;;;;;;;CAYjC,CAAC;AAEF,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuIjC,CAAC;AAEF,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuBrB,CAAC;AAEF,MAAM,YAAY,GAAG;;;;;;CAMpB,CAAC;AAEF,MAAM,iBAAiB,GAAG;;;;;;;;;CASzB,CAAC;AAEF,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;CAenB,CAAC"}