openxiangda-nest 2.0.0-alpha.100

package/dist/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../src/authz.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAOjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAEV,eAAe,EAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAEL,+BAA+B,EAChC,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAEV,sBAAsB,EAEtB,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,iBAAiB,GAAI,YAAY,MAAM,qFACM,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,uBAAuB,IAEnE,QAAQ,MAAM,EACd,cAAc,MAAM,GAAG,MAAM,EAC7B,aAAa,uBAAuB,CAAC,GAAG,CAAC,UAgB5C;AAED,eAAO,MAAM,gBAAgB,mDAQ5B,CAAC;AAEF,eAAO,MAAM,WAAW,mDAGvB,CAAC;AAEF,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,0BAA0B,GACnC,sBAAsB,CAiBxB;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,eAAe,EAC1B,SAAS,CAAC,EAAE,MAAM,EAAE,GACnB,sBAAsB,CAaxB;AAED,eAAO,MAAM,kBAAkB,mDAG9B,CAAC;AAEF,eAAO,MAAM,2BAA2B,mDAUvC,CAAC;AAEF,eAAO,MAAM,yBAAyB,mDAGrC,CAAC;AAEF,qBACa,qBAAsB,YAAW,WAAW;IAGrD,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAGjC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAwF9D,OAAO,CAAC,mBAAmB;IAmB3B,OAAO,CAAC,gBAAgB;CAgCzB"}

package/dist/authz.js

@@ -0,0 +1,207 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { ForbiddenException, Inject, Injectable, SetMetadata, UnauthorizedException, createParamDecorator, } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { SCHEMA_VERSIONS } from "openxiangda-contracts";
+import { isOpenXiangdaInfrastructureController } from "./infrastructure-controller.js";
+import { OPENXIANGDA_OPERATION_CONTRACT, OPENXIANGDA_REQUIRED_CAPABILITY, } from "./tokens.js";
+export const RequireCapability = (capability) => SetMetadata(OPENXIANGDA_REQUIRED_CAPABILITY, capability);
+/**
+ * Binds one controller route to the immutable App API contract and protects it
+ * with the same generated capability constant. The release verifier can inspect
+ * this metadata without bootstrapping application business code.
+ */
+export function OpenXiangdaOperation(operation) {
+    return (target, propertyKey, descriptor) => {
+        SetMetadata(OPENXIANGDA_OPERATION_CONTRACT, operation)(target, propertyKey, descriptor);
+        SetMetadata(OPENXIANGDA_REQUIRED_CAPABILITY, operation.requiredCapability)(target, propertyKey, descriptor);
+    };
+}
+export const CurrentPrincipal = createParamDecorator((_data, context) => {
+    const principal = requireContext(context).principal;
+    if (principal.principalType !== "user") {
+        throw new UnauthorizedException("OPENXIANGDA_USER_PRINCIPAL_REQUIRED");
+    }
+    return principal;
+});
+export const CurrentUser = createParamDecorator((_data, context) => currentUserFromVerifiedContext(requireContext(context)));
+export function currentUserFromVerifiedContext(verified) {
+    const principal = verified.principal;
+    if (principal.principalType === "developer") {
+        return {
+            userId: principal.userId,
+            displayName: principal.displayName,
+            appCode: principal.appCode,
+            environmentKey: principal.environmentKey,
+            roleCodes: [...principal.roleCodes],
+            isAppSuperAdmin: principal.isAppSuperAdmin,
+            capabilityCodes: [...principal.capabilityCodes],
+        };
+    }
+    if (principal.principalType !== "user") {
+        throw new UnauthorizedException("OPENXIANGDA_USER_PRINCIPAL_REQUIRED");
+    }
+    return currentUserFromPrincipal(principal, verified.roleCodes);
+}
+export function currentUserFromPrincipal(principal, roleCodes) {
+    const verifiedRoleCodes = roleCodes ||
+        principal.roleCodes || [];
+    return {
+        userId: principal.userId,
+        displayName: principal.displayName,
+        appCode: principal.appCode,
+        environmentKey: principal.environmentKey,
+        roleCodes: [...new Set(verifiedRoleCodes)],
+        isAppSuperAdmin: principal.isAppSuperAdmin,
+        capabilityCodes: [...principal.capabilities],
+    };
+}
+export const CurrentPerspective = createParamDecorator((_data, context) => requireContext(context).perspectiveCode);
+export const CurrentApplicationPrincipal = createParamDecorator((_data, context) => {
+    const principal = requireContext(context).principal;
+    if (principal.principalType !== "service") {
+        throw new UnauthorizedException("OPENXIANGDA_APPLICATION_PRINCIPAL_REQUIRED");
+    }
+    return principal;
+});
+export const CurrentOpenXiangdaContext = createParamDecorator((_data, context) => requireContext(context));
+let OpenXiangdaAuthzGuard = class OpenXiangdaAuthzGuard {
+    reflector;
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    async canActivate(context) {
+        if (context.getType() !== "http")
+            return true;
+        if (isOpenXiangdaInfrastructureController(context.getClass()))
+            return true;
+        const request = context.switchToHttp().getRequest();
+        const operation = this.reflector.getAllAndOverride(OPENXIANGDA_OPERATION_CONTRACT, [context.getHandler(), context.getClass()]);
+        if (request.openxiangda?.principal.principalType === "developer") {
+            // The platform current endpoint has validated the short-lived Dev Session
+            // and returned the complete role/capability union. Data operations remain
+            // platform-authorized through the same session.
+            const capability = this.reflector.getAllAndOverride(OPENXIANGDA_REQUIRED_CAPABILITY, [context.getHandler(), context.getClass()]);
+            if (capability &&
+                !request.openxiangda.principal.isAppSuperAdmin &&
+                !request.openxiangda.principal.capabilityCodes.includes(capability)) {
+                throw new ForbiddenException({
+                    code: "OPENXIANGDA_CAPABILITY_DENIED",
+                    capability,
+                });
+            }
+            if (operation)
+                request.openxiangda.operation = operation;
+            return true;
+        }
+        const invocation = request.openxiangdaInvocation;
+        if (!invocation) {
+            throw new UnauthorizedException("OPENXIANGDA_GATEWAY_CONTEXT_REQUIRED");
+        }
+        const { authorization, perspectiveCode } = invocation;
+        const capability = this.reflector.getAllAndOverride(OPENXIANGDA_REQUIRED_CAPABILITY, [context.getHandler(), context.getClass()]);
+        if (invocation.principal.principalType === "application") {
+            const application = invocation.principal;
+            if (!application.scopes.includes("app:invoke")) {
+                throw new ForbiddenException({
+                    code: "OPENXIANGDA_APPLICATION_INVOKE_DENIED",
+                });
+            }
+            if (!capability) {
+                throw new ForbiddenException({
+                    code: "OPENXIANGDA_SERVICE_CAPABILITY_REQUIRED",
+                });
+            }
+            if (!application.scopes.includes(capability)) {
+                throw new ForbiddenException({
+                    code: "OPENXIANGDA_CAPABILITY_DENIED",
+                    capability,
+                });
+            }
+            request.openxiangda = {
+                principal: this.servicePrincipal(application, invocation.target),
+                authorization,
+                perspectiveCode: null,
+                ...(operation ? { operation } : {}),
+            };
+            return true;
+        }
+        if (this.isVerifiedRoleUnion(invocation.principal)) {
+            const roleCodes = [...new Set(invocation.principal.roleCodes)];
+            request.openxiangda = {
+                principal: invocation.principal,
+                authorization,
+                perspectiveCode,
+                roleCodes,
+                ...(operation ? { operation } : {}),
+            };
+            if (capability &&
+                !invocation.principal.isAppSuperAdmin &&
+                !invocation.principal.capabilities.includes(capability)) {
+                throw new ForbiddenException({
+                    code: "OPENXIANGDA_CAPABILITY_DENIED",
+                    capability,
+                });
+            }
+            return true;
+        }
+        throw new UnauthorizedException("OPENXIANGDA_USER_UNION_REQUIRED");
+    }
+    isVerifiedRoleUnion(principal) {
+        return ((principal.subjectKind === "role_union" ||
+            principal.subjectKind === "super_admin") &&
+            Array.isArray(principal.roleCodes) &&
+            principal.roleCodes.length <= 32 &&
+            principal.roleCodes.every(code => /^[A-Za-z0-9._:-]{1,128}$/.test(code)) &&
+            Array.isArray(principal.capabilities) &&
+            principal.capabilities.length <= 2000 &&
+            principal.capabilities.every(code => /^[A-Za-z0-9*._:-]{1,256}$/.test(code)));
+    }
+    servicePrincipal(input, target) {
+        return {
+            schemaVersion: SCHEMA_VERSIONS.principal,
+            tenantId: input.tenantId,
+            appCode: input.appCode,
+            environmentKey: input.environmentKey,
+            environmentId: target.environmentId,
+            appVersionId: target.appVersionId,
+            deploymentRunId: target.deploymentRunId,
+            environmentHeadRevision: target.headRevision,
+            backendRevisionId: target.backendRevisionId,
+            principalType: "service",
+            subjectId: input.clientId,
+            clientRecordId: input.clientRecordId,
+            clientId: input.clientId,
+            credentialVersion: input.credentialVersion,
+            scopes: input.scopes,
+            rateLimitPerMinute: input.rateLimitPerMinute,
+            tokenId: input.tokenId,
+            authzVersion: input.credentialVersion,
+            isAppSuperAdmin: false,
+        };
+    }
+};
+OpenXiangdaAuthzGuard = __decorate([
+    Injectable(),
+    __param(0, Inject(Reflector)),
+    __metadata("design:paramtypes", [Reflector])
+], OpenXiangdaAuthzGuard);
+export { OpenXiangdaAuthzGuard };
+function requireContext(context) {
+    const request = context.switchToHttp().getRequest();
+    if (!request.openxiangda) {
+        throw new UnauthorizedException("OPENXIANGDA_CONTEXT_NOT_VERIFIED");
+    }
+    return request.openxiangda;
+}
+//# sourceMappingURL=authz.js.map

package/dist/authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../src/authz.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAGL,kBAAkB,EAClB,MAAM,EACN,UAAU,EACV,WAAW,EACX,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAMzC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAC;AACvF,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,aAAa,CAAC;AAQrB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAkB,EAAE,EAAE,CACtD,WAAW,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAkC;IACrE,OAAO,CACL,MAAc,EACd,WAA6B,EAC7B,UAAyC,EACzC,EAAE;QACF,WAAW,CAAC,8BAA8B,EAAE,SAAS,CAAC,CACpD,MAAM,EACN,WAA8B,EAC9B,UAA0C,CAC3C,CAAC;QACF,WAAW,CACT,+BAA+B,EAC/B,SAAS,CAAC,kBAAkB,CAC7B,CACC,MAAM,EACN,WAA8B,EAC9B,UAA0C,CAC3C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAClD,CAAC,KAAc,EAAE,OAAyB,EAAmB,EAAE;IAC7D,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC;IACpD,IAAI,SAAS,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAC7C,CAAC,KAAc,EAAE,OAAyB,EAA0B,EAAE,CACpE,8BAA8B,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAC1D,CAAC;AAEF,MAAM,UAAU,8BAA8B,CAC5C,QAAoC;IAEpC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACrC,IAAI,SAAS,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC;YACnC,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC;SAChD,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,SAA0B,EAC1B,SAAoB;IAEpB,MAAM,iBAAiB,GACrB,SAAS;QACT,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC;IAC5B,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC1C,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CACpD,CAAC,KAAc,EAAE,OAAyB,EAAiB,EAAE,CAC3D,cAAc,CAAC,OAAO,CAAC,CAAC,eAAe,CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAC7D,CAAC,KAAc,EAAE,OAAyB,EAA+B,EAAE;IACzE,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC;IACpD,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,qBAAqB,CAC7B,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,SAAwC,CAAC;AAClD,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAC3D,CAAC,KAAc,EAAE,OAAyB,EAA8B,EAAE,CACxE,cAAc,CAAC,OAAO,CAAC,CAC1B,CAAC;AAGK,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAGb;IAFnB,YAEmB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,qCAAqC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAA0B,CAAC;QAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAChD,8BAA8B,EAC9B,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QACF,IAAI,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;YACjE,0EAA0E;YAC1E,0EAA0E;YAC1E,gDAAgD;YAChD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACjD,+BAA+B,EAC/B,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;YACF,IACE,UAAU;gBACV,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe;gBAC9C,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EACnE,CAAC;gBACD,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,IAAI,EAAE,+BAA+B;oBACrC,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YACD,IAAI,SAAS;gBAAE,OAAO,CAAC,WAAW,CAAC,SAAS,GAAG,SAAS,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,qBAAqB,CAAC,sCAAsC,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,UAAU,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACjD,+BAA+B,EAC/B,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QACF,IAAI,UAAU,CAAC,SAAS,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;YACzD,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC;YACzC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,IAAI,EAAE,uCAAuC;iBAC9C,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,IAAI,EAAE,yCAAyC;iBAChD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,IAAI,EAAE,+BAA+B;oBACrC,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,WAAW,GAAG;gBACpB,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC;gBAChE,aAAa;gBACb,eAAe,EAAE,IAAI;gBACrB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,WAAW,GAAG;gBACpB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,aAAa;gBACb,eAAe;gBACf,SAAS;gBACT,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC,CAAC;YACF,IACE,UAAU;gBACV,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe;gBACrC,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EACvD,CAAC;gBACD,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,IAAI,EAAE,+BAA+B;oBACrC,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,iCAAiC,CAAC,CAAC;IACrE,CAAC;IAEO,mBAAmB,CACzB,SAA0B;QAE1B,OAAO,CACL,CAAC,SAAS,CAAC,WAAW,KAAK,YAAY;YACrC,SAAS,CAAC,WAAW,KAAK,aAAa,CAAC;YAC1C,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;YAClC,SAAS,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE;YAChC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAC/B,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CACtC;YACD,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;YACrC,SAAS,CAAC,YAAY,CAAC,MAAM,IAAI,IAAI;YACrC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAClC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CACvC,CACF,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,KAAkC,EAClC,MAMC;QAED,OAAO;YACL,aAAa,EAAE,eAAe,CAAC,SAAS;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,uBAAuB,EAAE,MAAM,CAAC,YAAY;YAC5C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,iBAAiB;YACrC,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;CACF,CAAA;AAjJY,qBAAqB;IADjC,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,SAAS,CAAC,CAAA;qCACU,SAAS;GAH5B,qBAAqB,CAiJjC;;AAED,SAAS,cAAc,CAAC,OAAyB;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAA0B,CAAC;IAC5E,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,CAAC;AAC7B,CAAC"}

package/dist/bootstrap.d.ts

@@ -0,0 +1,15 @@
+import type { Type } from '@nestjs/common';
+import { type NestFastifyApplication } from '@nestjs/platform-fastify';
+export interface OpenXiangdaApplicationBootstrapOptions {
+    port?: number;
+    host?: string;
+    trustProxy?: boolean;
+}
+/**
+ * Starts the canonical OpenXiangda 2.0 NestJS runtime.
+ *
+ * Raw body capture is part of the gateway assertion contract, so applications
+ * must not reproduce the NestFactory/Fastify setup themselves.
+ */
+export declare function bootstrapOpenXiangdaApplication(rootModule: Type<unknown>, options?: OpenXiangdaApplicationBootstrapOptions): Promise<NestFastifyApplication>;
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../src/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,sCAAsC;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAyBD;;;;;GAKG;AACH,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,EACzB,OAAO,GAAE,sCAA2C,GACnD,OAAO,CAAC,sBAAsB,CAAC,CA0BjC"}

package/dist/bootstrap.js

@@ -0,0 +1,40 @@
+import { NestFactory } from '@nestjs/core';
+import { FastifyAdapter, } from '@nestjs/platform-fastify';
+const STRUCTURED_CLOUD_EVENT_CONTENT_TYPE = 'application/cloudevents+json';
+const STRUCTURED_CLOUD_EVENT_BODY_LIMIT = 65_536;
+class OpenXiangdaFastifyAdapter extends FastifyAdapter {
+    registerParserMiddleware(prefix, rawBody) {
+        super.registerParserMiddleware(prefix, rawBody);
+        const fastify = this.getInstance();
+        const { onProtoPoisoning, onConstructorPoisoning } = fastify.initialConfig;
+        const jsonParser = fastify.getDefaultJsonParser(onProtoPoisoning ?? 'error', onConstructorPoisoning ?? 'error');
+        this.useBodyParser(STRUCTURED_CLOUD_EVENT_CONTENT_TYPE, rawBody === true, { bodyLimit: STRUCTURED_CLOUD_EVENT_BODY_LIMIT }, (request, body, done) => jsonParser(request, body.toString('utf8'), done));
+    }
+}
+/**
+ * Starts the canonical OpenXiangda 2.0 NestJS runtime.
+ *
+ * Raw body capture is part of the gateway assertion contract, so applications
+ * must not reproduce the NestFactory/Fastify setup themselves.
+ */
+export async function bootstrapOpenXiangdaApplication(rootModule, options = {}) {
+    if (!options || typeof options !== 'object' || Array.isArray(options)) {
+        throw new Error('OPENXIANGDA_BOOTSTRAP_OPTIONS_OBJECT_REQUIRED');
+    }
+    const allowedOptionKeys = new Set(['port', 'host', 'trustProxy']);
+    const unknownOption = Object.keys(options).find(key => !allowedOptionKeys.has(key));
+    if (unknownOption) {
+        throw new Error(`OPENXIANGDA_BOOTSTRAP_OPTION_UNKNOWN:${unknownOption}`);
+    }
+    const app = await NestFactory.create(rootModule, new OpenXiangdaFastifyAdapter({
+        trustProxy: options.trustProxy ?? true,
+    }), { rawBody: true });
+    app.enableShutdownHooks();
+    const production = process.env.NODE_ENV === 'production';
+    const port = options.port ??
+        Number(process.env.OPENXIANGDA_APP_PORT || process.env.PORT || 3000);
+    const host = options.host ?? (production ? '0.0.0.0' : '127.0.0.1');
+    await app.listen(port, host);
+    return app;
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../src/bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACL,cAAc,GAEf,MAAM,0BAA0B,CAAC;AAQlC,MAAM,mCAAmC,GAAG,8BAA8B,CAAC;AAC3E,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAEjD,MAAM,yBAA0B,SAAQ,cAAc;IAC3C,wBAAwB,CAAC,MAAe,EAAE,OAAiB;QAClE,KAAK,CAAC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEhD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3E,MAAM,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAC7C,gBAAgB,IAAI,OAAO,EAC3B,sBAAsB,IAAI,OAAO,CAClC,CAAC;QACF,IAAI,CAAC,aAAa,CAChB,mCAAmC,EACnC,OAAO,KAAK,IAAI,EAChB,EAAE,SAAS,EAAE,iCAAiC,EAAE,EAChD,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CACtB,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CACnD,CAAC;IACJ,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAyB,EACzB,UAAkD,EAAE;IAEpD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC7C,GAAG,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACnC,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,wCAAwC,aAAa,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAClC,UAAU,EACV,IAAI,yBAAyB,CAAC;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;KACvC,CAAC,EACF,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;IACF,GAAG,CAAC,mBAAmB,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACzD,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/business-action-context.d.ts

@@ -0,0 +1,14 @@
+import type { OpenXiangdaBusinessActionContext, OpenXiangdaHttpRequest } from './types.js';
+export interface OpenXiangdaBusinessActionRuntimeContext {
+    authorization: string;
+    perspectiveCode: string | null;
+    action: OpenXiangdaBusinessActionContext;
+}
+/**
+ * Resolves immutable Named Action metadata from the verified request.
+ *
+ * The authorization value is the short-lived platform invocation (or bounded
+ * Connected Dev Session), never the caller's original login token.
+ */
+export declare function requireOpenXiangdaBusinessActionContext(request: OpenXiangdaHttpRequest): OpenXiangdaBusinessActionRuntimeContext;
+//# sourceMappingURL=business-action-context.d.ts.map

package/dist/business-action-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-action-context.d.ts","sourceRoot":"","sources":["../src/business-action-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gCAAgC,EAChC,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,uCAAuC;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,gCAAgC,CAAC;CAC1C;AAED;;;;;GAKG;AACH,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,sBAAsB,GAC9B,uCAAuC,CAyCzC"}

package/dist/business-action-context.js

@@ -0,0 +1,41 @@
+import { UnauthorizedException } from '@nestjs/common';
+/**
+ * Resolves immutable Named Action metadata from the verified request.
+ *
+ * The authorization value is the short-lived platform invocation (or bounded
+ * Connected Dev Session), never the caller's original login token.
+ */
+export function requireOpenXiangdaBusinessActionContext(request) {
+    const verified = request.openxiangda;
+    if (!verified) {
+        throw new UnauthorizedException('OPENXIANGDA_CONTEXT_NOT_VERIFIED');
+    }
+    if (!verified.operation) {
+        throw new UnauthorizedException('OPENXIANGDA_BUSINESS_ACTION_OPERATION_REQUIRED');
+    }
+    if (verified.principal.principalType !== 'user' &&
+        verified.principal.principalType !== 'developer') {
+        throw new UnauthorizedException('OPENXIANGDA_BUSINESS_ACTION_USER_CONTEXT_REQUIRED');
+    }
+    return {
+        authorization: verified.authorization,
+        perspectiveCode: verified.perspectiveCode,
+        action: {
+            code: verified.operation.code,
+            requiredCapability: verified.operation.requiredCapability,
+            ...(() => {
+                const value = request.headers['x-request-id'];
+                const requestId = String(Array.isArray(value) ? value[0] || '' : value || '').trim();
+                return /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(requestId)
+                    ? { requestId }
+                    : {};
+            })(),
+            ...(verified.connectedDevelopmentSessionToken
+                ? {
+                    connectedDevelopmentSessionToken: verified.connectedDevelopmentSessionToken,
+                }
+                : {}),
+        },
+    };
+}
+//# sourceMappingURL=business-action-context.js.map

package/dist/business-action-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-action-context.js","sourceRoot":"","sources":["../src/business-action-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAYvD;;;;;GAKG;AACH,MAAM,UAAU,uCAAuC,CACrD,OAA+B;IAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,qBAAqB,CAC7B,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,SAAS,CAAC,aAAa,KAAK,MAAM;QAC3C,QAAQ,CAAC,SAAS,CAAC,aAAa,KAAK,WAAW,EAChD,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI;YAC7B,kBAAkB,EAAE,QAAQ,CAAC,SAAS,CAAC,kBAAkB;YACzD,GAAG,CAAC,GAAG,EAAE;gBACP,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBAC9C,MAAM,SAAS,GAAG,MAAM,CACtB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CACpD,CAAC,IAAI,EAAE,CAAC;gBACT,OAAO,qCAAqC,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC1D,CAAC,CAAC,EAAE,SAAS,EAAE;oBACf,CAAC,CAAC,EAAE,CAAC;YACT,CAAC,CAAC,EAAE;YACJ,GAAG,CAAC,QAAQ,CAAC,gCAAgC;gBAC3C,CAAC,CAAC;oBACE,gCAAgC,EAC9B,QAAQ,CAAC,gCAAgC;iBAC5C;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC"}

package/dist/business-directory.d.ts

@@ -0,0 +1,14 @@
+import type { CurrentInitiatorDirectorySnapshot } from 'openxiangda-contracts';
+import { OpenXiangdaPlatformClient } from './platform-client.js';
+import type { OpenXiangdaHttpRequest } from './types.js';
+/**
+ * Request-scoped access to directory facts declared by the active Named Action.
+ * The initiator is always derived from the verified gateway invocation.
+ */
+export declare class OpenXiangdaBusinessDirectoryService {
+    private readonly request;
+    private readonly platform;
+    constructor(request: OpenXiangdaHttpRequest, platform: OpenXiangdaPlatformClient);
+    currentInitiator(): Promise<CurrentInitiatorDirectorySnapshot>;
+}
+//# sourceMappingURL=business-directory.d.ts.map

package/dist/business-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-directory.d.ts","sourceRoot":"","sources":["../src/business-directory.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAE/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD;;;GAGG;AACH,qBACa,mCAAmC;IAE3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAEzC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFS,OAAO,EAAE,sBAAsB,EAEhD,QAAQ,EAAE,yBAAyB;IAGhD,gBAAgB,IAAI,OAAO,CAAC,iCAAiC,CAAC;CAOrE"}

package/dist/business-directory.js

@@ -0,0 +1,40 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable, Scope } from '@nestjs/common';
+import { REQUEST } from '@nestjs/core';
+import { requireOpenXiangdaBusinessActionContext } from './business-action-context.js';
+import { OpenXiangdaPlatformClient } from './platform-client.js';
+/**
+ * Request-scoped access to directory facts declared by the active Named Action.
+ * The initiator is always derived from the verified gateway invocation.
+ */
+let OpenXiangdaBusinessDirectoryService = class OpenXiangdaBusinessDirectoryService {
+    request;
+    platform;
+    constructor(request, platform) {
+        this.request = request;
+        this.platform = platform;
+    }
+    async currentInitiator() {
+        const context = requireOpenXiangdaBusinessActionContext(this.request);
+        return await this.platform.resolveCurrentInitiator(context.authorization, context.action);
+    }
+};
+OpenXiangdaBusinessDirectoryService = __decorate([
+    Injectable({ scope: Scope.REQUEST }),
+    __param(0, Inject(REQUEST)),
+    __param(1, Inject(OpenXiangdaPlatformClient)),
+    __metadata("design:paramtypes", [Object, OpenXiangdaPlatformClient])
+], OpenXiangdaBusinessDirectoryService);
+export { OpenXiangdaBusinessDirectoryService };
+//# sourceMappingURL=business-directory.js.map

package/dist/business-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-directory.js","sourceRoot":"","sources":["../src/business-directory.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAGjE;;;GAGG;AAEI,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAEV;IAEjB;IAHnB,YACoC,OAA+B,EAEhD,QAAmC;QAFlB,YAAO,GAAP,OAAO,CAAwB;QAEhD,aAAQ,GAAR,QAAQ,CAA2B;IACnD,CAAC;IAEJ,KAAK,CAAC,gBAAgB;QACpB,MAAM,OAAO,GAAG,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAChD,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;CACF,CAAA;AAdY,mCAAmC;IAD/C,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAGhC,WAAA,MAAM,CAAC,OAAO,CAAC,CAAA;IACf,WAAA,MAAM,CAAC,yBAAyB,CAAC,CAAA;6CACP,yBAAyB;GAJ3C,mCAAmC,CAc/C"}

package/dist/business-notification.d.ts

@@ -0,0 +1,23 @@
+import type { BusinessNotificationSendV2, EventBusinessNotificationSendV2 } from 'openxiangda-contracts';
+import { OpenXiangdaApplicationCredentials } from './application-credentials.js';
+import { OpenXiangdaEventContext } from './event-context.js';
+import { OpenXiangdaPlatformClient } from './platform-client.js';
+import type { OpenXiangdaHttpRequest } from './types.js';
+export type OpenXiangdaBusinessNotificationInput = Omit<BusinessNotificationSendV2, 'environmentKey'>;
+export type OpenXiangdaEventBusinessNotificationInput = Omit<EventBusinessNotificationSendV2, 'environmentKey'>;
+/**
+ * Channel-neutral Notification Hub facade for an authorized Named Action.
+ *
+ * The platform revalidates the action proof and promotes the call to the exact
+ * app/environment application principal while retaining the initiator audit.
+ */
+export declare class OpenXiangdaBusinessNotificationService {
+    private readonly request;
+    private readonly platform;
+    private readonly credentials;
+    private readonly eventContext;
+    constructor(request: OpenXiangdaHttpRequest, platform: OpenXiangdaPlatformClient, credentials: OpenXiangdaApplicationCredentials, eventContext: OpenXiangdaEventContext);
+    send(input: OpenXiangdaBusinessNotificationInput): Promise<import("openxiangda-contracts").NotificationMessageV2>;
+    sendFromEvent(input: OpenXiangdaEventBusinessNotificationInput): Promise<import("openxiangda-contracts").NotificationMessageV2>;
+}
+//# sourceMappingURL=business-notification.d.ts.map

package/dist/business-notification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-notification.d.ts","sourceRoot":"","sources":["../src/business-notification.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,0BAA0B,EAC1B,+BAA+B,EAChC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AAEjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,MAAM,oCAAoC,GAAG,IAAI,CACrD,0BAA0B,EAC1B,gBAAgB,CACjB,CAAC;AACF,MAAM,MAAM,yCAAyC,GAAG,IAAI,CAC1D,+BAA+B,EAC/B,gBAAgB,CACjB,CAAC;AAEF;;;;;GAKG;AACH,qBACa,sCAAsC;IAE9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAEzC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBANK,OAAO,EAAE,sBAAsB,EAEhD,QAAQ,EAAE,yBAAyB,EAEnC,WAAW,EAAE,iCAAiC,EAE9C,YAAY,EAAE,uBAAuB;IAGlD,IAAI,CAAC,KAAK,EAAE,oCAAoC;IAShD,aAAa,CAAC,KAAK,EAAE,yCAAyC;CAUrE"}

package/dist/business-notification.js

@@ -0,0 +1,58 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable, Scope, UnauthorizedException } from '@nestjs/common';
+import { REQUEST } from '@nestjs/core';
+import { OpenXiangdaApplicationCredentials } from './application-credentials.js';
+import { requireOpenXiangdaBusinessActionContext } from './business-action-context.js';
+import { OpenXiangdaEventContext } from './event-context.js';
+import { OpenXiangdaPlatformClient } from './platform-client.js';
+/**
+ * Channel-neutral Notification Hub facade for an authorized Named Action.
+ *
+ * The platform revalidates the action proof and promotes the call to the exact
+ * app/environment application principal while retaining the initiator audit.
+ */
+let OpenXiangdaBusinessNotificationService = class OpenXiangdaBusinessNotificationService {
+    request;
+    platform;
+    credentials;
+    eventContext;
+    constructor(request, platform, credentials, eventContext) {
+        this.request = request;
+        this.platform = platform;
+        this.credentials = credentials;
+        this.eventContext = eventContext;
+    }
+    async send(input) {
+        const context = requireOpenXiangdaBusinessActionContext(this.request);
+        return await this.platform.sendBusinessNotification(context.authorization, input, context.action);
+    }
+    async sendFromEvent(input) {
+        if (!this.eventContext.current()) {
+            throw new UnauthorizedException('OPENXIANGDA_BUSINESS_NOTIFICATION_EVENT_CONTEXT_REQUIRED');
+        }
+        return await this.credentials.withAuthorization(async (authorization) => await this.platform.sendEventNotification(authorization, input));
+    }
+};
+OpenXiangdaBusinessNotificationService = __decorate([
+    Injectable({ scope: Scope.REQUEST }),
+    __param(0, Inject(REQUEST)),
+    __param(1, Inject(OpenXiangdaPlatformClient)),
+    __param(2, Inject(OpenXiangdaApplicationCredentials)),
+    __param(3, Inject(OpenXiangdaEventContext)),
+    __metadata("design:paramtypes", [Object, OpenXiangdaPlatformClient,
+        OpenXiangdaApplicationCredentials,
+        OpenXiangdaEventContext])
+], OpenXiangdaBusinessNotificationService);
+export { OpenXiangdaBusinessNotificationService };
+//# sourceMappingURL=business-notification.js.map

package/dist/business-notification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-notification.js","sourceRoot":"","sources":["../src/business-notification.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAKvC,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAYjE;;;;;GAKG;AAEI,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAEb;IAEjB;IAEA;IAEA;IAPnB,YACoC,OAA+B,EAEhD,QAAmC,EAEnC,WAA8C,EAE9C,YAAqC;QANpB,YAAO,GAAP,OAAO,CAAwB;QAEhD,aAAQ,GAAR,QAAQ,CAA2B;QAEnC,gBAAW,GAAX,WAAW,CAAmC;QAE9C,iBAAY,GAAZ,YAAY,CAAyB;IACrD,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,KAA2C;QACpD,MAAM,OAAO,GAAG,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CACjD,OAAO,CAAC,aAAa,EACrB,KAAK,EACL,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAgD;QAClE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,qBAAqB,CAC7B,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,KAAK,EAAC,aAAa,EAAC,EAAE,CACpE,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,aAAa,EAAE,KAAK,CAAC,CAChE,CAAC;IACJ,CAAC;CACF,CAAA;AA9BY,sCAAsC;IADlD,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAGhC,WAAA,MAAM,CAAC,OAAO,CAAC,CAAA;IACf,WAAA,MAAM,CAAC,yBAAyB,CAAC,CAAA;IAEjC,WAAA,MAAM,CAAC,iCAAiC,CAAC,CAAA;IAEzC,WAAA,MAAM,CAAC,uBAAuB,CAAC,CAAA;6CAHL,yBAAyB;QAEtB,iCAAiC;QAEhC,uBAAuB;GAR7C,sCAAsC,CA8BlD"}

package/dist/business-process.d.ts

@@ -0,0 +1,23 @@
+import { type BusinessProcessAnswer, type BusinessProcessCommand, type BusinessProcessCommit, type BusinessProcessPoll, type BusinessProcessReceipt, type BusinessProcessRetry, type ProcessCommandSurface } from 'openxiangda-contracts';
+import { OpenXiangdaPlatformClient } from './platform-client.js';
+import type { OpenXiangdaHttpRequest } from './types.js';
+export type OpenXiangdaBusinessProcessCommitInput = Omit<BusinessProcessCommit, 'schemaVersion' | 'environmentKey'>;
+/**
+ * Durable business mutation + Workflow command facade for verified Named Actions.
+ * The operation proof is derived exclusively from the gateway-verified request.
+ */
+export declare class OpenXiangdaBusinessProcessService {
+    private readonly request;
+    private readonly platform;
+    constructor(request: OpenXiangdaHttpRequest, platform: OpenXiangdaPlatformClient);
+    commit(input: OpenXiangdaBusinessProcessCommitInput): Promise<BusinessProcessCommand>;
+    status(commandId: string): Promise<BusinessProcessCommand>;
+    receipt(commandId: string): Promise<BusinessProcessReceipt>;
+    poll(commandId: string, afterRevision?: number): Promise<BusinessProcessPoll>;
+    surface(commandId: string): Promise<ProcessCommandSurface>;
+    answer(commandId: string, input: Omit<BusinessProcessAnswer, 'schemaVersion'>): Promise<BusinessProcessCommand>;
+    retry(commandId: string, input: Omit<BusinessProcessRetry, 'schemaVersion'>): Promise<BusinessProcessCommand>;
+    private context;
+    private assertDeclared;
+}
+//# sourceMappingURL=business-process.d.ts.map

package/dist/business-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-process.d.ts","sourceRoot":"","sources":["../src/business-process.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,MAAM,qCAAqC,GAAG,IAAI,CACtD,qBAAqB,EACrB,eAAe,GAAG,gBAAgB,CACnC,CAAC;AAEF;;;GAGG;AACH,qBACa,iCAAiC;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAEzC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFS,OAAO,EAAE,sBAAsB,EAEhD,QAAQ,EAAE,yBAAyB;IAGhD,MAAM,CACV,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,sBAAsB,CAAC;IAa5B,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAY1D,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAW3D,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,SAAI,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAYxE,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAW1D,MAAM,CACV,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,eAAe,CAAC,GAClD,OAAO,CAAC,sBAAsB,CAAC;IAa5B,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,GACjD,OAAO,CAAC,sBAAsB,CAAC;IAalC,OAAO,CAAC,OAAO;IAkCf,OAAO,CAAC,cAAc;CAWvB"}