stratal 0.0.1

package/dist/errors/get-http-status.js

@@ -0,0 +1,62 @@
+import { ERROR_CODES } from './error-codes';
+/**
+ * Maps error codes to HTTP status codes
+ *
+ * This utility is used by the frontend to set appropriate HTTP status codes
+ * when returning errors from API routes.
+ *
+ * @param code - Numeric error code from ERROR_CODES registry
+ * @returns HTTP status code (200-599)
+ */
+export function getHttpStatus(code) {
+    // Validation errors (1000-1999) → 400 Bad Request
+    if (code >= 1000 && code < 2000) {
+        return 400;
+    }
+    // Database errors (2000-2999)
+    if (code >= 2000 && code < 3000) {
+        // Record not found → 404
+        if (code === ERROR_CODES.DATABASE.RECORD_NOT_FOUND)
+            return 404;
+        // Unique constraint / conflict → 409
+        if (code === ERROR_CODES.DATABASE.UNIQUE_CONSTRAINT)
+            return 409;
+        // Other database errors → 500
+        return 500;
+    }
+    // Authentication errors (3000-3099) → 401 Unauthorized
+    if (code >= 3000 && code < 3100) {
+        return 401;
+    }
+    // Authorization errors (3100-3199) → 403 Forbidden
+    if (code >= 3100 && code < 3200) {
+        return 403;
+    }
+    // Resource not found (4000-4099) → 404 Not Found
+    if (code >= 4000 && code < 4100) {
+        return 404;
+    }
+    // Resource conflict (4100-4199) → 409 Conflict
+    if (code >= 4100 && code < 4200) {
+        return 409;
+    }
+    // Business logic errors (5000-5999)
+    if (code >= 5000 && code < 6000) {
+        // Domain-specific NOT_FOUND errors → 404
+        // 5000: NOTES.NOT_FOUND
+        // 5100: USERS.NOT_FOUND
+        // 5200: APPLICATIONS.NOT_FOUND
+        if (code === 5000 || code === 5100 || code === 5200) {
+            return 404;
+        }
+        // Other business logic errors → 422 Unprocessable Entity
+        return 422;
+    }
+    // System errors (9000-9999) → 500 Internal Server Error
+    if (code >= 9000) {
+        return 500;
+    }
+    // Default to 500 for unknown codes
+    return 500;
+}
+//# sourceMappingURL=get-http-status.js.map

package/dist/errors/get-http-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-http-status.js","sourceRoot":"","sources":["../../src/errors/get-http-status.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE3C;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,kDAAkD;IAClD,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAChC,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,8BAA8B;IAC9B,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAChC,yBAAyB;QACzB,IAAI,IAAI,KAAK,WAAW,CAAC,QAAQ,CAAC,gBAAgB;YAAE,OAAO,GAAG,CAAA;QAC9D,qCAAqC;QACrC,IAAI,IAAI,KAAK,WAAW,CAAC,QAAQ,CAAC,iBAAiB;YAAE,OAAO,GAAG,CAAA;QAC/D,8BAA8B;QAC9B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,uDAAuD;IACvD,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAChC,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,mDAAmD;IACnD,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAChC,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,iDAAiD;IACjD,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAChC,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,+CAA+C;IAC/C,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAChC,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,oCAAoC;IACpC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAChC,yCAAyC;QACzC,wBAAwB;QACxB,wBAAwB;QACxB,+BAA+B;QAC/B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACpD,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,yDAAyD;QACzD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,wDAAwD;IACxD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,mCAAmC;IACnC,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/errors/index.d.ts

@@ -0,0 +1,5 @@
+export { ApplicationError } from './application-error';
+export * from './get-http-status';
+export * from './is-application-error';
+export * from './error-codes';
+//# sourceMappingURL=index.d.ts.map

package/dist/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,eAAe,CAAA"}

package/dist/errors/index.js

@@ -0,0 +1,5 @@
+export { ApplicationError } from './application-error';
+export * from './get-http-status';
+export * from './is-application-error';
+export * from './error-codes';
+//# sourceMappingURL=index.js.map

package/dist/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,eAAe,CAAA"}

package/dist/errors/is-application-error.d.ts

@@ -0,0 +1,9 @@
+import { ApplicationError } from './application-error';
+/**
+ * Type guard to check if an error is an ApplicationError
+ *
+ * @param error - The error to check
+ * @returns True if the error is an ApplicationError instance
+ */
+export declare function isApplicationError(error: unknown): error is ApplicationError;
+//# sourceMappingURL=is-application-error.d.ts.map

package/dist/errors/is-application-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-application-error.d.ts","sourceRoot":"","sources":["../../src/errors/is-application-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E"}

package/dist/errors/is-application-error.js

@@ -0,0 +1,11 @@
+import { ApplicationError } from './application-error';
+/**
+ * Type guard to check if an error is an ApplicationError
+ *
+ * @param error - The error to check
+ * @returns True if the error is an ApplicationError instance
+ */
+export function isApplicationError(error) {
+    return error instanceof ApplicationError;
+}
+//# sourceMappingURL=is-application-error.js.map

package/dist/errors/is-application-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-application-error.js","sourceRoot":"","sources":["../../src/errors/is-application-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,KAAK,YAAY,gBAAgB,CAAA;AAC1C,CAAC"}

package/dist/guards/guard-execution.service.d.ts

@@ -0,0 +1,37 @@
+import type { Container } from '../di';
+import type { LoggerService } from '../logger';
+import type { RouterContext } from '../router';
+import type { Guard } from './types';
+/**
+ * Guard Execution Service
+ *
+ * Executes guards for a route and determines if the request should proceed.
+ * Guards are executed in order; all must pass for the request to proceed.
+ */
+export declare class GuardExecutionService {
+    private readonly logger;
+    constructor(logger: LoggerService);
+    /**
+     * Execute all guards for a route
+     *
+     * @param guards - Array of guards (classes or instances)
+     * @param context - Router context
+     * @param container - Request-scoped DI container
+     * @returns true if all guards pass
+     * @throws Error from first failing guard
+     */
+    executeGuards(guards: Guard[], context: RouterContext, container: Container): Promise<boolean>;
+    /**
+     * Resolve a guard to an instance
+     *
+     * @param guard - Guard class or instance
+     * @param container - Request-scoped DI container
+     * @returns Guard instance
+     */
+    private resolveGuard;
+    /**
+     * Type guard to check if value is a guard instance
+     */
+    private isGuardInstance;
+}
+//# sourceMappingURL=guard-execution.service.d.ts.map

package/dist/guards/guard-execution.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-execution.service.d.ts","sourceRoot":"","sources":["../../src/guards/guard-execution.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,KAAK,EAAe,KAAK,EAAE,MAAM,SAAS,CAAA;AAEjD;;;;;GAKG;AACH,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,aAAa;IAElD;;;;;;;;OAQG;IACG,aAAa,CACjB,MAAM,EAAE,KAAK,EAAE,EACf,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,OAAO,CAAC;IAiCnB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAUpB;;OAEG;IACH,OAAO,CAAC,eAAe;CASxB"}

package/dist/guards/guard-execution.service.js

@@ -0,0 +1,74 @@
+/**
+ * Guard Execution Service
+ *
+ * Executes guards for a route and determines if the request should proceed.
+ * Guards are executed in order; all must pass for the request to proceed.
+ */
+export class GuardExecutionService {
+    logger;
+    constructor(logger) {
+        this.logger = logger;
+    }
+    /**
+     * Execute all guards for a route
+     *
+     * @param guards - Array of guards (classes or instances)
+     * @param context - Router context
+     * @param container - Request-scoped DI container
+     * @returns true if all guards pass
+     * @throws Error from first failing guard
+     */
+    async executeGuards(guards, context, container) {
+        if (guards.length === 0) {
+            return true;
+        }
+        this.logger.debug('Executing guards', {
+            guardCount: guards.length,
+            path: context.c.req.path,
+            method: context.c.req.method,
+        });
+        for (const guard of guards) {
+            const guardInstance = this.resolveGuard(guard, container);
+            const canActivate = await guardInstance.canActivate(context);
+            if (!canActivate) {
+                this.logger.debug('Guard denied access', {
+                    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- guard.constructor may be null at runtime
+                    guard: guard.constructor?.name || 'AnonymousGuard',
+                    path: context.c.req.path,
+                });
+                return false;
+            }
+        }
+        this.logger.debug('All guards passed', {
+            guardCount: guards.length,
+            path: context.c.req.path,
+        });
+        return true;
+    }
+    /**
+     * Resolve a guard to an instance
+     *
+     * @param guard - Guard class or instance
+     * @param container - Request-scoped DI container
+     * @returns Guard instance
+     */
+    resolveGuard(guard, container) {
+        // If already an instance (has canActivate method), use directly
+        if (this.isGuardInstance(guard)) {
+            return guard;
+        }
+        // Otherwise, resolve from container
+        return container.resolve(guard);
+    }
+    /**
+     * Type guard to check if value is a guard instance
+     */
+    isGuardInstance(guard) {
+        return (typeof guard === 'object' &&
+            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- typeof null === 'object', null check is required
+            guard !== null &&
+            'canActivate' in guard &&
+            typeof guard.canActivate === 'function');
+    }
+}
+//# sourceMappingURL=guard-execution.service.js.map

package/dist/guards/guard-execution.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-execution.service.js","sourceRoot":"","sources":["../../src/guards/guard-execution.service.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAI,CAAC;IAEvD;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CACjB,MAAe,EACf,OAAsB,EACtB,SAAoB;QAEpB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE;YACpC,UAAU,EAAE,MAAM,CAAC,MAAM;YACzB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI;YACxB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;SAC7B,CAAC,CAAA;QAEF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;YACzD,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAE5D,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE;oBACvC,mHAAmH;oBACnH,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,IAAI,gBAAgB;oBAClD,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI;iBACzB,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACrC,UAAU,EAAE,MAAM,CAAC,MAAM;YACzB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI;SACzB,CAAC,CAAA;QAEF,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,KAAY,EAAE,SAAoB;QACrD,gEAAgE;QAChE,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAA;QACd,CAAC;QAED,oCAAoC;QACpC,OAAO,SAAS,CAAC,OAAO,CAAc,KAAK,CAAC,CAAA;IAC9C,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,KAAY;QAClC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,2HAA2H;YAC3H,KAAK,KAAK,IAAI;YACd,aAAa,IAAI,KAAK;YACtB,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU,CACxC,CAAA;IACH,CAAC;CACF"}

package/dist/guards/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Guard utilities for route protection
+ *
+ * This module provides:
+ * - Guard types and interfaces
+ * - UseGuards decorator for applying guards to controllers/methods
+ * - GuardExecutionService for executing guards
+ */
+export * from './types';
+export * from './use-guards.decorator';
+export { GuardExecutionService } from './guard-execution.service';
+//# sourceMappingURL=index.d.ts.map

package/dist/guards/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,SAAS,CAAA;AACvB,cAAc,wBAAwB,CAAA;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA"}

package/dist/guards/index.js

@@ -0,0 +1,12 @@
+/**
+ * Guard utilities for route protection
+ *
+ * This module provides:
+ * - Guard types and interfaces
+ * - UseGuards decorator for applying guards to controllers/methods
+ * - GuardExecutionService for executing guards
+ */
+export * from './types';
+export * from './use-guards.decorator';
+export { GuardExecutionService } from './guard-execution.service';
+//# sourceMappingURL=index.js.map

package/dist/guards/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,SAAS,CAAA;AACvB,cAAc,wBAAwB,CAAA;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA"}

package/dist/guards/types.d.ts

@@ -0,0 +1,60 @@
+import type { RouterContext } from '../router';
+import type { Constructor } from '../types';
+/**
+ * Interface for guards that control access to routes
+ *
+ * Guards are executed after middlewares but before route handlers.
+ * They determine if a request should be allowed to proceed.
+ *
+ * @example
+ * ```typescript
+ * class RoleGuard implements CanActivate {
+ *   constructor(private readonly role: string) {}
+ *
+ *   async canActivate(context: RouterContext): Promise<boolean> {
+ *     const user = context.getUser()
+ *     return user?.roles.includes(this.role) ?? false
+ *   }
+ * }
+ * ```
+ */
+export interface CanActivate {
+    /**
+     * Determine if the request should be allowed
+     *
+     * @param context - Router context with request/response helpers
+     * @returns true to allow, false to deny (throws 403)
+     */
+    canActivate(context: RouterContext): boolean | Promise<boolean>;
+}
+/**
+ * Type for guard class constructors
+ */
+export type GuardClass = Constructor<CanActivate>;
+/**
+ * Guard can be a class constructor or an instance
+ * Instances are used for factory-created guards with configuration
+ */
+export type Guard = GuardClass | CanActivate;
+/**
+ * Options for AuthGuard factory
+ */
+export interface AuthGuardOptions {
+    /**
+     * Required permissions (scopes) for authorization
+     * If provided, permission check is performed after authentication.
+     * If omitted, only authentication is required.
+     */
+    scopes?: string[];
+}
+/**
+ * Metadata stored by @UseGuards decorator
+ */
+export interface GuardMetadata {
+    guards: Guard[];
+}
+/**
+ * Metadata key for guard storage
+ */
+export declare const GUARD_METADATA_KEY: unique symbol;
+//# sourceMappingURL=types.d.ts.map

package/dist/guards/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/guards/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAE3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChE;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;AAEjD;;;GAGG;AACH,MAAM,MAAM,KAAK,GAAG,UAAU,GAAG,WAAW,CAAA;AAE5C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,KAAK,EAAE,CAAA;CAChB;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,eAAmB,CAAA"}

package/dist/guards/types.js

@@ -0,0 +1,5 @@
+/**
+ * Metadata key for guard storage
+ */
+export const GUARD_METADATA_KEY = Symbol('guards');
+//# sourceMappingURL=types.js.map

package/dist/guards/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/guards/types.ts"],"names":[],"mappings":"AA6DA;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA"}

package/dist/guards/use-guards.decorator.d.ts

@@ -0,0 +1,73 @@
+import { type Guard, type GuardMetadata } from './types';
+/**
+ * UseGuards Decorator
+ *
+ * Applies one or more guards to a controller or method.
+ * Guards are executed in order and all must pass for the request to proceed.
+ *
+ * **Execution Order:**
+ * 1. Request → Global Middlewares → Route Middlewares
+ * 2. **Guards (controller-level, then method-level)**
+ * 3. Route Handler
+ *
+ * **Guard Resolution:**
+ * - Guard classes are resolved from the request-scoped DI container
+ * - Guard instances (from factory functions) are used directly
+ *
+ * @param guards - Guard classes or instances to apply
+ *
+ * @example Authentication only
+ * ```typescript
+ * @TenantController('/api/v1/profile')
+ * @UseGuards(AuthGuard())
+ * export class ProfileController {
+ *   show() { } // Requires authentication
+ * }
+ * ```
+ *
+ * @example Authentication with permissions
+ * ```typescript
+ * @TenantController('/api/v1/students')
+ * @UseGuards(AuthGuard({ scopes: ['students:read'] }))
+ * export class StudentsController {
+ *   index() { } // Requires 'students:read' permission
+ * }
+ * ```
+ *
+ * @example Method-level guards
+ * ```typescript
+ * @TenantController('/api/v1/students')
+ * @UseGuards(AuthGuard()) // Controller-level: auth only
+ * export class StudentsController {
+ *   index() { } // Auth only (inherited)
+ *
+ *   @UseGuards(AuthGuard({ scopes: ['students:create'] }))
+ *   create() { } // Auth + 'students:create' permission
+ * }
+ * ```
+ *
+ * @example Multiple guards
+ * ```typescript
+ * @UseGuards(AuthGuard(), RateLimitGuard(), TenantGuard())
+ * export class SecureController {
+ *   // All guards must pass
+ * }
+ * ```
+ */
+export declare function UseGuards(...guards: Guard[]): ClassDecorator & MethodDecorator;
+/**
+ * Get controller-level guard metadata
+ *
+ * @param target - Controller class
+ * @returns Guard metadata or undefined if not decorated
+ */
+export declare function getControllerGuards(target: object): GuardMetadata | undefined;
+/**
+ * Get method-level guard metadata
+ *
+ * @param target - Controller prototype
+ * @param propertyKey - Method name
+ * @returns Guard metadata or undefined if not decorated
+ */
+export declare function getMethodGuards(target: object, propertyKey: string | symbol): GuardMetadata | undefined;
+//# sourceMappingURL=use-guards.decorator.d.ts.map

package/dist/guards/use-guards.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-guards.decorator.d.ts","sourceRoot":"","sources":["../../src/guards/use-guards.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,KAAK,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAgB,SAAS,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,GAAG,eAAe,CAY9E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,GAAG,SAAS,CAEvG"}

package/dist/guards/use-guards.decorator.js

@@ -0,0 +1,89 @@
+import { GUARD_METADATA_KEY } from './types';
+/**
+ * UseGuards Decorator
+ *
+ * Applies one or more guards to a controller or method.
+ * Guards are executed in order and all must pass for the request to proceed.
+ *
+ * **Execution Order:**
+ * 1. Request → Global Middlewares → Route Middlewares
+ * 2. **Guards (controller-level, then method-level)**
+ * 3. Route Handler
+ *
+ * **Guard Resolution:**
+ * - Guard classes are resolved from the request-scoped DI container
+ * - Guard instances (from factory functions) are used directly
+ *
+ * @param guards - Guard classes or instances to apply
+ *
+ * @example Authentication only
+ * ```typescript
+ * @TenantController('/api/v1/profile')
+ * @UseGuards(AuthGuard())
+ * export class ProfileController {
+ *   show() { } // Requires authentication
+ * }
+ * ```
+ *
+ * @example Authentication with permissions
+ * ```typescript
+ * @TenantController('/api/v1/students')
+ * @UseGuards(AuthGuard({ scopes: ['students:read'] }))
+ * export class StudentsController {
+ *   index() { } // Requires 'students:read' permission
+ * }
+ * ```
+ *
+ * @example Method-level guards
+ * ```typescript
+ * @TenantController('/api/v1/students')
+ * @UseGuards(AuthGuard()) // Controller-level: auth only
+ * export class StudentsController {
+ *   index() { } // Auth only (inherited)
+ *
+ *   @UseGuards(AuthGuard({ scopes: ['students:create'] }))
+ *   create() { } // Auth + 'students:create' permission
+ * }
+ * ```
+ *
+ * @example Multiple guards
+ * ```typescript
+ * @UseGuards(AuthGuard(), RateLimitGuard(), TenantGuard())
+ * export class SecureController {
+ *   // All guards must pass
+ * }
+ * ```
+ */
+export function UseGuards(...guards) {
+    return (target, propertyKey) => {
+        const metadata = { guards };
+        if (propertyKey !== undefined) {
+            // Method decorator - store on method
+            Reflect.defineMetadata(GUARD_METADATA_KEY, metadata, target, propertyKey);
+        }
+        else {
+            // Class decorator - store on class
+            Reflect.defineMetadata(GUARD_METADATA_KEY, metadata, target);
+        }
+    };
+}
+/**
+ * Get controller-level guard metadata
+ *
+ * @param target - Controller class
+ * @returns Guard metadata or undefined if not decorated
+ */
+export function getControllerGuards(target) {
+    return Reflect.getMetadata(GUARD_METADATA_KEY, target);
+}
+/**
+ * Get method-level guard metadata
+ *
+ * @param target - Controller prototype
+ * @param propertyKey - Method name
+ * @returns Guard metadata or undefined if not decorated
+ */
+export function getMethodGuards(target, propertyKey) {
+    return Reflect.getMetadata(GUARD_METADATA_KEY, target, propertyKey);
+}
+//# sourceMappingURL=use-guards.decorator.js.map

package/dist/guards/use-guards.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-guards.decorator.js","sourceRoot":"","sources":["../../src/guards/use-guards.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAkC,MAAM,SAAS,CAAA;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,UAAU,SAAS,CAAC,GAAG,MAAe;IAC1C,OAAO,CAAC,MAAc,EAAE,WAA6B,EAAE,EAAE;QACvD,MAAM,QAAQ,GAAkB,EAAE,MAAM,EAAE,CAAA;QAE1C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,qCAAqC;YACrC,OAAO,CAAC,cAAc,CAAC,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;QAC3E,CAAC;aAAM,CAAC;YACN,mCAAmC;YACnC,OAAO,CAAC,cAAc,CAAC,kBAAkB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,OAAO,CAAC,WAAW,CAAC,kBAAkB,EAAE,MAAM,CAA8B,CAAA;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,WAA4B;IAC1E,OAAO,OAAO,CAAC,WAAW,CAAC,kBAAkB,EAAE,MAAM,EAAE,WAAW,CAA8B,CAAA;AAClG,CAAC"}

package/dist/i18n/errors/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * I18n Module Errors
+ */
+export { LocaleNotSupportedError } from './locale-not-supported.error';
+export { TranslationMissingError } from './translation-missing.error';
+//# sourceMappingURL=index.d.ts.map

package/dist/i18n/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/i18n/errors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA"}

package/dist/i18n/errors/index.js

@@ -0,0 +1,6 @@
+/**
+ * I18n Module Errors
+ */
+export { LocaleNotSupportedError } from './locale-not-supported.error';
+export { TranslationMissingError } from './translation-missing.error';
+//# sourceMappingURL=index.js.map

package/dist/i18n/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/i18n/errors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA"}

package/dist/i18n/errors/locale-not-supported.error.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Locale Not Supported Error
+ * Thrown when an unsupported locale is requested
+ *
+ * HTTP Status: 500 Internal Server Error
+ * Error Code: 9301
+ */
+import { ApplicationError } from '../../infrastructure/error-handler';
+export declare class LocaleNotSupportedError extends ApplicationError {
+    constructor(locale: string, supportedLocales: string[]);
+}
+//# sourceMappingURL=locale-not-supported.error.d.ts.map

package/dist/i18n/errors/locale-not-supported.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locale-not-supported.error.d.ts","sourceRoot":"","sources":["../../../src/i18n/errors/locale-not-supported.error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AAErE,qBAAa,uBAAwB,SAAQ,gBAAgB;gBAC/C,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE;CAOvD"}

package/dist/i18n/errors/locale-not-supported.error.js

@@ -0,0 +1,15 @@
+/**
+ * Locale Not Supported Error
+ * Thrown when an unsupported locale is requested
+ *
+ * HTTP Status: 500 Internal Server Error
+ * Error Code: 9301
+ */
+import { ERROR_CODES } from '../../errors';
+import { ApplicationError } from '../../infrastructure/error-handler';
+export class LocaleNotSupportedError extends ApplicationError {
+    constructor(locale, supportedLocales) {
+        super('errors.localeNotSupported', ERROR_CODES.I18N.LOCALE_NOT_SUPPORTED, { locale, supportedLocales: supportedLocales.join(', ') });
+    }
+}
+//# sourceMappingURL=locale-not-supported.error.js.map

package/dist/i18n/errors/locale-not-supported.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"locale-not-supported.error.js","sourceRoot":"","sources":["../../../src/i18n/errors/locale-not-supported.error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AAErE,MAAM,OAAO,uBAAwB,SAAQ,gBAAgB;IAC3D,YAAY,MAAc,EAAE,gBAA0B;QACpD,KAAK,CACH,2BAA2B,EAC3B,WAAW,CAAC,IAAI,CAAC,oBAAoB,EACrC,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1D,CAAA;IACH,CAAC;CACF"}

package/dist/i18n/errors/translation-missing.error.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Translation Missing Error
+ * Thrown when a translation key is missing from all locales
+ *
+ * HTTP Status: 500 Internal Server Error
+ * Error Code: 9300
+ */
+import { ApplicationError } from '../../infrastructure/error-handler';
+export declare class TranslationMissingError extends ApplicationError {
+    constructor(key: string, locale: string);
+}
+//# sourceMappingURL=translation-missing.error.d.ts.map

package/dist/i18n/errors/translation-missing.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"translation-missing.error.d.ts","sourceRoot":"","sources":["../../../src/i18n/errors/translation-missing.error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AAErE,qBAAa,uBAAwB,SAAQ,gBAAgB;gBAC/C,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAOxC"}

package/dist/i18n/errors/translation-missing.error.js

@@ -0,0 +1,15 @@
+/**
+ * Translation Missing Error
+ * Thrown when a translation key is missing from all locales
+ *
+ * HTTP Status: 500 Internal Server Error
+ * Error Code: 9300
+ */
+import { ERROR_CODES } from '../../errors';
+import { ApplicationError } from '../../infrastructure/error-handler';
+export class TranslationMissingError extends ApplicationError {
+    constructor(key, locale) {
+        super('errors.translationMissing', ERROR_CODES.I18N.TRANSLATION_MISSING, { key, locale });
+    }
+}
+//# sourceMappingURL=translation-missing.error.js.map

package/dist/i18n/errors/translation-missing.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"translation-missing.error.js","sourceRoot":"","sources":["../../../src/i18n/errors/translation-missing.error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AAErE,MAAM,OAAO,uBAAwB,SAAQ,gBAAgB;IAC3D,YAAY,GAAW,EAAE,MAAc;QACrC,KAAK,CACH,2BAA2B,EAC3B,WAAW,CAAC,IAAI,CAAC,mBAAmB,EACpC,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAA;IACH,CAAC;CACF"}