@antasphere/chassis-server 1.0.0

package/dist/platform/entitlements.d.ts

@@ -0,0 +1,26 @@
+import type { EntitlementDecision, EntitlementService, MeteredAction, Principal, RequestQuota } from '@antasphere/chassis-contract';
+/**
+ * Default EntitlementService: everything is allowed, bounded only by
+ * instance-level env caps. The cloud/central edition swaps this via the
+ * registry for a credits-backed implementation; handlers only ever call
+ * `entitlements.check(...)` and never know the difference.
+ */
+export interface InstanceCaps {
+    maxFileSizeMb: number;
+    /** General-API quota defaults: sustained per-minute + 1 s spike cap (env-driven). */
+    apiRequestsPerMinute: number;
+    apiRequestsBurstPerSecond: number;
+}
+export declare class AllowAllEntitlements implements EntitlementService {
+    private readonly caps;
+    constructor(caps: InstanceCaps);
+    check(_principal: Principal, action: MeteredAction): Promise<EntitlementDecision>;
+    /**
+     * One flat instance-level quota for every principal. A plan-aware edition
+     * returns different values per plan here — the enforcing middleware keys
+     * buckets by (quota size, principal), so per-plan variation needs no other
+     * change.
+     */
+    getRequestQuota(_principal: Principal): Promise<RequestQuota>;
+}
+//# sourceMappingURL=entitlements.d.ts.map

package/dist/platform/entitlements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.d.ts","sourceRoot":"","sources":["../../src/platform/entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,SAAS,EACT,YAAY,EACb,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED,qBAAa,oBAAqB,YAAW,kBAAkB;IACjD,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,YAAY;IAEzC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAUvF;;;;;OAKG;IACG,eAAe,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;CAMpE"}

package/dist/platform/entitlements.js

@@ -0,0 +1,28 @@
+export class AllowAllEntitlements {
+    caps;
+    constructor(caps) {
+        this.caps = caps;
+    }
+    async check(_principal, action) {
+        if (action.key === 'files.upload' && action.unit === 'bytes') {
+            const max = this.caps.maxFileSizeMb * 1024 * 1024;
+            if (action.quantity > max) {
+                return { allowed: false, reason: `file exceeds MAX_FILE_SIZE_MB (${this.caps.maxFileSizeMb}MB)` };
+            }
+        }
+        return { allowed: true };
+    }
+    /**
+     * One flat instance-level quota for every principal. A plan-aware edition
+     * returns different values per plan here — the enforcing middleware keys
+     * buckets by (quota size, principal), so per-plan variation needs no other
+     * change.
+     */
+    async getRequestQuota(_principal) {
+        return {
+            perMinute: this.caps.apiRequestsPerMinute,
+            burstPerSecond: this.caps.apiRequestsBurstPerSecond
+        };
+    }
+}
+//# sourceMappingURL=entitlements.js.map

package/dist/platform/entitlements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.js","sourceRoot":"","sources":["../../src/platform/entitlements.ts"],"names":[],"mappings":"AAqBA,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,IAAkB;QAAlB,SAAI,GAAJ,IAAI,CAAc;IAAG,CAAC;IAEnD,KAAK,CAAC,KAAK,CAAC,UAAqB,EAAE,MAAqB;QACtD,IAAI,MAAM,CAAC,GAAG,KAAK,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC;YAClD,IAAI,MAAM,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,EAAE,CAAC;YACpG,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,UAAqB;QACzC,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB;YACzC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,yBAAyB;SACpD,CAAC;IACJ,CAAC;CACF"}

package/dist/platform/events.d.ts

@@ -0,0 +1,87 @@
+import type { Logger } from '../logger.js';
+/**
+ * Internal event bus: domain modules publish, platform modules (and later
+ * rail/ee modules registered at boot) subscribe. Deliberately synchronous
+ * fan-out with error isolation — a failing subscriber never breaks the
+ * publisher's request path.
+ */
+export type PlatformEvents = {
+    /**
+     * Fired by the identity layer (Better Auth databaseHooks.user.create.after,
+     * wired in boot) for EVERY account entrance — setup, invitation accept,
+     * collaborator claim, future SSO JIT. Trustworthy by construction; call
+     * sites never emit it.
+     */
+    'user.created': {
+        userId: string;
+        email: string;
+    };
+    'member.joined': {
+        workspaceId: string;
+        userId: string;
+        role: string;
+    };
+    'member.updated': {
+        workspaceId: string;
+        userId: string;
+    };
+    'member.removed': {
+        workspaceId: string;
+        userId: string;
+    };
+    'apikey.created': {
+        workspaceId: string;
+        apiKeyId: string;
+    };
+    'apikey.revoked': {
+        workspaceId: string;
+        apiKeyId: string;
+    };
+    'invitation.created': {
+        workspaceId: string;
+        invitationId: string;
+    };
+    'invitation.accepted': {
+        workspaceId: string;
+        invitationId: string;
+        userId: string;
+    };
+    'file.uploaded': {
+        workspaceId: string;
+        fileId: string;
+        sizeBytes: number;
+    };
+    /** workspaceId is null on the cloud edition — setup creates no workspace there. */
+    /** A person created ANOTHER workspace from inside the product (POST /workspaces). */
+    'workspace.created': {
+        workspaceId: string;
+        ownerUserId: string;
+    };
+    'setup.completed': {
+        workspaceId: string | null;
+        instanceId: string;
+    };
+};
+/**
+ * The events a bus carries: the chassis ones plus the tool's own (`TExtra`, a
+ * map of event name to payload, declared by the tool that instantiates the bus).
+ */
+export type EventMap<TExtra = {}> = PlatformEvents & TExtra;
+type Handler<M, E extends keyof M> = (payload: M[E]) => void | Promise<void>;
+export declare class EventBus<TExtra = {}> {
+    private readonly logger;
+    private handlers;
+    constructor(logger: Logger);
+    on<E extends keyof EventMap<TExtra>>(event: E, handler: Handler<EventMap<TExtra>, E>): () => void;
+    /**
+     * The SAME bus as the chassis sees it: the generic events only. The
+     * composition code is generic over the tool's event map, and a bus is
+     * invariant in it (it both takes and hands out payloads), so the chassis
+     * modules, written against the generic map, read the bus through this view.
+     * Sound as long as a tool never re-declares a chassis event name.
+     */
+    chassisView(): EventBus;
+    emit<E extends keyof EventMap<TExtra>>(event: E, payload: EventMap<TExtra>[E]): void;
+}
+export {};
+//# sourceMappingURL=events.d.ts.map

package/dist/platform/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/platform/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;;OAKG;IACH,cAAc,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,eAAe,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,gBAAgB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,gBAAgB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,gBAAgB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,gBAAgB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,oBAAoB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,qBAAqB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrF,eAAe,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5E,mFAAmF;IACnF,qFAAqF;IACrF,mBAAmB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,iBAAiB,EAAE;QAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE,CAAC;AAEF;;;GAGG;AAEH,MAAM,MAAM,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,cAAc,GAAG,MAAM,CAAC;AAE5D,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAG7E,qBAAa,QAAQ,CAAC,MAAM,GAAG,EAAE;IAGnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,QAAQ,CAA4E;gBAE/D,MAAM,EAAE,MAAM;IAE3C,EAAE,CAAC,CAAC,SAAS,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,IAAI;IAOjG;;;;;;OAMG;IACH,WAAW,IAAI,QAAQ;IAIvB,IAAI,CAAC,CAAC,SAAS,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;CAOrF"}

package/dist/platform/events.js

@@ -0,0 +1,32 @@
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+export class EventBus {
+    logger;
+    handlers = new Map();
+    constructor(logger) {
+        this.logger = logger;
+    }
+    on(event, handler) {
+        const set = this.handlers.get(event) ?? new Set();
+        set.add(handler);
+        this.handlers.set(event, set);
+        return () => set.delete(handler);
+    }
+    /**
+     * The SAME bus as the chassis sees it: the generic events only. The
+     * composition code is generic over the tool's event map, and a bus is
+     * invariant in it (it both takes and hands out payloads), so the chassis
+     * modules, written against the generic map, read the bus through this view.
+     * Sound as long as a tool never re-declares a chassis event name.
+     */
+    chassisView() {
+        return this;
+    }
+    emit(event, payload) {
+        for (const handler of this.handlers.get(event) ?? []) {
+            Promise.resolve(handler(payload)).catch((err) => {
+                this.logger.error({ err, event }, 'event handler failed');
+            });
+        }
+    }
+}
+//# sourceMappingURL=events.js.map

package/dist/platform/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/platform/events.ts"],"names":[],"mappings":"AAuCA,mEAAmE;AACnE,MAAM,OAAO,QAAQ;IAGU;IAFrB,QAAQ,GAAG,IAAI,GAAG,EAAiE,CAAC;IAE5F,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,EAAE,CAAmC,KAAQ,EAAE,OAAqC;QAClF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,OAA2C,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,OAA2C,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;OAMG;IACH,WAAW;QACT,OAAO,IAA2B,CAAC;IACrC,CAAC;IAED,IAAI,CAAmC,KAAQ,EAAE,OAA4B;QAC3E,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,OAAO,CAAC,OAAO,CAAE,OAAwC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,sBAAsB,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/platform/index.d.ts

@@ -0,0 +1,8 @@
+export { AllowAllEntitlements } from './entitlements.js';
+export { EventBus } from './events.js';
+export { type PlatformRegistry, createRegistry } from './registry.js';
+export { NoopUsageSink } from './usage.js';
+export { WorkspaceService } from './workspaces.js';
+export { bindEditionSeams } from './edition.js';
+export { LocalIdentityProvider } from './local-identity.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/platform/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/platform/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,KAAK,gBAAgB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/platform/index.js

@@ -0,0 +1,8 @@
+export { AllowAllEntitlements } from './entitlements.js';
+export { EventBus } from './events.js';
+export { createRegistry } from './registry.js';
+export { NoopUsageSink } from './usage.js';
+export { WorkspaceService } from './workspaces.js';
+export { bindEditionSeams } from './edition.js';
+export { LocalIdentityProvider } from './local-identity.js';
+//# sourceMappingURL=index.js.map

package/dist/platform/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/platform/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAyB,cAAc,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/platform/local-identity.d.ts

@@ -0,0 +1,39 @@
+import { type Db } from '@antasphere/chassis-db';
+import { type IdentityProvider, type InstanceAuthDescriptor, type Principal, type RequestContext } from '@antasphere/chassis-contract';
+import type { Auth } from '../identity/better-auth.js';
+import { type OnWorkspaceMiss } from '../identity/resolve-membership.js';
+/**
+ * The template's default IdentityProvider: Better Auth sessions + a LIVE
+ * workspace_members re-check on every request. The membership row — not the
+ * cookie — is the authorization decision, so deactivating a member locks
+ * them out instantly regardless of cookie age.
+ *
+ * Workspace scoping (ADR 014, user-scoped credential model): a session
+ * resolves to exactly ONE workspace per request via the shared
+ * resolveMembership rule — the X-Workspace-Id header names it (ACTIVE
+ * membership required, else null: fail closed, an unknown workspace and a
+ * workspace the user does not belong to are indistinguishable); without the
+ * header the user's default membership wins, else the deterministic oldest
+ * active membership.
+ *
+ * API-key and OAuth-bearer resolution live in the auth-context middleware
+ * (they are credential formats, not identity sources) and share the SAME
+ * selection rule; this provider is the seam the central account service
+ * replaces later.
+ */
+export declare class LocalIdentityProvider implements IdentityProvider {
+    private readonly auth;
+    private readonly db;
+    private readonly hasGoogle;
+    private readonly hasOtp;
+    private readonly hasPasswordReset;
+    private readonly hasEmailChange;
+    /** Cloud only: one cached reconcile on a well-formed selector miss. */
+    private readonly onWorkspaceMiss?;
+    constructor(auth: Auth, db: Db, hasGoogle: boolean, hasOtp?: boolean, hasPasswordReset?: boolean, hasEmailChange?: boolean, 
+    /** Cloud only: one cached reconcile on a well-formed selector miss. */
+    onWorkspaceMiss?: OnWorkspaceMiss | undefined);
+    resolve(ctx: RequestContext): Promise<Principal | null>;
+    describe(): InstanceAuthDescriptor;
+}
+//# sourceMappingURL=local-identity.d.ts.map

package/dist/platform/local-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-identity.d.ts","sourceRoot":"","sources":["../../src/platform/local-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,mCAAmC,CAAC;AAE3C;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,qBAAsB,YAAW,gBAAgB;IAE1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAPhB,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,EAAE,EACN,SAAS,EAAE,OAAO,EAClB,MAAM,GAAE,OAAe,EACvB,gBAAgB,GAAE,OAAe,EACjC,cAAc,GAAE,OAAe;IAChD,uEAAuE;IACtD,eAAe,CAAC,EAAE,eAAe,GAAG,SAAS;IAG1D,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IA8B7D,QAAQ,IAAI,sBAAsB;CAanC"}

package/dist/platform/local-identity.js

@@ -0,0 +1,87 @@
+import {} from '@antasphere/chassis-db';
+import { ACTIVE_WORKSPACE_HEADER } from '@antasphere/chassis-contract';
+import { isWorkspaceSelector, resolveMembership } from '../identity/resolve-membership.js';
+/**
+ * The template's default IdentityProvider: Better Auth sessions + a LIVE
+ * workspace_members re-check on every request. The membership row — not the
+ * cookie — is the authorization decision, so deactivating a member locks
+ * them out instantly regardless of cookie age.
+ *
+ * Workspace scoping (ADR 014, user-scoped credential model): a session
+ * resolves to exactly ONE workspace per request via the shared
+ * resolveMembership rule — the X-Workspace-Id header names it (ACTIVE
+ * membership required, else null: fail closed, an unknown workspace and a
+ * workspace the user does not belong to are indistinguishable); without the
+ * header the user's default membership wins, else the deterministic oldest
+ * active membership.
+ *
+ * API-key and OAuth-bearer resolution live in the auth-context middleware
+ * (they are credential formats, not identity sources) and share the SAME
+ * selection rule; this provider is the seam the central account service
+ * replaces later.
+ */
+export class LocalIdentityProvider {
+    auth;
+    db;
+    hasGoogle;
+    hasOtp;
+    hasPasswordReset;
+    hasEmailChange;
+    onWorkspaceMiss;
+    constructor(auth, db, hasGoogle, hasOtp = false, hasPasswordReset = false, hasEmailChange = false, 
+    /** Cloud only: one cached reconcile on a well-formed selector miss. */
+    onWorkspaceMiss) {
+        this.auth = auth;
+        this.db = db;
+        this.hasGoogle = hasGoogle;
+        this.hasOtp = hasOtp;
+        this.hasPasswordReset = hasPasswordReset;
+        this.hasEmailChange = hasEmailChange;
+        this.onWorkspaceMiss = onWorkspaceMiss;
+    }
+    async resolve(ctx) {
+        const session = await this.auth.api.getSession({
+            headers: ctx.headers
+        });
+        if (!session?.user)
+            return null;
+        const requested = ctx.headers.get(ACTIVE_WORKSPACE_HEADER)?.trim() || null;
+        let row = await resolveMembership(this.db, session.user.id, requested);
+        if (!row && requested && this.onWorkspaceMiss && isWorkspaceSelector(requested)) {
+            // Unknown-workspace deep-link retry (cloud): the named workspace may
+            // be a hub org granted since the last pass. One cached reconcile, one
+            // re-run of the SAME lookup — no recursion.
+            await this.onWorkspaceMiss(session.user.id, requested);
+            row = await resolveMembership(this.db, session.user.id, requested);
+        }
+        if (!row)
+            return null;
+        return {
+            userId: session.user.id,
+            email: session.user.email,
+            name: session.user.name,
+            workspaceId: row.workspaceId,
+            role: row.role,
+            origin: row.origin,
+            via: 'session',
+            scopes: null,
+            ...(row.accountRef ? { accountRef: row.accountRef } : {})
+        };
+    }
+    describe() {
+        // 'oauth' is always on: every instance is an OAuth 2.1 AS for its /mcp (M6).
+        const methods = ['password', 'api-key', 'oauth'];
+        if (this.hasOtp)
+            methods.push('email-otp');
+        if (this.hasGoogle)
+            methods.push('google');
+        return {
+            methods,
+            passwordReset: this.hasPasswordReset,
+            emailChange: this.hasEmailChange,
+            // Opt-in TOTP needs no email driver — always available on the template.
+            twoFactor: true
+        };
+    }
+}
+//# sourceMappingURL=local-identity.js.map

package/dist/platform/local-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-identity.js","sourceRoot":"","sources":["../../src/platform/local-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,EACL,uBAAuB,EAKxB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EAElB,MAAM,mCAAmC,CAAC;AAE3C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,qBAAqB;IAEb;IACA;IACA;IACA;IACA;IACA;IAEA;IARnB,YACmB,IAAU,EACV,EAAM,EACN,SAAkB,EAClB,SAAkB,KAAK,EACvB,mBAA4B,KAAK,EACjC,iBAA0B,KAAK;IAChD,uEAAuE;IACtD,eAA6C;QAP7C,SAAI,GAAJ,IAAI,CAAM;QACV,OAAE,GAAF,EAAE,CAAI;QACN,cAAS,GAAT,SAAS,CAAS;QAClB,WAAM,GAAN,MAAM,CAAiB;QACvB,qBAAgB,GAAhB,gBAAgB,CAAiB;QACjC,mBAAc,GAAd,cAAc,CAAiB;QAE/B,oBAAe,GAAf,eAAe,CAA8B;IAC7D,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,GAAmB;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAC7C,OAAO,EAAE,GAAG,CAAC,OAAkB;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,IAAI;YAAE,OAAO,IAAI,CAAC;QAEhC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAC3E,IAAI,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC,eAAe,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;YAChF,qEAAqE;YACrE,sEAAsE;YACtE,4CAA4C;YAC5C,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACvD,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;YACvB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,SAAS;YACd,MAAM,EAAE,IAAI;YACZ,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,6EAA6E;QAC7E,MAAM,OAAO,GAAsC,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,OAAO;YACL,OAAO;YACP,aAAa,EAAE,IAAI,CAAC,gBAAgB;YACpC,WAAW,EAAE,IAAI,CAAC,cAAc;YAChC,wEAAwE;YACxE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;CACF"}

package/dist/platform/registry.d.ts

@@ -0,0 +1,23 @@
+import type { EntitlementService, IdentityProvider, UsageSink } from '@antasphere/chassis-contract';
+import type { EventBus } from './events.js';
+import type { WorkspaceService } from './workspaces.js';
+/**
+ * Boot-time module registry: the single place where seam implementations are
+ * bound. The template binds local defaults; a rail-connected or ee edition
+ * re-binds its own implementations here at boot (Cal.com/n8n pattern) and
+ * nothing else in the codebase changes.
+ */
+export interface PlatformRegistry<TExtra = {}> {
+    identity: IdentityProvider;
+    entitlements: EntitlementService;
+    usage: UsageSink;
+    events: EventBus<TExtra>;
+    /**
+     * Workspace lifecycle (ADR 014). Setup creates the FIRST workspace through
+     * it; product flows that open workspace creation (the cloud edition's lazy
+     * org projection) call it here instead of inserting rows themselves.
+     */
+    workspaces: WorkspaceService;
+}
+export declare function createRegistry<TExtra = {}>(defaults: PlatformRegistry<TExtra>): PlatformRegistry<TExtra>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/platform/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/platform/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACpG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;GAKG;AAEH,MAAM,WAAW,gBAAgB,CAAC,MAAM,GAAG,EAAE;IAC3C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,kBAAkB,CAAC;IACjC,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzB;;;;OAIG;IACH,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAGD,wBAAgB,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAExG"}

package/dist/platform/registry.js

@@ -0,0 +1,5 @@
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+export function createRegistry(defaults) {
+    return { ...defaults };
+}
+//# sourceMappingURL=registry.js.map

package/dist/platform/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/platform/registry.ts"],"names":[],"mappings":"AAwBA,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAc,QAAkC;IAC5E,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;AACzB,CAAC"}

package/dist/platform/usage.d.ts

@@ -0,0 +1,11 @@
+import type { UsageEvent, UsageSink } from '@antasphere/chassis-contract';
+/**
+ * Default UsageSink: drop everything. Domain code always emits usage events
+ * (they double as local analytics hooks); only a rail-connected sink turns
+ * them into billing. Zero phone-home is the default posture — nothing leaves
+ * the instance unless an operator explicitly configures a sink.
+ */
+export declare class NoopUsageSink implements UsageSink {
+    emit(_event: UsageEvent): Promise<void>;
+}
+//# sourceMappingURL=usage.d.ts.map

package/dist/platform/usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.d.ts","sourceRoot":"","sources":["../../src/platform/usage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE1E;;;;;GAKG;AACH,qBAAa,aAAc,YAAW,SAAS;IACvC,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAG9C"}

package/dist/platform/usage.js

@@ -0,0 +1,12 @@
+/**
+ * Default UsageSink: drop everything. Domain code always emits usage events
+ * (they double as local analytics hooks); only a rail-connected sink turns
+ * them into billing. Zero phone-home is the default posture — nothing leaves
+ * the instance unless an operator explicitly configures a sink.
+ */
+export class NoopUsageSink {
+    async emit(_event) {
+        // intentionally empty
+    }
+}
+//# sourceMappingURL=usage.js.map

package/dist/platform/usage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.js","sourceRoot":"","sources":["../../src/platform/usage.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACxB,KAAK,CAAC,IAAI,CAAC,MAAkB;QAC3B,sBAAsB;IACxB,CAAC;CACF"}

package/dist/platform/workspaces.d.ts

@@ -0,0 +1,25 @@
+import { type DbConn } from '@antasphere/chassis-db';
+/**
+ * Workspace lifecycle — the template's one creation path (ADR 014). Setup
+ * creates the FIRST workspace through it; products that open their own
+ * workspace-creation flow (a hub's sign-up, a cloud edition's lazy org
+ * projection) call it via the platform registry instead of hand-rolling
+ * the two inserts. The template exposed no HTTP endpoint for this (workspace
+ * creation is a product decision); the chassis took that decision with
+ * `POST /workspaces` (api/workspaces.ts, PRDCT-2444): sessions only, capped
+ * per person, and still through THIS service — never a second insert path.
+ */
+export declare class WorkspaceService {
+    private readonly db;
+    constructor(db: DbConn);
+    /**
+     * Create a workspace with `ownerUserId` as its ACTIVE OWNER — one unit:
+     * pass a transaction handle (`conn`) to join an enclosing transaction
+     * (setup does), or omit it to run the two inserts on this service's
+     * connection inside their own transaction when it supports one.
+     */
+    create(name: string, ownerUserId: string, conn?: DbConn): Promise<{
+        workspaceId: string;
+    }>;
+}
+//# sourceMappingURL=workspaces.d.ts.map

package/dist/platform/workspaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaces.d.ts","sourceRoot":"","sources":["../../src/platform/workspaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEnF;;;;;;;;;GASG;AACH,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,MAAM;IAEvC;;;;;OAKG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE,MAAgB,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAmB1G"}

package/dist/platform/workspaces.js

@@ -0,0 +1,44 @@
+import { workspaceMembers, workspaces } from '@antasphere/chassis-db';
+/**
+ * Workspace lifecycle — the template's one creation path (ADR 014). Setup
+ * creates the FIRST workspace through it; products that open their own
+ * workspace-creation flow (a hub's sign-up, a cloud edition's lazy org
+ * projection) call it via the platform registry instead of hand-rolling
+ * the two inserts. The template exposed no HTTP endpoint for this (workspace
+ * creation is a product decision); the chassis took that decision with
+ * `POST /workspaces` (api/workspaces.ts, PRDCT-2444): sessions only, capped
+ * per person, and still through THIS service — never a second insert path.
+ */
+export class WorkspaceService {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * Create a workspace with `ownerUserId` as its ACTIVE OWNER — one unit:
+     * pass a transaction handle (`conn`) to join an enclosing transaction
+     * (setup does), or omit it to run the two inserts on this service's
+     * connection inside their own transaction when it supports one.
+     */
+    async create(name, ownerUserId, conn = this.db) {
+        const run = async (tx) => {
+            const [workspace] = await tx.insert(workspaces).values({ name }).returning({ id: workspaces.id });
+            if (!workspace)
+                throw new Error('workspace insert returned no row');
+            await tx.insert(workspaceMembers).values({
+                workspaceId: workspace.id,
+                userId: ownerUserId,
+                role: 'owner'
+            });
+            return { workspaceId: workspace.id };
+        };
+        // A DbConn may already BE a transaction (no .transaction on the type);
+        // when the caller hands us a plain Db, wrap the pair so a workspace can
+        // never exist without its owner membership.
+        if ('transaction' in conn && typeof conn.transaction === 'function') {
+            return conn.transaction(async (tx) => run(tx));
+        }
+        return run(conn);
+    }
+}
+//# sourceMappingURL=workspaces.js.map

package/dist/platform/workspaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaces.js","sourceRoot":"","sources":["../../src/platform/workspaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAe,MAAM,wBAAwB,CAAC;AAEnF;;;;;;;;;GASG;AACH,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,EAAU;QAAV,OAAE,GAAF,EAAE,CAAQ;IAAG,CAAC;IAE3C;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,WAAmB,EAAE,OAAe,IAAI,CAAC,EAAE;QACpE,MAAM,GAAG,GAAG,KAAK,EAAE,EAAU,EAAE,EAAE;YAC/B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAClG,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACpE,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;gBACvC,WAAW,EAAE,SAAS,CAAC,EAAE;gBACzB,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;YACH,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;QACvC,CAAC,CAAC;QACF,uEAAuE;QACvE,wEAAwE;QACxE,4CAA4C;QAC5C,IAAI,aAAa,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;CACF"}

package/dist/projects/access.d.ts

@@ -0,0 +1,40 @@
+import { type SQL, type SQLWrapper } from 'drizzle-orm';
+import type { Principal, ProjectRole } from '@antasphere/chassis-contract';
+import { type DbConn } from '@antasphere/chassis-db';
+export interface ProjectGrantOptions {
+    /** The least role that satisfies the predicate. */
+    atLeast: ProjectRole;
+    /** `write` adds the archived-write rule; `read` does not look at the archive. */
+    access: 'read' | 'write';
+}
+/**
+ * A boolean SQL expression over `projectId`, a column (or expression) of the
+ * CALLER's query that holds a project id: the tool's link table column, or
+ * `projects.id` itself. The aliases are prefixed so they cannot collide with
+ * the ones of the query the predicate is embedded in.
+ *
+ * **Pass a QUALIFIED reference when the predicate lands in a SELECT LIST.**
+ * drizzle renders a column object of a single-table select WITHOUT its table
+ * name there (`"id"`), and inside this subquery a bare `"id"` binds to the
+ * subquery's own tables: ambiguous at best, always-true at worst. A raw
+ * `sql\`"link_table"."project_id"\`` (or `PROJECTS_ID` below) is immune; a
+ * column object is safe in a WHERE, where drizzle always qualifies it.
+ */
+export declare function projectGrantPredicate(principal: Pick<Principal, 'userId' | 'workspaceId' | 'role' | 'origin'>, projectId: SQLWrapper, opts: ProjectGrantOptions): SQL;
+/** `projects.id`, always qualified: safe in a select list as in a WHERE (see above). */
+export declare const PROJECTS_ID: SQL;
+/**
+ * The caller's effective role on a project AS A SQL EXPRESSION over a project
+ * id column: `manager`, `editor`, `viewer`, or NULL (no read). Built from the
+ * predicate above, never beside it. Archive-blind on purpose: a role is a
+ * READ fact, and whether an act is allowed on an archived project is the
+ * act's own question (`access: 'write'`, or the route's 409).
+ */
+export declare function projectRoleExpression(principal: Pick<Principal, 'userId' | 'workspaceId' | 'role' | 'origin'>, projectId: SQLWrapper): SQL<ProjectRole | null>;
+/**
+ * The effective role of `principal` on one project of the request's
+ * workspace, or null. **null = 404**: no such project here, or a project the
+ * principal cannot read; the two must stay indistinguishable to the caller.
+ */
+export declare function projectRole(conn: DbConn, principal: Pick<Principal, 'userId' | 'workspaceId' | 'role' | 'origin'>, projectId: string): Promise<ProjectRole | null>;
+//# sourceMappingURL=access.d.ts.map

package/dist/projects/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/projects/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,KAAK,GAAG,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAY,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA0C/D,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,OAAO,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC,EACxE,SAAS,EAAE,UAAU,EACrB,IAAI,EAAE,mBAAmB,GACxB,GAAG,CAkDL;AAED,wFAAwF;AACxF,eAAO,MAAM,WAAW,EAAE,GAAgC,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC,EACxE,SAAS,EAAE,UAAU,GACpB,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,CAQzB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC,EACxE,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAO7B"}