@baruk/core 0.1.0 → 0.3.0

package/dist/billing/repository.js

@@ -0,0 +1,167 @@
+import { NotFoundError, uuidv7 } from '@baruk/shared';
+function mapFee(r) {
+    return {
+        id: r.id,
+        clientId: r.client_id,
+        description: r.description,
+        amount: Number(r.amount),
+        periodicity: r.periodicity,
+        dueDay: r.due_day,
+        billingMethod: r.billing_method,
+        discount: Number(r.discount),
+        finePercent: Number(r.fine_percent),
+        interestPercent: Number(r.interest_percent),
+        status: r.status,
+        startsOn: r.starts_on ? r.starts_on.toISOString().slice(0, 10) : null,
+        endsOn: r.ends_on ? r.ends_on.toISOString().slice(0, 10) : null,
+        createdAt: r.created_at.toISOString(),
+    };
+}
+const FEE_COLS = `
+  id, client_id, description, amount, periodicity, due_day, billing_method,
+  discount, fine_percent, interest_percent, status, starts_on, ends_on, created_at
+`;
+export async function createFeeAgreement(tx, input) {
+    const rows = await tx `
+    INSERT INTO fee_agreement (
+      id, tenant_id, client_id, description, amount, periodicity, due_day,
+      billing_method, discount, fine_percent, interest_percent, starts_on, created_by
+    ) VALUES (
+      ${uuidv7()}, current_setting('app.current_tenant')::uuid, ${input.clientId},
+      ${input.description ?? 'Honorários'}, ${input.amount}, ${input.periodicity ?? 'monthly'},
+      ${input.dueDay ?? null}, ${input.billingMethod ?? 'pix'}, ${input.discount ?? 0},
+      ${input.finePercent ?? 0}, ${input.interestPercent ?? 0}, ${input.startsOn ?? null}, ${input.createdBy ?? null}
+    )
+    RETURNING ${tx.unsafe(FEE_COLS)}
+  `;
+    return mapFee(rows[0]);
+}
+export async function listFeeAgreements(tx, clientId) {
+    const rows = await tx `
+    SELECT ${tx.unsafe(FEE_COLS)} FROM fee_agreement
+    WHERE deleted_at IS NULL
+      AND (${clientId ?? null}::uuid IS NULL OR client_id = ${clientId ?? null})
+    ORDER BY created_at DESC
+  `;
+    return rows.map(mapFee);
+}
+export async function setFeeStatus(tx, id, status) {
+    const rows = await tx `
+    UPDATE fee_agreement SET status = ${status}, updated_at = now(), version = version + 1
+    WHERE id = ${id} AND deleted_at IS NULL RETURNING id
+  `;
+    return rows.count;
+}
+function mapCharge(r) {
+    return {
+        id: r.id,
+        clientId: r.client_id,
+        feeAgreementId: r.fee_agreement_id,
+        provider: r.provider,
+        externalId: r.external_id,
+        method: r.method,
+        amount: Number(r.amount),
+        status: r.status,
+        description: r.description,
+        dueDate: r.due_date ? r.due_date.toISOString().slice(0, 10) : null,
+        paidAt: r.paid_at ? r.paid_at.toISOString() : null,
+        metadata: r.metadata ?? {},
+        createdAt: r.created_at.toISOString(),
+    };
+}
+const CHARGE_COLS = `
+  id, client_id, fee_agreement_id, provider, external_id, method, amount,
+  status, description, due_date, paid_at, metadata, created_at
+`;
+export async function createCharge(tx, input) {
+    const rows = await tx `
+    INSERT INTO charge (
+      id, tenant_id, client_id, fee_agreement_id, provider, external_id, method,
+      amount, status, description, due_date, metadata, created_by
+    ) VALUES (
+      ${uuidv7()}, current_setting('app.current_tenant')::uuid, ${input.clientId},
+      ${input.feeAgreementId ?? null}, ${input.provider ?? 'manual'}, ${input.externalId ?? null},
+      ${input.method ?? 'pix'}, ${input.amount}, ${input.status ?? 'pending'},
+      ${input.description ?? null}, ${input.dueDate ?? null},
+      ${tx.json((input.metadata ?? {}))}, ${input.createdBy ?? null}
+    )
+    RETURNING ${tx.unsafe(CHARGE_COLS)}
+  `;
+    return mapCharge(rows[0]);
+}
+export async function listCharges(tx, filter = {}) {
+    const limit = Math.min(filter.limit ?? 50, 200);
+    const offset = filter.offset ?? 0;
+    const rows = await tx `
+    SELECT ${tx.unsafe(CHARGE_COLS)}, count(*) OVER() AS total
+    FROM charge
+    WHERE deleted_at IS NULL
+      AND (${filter.clientId ?? null}::uuid IS NULL OR client_id = ${filter.clientId ?? null})
+      AND (${filter.status ?? null}::text IS NULL OR status = ${filter.status ?? null})
+    ORDER BY created_at DESC
+    LIMIT ${limit} OFFSET ${offset}
+  `;
+    const total = rows[0] ? Number(rows[0].total) : 0;
+    return { items: rows.map(mapCharge), total };
+}
+export async function getCharge(tx, id) {
+    const rows = await tx `
+    SELECT ${tx.unsafe(CHARGE_COLS)} FROM charge WHERE id = ${id} AND deleted_at IS NULL
+  `;
+    if (!rows[0])
+        throw new NotFoundError('Cobrança não encontrada');
+    return mapCharge(rows[0]);
+}
+export async function markChargePaid(tx, id, paidAt) {
+    const rows = await tx `
+    UPDATE charge SET status = 'paid', paid_at = COALESCE(${paidAt ?? null}::timestamptz, now()),
+      updated_at = now(), version = version + 1
+    WHERE id = ${id} AND deleted_at IS NULL AND status <> 'paid' RETURNING id
+  `;
+    return rows.count;
+}
+/** Reconciliação por webhook: encontra a cobrança pelo (provider, external_id) e marca paga. */
+export async function markChargePaidByExternal(tx, provider, externalId, paidAt) {
+    const rows = await tx `
+    UPDATE charge SET status = 'paid', paid_at = COALESCE(${paidAt ?? null}::timestamptz, now()),
+      updated_at = now(), version = version + 1
+    WHERE provider = ${provider} AND external_id = ${externalId}
+      AND deleted_at IS NULL AND status <> 'paid' RETURNING id
+  `;
+    return rows.count;
+}
+export async function setChargeStatus(tx, id, status) {
+    const rows = await tx `
+    UPDATE charge SET status = ${status}, updated_at = now(), version = version + 1
+    WHERE id = ${id} AND deleted_at IS NULL RETURNING id
+  `;
+    return rows.count;
+}
+/** KPIs financeiros do dashboard: previsto, recebido e inadimplência. */
+export async function billingSummary(tx) {
+    const rows = await tx `
+    SELECT
+      COALESCE(sum(amount) FILTER (WHERE status IN ('pending','sent','overdue')), 0) AS expected,
+      COALESCE(sum(amount) FILTER (WHERE status = 'paid'), 0) AS received,
+      COALESCE(sum(amount) FILTER (WHERE status = 'overdue'), 0) AS overdue,
+      COALESCE(count(*) FILTER (WHERE status = 'overdue'), 0)::int AS overdue_count
+    FROM charge WHERE deleted_at IS NULL
+  `;
+    const r = rows[0];
+    return {
+        expected: Number(r.expected),
+        received: Number(r.received),
+        overdue: Number(r.overdue),
+        overdueCount: r.overdue_count,
+    };
+}
+/** Cobranças em aberto vencidas até `today` — usadas pela régua de inadimplência. */
+export async function listOpenCharges(tx) {
+    const rows = await tx `
+    SELECT ${tx.unsafe(CHARGE_COLS)} FROM charge
+    WHERE deleted_at IS NULL AND status IN ('pending','sent','overdue') AND due_date IS NOT NULL
+    ORDER BY due_date ASC
+  `;
+    return rows.map(mapCharge);
+}
+//# sourceMappingURL=repository.js.map

package/dist/billing/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/billing/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAkDtD,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5B,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACnC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QACrE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/D,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG;;;CAGhB,CAAC;AAgBF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,KAAqB;IACpE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAU;;;;;QAKzB,MAAM,EAAE,kDAAkD,KAAK,CAAC,QAAQ;QACxE,KAAK,CAAC,WAAW,IAAI,YAAY,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW,IAAI,SAAS;QACrF,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC,aAAa,IAAI,KAAK,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC;QAC7E,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,KAAK,CAAC,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI;;gBAEpG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;GAChC,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,QAAiB;IAC/D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAU;aACpB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;;aAEnB,QAAQ,IAAI,IAAI,iCAAiC,QAAQ,IAAI,IAAI;;GAE3E,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,EAAU,EAAE,MAAiB;IACtE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;wCACiB,MAAM;iBAC7B,EAAE;GAChB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAsCD,SAAS,SAAS,CAAC,CAAY;IAC7B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,cAAc,EAAE,CAAC,CAAC,gBAAgB;QAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QAClD,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;QAC1B,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG;;;CAGnB,CAAC;AAgBF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,KAAwB;IACjE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAa;;;;;QAK5B,MAAM,EAAE,kDAAkD,KAAK,CAAC,QAAQ;QACxE,KAAK,CAAC,cAAc,IAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,KAAK,KAAK,CAAC,UAAU,IAAI,IAAI;QACxF,KAAK,CAAC,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,SAAS;QACpE,KAAK,CAAC,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,IAAI;QACnD,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAU,CAAC,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI;;gBAE5D,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;GACnC,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAC7B,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAM,EACN,SAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAmC;aAC7C,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;;;aAGtB,MAAM,CAAC,QAAQ,IAAI,IAAI,iCAAiC,MAAM,CAAC,QAAQ,IAAI,IAAI;aAC/E,MAAM,CAAC,MAAM,IAAI,IAAI,8BAA8B,MAAM,CAAC,MAAM,IAAI,IAAI;;YAEzE,KAAK,WAAW,MAAM;GAC/B,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,EAAU;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAa;aACvB,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,2BAA2B,EAAE;GAC7D,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAM,EAAE,EAAU,EAAE,MAAe;IACtE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;4DACqC,MAAM,IAAI,IAAI;;iBAEzD,EAAE;GAChB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAM,EACN,QAAgB,EAChB,UAAkB,EAClB,MAAe;IAEf,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;4DACqC,MAAM,IAAI,IAAI;;uBAEnD,QAAQ,sBAAsB,UAAU;;GAE5D,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,EAAU,EAAE,MAAoB;IAC5E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;iCACU,MAAM;iBACtB,EAAE;GAChB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAM;IAMzC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkF;;;;;;;GAOtG,CAAC;IACF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACnB,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1B,YAAY,EAAE,CAAC,CAAC,aAAa;KAC9B,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAM;IAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAa;aACvB,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;;;GAGhC,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC"}

package/dist/cjs/audit/audit.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appendAudit = appendAudit;
+const shared_1 = require("@baruk/shared");
+/**
+ * Registra uma linha na trilha append-only. DEVE rodar dentro de um contexto de
+ * tenant (`withContext`): o `tenant_id` é derivado da GUC `app.current_tenant`,
+ * então a linha auditada sempre pertence ao tenant corrente e satisfaz a RLS.
+ */
+async function appendAudit(tx, entry) {
+    await tx `
+    INSERT INTO audit_log (
+      id, tenant_id, actor_type, actor_id, action, resource_type,
+      resource_id, result, diff, metadata, ip, user_agent
+    ) VALUES (
+      ${(0, shared_1.uuidv7)()},
+      current_setting('app.current_tenant')::uuid,
+      ${entry.actorType ?? 'user'},
+      ${entry.actorId ?? null},
+      ${entry.action},
+      ${entry.resourceType},
+      ${entry.resourceId ?? null},
+      ${entry.result ?? 'success'},
+      ${entry.diff === undefined ? null : tx.json(entry.diff)},
+      ${tx.json((entry.metadata ?? {}))},
+      ${entry.ip ?? null},
+      ${entry.userAgent ?? null}
+    )
+  `;
+}
+//# sourceMappingURL=audit.js.map

package/dist/cjs/audit/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/audit/audit.ts"],"names":[],"mappings":";;AAsBA,kCAoBC;AA1CD,0CAAuD;AAiBvD;;;;GAIG;AACI,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,KAAiB;IACzD,MAAM,EAAE,CAAA;;;;;QAKF,IAAA,eAAM,GAAE;;QAER,KAAK,CAAC,SAAS,IAAI,MAAM;QACzB,KAAK,CAAC,OAAO,IAAI,IAAI;QACrB,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,UAAU,IAAI,IAAI;QACxB,KAAK,CAAC,MAAM,IAAI,SAAS;QACzB,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAa,CAAC;QAC9D,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAU,CAAC;QACxC,KAAK,CAAC,EAAE,IAAI,IAAI;QAChB,KAAK,CAAC,SAAS,IAAI,IAAI;;GAE5B,CAAC;AACJ,CAAC"}

package/dist/cjs/audit/repository.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listAudit = listAudit;
+/** Lista a trilha de auditoria do tenant corrente (RLS já isola). Somente leitura. */
+async function listAudit(tx, filter = {}) {
+    const limit = Math.min(filter.limit ?? 30, 100);
+    const offset = filter.offset ?? 0;
+    const rows = await tx `
+    SELECT id, actor_type, actor_id, action, resource_type, resource_id, result,
+           occurred_at, count(*) OVER() AS total
+    FROM audit_log
+    WHERE (${filter.action ?? null}::text IS NULL OR action = ${filter.action ?? null})
+      AND (${filter.resourceType ?? null}::text IS NULL OR resource_type = ${filter.resourceType ?? null})
+    ORDER BY occurred_at DESC
+    LIMIT ${limit} OFFSET ${offset}
+  `;
+    const total = rows[0] ? Number(rows[0].total) : 0;
+    return {
+        total,
+        items: rows.map((r) => ({
+            id: r.id,
+            actorType: r.actor_type,
+            actorId: r.actor_id,
+            action: r.action,
+            resourceType: r.resource_type,
+            resourceId: r.resource_id,
+            result: r.result,
+            occurredAt: r.occurred_at.toISOString(),
+        })),
+    };
+}
+//# sourceMappingURL=repository.js.map

package/dist/cjs/audit/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/audit/repository.ts"],"names":[],"mappings":";;AAcA,8BA+BC;AAhCD,sFAAsF;AAC/E,KAAK,UAAU,SAAS,CAC7B,EAAM,EACN,SAAsF,EAAE;IAExF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;aAIU,MAAM,CAAC,MAAM,IAAI,IAAI,8BAA8B,MAAM,CAAC,MAAM,IAAI,IAAI;aACxE,MAAM,CAAC,YAAY,IAAI,IAAI,qCAAqC,MAAM,CAAC,YAAY,IAAI,IAAI;;YAE5F,KAAK,WAAW,MAAM;GAC/B,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,OAAO,EAAE,CAAC,CAAC,QAAQ;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,YAAY,EAAE,CAAC,CAAC,aAAa;YAC7B,UAAU,EAAE,CAAC,CAAC,WAAW;YACzB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE;SACxC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/cjs/auth/password-reset.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestPasswordReset = requestPasswordReset;
+exports.resetPassword = resetPassword;
+const shared_1 = require("@baruk/shared");
+const password_js_1 = require("./password.js");
+const session_token_js_1 = require("./session-token.js");
+const RESET_TTL_MS = 60 * 60 * 1000; // 1h
+const REAL_CLOCK = { now: () => Date.now() };
+/**
+ * Solicita reset. Retorna o token EM CLARO (para compor o link do e-mail) e o
+ * userId — ou null se o e-mail não existe (o chamador responde genericamente
+ * de qualquer forma, para não revelar existência de conta).
+ */
+async function requestPasswordReset(db, email, clock = REAL_CLOCK) {
+    const users = await db `
+    SELECT id, status FROM "user" WHERE email = ${email} AND deleted_at IS NULL
+  `;
+    const user = users[0];
+    if (!user || user.status === 'disabled')
+        return null;
+    const { token, tokenHash } = (0, session_token_js_1.generateSessionToken)();
+    const now = clock.now();
+    await db `
+    INSERT INTO password_reset (id, user_id, token_hash, expires_at)
+    VALUES (${(0, shared_1.uuidv7)()}, ${user.id}, ${tokenHash}, ${new Date(now + RESET_TTL_MS)})
+  `;
+    return { token, userId: user.id };
+}
+/**
+ * Redefine a senha usando um token válido (não usado, não expirado). Marca o
+ * token como usado, limpa `must_change_password` e revoga sessões anteriores.
+ */
+async function resetPassword(db, token, newPassword, clock = REAL_CLOCK) {
+    if (newPassword.length < 8)
+        return false;
+    const th = (0, session_token_js_1.hashToken)(token);
+    const rows = await db `
+    SELECT id, user_id FROM password_reset
+    WHERE token_hash = ${th} AND used_at IS NULL AND expires_at > ${new Date(clock.now())}
+  `;
+    const reset = rows[0];
+    if (!reset)
+        return false;
+    await db.begin(async (tx) => {
+        await tx `
+      INSERT INTO user_credential (user_id, password_hash, must_change_password)
+      VALUES (${reset.user_id}, ${(0, password_js_1.hashPassword)(newPassword)}, false)
+      ON CONFLICT (user_id) DO UPDATE
+        SET password_hash = EXCLUDED.password_hash, must_change_password = false, updated_at = now()
+    `;
+        await tx `UPDATE password_reset SET used_at = now() WHERE id = ${reset.id}`;
+        // Revoga sessões anteriores (uso único de fato).
+        await tx `UPDATE user_session SET revoked_at = now() WHERE user_id = ${reset.user_id} AND revoked_at IS NULL`;
+    });
+    return true;
+}
+//# sourceMappingURL=password-reset.js.map

package/dist/cjs/auth/password-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.js","sourceRoot":"","sources":["../../../src/auth/password-reset.ts"],"names":[],"mappings":";;AAiBA,oDAkBC;AAMD,sCA2BC;AApED,0CAAuC;AAEvC,+CAA6C;AAC7C,yDAAqE;AAErE,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;AAK1C,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAkC;kDACR,KAAK;GACpD,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE,CAAA;;cAEI,IAAA,eAAM,GAAE,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC;GAC9E,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,KAAa,EACb,WAAmB,EACnB,QAAe,UAAU;IAEzB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,EAAE,GAAG,IAAA,4BAAS,EAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAmC;;yBAEjC,EAAE,yCAAyC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;GACtF,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1B,MAAM,EAAE,CAAA;;gBAEI,KAAK,CAAC,OAAO,KAAK,IAAA,0BAAY,EAAC,WAAW,CAAC;;;KAGtD,CAAC;QACF,MAAM,EAAE,CAAA,wDAAwD,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3E,iDAAiD;QACjD,MAAM,EAAE,CAAA,8DAA8D,KAAK,CAAC,OAAO,yBAAyB,CAAC;IAC/G,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cjs/auth/password.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashPassword = hashPassword;
+exports.verifyPassword = verifyPassword;
+const node_crypto_1 = require("node:crypto");
+// scrypt (nativo do Node, sem dependência). Parâmetros dentro do maxmem padrão.
+const N = 16384;
+const R = 8;
+const P = 1;
+const KEYLEN = 64;
+/** Deriva um hash scrypt com salt aleatório, no formato `scrypt$N$r$p$salt$hash`. */
+function hashPassword(password) {
+    const salt = (0, node_crypto_1.randomBytes)(16);
+    const derived = (0, node_crypto_1.scryptSync)(password, salt, KEYLEN, { N, r: R, p: P });
+    return ['scrypt', N, R, P, salt.toString('base64'), derived.toString('base64')].join('$');
+}
+/** Verifica uma senha contra o hash armazenado, em tempo constante. */
+function verifyPassword(password, stored) {
+    const parts = stored.split('$');
+    if (parts.length !== 6 || parts[0] !== 'scrypt')
+        return false;
+    const [, n, r, p, saltB64, hashB64] = parts;
+    const salt = Buffer.from(saltB64, 'base64');
+    const expected = Buffer.from(hashB64, 'base64');
+    const derived = (0, node_crypto_1.scryptSync)(password, salt, expected.length, {
+        N: Number(n),
+        r: Number(r),
+        p: Number(p),
+    });
+    return derived.length === expected.length && (0, node_crypto_1.timingSafeEqual)(derived, expected);
+}
+//# sourceMappingURL=password.js.map

package/dist/cjs/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../src/auth/password.ts"],"names":[],"mappings":";;AASA,oCAIC;AAGD,wCAYC;AA5BD,6CAAuE;AAEvE,gFAAgF;AAChF,MAAM,CAAC,GAAG,KAAK,CAAC;AAChB,MAAM,CAAC,GAAG,CAAC,CAAC;AACZ,MAAM,CAAC,GAAG,CAAC,CAAC;AACZ,MAAM,MAAM,GAAG,EAAE,CAAC;AAElB,qFAAqF;AACrF,SAAgB,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5F,CAAC;AAED,uEAAuE;AACvE,SAAgB,cAAc,CAAC,QAAgB,EAAE,MAAc;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE;QAC1D,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACZ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACZ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;KACb,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAClF,CAAC"}

package/dist/cjs/auth/service.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.upsertUserWithPassword = upsertUserWithPassword;
+exports.login = login;
+exports.listMemberships = listMemberships;
+exports.selectTenant = selectTenant;
+exports.authenticate = authenticate;
+exports.sessionMemberships = sessionMemberships;
+exports.sessionProducts = sessionProducts;
+exports.logout = logout;
+const shared_1 = require("@baruk/shared");
+const context_js_1 = require("../db/context.js");
+const audit_js_1 = require("../audit/audit.js");
+const authorize_js_1 = require("../rbac/authorize.js");
+const repository_js_1 = require("../portal/repository.js");
+const repository_js_2 = require("../products/repository.js");
+const password_js_1 = require("./password.js");
+const session_token_js_1 = require("./session-token.js");
+const SESSION_TTL_MS = 12 * 60 * 60 * 1000; // 12h
+const REAL_CLOCK = { now: () => Date.now() };
+/** Cria (ou atualiza) um usuário staff com senha local. Usado pelo seed. */
+async function upsertUserWithPassword(db, input) {
+    const rows = await db `
+    INSERT INTO "user" (id, email, full_name, user_type, auth_provider)
+    VALUES (${(0, shared_1.uuidv7)()}, ${input.email}, ${input.fullName}, ${input.userType ?? 'staff'}, 'password')
+    ON CONFLICT (email) WHERE deleted_at IS NULL
+    DO UPDATE SET full_name = EXCLUDED.full_name, updated_at = now()
+    RETURNING id
+  `;
+    const userId = rows[0].id;
+    await db `
+    INSERT INTO user_credential (user_id, password_hash)
+    VALUES (${userId}, ${(0, password_js_1.hashPassword)(input.password)})
+    ON CONFLICT (user_id) DO UPDATE SET password_hash = EXCLUDED.password_hash, updated_at = now()
+  `;
+    return {
+        id: userId,
+        email: input.email,
+        fullName: input.fullName,
+        userType: input.userType ?? 'staff',
+    };
+}
+/** Login com e-mail/senha. Emite sessão; auto-seleciona tenant se houver só um. */
+async function login(db, input, clock = REAL_CLOCK) {
+    const users = await db `
+    SELECT id, email, full_name, user_type, status
+    FROM "user" WHERE email = ${input.email} AND deleted_at IS NULL
+  `;
+    const user = users[0];
+    if (!user || user.status !== 'active') {
+        throw new shared_1.UnauthorizedError('Credenciais inválidas');
+    }
+    const creds = await db `
+    SELECT password_hash FROM user_credential WHERE user_id = ${user.id}
+  `;
+    if (!creds[0] || !(0, password_js_1.verifyPassword)(input.password, creds[0].password_hash)) {
+        throw new shared_1.UnauthorizedError('Credenciais inválidas');
+    }
+    const { token, tokenHash } = (0, session_token_js_1.generateSessionToken)();
+    const now = clock.now();
+    const sessionId = (0, shared_1.uuidv7)();
+    const expiresAt = new Date(now + SESSION_TTL_MS);
+    await db `
+    INSERT INTO user_session (id, user_id, token_hash, active_tenant_id, expires_at)
+    VALUES (${sessionId}, ${user.id}, ${tokenHash}, NULL, ${expiresAt})
+  `;
+    await db `UPDATE "user" SET last_login_at = ${new Date(now)} WHERE id = ${user.id}`;
+    const memberships = await listMemberships(db, user.id);
+    let activeTenantId = null;
+    if (memberships.length === 1) {
+        activeTenantId = memberships[0].tenantId;
+        await db `UPDATE user_session SET active_tenant_id = ${activeTenantId} WHERE id = ${sessionId}`;
+        await auditWithinTenant(db, activeTenantId, user.id, {
+            action: 'login',
+            resourceType: 'user_session',
+            resourceId: sessionId,
+            ip: input.ip,
+            userAgent: input.userAgent,
+        });
+    }
+    return {
+        token,
+        user: { id: user.id, email: user.email, fullName: user.full_name, userType: user.user_type },
+        memberships,
+        activeTenantId,
+    };
+}
+/** Lista os tenants a que o usuário pertence (usa RLS self-clause de membership). */
+async function listMemberships(db, userId) {
+    return (0, context_js_1.withContext)(db, { userId }, async (tx) => {
+        const rows = await tx `
+      SELECT m.tenant_id, t.code, t.display_name, m.status
+      FROM membership m
+      JOIN tenant t ON t.id = m.tenant_id
+      WHERE m.user_id = ${userId} AND m.deleted_at IS NULL AND m.status = 'active'
+      ORDER BY t.display_name
+    `;
+        return rows.map((r) => ({
+            tenantId: r.tenant_id,
+            tenantCode: r.code,
+            tenantName: r.display_name,
+            status: r.status,
+        }));
+    });
+}
+/** Escolhe/troca o tenant ativo de uma sessão, validando a membership. */
+async function selectTenant(db, input) {
+    const session = await resolveSessionRow(db, input.token);
+    const memberships = await listMemberships(db, session.user_id);
+    const allowed = memberships.some((m) => m.tenantId === input.tenantId);
+    if (!allowed) {
+        throw new shared_1.ForbiddenError('Usuário não pertence a este tenant');
+    }
+    await db `
+    UPDATE user_session SET active_tenant_id = ${input.tenantId} WHERE id = ${session.id}
+  `;
+    return (0, context_js_1.withContext)(db, { tenantId: input.tenantId, userId: session.user_id }, async (tx) => {
+        const permissions = await (0, authorize_js_1.loadUserPermissions)(tx, session.user_id);
+        await (0, audit_js_1.appendAudit)(tx, {
+            actorId: session.user_id,
+            action: 'select_tenant',
+            resourceType: 'tenant',
+            resourceId: input.tenantId,
+            ip: input.ip,
+            userAgent: input.userAgent,
+        });
+        return {
+            userId: session.user_id,
+            userType: session.user_type,
+            tenantId: input.tenantId,
+            permissions,
+        };
+    });
+}
+/**
+ * Resolve uma sessão ativa em contexto autenticado (o que o middleware da API
+ * chama por request). Exige tenant ativo já selecionado.
+ */
+async function authenticate(db, token, clock = REAL_CLOCK) {
+    const session = await resolveSessionRow(db, token, clock);
+    if (!session.active_tenant_id) {
+        throw new shared_1.UnauthorizedError('Nenhum tenant selecionado para esta sessão');
+    }
+    const tenantId = session.active_tenant_id;
+    return (0, context_js_1.withContext)(db, { tenantId, userId: session.user_id }, async (tx) => {
+        const permissions = await (0, authorize_js_1.loadUserPermissions)(tx, session.user_id);
+        const ctx = {
+            userId: session.user_id,
+            userType: session.user_type,
+            tenantId,
+            permissions,
+        };
+        if (session.user_type === 'client_portal') {
+            ctx.clientId = await (0, repository_js_1.getPortalClientId)(tx, session.user_id);
+        }
+        return ctx;
+    });
+}
+async function resolveSessionRow(db, token, clock = REAL_CLOCK) {
+    const rows = await db `
+    SELECT s.id, s.user_id, u.user_type, s.active_tenant_id
+    FROM user_session s
+    JOIN "user" u ON u.id = s.user_id
+    WHERE s.token_hash = ${(0, session_token_js_1.hashToken)(token)}
+      AND s.revoked_at IS NULL
+      AND s.expires_at > ${new Date(clock.now())}
+      AND u.deleted_at IS NULL
+  `;
+    if (!rows[0])
+        throw new shared_1.UnauthorizedError('Sessão inválida ou expirada');
+    return rows[0];
+}
+/** Memberships da sessão atual (para o seletor de tenant, antes de escolher um). */
+async function sessionMemberships(db, token) {
+    const session = await resolveSessionRow(db, token);
+    return listMemberships(db, session.user_id);
+}
+/** Produtos que a sessão pode acessar (entitlements) + audiência. Roteamento do Hub. */
+async function sessionProducts(db, token) {
+    const session = await resolveSessionRow(db, token);
+    const products = await (0, context_js_1.withContext)(db, { userId: session.user_id }, (tx) => (0, repository_js_2.listProductsForUser)(tx, session.user_id));
+    return { userType: session.user_type, products };
+}
+/** Revoga a sessão (logout). */
+async function logout(db, token) {
+    await db `UPDATE user_session SET revoked_at = now() WHERE token_hash = ${(0, session_token_js_1.hashToken)(token)}`;
+}
+async function auditWithinTenant(db, tenantId, actorId, entry) {
+    await (0, context_js_1.withContext)(db, { tenantId, userId: actorId }, (tx) => (0, audit_js_1.appendAudit)(tx, entry));
+}
+//# sourceMappingURL=service.js.map

package/dist/cjs/auth/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/service.ts"],"names":[],"mappings":";;AAmDA,wDAuBC;AAGD,sBAsDC;AAGD,0CAkBC;AAGD,oCA8BC;AAMD,oCAuBC;AA4BD,gDAGC;AAGD,0CASC;AAGD,wBAEC;AAtQD,0CAAyF;AAGzF,iDAA+C;AAC/C,gDAAgD;AAChD,uDAA2D;AAC3D,2DAA4D;AAC5D,6DAAoF;AACpF,+CAA6D;AAC7D,yDAAqE;AAErE,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAqClD,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD,4EAA4E;AACrE,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,KAAiF;IAEjF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;cAE3B,IAAA,eAAM,GAAE,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO;;;;GAIpF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IAC3B,MAAM,EAAE,CAAA;;cAEI,MAAM,KAAK,IAAA,0BAAY,EAAC,KAAK,CAAC,QAAQ,CAAC;;GAElD,CAAC;IACF,OAAO;QACL,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO;KACpC,CAAC;AACJ,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,KAAK,CACzB,EAAM,EACN,KAAyD,EACzD,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAErB;;gCAE6B,KAAK,CAAC,KAAK;GACxC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAA6B;gEACW,IAAI,CAAC,EAAE;GACpE,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAc,EAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,IAAA,eAAM,GAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;IAEjD,MAAM,EAAE,CAAA;;cAEI,SAAS,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,WAAW,SAAS;GAClE,CAAC;IACF,MAAM,EAAE,CAAA,qCAAqC,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,EAAE,EAAE,CAAC;IAEnF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvD,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,cAAc,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC;QAC1C,MAAM,EAAE,CAAA,8CAA8C,cAAc,eAAe,SAAS,EAAE,CAAC;QAC/F,MAAM,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,YAAY,EAAE,cAAc;YAC5B,UAAU,EAAE,SAAS;YACrB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;QAC5F,WAAW;QACX,cAAc;KACf,CAAC;AACJ,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,MAAc;IAC1D,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;0BAIqB,MAAM;;KAE3B,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,UAAU,EAAE,CAAC,CAAC,YAAY;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AACnE,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAyD;IAEzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAc,CAAC,oCAAoC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,CAAA;iDACuC,KAAK,CAAC,QAAQ,eAAe,OAAO,CAAC,EAAE;GACrF,CAAC;IACF,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzF,MAAM,WAAW,GAAG,MAAM,IAAA,kCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,KAAK,CAAC,QAAQ;YAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW;SACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,0BAAiB,CAAC,4CAA4C,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC1C,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzE,MAAM,WAAW,GAAG,MAAM,IAAA,kCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,GAAG,GAAgB;YACvB,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ;YACR,WAAW;SACZ,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YAC1C,GAAG,CAAC,QAAQ,GAAG,MAAM,IAAA,iCAAiB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AASD,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAc;;;;2BAIV,IAAA,4BAAS,EAAC,KAAK,CAAC;;2BAEhB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;;GAE7C,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,oFAAoF;AAC7E,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,KAAa;IAC5D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,wFAAwF;AACjF,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CACzE,IAAA,mCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CACzC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,gCAAgC;AACzB,KAAK,UAAU,MAAM,CAAC,EAAM,EAAE,KAAa;IAChD,MAAM,EAAE,CAAA,iEAAiE,IAAA,4BAAS,EAAC,KAAK,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,QAAgB,EAChB,OAAe,EACf,KAAwC;IAExC,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,sBAAW,EAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AACvF,CAAC"}

package/dist/cjs/auth/session-token.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSessionToken = generateSessionToken;
+exports.hashToken = hashToken;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Sessão opaca: o cliente recebe um token aleatório; o banco guarda apenas o
+ * hash SHA-256 (nunca o token em claro). Resolver a sessão = hashear o token
+ * recebido e buscar por igualdade.
+ */
+function generateSessionToken() {
+    const token = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+    return { token, tokenHash: hashToken(token) };
+}
+function hashToken(token) {
+    return (0, node_crypto_1.createHash)('sha256').update(token).digest('hex');
+}
+//# sourceMappingURL=session-token.js.map

package/dist/cjs/auth/session-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-token.js","sourceRoot":"","sources":["../../../src/auth/session-token.ts"],"names":[],"mappings":";;AAOA,oDAGC;AAED,8BAEC;AAdD,6CAAsD;AAEtD;;;;GAIG;AACH,SAAgB,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAgB,SAAS,CAAC,KAAa;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/cjs/billing/dunning.js

@@ -0,0 +1,54 @@
+"use strict";
+/**
+ * Motor de régua de inadimplência (dunning) — PURO e determinístico. Não envia
+ * nada: apenas decide QUAIS passos estão vencidos para uma cobrança numa data de
+ * referência. O disparo efetivo (WhatsApp/Email/Notificação) é responsabilidade
+ * do Communication/Automation Engine — o Billing só define a política. Assim a
+ * régua é 100% testável sem I/O e pronta para rodar num cron/queue.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_DUNNING_STEPS = void 0;
+exports.stepKey = stepKey;
+exports.dueDunningSteps = dueDunningSteps;
+/** Régua padrão de contabilidade: lembrete antes + escalonamento após o vencimento. */
+exports.DEFAULT_DUNNING_STEPS = [
+    { offsetDays: -3, channel: 'whatsapp', template: 'lembrete_previo' },
+    { offsetDays: 0, channel: 'whatsapp', template: 'vencimento_hoje' },
+    { offsetDays: 3, channel: 'whatsapp', template: 'atraso_3d' },
+    { offsetDays: 7, channel: 'email', template: 'atraso_7d' },
+    { offsetDays: 15, channel: 'email', template: 'atraso_15d' },
+    { offsetDays: 30, channel: 'whatsapp', template: 'atraso_30d' },
+    { offsetDays: 60, channel: 'email', template: 'atraso_60d' },
+    { offsetDays: 90, channel: 'notification', template: 'atraso_90d' },
+];
+function stepKey(step) {
+    const tag = step.offsetDays === 0 ? 'D0' : step.offsetDays > 0 ? `D+${step.offsetDays}` : `D${step.offsetDays}`;
+    return `${tag}:${step.channel}`;
+}
+function addDays(isoDate, days) {
+    const d = new Date(`${isoDate}T00:00:00Z`);
+    d.setUTCDate(d.getUTCDate() + days);
+    return d.toISOString().slice(0, 10);
+}
+/**
+ * Retorna os passos VENCIDOS (data agendada <= hoje) ainda não executados, para
+ * uma cobrança em aberto. `today` e `executed` são injetados (determinismo).
+ */
+function dueDunningSteps(steps, charge, today, executed = new Set()) {
+    if (!charge.dueDate)
+        return [];
+    if (charge.status === 'paid' || charge.status === 'canceled' || charge.status === 'refunded')
+        return [];
+    const due = [];
+    for (const step of steps) {
+        const key = stepKey(step);
+        if (executed.has(key))
+            continue;
+        const scheduledFor = addDays(charge.dueDate, step.offsetDays);
+        if (scheduledFor <= today) {
+            due.push({ ...step, stepKey: key, scheduledFor });
+        }
+    }
+    return due.sort((a, b) => a.scheduledFor.localeCompare(b.scheduledFor));
+}
+//# sourceMappingURL=dunning.js.map

package/dist/cjs/billing/dunning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dunning.js","sourceRoot":"","sources":["../../../src/billing/dunning.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AA8BH,0BAGC;AAiBD,0CAmBC;AAnDD,uFAAuF;AAC1E,QAAA,qBAAqB,GAA2B;IAC3D,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE;IACpE,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE;IACnE,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE;IAC7D,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE;IAC1D,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC5D,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC/D,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC5D,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE;CACpE,CAAC;AAEF,SAAgB,OAAO,CAAC,IAAiB;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;IAChH,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,IAAY;IAC5C,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAOD;;;GAGG;AACH,SAAgB,eAAe,CAC7B,KAA6B,EAC7B,MAAyB,EACzB,KAAa,EACb,WAAgC,IAAI,GAAG,EAAE;IAEzC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAExG,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAC1E,CAAC"}