@baruk/core 0.1.0

package/README.md

@@ -0,0 +1,6 @@
+# @baruk/core — Motor Baruk (agnóstico de segmento)
+
+Infraestrutura reutilizável: auth, tenancy, rbac, audit, vault, documents, communication, billing, notifications, events, search, ai-agents.
+
+**Regra:** NÃO importa nenhuma vertical. Ver `docs/architecture/02-core-vs-verticals.md`.
+Scaffold da Fase 06 — sem implementação de negócio ainda (roadmap: Fase 07+).

package/dist/audit/audit.d.ts

@@ -0,0 +1,22 @@
+import { type ActorType } from '@baruk/shared';
+import type { Tx } from '../db/client.js';
+export interface AuditEntry {
+    actorType?: ActorType;
+    actorId?: string | null;
+    action: string;
+    resourceType: string;
+    resourceId?: string | null;
+    result?: 'success' | 'failure' | 'denied';
+    /** Antes/depois — a camada chamadora já deve redigir segredos. */
+    diff?: unknown;
+    metadata?: Record<string, unknown>;
+    ip?: string | null;
+    userAgent?: string | null;
+}
+/**
+ * Registra uma linha na trilha append-only. DEVE rodar dentro de um contexto de
+ * tenant (`withContext`): o `tenant_id` é derivado da GUC `app.current_tenant`,
+ * então a linha auditada sempre pertence ao tenant corrente e satisfaz a RLS.
+ */
+export declare function appendAudit(tx: Tx, entry: AuditEntry): Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/audit/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC1C,kEAAkE;IAClE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB1E"}

package/dist/audit/audit.js

@@ -0,0 +1,28 @@
+import { uuidv7 } from '@baruk/shared';
+/**
+ * Registra uma linha na trilha append-only. DEVE rodar dentro de um contexto de
+ * tenant (`withContext`): o `tenant_id` é derivado da GUC `app.current_tenant`,
+ * então a linha auditada sempre pertence ao tenant corrente e satisfaz a RLS.
+ */
+export async function appendAudit(tx, entry) {
+    await tx `
+    INSERT INTO audit_log (
+      id, tenant_id, actor_type, actor_id, action, resource_type,
+      resource_id, result, diff, metadata, ip, user_agent
+    ) VALUES (
+      ${uuidv7()},
+      current_setting('app.current_tenant')::uuid,
+      ${entry.actorType ?? 'user'},
+      ${entry.actorId ?? null},
+      ${entry.action},
+      ${entry.resourceType},
+      ${entry.resourceId ?? null},
+      ${entry.result ?? 'success'},
+      ${entry.diff === undefined ? null : tx.json(entry.diff)},
+      ${tx.json((entry.metadata ?? {}))},
+      ${entry.ip ?? null},
+      ${entry.userAgent ?? null}
+    )
+  `;
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/audit/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkB,MAAM,eAAe,CAAC;AAiBvD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,KAAiB;IACzD,MAAM,EAAE,CAAA;;;;;QAKF,MAAM,EAAE;;QAER,KAAK,CAAC,SAAS,IAAI,MAAM;QACzB,KAAK,CAAC,OAAO,IAAI,IAAI;QACrB,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,UAAU,IAAI,IAAI;QACxB,KAAK,CAAC,MAAM,IAAI,SAAS;QACzB,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAa,CAAC;QAC9D,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAU,CAAC;QACxC,KAAK,CAAC,EAAE,IAAI,IAAI;QAChB,KAAK,CAAC,SAAS,IAAI,IAAI;;GAE5B,CAAC;AACJ,CAAC"}

package/dist/audit/repository.d.ts

@@ -0,0 +1,22 @@
+import type { Tx } from '../db/client.js';
+export interface AuditRow {
+    id: string;
+    actorType: string;
+    actorId: string | null;
+    action: string;
+    resourceType: string;
+    resourceId: string | null;
+    result: string;
+    occurredAt: string;
+}
+/** Lista a trilha de auditoria do tenant corrente (RLS já isola). Somente leitura. */
+export declare function listAudit(tx: Tx, filter?: {
+    action?: string;
+    resourceType?: string;
+    limit?: number;
+    offset?: number;
+}): Promise<{
+    items: AuditRow[];
+    total: number;
+}>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/audit/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/audit/repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,sFAAsF;AACtF,wBAAsB,SAAS,CAC7B,EAAE,EAAE,EAAE,EACN,MAAM,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACvF,OAAO,CAAC;IAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA4B/C"}

package/dist/audit/repository.js

@@ -0,0 +1,29 @@
+/** Lista a trilha de auditoria do tenant corrente (RLS já isola). Somente leitura. */
+export async function listAudit(tx, filter = {}) {
+    const limit = Math.min(filter.limit ?? 30, 100);
+    const offset = filter.offset ?? 0;
+    const rows = await tx `
+    SELECT id, actor_type, actor_id, action, resource_type, resource_id, result,
+           occurred_at, count(*) OVER() AS total
+    FROM audit_log
+    WHERE (${filter.action ?? null}::text IS NULL OR action = ${filter.action ?? null})
+      AND (${filter.resourceType ?? null}::text IS NULL OR resource_type = ${filter.resourceType ?? null})
+    ORDER BY occurred_at DESC
+    LIMIT ${limit} OFFSET ${offset}
+  `;
+    const total = rows[0] ? Number(rows[0].total) : 0;
+    return {
+        total,
+        items: rows.map((r) => ({
+            id: r.id,
+            actorType: r.actor_type,
+            actorId: r.actor_id,
+            action: r.action,
+            resourceType: r.resource_type,
+            resourceId: r.resource_id,
+            result: r.result,
+            occurredAt: r.occurred_at.toISOString(),
+        })),
+    };
+}
+//# sourceMappingURL=repository.js.map

package/dist/audit/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/audit/repository.ts"],"names":[],"mappings":"AAaA,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAM,EACN,SAAsF,EAAE;IAExF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;aAIU,MAAM,CAAC,MAAM,IAAI,IAAI,8BAA8B,MAAM,CAAC,MAAM,IAAI,IAAI;aACxE,MAAM,CAAC,YAAY,IAAI,IAAI,qCAAqC,MAAM,CAAC,YAAY,IAAI,IAAI;;YAE5F,KAAK,WAAW,MAAM;GAC/B,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,OAAO,EAAE,CAAC,CAAC,QAAQ;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,YAAY,EAAE,CAAC,CAAC,aAAa;YAC7B,UAAU,EAAE,CAAC,CAAC,WAAW;YACzB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE;SACxC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/auth/password-reset.d.ts

@@ -0,0 +1,20 @@
+import type { Db } from '../db/client.js';
+interface Nower {
+    now(): number;
+}
+/**
+ * Solicita reset. Retorna o token EM CLARO (para compor o link do e-mail) e o
+ * userId — ou null se o e-mail não existe (o chamador responde genericamente
+ * de qualquer forma, para não revelar existência de conta).
+ */
+export declare function requestPasswordReset(db: Db, email: string, clock?: Nower): Promise<{
+    token: string;
+    userId: string;
+} | null>;
+/**
+ * Redefine a senha usando um token válido (não usado, não expirado). Marca o
+ * token como usado, limpa `must_change_password` e revoga sessões anteriores.
+ */
+export declare function resetPassword(db: Db, token: string, newPassword: string, clock?: Nower): Promise<boolean>;
+export {};
+//# sourceMappingURL=password-reset.d.ts.map

package/dist/auth/password-reset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.d.ts","sourceRoot":"","sources":["../../src/auth/password-reset.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAO1C,UAAU,KAAK;IACb,GAAG,IAAI,MAAM,CAAC;CACf;AAGD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,KAAkB,GACxB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAcnD;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,KAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAuBlB"}

package/dist/auth/password-reset.js

@@ -0,0 +1,56 @@
+import { uuidv7 } from '@baruk/shared';
+// Convergência RFC-IDENTITY-003 §3.2: novos hashes via KDF canônico (variante async).
+import { hashPasswordAsync } from './password.js';
+import { generateSessionToken, hashToken } from './session-token.js';
+const RESET_TTL_MS = 60 * 60 * 1000; // 1h
+const REAL_CLOCK = { now: () => Date.now() };
+/**
+ * Solicita reset. Retorna o token EM CLARO (para compor o link do e-mail) e o
+ * userId — ou null se o e-mail não existe (o chamador responde genericamente
+ * de qualquer forma, para não revelar existência de conta).
+ */
+export async function requestPasswordReset(db, email, clock = REAL_CLOCK) {
+    const users = await db `
+    SELECT id, status FROM "user" WHERE email = ${email} AND deleted_at IS NULL
+  `;
+    const user = users[0];
+    if (!user || user.status === 'disabled')
+        return null;
+    const { token, tokenHash } = generateSessionToken();
+    const now = clock.now();
+    await db `
+    INSERT INTO password_reset (id, user_id, token_hash, expires_at)
+    VALUES (${uuidv7()}, ${user.id}, ${tokenHash}, ${new Date(now + RESET_TTL_MS)})
+  `;
+    return { token, userId: user.id };
+}
+/**
+ * Redefine a senha usando um token válido (não usado, não expirado). Marca o
+ * token como usado, limpa `must_change_password` e revoga sessões anteriores.
+ */
+export async function resetPassword(db, token, newPassword, clock = REAL_CLOCK) {
+    if (newPassword.length < 8)
+        return false;
+    const th = hashToken(token);
+    const rows = await db `
+    SELECT id, user_id FROM password_reset
+    WHERE token_hash = ${th} AND used_at IS NULL AND expires_at > ${new Date(clock.now())}
+  `;
+    const reset = rows[0];
+    if (!reset)
+        return false;
+    const passwordHash = await hashPasswordAsync(newPassword);
+    await db.begin(async (tx) => {
+        await tx `
+      INSERT INTO user_credential (user_id, password_hash, must_change_password)
+      VALUES (${reset.user_id}, ${passwordHash}, false)
+      ON CONFLICT (user_id) DO UPDATE
+        SET password_hash = EXCLUDED.password_hash, must_change_password = false, updated_at = now()
+    `;
+        await tx `UPDATE password_reset SET used_at = now() WHERE id = ${reset.id}`;
+        // Revoga sessões anteriores (uso único de fato).
+        await tx `UPDATE user_session SET revoked_at = now() WHERE user_id = ${reset.user_id} AND revoked_at IS NULL`;
+    });
+    return true;
+}
+//# sourceMappingURL=password-reset.js.map

package/dist/auth/password-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.js","sourceRoot":"","sources":["../../src/auth/password-reset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,sFAAsF;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAErE,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;AAK1C,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAkC;kDACR,KAAK;GACpD,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,oBAAoB,EAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE,CAAA;;cAEI,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC;GAC9E,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,KAAa,EACb,WAAmB,EACnB,QAAe,UAAU;IAEzB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAmC;;yBAEjC,EAAE,yCAAyC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;GACtF,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1B,MAAM,EAAE,CAAA;;gBAEI,KAAK,CAAC,OAAO,KAAK,YAAY;;;KAGzC,CAAC;QACF,MAAM,EAAE,CAAA,wDAAwD,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3E,iDAAiD;QACjD,MAAM,EAAE,CAAA,8DAA8D,KAAK,CAAC,OAAO,yBAAyB,CAAC;IAC/G,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/password.d.ts

@@ -0,0 +1,21 @@
+/**
+ * [contrato público — SÍNCRONO] Deriva um hash scrypt (keylen 64) com salt aleatório,
+ * no formato `scrypt$N$r$p$saltB64$hashB64`. Idêntico ao pré-R1.
+ */
+export declare function hashPassword(password: string): string;
+/**
+ * [contrato público — SÍNCRONO] Verifica a senha contra o hash armazenado, em tempo
+ * constante. Aceita o encoding legado (base64) e o canônico (base64url).
+ */
+export declare function verifyPassword(password: string, stored: string): boolean;
+/**
+ * [aditivo — convergência RFC-IDENTITY-003 §3.2] Deriva o hash via KDF CANÔNICO de
+ * @baruk/identity (scrypt keylen 64). Assíncrono (scrypt não-bloqueante). Emite base64url.
+ */
+export declare function hashPasswordAsync(password: string): Promise<string>;
+/**
+ * [aditivo — convergência RFC-IDENTITY-003 §3.2] Verifica via verify CANÔNICO de
+ * @baruk/identity — aceita os hashes legados (base64/keylen 64). Assíncrono.
+ */
+export declare function verifyPasswordAsync(password: string, stored: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AA4BA;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAYxE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEtF"}

package/dist/auth/password.js

@@ -0,0 +1,67 @@
+/**
+ * Senha/KDF do @baruk/core — contrato público SÍNCRONO preservado + convergência ADITIVA.
+ * ---------------------------------------------------------------------------
+ * RFC-IDENTITY-003 §3.2/§4 (remediação R1 — restauração de compatibilidade).
+ *
+ * Contrato público (barrel `@baruk/core`): `hashPassword`/`verifyPassword` seguem
+ * SÍNCRONOS (`string`/`boolean`), byte-a-byte idênticos ao pré-R1 — a superfície
+ * pública NÃO muda (SemVer preservado; RFC §2). O `verifyPassword` aceita tanto o
+ * encoding legado (base64) quanto o canônico (base64url), portanto não há gap de
+ * formato entre os hashes gravados pela via síncrona e pela via canônica.
+ *
+ * Convergência sobre @baruk/identity (RFC-IDENTITY-003 §3.2) é ADITIVA: exposta
+ * via `hashPasswordAsync`/`verifyPasswordAsync`, que consomem o KDF canônico
+ * (scrypt, params da plataforma keylen 64). Novos hashes canônicos saem em
+ * base64url (uniformização sancionada pela RFC §4); os legados seguem válidos.
+ */
+import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
+import { hashPassword as canonicalHash, verifyPassword as canonicalVerify } from '@baruk/identity';
+/** Params da plataforma — idênticos ao KDF legado do core (keylen 64). RFC-IDENTITY-003 §3.2. */
+const PLATFORM_SCRYPT = { N: 16384, r: 8, p: 1, keylen: 64 };
+/** Decodifica base64 OU base64url (tolerante): o verify aceita hashes de ambas as vias. */
+function decodeB64(s) {
+    return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+}
+/**
+ * [contrato público — SÍNCRONO] Deriva um hash scrypt (keylen 64) com salt aleatório,
+ * no formato `scrypt$N$r$p$saltB64$hashB64`. Idêntico ao pré-R1.
+ */
+export function hashPassword(password) {
+    const { N, r, p, keylen } = PLATFORM_SCRYPT;
+    const salt = randomBytes(16);
+    const derived = scryptSync(password, salt, keylen, { N, r, p });
+    return ['scrypt', N, r, p, salt.toString('base64'), derived.toString('base64')].join('$');
+}
+/**
+ * [contrato público — SÍNCRONO] Verifica a senha contra o hash armazenado, em tempo
+ * constante. Aceita o encoding legado (base64) e o canônico (base64url).
+ */
+export function verifyPassword(password, stored) {
+    const parts = stored.split('$');
+    if (parts.length !== 6 || parts[0] !== 'scrypt')
+        return false;
+    const [, n, r, p, saltEnc, hashEnc] = parts;
+    const salt = decodeB64(saltEnc);
+    const expected = decodeB64(hashEnc);
+    const derived = scryptSync(password, salt, expected.length, {
+        N: Number(n),
+        r: Number(r),
+        p: Number(p),
+    });
+    return derived.length === expected.length && timingSafeEqual(derived, expected);
+}
+/**
+ * [aditivo — convergência RFC-IDENTITY-003 §3.2] Deriva o hash via KDF CANÔNICO de
+ * @baruk/identity (scrypt keylen 64). Assíncrono (scrypt não-bloqueante). Emite base64url.
+ */
+export function hashPasswordAsync(password) {
+    return canonicalHash(password, PLATFORM_SCRYPT);
+}
+/**
+ * [aditivo — convergência RFC-IDENTITY-003 §3.2] Verifica via verify CANÔNICO de
+ * @baruk/identity — aceita os hashes legados (base64/keylen 64). Assíncrono.
+ */
+export function verifyPasswordAsync(password, stored) {
+    return canonicalVerify(password, stored);
+}
+//# sourceMappingURL=password.js.map

package/dist/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,IAAI,aAAa,EAAE,cAAc,IAAI,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGnG,iGAAiG;AACjG,MAAM,eAAe,GAAiB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAE3E,2FAA2F;AAC3F,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAQ,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE;QAC1D,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACZ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACZ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;KACb,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,aAAa,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,MAAc;IAClE,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC"}

package/dist/auth/service.d.ts

@@ -0,0 +1,82 @@
+import { type UserType } from '@baruk/shared';
+import type { AuditContext } from '@baruk/shared';
+import type { Db } from '../db/client.js';
+import { type ProductAccess } from '../products/repository.js';
+import type { Principal, Membership } from '@baruk/identity';
+export interface AuthUser {
+    id: string;
+    email: string;
+    fullName: string;
+    userType: UserType;
+}
+export interface MembershipView {
+    tenantId: string;
+    tenantCode: string;
+    tenantName: string;
+    status: string;
+}
+export interface LoginResult {
+    token: string;
+    user: AuthUser;
+    memberships: MembershipView[];
+    /** Preenchido quando o usuário tem exatamente um tenant (auto-seleção). */
+    activeTenantId: string | null;
+}
+/** Contexto autenticado e já resolvido a um tenant (o que a API injeta por request). */
+export interface AuthContext {
+    userId: string;
+    userType: UserType;
+    tenantId: string;
+    permissions: Set<string>;
+    /** Para usuários de portal: o client ao qual estão restritos (row-scope). */
+    clientId?: string;
+}
+interface Nower {
+    now(): number;
+}
+/** Cria (ou atualiza) um usuário staff com senha local. Usado pelo seed. */
+export declare function upsertUserWithPassword(db: Db, input: {
+    email: string;
+    fullName: string;
+    password: string;
+    userType?: UserType;
+}): Promise<AuthUser>;
+/** Login com e-mail/senha. Emite sessão; auto-seleciona tenant se houver só um. */
+export declare function login(db: Db, input: {
+    email: string;
+    password: string;
+} & AuditContext, clock?: Nower): Promise<LoginResult>;
+/** Lista os tenants a que o usuário pertence (usa RLS self-clause de membership). */
+export declare function listMemberships(db: Db, userId: string): Promise<MembershipView[]>;
+/** Escolhe/troca o tenant ativo de uma sessão, validando a membership. */
+export declare function selectTenant(db: Db, input: {
+    token: string;
+    tenantId: string;
+} & AuditContext): Promise<AuthContext>;
+/**
+ * Resolve uma sessão ativa em contexto autenticado (o que o middleware da API
+ * chama por request). Exige tenant ativo já selecionado.
+ */
+export declare function authenticate(db: Db, token: string, clock?: Nower): Promise<AuthContext>;
+/** Memberships da sessão atual (para o seletor de tenant, antes de escolher um). */
+export declare function sessionMemberships(db: Db, token: string): Promise<MembershipView[]>;
+/** Produtos que a sessão pode acessar (entitlements) + audiência. Roteamento do Hub. */
+export declare function sessionProducts(db: Db, token: string): Promise<{
+    userType: UserType;
+    products: ProductAccess[];
+}>;
+/** Revoga a sessão (logout). */
+export declare function logout(db: Db, token: string): Promise<void>;
+/**
+ * Convergência de contratos (RFC-IDENTITY-003 §3.5) — adaptadores finos que
+ * projetam os tipos de DOMÍNIO da plataforma sobre os contratos CANÔNICOS de
+ * `@baruk/identity`. São ADITIVOS: não alteram o schema/DB nem os tipos que a
+ * API consome hoje (`AuthUser`/`MembershipView`/`AuthContext` permanecem os
+ * contratos de domínio multi-tenant). Habilitam a adoção incremental dos
+ * canônicos no cutover para o registry (C10). O `AuthContext` canônico usa
+ * `permissions` como mapa escopo→chaves e `activeScopeId = tenantId`.
+ */
+export declare function toPrincipal(user: AuthUser, scopeId: string): Principal;
+export declare function toMembership(view: MembershipView, principalId: string): Membership;
+export {};
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/auth/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6C,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAK1C,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAKpF,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAI7D,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,2EAA2E;IAC3E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,wFAAwF;AACxF,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,KAAK;IACb,GAAG,IAAI,MAAM,CAAC;CACf;AAGD,4EAA4E;AAC5E,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAE,GAChF,OAAO,CAAC,QAAQ,CAAC,CAqBnB;AAED,mFAAmF;AACnF,wBAAsB,KAAK,CACzB,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,EACzD,KAAK,GAAE,KAAkB,GACxB,OAAO,CAAC,WAAW,CAAC,CAkDtB;AAED,qFAAqF;AACrF,wBAAsB,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAkBvF;AAED,0EAA0E;AAC1E,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,GACxD,OAAO,CAAC,WAAW,CAAC,CA2BtB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,KAAkB,GACxB,OAAO,CAAC,WAAW,CAAC,CAmBtB;AA2BD,oFAAoF;AACpF,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAGzF;AAED,wFAAwF;AACxF,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC,CAM5D;AAED,gCAAgC;AAChC,wBAAsB,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;AAWD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAStE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,CAUlF"}

package/dist/auth/service.js

@@ -0,0 +1,214 @@
+import { ForbiddenError, UnauthorizedError, uuidv7 } from '@baruk/shared';
+import { withContext } from '../db/context.js';
+import { appendAudit } from '../audit/audit.js';
+import { loadUserPermissions } from '../rbac/authorize.js';
+import { getPortalClientId } from '../portal/repository.js';
+import { listProductsForUser } from '../products/repository.js';
+// Convergência RFC-IDENTITY-003 §3.2: o core adota o KDF canônico via as variantes
+// async (o contrato público síncrono hashPassword/verifyPassword segue exportado no barrel).
+import { hashPasswordAsync, verifyPasswordAsync } from './password.js';
+import { generateSessionToken, hashToken } from './session-token.js';
+const SESSION_TTL_MS = 12 * 60 * 60 * 1000; // 12h
+const REAL_CLOCK = { now: () => Date.now() };
+/** Cria (ou atualiza) um usuário staff com senha local. Usado pelo seed. */
+export async function upsertUserWithPassword(db, input) {
+    const rows = await db `
+    INSERT INTO "user" (id, email, full_name, user_type, auth_provider)
+    VALUES (${uuidv7()}, ${input.email}, ${input.fullName}, ${input.userType ?? 'staff'}, 'password')
+    ON CONFLICT (email) WHERE deleted_at IS NULL
+    DO UPDATE SET full_name = EXCLUDED.full_name, updated_at = now()
+    RETURNING id
+  `;
+    const userId = rows[0].id;
+    const passwordHash = await hashPasswordAsync(input.password);
+    await db `
+    INSERT INTO user_credential (user_id, password_hash)
+    VALUES (${userId}, ${passwordHash})
+    ON CONFLICT (user_id) DO UPDATE SET password_hash = EXCLUDED.password_hash, updated_at = now()
+  `;
+    return {
+        id: userId,
+        email: input.email,
+        fullName: input.fullName,
+        userType: input.userType ?? 'staff',
+    };
+}
+/** Login com e-mail/senha. Emite sessão; auto-seleciona tenant se houver só um. */
+export async function login(db, input, clock = REAL_CLOCK) {
+    const users = await db `
+    SELECT id, email, full_name, user_type, status
+    FROM "user" WHERE email = ${input.email} AND deleted_at IS NULL
+  `;
+    const user = users[0];
+    if (!user || user.status !== 'active') {
+        throw new UnauthorizedError('Credenciais inválidas');
+    }
+    const creds = await db `
+    SELECT password_hash FROM user_credential WHERE user_id = ${user.id}
+  `;
+    if (!creds[0] || !(await verifyPasswordAsync(input.password, creds[0].password_hash))) {
+        throw new UnauthorizedError('Credenciais inválidas');
+    }
+    const { token, tokenHash } = generateSessionToken();
+    const now = clock.now();
+    const sessionId = uuidv7();
+    const expiresAt = new Date(now + SESSION_TTL_MS);
+    await db `
+    INSERT INTO user_session (id, user_id, token_hash, active_tenant_id, expires_at)
+    VALUES (${sessionId}, ${user.id}, ${tokenHash}, NULL, ${expiresAt})
+  `;
+    await db `UPDATE "user" SET last_login_at = ${new Date(now)} WHERE id = ${user.id}`;
+    const memberships = await listMemberships(db, user.id);
+    let activeTenantId = null;
+    if (memberships.length === 1) {
+        activeTenantId = memberships[0].tenantId;
+        await db `UPDATE user_session SET active_tenant_id = ${activeTenantId} WHERE id = ${sessionId}`;
+        await auditWithinTenant(db, activeTenantId, user.id, {
+            action: 'login',
+            resourceType: 'user_session',
+            resourceId: sessionId,
+            ip: input.ip,
+            userAgent: input.userAgent,
+        });
+    }
+    return {
+        token,
+        user: { id: user.id, email: user.email, fullName: user.full_name, userType: user.user_type },
+        memberships,
+        activeTenantId,
+    };
+}
+/** Lista os tenants a que o usuário pertence (usa RLS self-clause de membership). */
+export async function listMemberships(db, userId) {
+    return withContext(db, { userId }, async (tx) => {
+        const rows = await tx `
+      SELECT m.tenant_id, t.code, t.display_name, m.status
+      FROM membership m
+      JOIN tenant t ON t.id = m.tenant_id
+      WHERE m.user_id = ${userId} AND m.deleted_at IS NULL AND m.status = 'active'
+      ORDER BY t.display_name
+    `;
+        return rows.map((r) => ({
+            tenantId: r.tenant_id,
+            tenantCode: r.code,
+            tenantName: r.display_name,
+            status: r.status,
+        }));
+    });
+}
+/** Escolhe/troca o tenant ativo de uma sessão, validando a membership. */
+export async function selectTenant(db, input) {
+    const session = await resolveSessionRow(db, input.token);
+    const memberships = await listMemberships(db, session.user_id);
+    const allowed = memberships.some((m) => m.tenantId === input.tenantId);
+    if (!allowed) {
+        throw new ForbiddenError('Usuário não pertence a este tenant');
+    }
+    await db `
+    UPDATE user_session SET active_tenant_id = ${input.tenantId} WHERE id = ${session.id}
+  `;
+    return withContext(db, { tenantId: input.tenantId, userId: session.user_id }, async (tx) => {
+        const permissions = await loadUserPermissions(tx, session.user_id);
+        await appendAudit(tx, {
+            actorId: session.user_id,
+            action: 'select_tenant',
+            resourceType: 'tenant',
+            resourceId: input.tenantId,
+            ip: input.ip,
+            userAgent: input.userAgent,
+        });
+        return {
+            userId: session.user_id,
+            userType: session.user_type,
+            tenantId: input.tenantId,
+            permissions,
+        };
+    });
+}
+/**
+ * Resolve uma sessão ativa em contexto autenticado (o que o middleware da API
+ * chama por request). Exige tenant ativo já selecionado.
+ */
+export async function authenticate(db, token, clock = REAL_CLOCK) {
+    const session = await resolveSessionRow(db, token, clock);
+    if (!session.active_tenant_id) {
+        throw new UnauthorizedError('Nenhum tenant selecionado para esta sessão');
+    }
+    const tenantId = session.active_tenant_id;
+    return withContext(db, { tenantId, userId: session.user_id }, async (tx) => {
+        const permissions = await loadUserPermissions(tx, session.user_id);
+        const ctx = {
+            userId: session.user_id,
+            userType: session.user_type,
+            tenantId,
+            permissions,
+        };
+        if (session.user_type === 'client_portal') {
+            ctx.clientId = await getPortalClientId(tx, session.user_id);
+        }
+        return ctx;
+    });
+}
+async function resolveSessionRow(db, token, clock = REAL_CLOCK) {
+    const rows = await db `
+    SELECT s.id, s.user_id, u.user_type, s.active_tenant_id
+    FROM user_session s
+    JOIN "user" u ON u.id = s.user_id
+    WHERE s.token_hash = ${hashToken(token)}
+      AND s.revoked_at IS NULL
+      AND s.expires_at > ${new Date(clock.now())}
+      AND u.deleted_at IS NULL
+  `;
+    if (!rows[0])
+        throw new UnauthorizedError('Sessão inválida ou expirada');
+    return rows[0];
+}
+/** Memberships da sessão atual (para o seletor de tenant, antes de escolher um). */
+export async function sessionMemberships(db, token) {
+    const session = await resolveSessionRow(db, token);
+    return listMemberships(db, session.user_id);
+}
+/** Produtos que a sessão pode acessar (entitlements) + audiência. Roteamento do Hub. */
+export async function sessionProducts(db, token) {
+    const session = await resolveSessionRow(db, token);
+    const products = await withContext(db, { userId: session.user_id }, (tx) => listProductsForUser(tx, session.user_id));
+    return { userType: session.user_type, products };
+}
+/** Revoga a sessão (logout). */
+export async function logout(db, token) {
+    await db `UPDATE user_session SET revoked_at = now() WHERE token_hash = ${hashToken(token)}`;
+}
+async function auditWithinTenant(db, tenantId, actorId, entry) {
+    await withContext(db, { tenantId, userId: actorId }, (tx) => appendAudit(tx, entry));
+}
+/**
+ * Convergência de contratos (RFC-IDENTITY-003 §3.5) — adaptadores finos que
+ * projetam os tipos de DOMÍNIO da plataforma sobre os contratos CANÔNICOS de
+ * `@baruk/identity`. São ADITIVOS: não alteram o schema/DB nem os tipos que a
+ * API consome hoje (`AuthUser`/`MembershipView`/`AuthContext` permanecem os
+ * contratos de domínio multi-tenant). Habilitam a adoção incremental dos
+ * canônicos no cutover para o registry (C10). O `AuthContext` canônico usa
+ * `permissions` como mapa escopo→chaves e `activeScopeId = tenantId`.
+ */
+export function toPrincipal(user, scopeId) {
+    return {
+        id: user.id,
+        email: user.email,
+        kind: user.userType === 'client_portal' ? 'client' : 'staff',
+        scopeId,
+        status: 'active',
+        sessionVersion: 0,
+    };
+}
+export function toMembership(view, principalId) {
+    return {
+        id: `${principalId}:${view.tenantId}`,
+        principalId,
+        scopeId: view.tenantId,
+        scopeSlug: view.tenantCode,
+        scopeName: view.tenantName,
+        roleKeys: [],
+        status: view.status === 'active' ? 'active' : 'suspended',
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/auth/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/auth/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAiB,MAAM,eAAe,CAAC;AAGzF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAsB,MAAM,2BAA2B,CAAC;AACpF,mFAAmF;AACnF,6FAA6F;AAC7F,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGrE,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAqClD,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,KAAiF;IAEjF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;cAE3B,MAAM,EAAE,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO;;;;GAIpF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IAC3B,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,EAAE,CAAA;;cAEI,MAAM,KAAK,YAAY;;GAElC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO;KACpC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,EAAM,EACN,KAAyD,EACzD,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAErB;;gCAE6B,KAAK,CAAC,KAAK;GACxC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAA6B;gEACW,IAAI,CAAC,EAAE;GACpE,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,oBAAoB,EAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;IAEjD,MAAM,EAAE,CAAA;;cAEI,SAAS,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,WAAW,SAAS;GAClE,CAAC;IACF,MAAM,EAAE,CAAA,qCAAqC,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,EAAE,EAAE,CAAC;IAEnF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvD,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,cAAc,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC;QAC1C,MAAM,EAAE,CAAA,8CAA8C,cAAc,eAAe,SAAS,EAAE,CAAC;QAC/F,MAAM,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,YAAY,EAAE,cAAc;YAC5B,UAAU,EAAE,SAAS;YACrB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;QAC5F,WAAW;QACX,cAAc;KACf,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,MAAc;IAC1D,OAAO,WAAW,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;0BAIqB,MAAM;;KAE3B,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,UAAU,EAAE,CAAC,CAAC,YAAY;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAyD;IAEzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,oCAAoC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,CAAA;iDACuC,KAAK,CAAC,QAAQ,eAAe,OAAO,CAAC,EAAE;GACrF,CAAC;IACF,OAAO,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzF,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,KAAK,CAAC,QAAQ;YAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW;SACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC1C,OAAO,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzE,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,GAAG,GAAgB;YACvB,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ;YACR,WAAW;SACZ,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YAC1C,GAAG,CAAC,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AASD,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAc;;;;2BAIV,SAAS,CAAC,KAAK,CAAC;;2BAEhB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;;GAE7C,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,KAAa;IAC5D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CACzE,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CACzC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,gCAAgC;AAChC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAM,EAAE,KAAa;IAChD,MAAM,EAAE,CAAA,iEAAiE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,QAAgB,EAChB,OAAe,EACf,KAAwC;IAExC,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,OAAe;IACzD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;QAC5D,OAAO;QACP,MAAM,EAAE,QAAQ;QAChB,cAAc,EAAE,CAAC;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAoB,EAAE,WAAmB;IACpE,OAAO;QACL,EAAE,EAAE,GAAG,WAAW,IAAI,IAAI,CAAC,QAAQ,EAAE;QACrC,WAAW;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;KAC1D,CAAC;AACJ,CAAC"}

package/dist/auth/session-token.d.ts

@@ -0,0 +1,8 @@
+/** Gera o token opaco entregue ao cliente + o hash a persistir (nunca o token cru). */
+export declare function generateSessionToken(): {
+    token: string;
+    tokenHash: string;
+};
+/** Hash determinístico (SHA-256 hex) para armazenar/resolver a sessão. */
+export declare function hashToken(token: string): string;
+//# sourceMappingURL=session-token.d.ts.map