@baruk/core 0.1.0

package/dist/auth/session-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-token.d.ts","sourceRoot":"","sources":["../../src/auth/session-token.ts"],"names":[],"mappings":"AAUA,uFAAuF;AACvF,wBAAgB,oBAAoB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAG3E;AAED,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C"}

package/dist/auth/session-token.js

@@ -0,0 +1,19 @@
+/**
+ * Sessão opaca do @baruk/core — CONVERGIDO sobre @baruk/identity (RFC-IDENTITY-003 §3.3).
+ * ---------------------------------------------------------------------------
+ * Consome a primitiva canônica de sessão opaca (@baruk/identity/opaque-session):
+ * token de 32B base64url + hash SHA-256 hex — idêntico byte-a-byte ao anterior,
+ * portanto zero mudança de formato ou de schema/DB. Mantém a assinatura pública
+ * `generateSessionToken` (thin wrapper `{ token, tokenHash }`) e `hashToken`.
+ */
+import { generateOpaqueToken, hashToken as canonicalHashToken } from '@baruk/identity';
+/** Gera o token opaco entregue ao cliente + o hash a persistir (nunca o token cru). */
+export function generateSessionToken() {
+    const token = generateOpaqueToken();
+    return { token, tokenHash: canonicalHashToken(token) };
+}
+/** Hash determinístico (SHA-256 hex) para armazenar/resolver a sessão. */
+export function hashToken(token) {
+    return canonicalHashToken(token);
+}
+//# sourceMappingURL=session-token.js.map

package/dist/auth/session-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-token.js","sourceRoot":"","sources":["../../src/auth/session-token.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,SAAS,IAAI,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEvF,uFAAuF;AACvF,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/dist/clients/repository.d.ts

@@ -0,0 +1,53 @@
+import type { Tx } from '../db/client.js';
+/**
+ * Repositório de `client` — SEMPRE tenant-scoped. Note que NENHUM método recebe
+ * ou filtra por `tenant_id`: o isolamento vem 100% da RLS + do contexto de
+ * transação (`withContext`). Uma query aqui jamais pode ver outro tenant, mesmo
+ * que o código tentasse — a rede de segurança final é o PostgreSQL.
+ */
+export interface ClientRecord {
+    id: string;
+    tenantId: string;
+    clientType: 'pf' | 'pj';
+    displayName: string;
+    documentNumber: string | null;
+    status: string;
+    createdAt: string;
+}
+export interface CreateClientInput {
+    displayName: string;
+    clientType?: 'pf' | 'pj';
+    documentNumber?: string | null;
+    createdBy?: string | null;
+}
+export declare function createClient(tx: Tx, input: CreateClientInput): Promise<ClientRecord>;
+export declare function listClients(tx: Tx): Promise<ClientRecord[]>;
+export declare function getClient(tx: Tx, id: string): Promise<ClientRecord>;
+/**
+ * Renomeia um cliente por id. Retorna a quantidade de linhas afetadas — sob RLS,
+ * uma tentativa cross-tenant afeta 0 linhas (o id "não existe" para este tenant).
+ */
+export declare function renameClient(tx: Tx, id: string, displayName: string): Promise<number>;
+export interface ListClientsFilter {
+    search?: string;
+    status?: string;
+    limit?: number;
+    offset?: number;
+}
+export declare function listClientsPaged(tx: Tx, filter?: ListClientsFilter): Promise<{
+    items: ClientRecord[];
+    total: number;
+}>;
+export interface UpdateClientInput {
+    displayName?: string;
+    legalName?: string | null;
+    email?: string | null;
+    phone?: string | null;
+    status?: string;
+    updatedBy?: string | null;
+}
+export declare function updateClient(tx: Tx, id: string, input: UpdateClientInput): Promise<number>;
+export declare function softDeleteClient(tx: Tx, id: string, deletedBy?: string | null): Promise<number>;
+/** Busca por documento normalizado (dedup de importação). Retorna id ou null. */
+export declare function findClientIdByDocument(tx: Tx, documentNumber: string): Promise<string | null>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/clients/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/clients/repository.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;GAKG;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAsBD,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAgB1F;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAQjE;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAQzE;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ3F;AAID,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,MAAM,GAAE,iBAAsB,GAC7B,OAAO,CAAC;IAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnD;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBhG;AAED,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAOrG;AAED,iFAAiF;AACjF,wBAAsB,sBAAsB,CAAC,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMnG"}

package/dist/clients/repository.js

@@ -0,0 +1,113 @@
+import { NotFoundError, uuidv7 } from '@baruk/shared';
+function mapRow(r) {
+    return {
+        id: r.id,
+        tenantId: r.tenant_id,
+        clientType: r.client_type,
+        displayName: r.display_name,
+        documentNumber: r.document_number,
+        status: r.status,
+        createdAt: r.created_at.toISOString(),
+    };
+}
+export async function createClient(tx, input) {
+    // tenant_id vem da GUC — nunca do input. A WITH CHECK da RLS recusa qualquer
+    // tentativa de gravar fora do tenant corrente.
+    const rows = await tx `
+    INSERT INTO client (id, tenant_id, client_type, display_name, document_number, created_by)
+    VALUES (
+      ${uuidv7()},
+      current_setting('app.current_tenant')::uuid,
+      ${input.clientType ?? 'pj'},
+      ${input.displayName},
+      ${input.documentNumber ?? null},
+      ${input.createdBy ?? null}
+    )
+    RETURNING id, tenant_id, client_type, display_name, document_number, status, created_at
+  `;
+    return mapRow(rows[0]);
+}
+export async function listClients(tx) {
+    const rows = await tx `
+    SELECT id, tenant_id, client_type, display_name, document_number, status, created_at
+    FROM client
+    WHERE deleted_at IS NULL
+    ORDER BY created_at DESC
+  `;
+    return rows.map((r) => mapRow(r));
+}
+export async function getClient(tx, id) {
+    const rows = await tx `
+    SELECT id, tenant_id, client_type, display_name, document_number, status, created_at
+    FROM client
+    WHERE id = ${id} AND deleted_at IS NULL
+  `;
+    if (!rows[0])
+        throw new NotFoundError('Cliente não encontrado');
+    return mapRow(rows[0]);
+}
+/**
+ * Renomeia um cliente por id. Retorna a quantidade de linhas afetadas — sob RLS,
+ * uma tentativa cross-tenant afeta 0 linhas (o id "não existe" para este tenant).
+ */
+export async function renameClient(tx, id, displayName) {
+    const rows = await tx `
+    UPDATE client
+    SET display_name = ${displayName}, updated_at = now(), version = version + 1
+    WHERE id = ${id} AND deleted_at IS NULL
+    RETURNING id
+  `;
+    return rows.count;
+}
+export async function listClientsPaged(tx, filter = {}) {
+    const limit = Math.min(filter.limit ?? 20, 100);
+    const offset = filter.offset ?? 0;
+    const like = filter.search ? `%${filter.search}%` : null;
+    const rows = await tx `
+    SELECT id, tenant_id, client_type, display_name, document_number, status, created_at,
+           count(*) OVER() AS total
+    FROM client
+    WHERE deleted_at IS NULL
+      AND (${filter.status ?? null}::text IS NULL OR status = ${filter.status ?? null})
+      AND (${like}::text IS NULL OR display_name ILIKE ${like} OR document_number ILIKE ${like})
+    ORDER BY created_at DESC
+    LIMIT ${limit} OFFSET ${offset}
+  `;
+    const total = rows[0] ? Number(rows[0].total) : 0;
+    return { items: rows.map((r) => mapRow(r)), total };
+}
+export async function updateClient(tx, id, input) {
+    // Casts explícitos: parâmetros NULL sem tipo quebram COALESCE ("could not
+    // determine data type of parameter") no PostgreSQL.
+    const rows = await tx `
+    UPDATE client SET
+      display_name = COALESCE(${input.displayName ?? null}::text, display_name),
+      legal_name   = COALESCE(${input.legalName ?? null}::text, legal_name),
+      email        = COALESCE(${input.email ?? null}::citext, email),
+      phone        = COALESCE(${input.phone ?? null}::text, phone),
+      status       = COALESCE(${input.status ?? null}::text, status),
+      updated_by   = ${input.updatedBy ?? null}::uuid,
+      updated_at   = now(),
+      version      = version + 1
+    WHERE id = ${id} AND deleted_at IS NULL
+    RETURNING id
+  `;
+    return rows.count;
+}
+export async function softDeleteClient(tx, id, deletedBy) {
+    const rows = await tx `
+    UPDATE client SET deleted_at = now(), deleted_by = ${deletedBy ?? null}
+    WHERE id = ${id} AND deleted_at IS NULL
+    RETURNING id
+  `;
+    return rows.count;
+}
+/** Busca por documento normalizado (dedup de importação). Retorna id ou null. */
+export async function findClientIdByDocument(tx, documentNumber) {
+    const rows = await tx `
+    SELECT id FROM client
+    WHERE document_number = ${documentNumber} AND deleted_at IS NULL LIMIT 1
+  `;
+    return rows[0]?.id ?? null;
+}
+//# sourceMappingURL=repository.js.map

package/dist/clients/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/clients/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AA2BtD,SAAS,MAAM,CAAC,CAQf;IACC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,cAAc,EAAE,CAAC,CAAC,eAAe;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,KAAwB;IACjE,6EAA6E;IAC7E,+CAA+C;IAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;;QAGf,MAAM,EAAE;;QAER,KAAK,CAAC,UAAU,IAAI,IAAI;QACxB,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5B,KAAK,CAAC,SAAS,IAAI,IAAI;;;GAG5B,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAU,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAM;IACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;;;;GAKpB,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAU,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,EAAU;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;;iBAGN,EAAE;GAChB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAU,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,EAAU,EAAE,WAAmB;IACxE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;yBAEE,WAAW;iBACnB,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,SAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,EAAE,CAA2B;;;;;aAKrC,MAAM,CAAC,MAAM,IAAI,IAAI,8BAA8B,MAAM,CAAC,MAAM,IAAI,IAAI;aACxE,IAAI,wCAAwC,IAAI,6BAA6B,IAAI;;YAElF,KAAK,WAAW,MAAM;GAC/B,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,EAAU,EAAE,KAAwB;IAC7E,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;gCAES,KAAK,CAAC,WAAW,IAAI,IAAI;gCACzB,KAAK,CAAC,SAAS,IAAI,IAAI;gCACvB,KAAK,CAAC,KAAK,IAAI,IAAI;gCACnB,KAAK,CAAC,KAAK,IAAI,IAAI;gCACnB,KAAK,CAAC,MAAM,IAAI,IAAI;uBAC7B,KAAK,CAAC,SAAS,IAAI,IAAI;;;iBAG7B,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAM,EAAE,EAAU,EAAE,SAAyB;IAClF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;yDACkC,SAAS,IAAI,IAAI;iBACzD,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAM,EAAE,cAAsB;IACzE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;8BAEX,cAAc;GACzC,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;AAC7B,CAAC"}

package/dist/dashboard/repository.d.ts

@@ -0,0 +1,19 @@
+import type { Tx } from '../db/client.js';
+/**
+ * Estatísticas AGNÓSTICAS do tenant (Core). Métricas específicas de contabilidade
+ * (ex.: clientes por regime tributário) vivem na vertical `@baruk/contabil` e são
+ * compostas na borda (API), preservando a fronteira Core→Vertical.
+ */
+export interface CoreDashboardStats {
+    clients: number;
+    activeUsers: number;
+    openRequests: number;
+    overdueRequests: number;
+    recentActivity: {
+        action: string;
+        resourceType: string;
+        occurredAt: string;
+    }[];
+}
+export declare function getCoreStats(tx: Tx): Promise<CoreDashboardStats>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/dashboard/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/dashboard/repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAChF;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkCtE"}

package/dist/dashboard/repository.js

@@ -0,0 +1,36 @@
+export async function getCoreStats(tx) {
+    const [clients] = await tx `
+    SELECT count(*)::int AS n FROM client WHERE deleted_at IS NULL
+  `;
+    const [users] = await tx `
+    SELECT count(*)::int AS n FROM membership WHERE status = 'active' AND deleted_at IS NULL
+  `;
+    const [open] = await tx `
+    SELECT count(*)::int AS n FROM service_request
+    WHERE deleted_at IS NULL
+      AND status IN ('sent','viewed','awaiting_client','answered','in_review')
+  `;
+    const [overdue] = await tx `
+    SELECT count(*)::int AS n FROM service_request
+    WHERE deleted_at IS NULL
+      AND (status = 'overdue'
+           OR (due_date IS NOT NULL AND due_date < current_date
+               AND status NOT IN ('done','canceled')))
+  `;
+    const recent = await tx `
+    SELECT action, resource_type, occurred_at
+    FROM audit_log ORDER BY occurred_at DESC LIMIT 8
+  `;
+    return {
+        clients: clients?.n ?? 0,
+        activeUsers: users?.n ?? 0,
+        openRequests: open?.n ?? 0,
+        overdueRequests: overdue?.n ?? 0,
+        recentActivity: recent.map((r) => ({
+            action: r.action,
+            resourceType: r.resource_type,
+            occurredAt: r.occurred_at.toISOString(),
+        })),
+    };
+}
+//# sourceMappingURL=repository.js.map

package/dist/dashboard/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/dashboard/repository.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM;IACvC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAiB;;GAE1C,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAiB;;GAExC,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAiB;;;;GAIvC,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAiB;;;;;;GAM1C,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAgE;;;GAGtF,CAAC;IACF,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC;QACxB,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC;QAC1B,YAAY,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC;QAC1B,eAAe,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC;QAChC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,YAAY,EAAE,CAAC,CAAC,aAAa;YAC7B,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE;SACxC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/db/client.d.ts

@@ -0,0 +1,19 @@
+import postgres from 'postgres';
+export type Db = postgres.Sql<Record<string, never>>;
+export type Tx = postgres.TransactionSql<Record<string, never>>;
+/** Qualquer executor de query: conexão de pool ou transação. */
+export type Queryable = Db | Tx;
+export interface DbOptions {
+    /** Máximo de conexões no pool. */
+    max?: number;
+    /** Rótulo do papel (owner/app) — só para diagnóstico. */
+    role?: 'owner' | 'app';
+}
+/**
+ * Cria um cliente Postgres (postgres.js). Duas instâncias são usadas no
+ * ecossistema (05-security §7.1, defesa em profundidade):
+ *  - OWNER: roda migrations/seed (cria schema).
+ *  - APP (baruk_app): runtime da aplicação — NOSUPERUSER, NOBYPASSRLS, sujeito à RLS.
+ */
+export declare function createDb(connectionString: string, opts?: DbOptions): Db;
+//# sourceMappingURL=client.d.ts.map

package/dist/db/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/db/client.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,MAAM,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACrD,MAAM,MAAM,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAChE,gEAAgE;AAChE,MAAM,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhC,MAAM,WAAW,SAAS;IACxB,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,GAAE,SAAc,GAAG,EAAE,CAgB3E"}

package/dist/db/client.js

@@ -0,0 +1,21 @@
+import postgres from 'postgres';
+/**
+ * Cria um cliente Postgres (postgres.js). Duas instâncias são usadas no
+ * ecossistema (05-security §7.1, defesa em profundidade):
+ *  - OWNER: roda migrations/seed (cria schema).
+ *  - APP (baruk_app): runtime da aplicação — NOSUPERUSER, NOBYPASSRLS, sujeito à RLS.
+ */
+export function createDb(connectionString, opts = {}) {
+    // SSL obrigatório em provedores gerenciados (Render/Neon/etc.); desligado em
+    // Postgres local. Detecta pelo host/flag da URL.
+    const isLocal = /@(localhost|127\.0\.0\.1|host\.docker\.internal|\[?::1\]?)[:/]/.test(connectionString);
+    const wantsSsl = !isLocal && /sslmode=require|render\.com|neon\.tech|supabase|amazonaws|\.cloud/.test(connectionString);
+    return postgres(connectionString, {
+        max: opts.max ?? 10,
+        // UUIDs são gerados na aplicação (uuidv7); datas em UTC.
+        prepare: true,
+        ssl: wantsSsl ? { rejectUnauthorized: false } : undefined,
+        onnotice: () => { }, // silencia NOTICEs verbosos de DO-blocks/IF EXISTS
+    });
+}
+//# sourceMappingURL=client.js.map

package/dist/db/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/db/client.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAchC;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,gBAAwB,EAAE,OAAkB,EAAE;IACrE,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,OAAO,GAAG,gEAAgE,CAAC,IAAI,CACnF,gBAAgB,CACjB,CAAC;IACF,MAAM,QAAQ,GACZ,CAAC,OAAO,IAAI,mEAAmE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEzG,OAAO,QAAQ,CAAC,gBAAgB,EAAE;QAChC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;QACnB,yDAAyD;QACzD,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;QACzD,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,mDAAmD;KACxE,CAAC,CAAC;AACL,CAAC"}

package/dist/db/context.d.ts

@@ -0,0 +1,27 @@
+import type { Db, Tx } from './client.js';
+/**
+ * Contexto de banco por request. `tenantId` alimenta a RLS via a GUC
+ * `app.current_tenant`; `userId` alimenta `app.current_user` (usado pela policy
+ * de `membership` para o usuário enxergar os próprios vínculos antes de escolher
+ * um tenant — seletor de tenant do SSO, 01-multi-tenancy §3).
+ */
+export interface DbContext {
+    readonly tenantId?: string;
+    readonly userId?: string;
+    /**
+     * Escopo de cliente (portal). Quando setado, a RLS restringe entidades
+     * client-scoped (ex.: service_request) a ESTE client — mesmo que a camada de
+     * aplicação esquecesse o filtro. Não setado (staff) = vê todos os clientes do tenant.
+     */
+    readonly clientId?: string;
+}
+/**
+ * Executa `fn` dentro de uma transação com as GUCs de contexto setadas via
+ * `set_config(..., is_local => true)` — ou seja, escopo de transação (equivalente
+ * a `SET LOCAL`). Toda leitura/escrita tenant-scoped DEVE passar por aqui: é o
+ * único ponto onde o `tenant_id` chega ao PostgreSQL, e ele nunca vem do cliente.
+ */
+export declare function withContext<T>(db: Db, ctx: DbContext, fn: (tx: Tx) => Promise<T>): Promise<T>;
+/** Açúcar sintático: contexto apenas de tenant. */
+export declare function withTenant<T>(db: Db, tenantId: string, fn: (tx: Tx) => Promise<T>): Promise<T>;
+//# sourceMappingURL=context.d.ts.map

package/dist/db/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/db/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,CAAC,EACjC,EAAE,EAAE,EAAE,EACN,GAAG,EAAE,SAAS,EACd,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GACzB,OAAO,CAAC,CAAC,CAAC,CAyBZ;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAE9F"}

package/dist/db/context.js

@@ -0,0 +1,36 @@
+import { isUuid, TenantContextError } from '@baruk/shared';
+/**
+ * Executa `fn` dentro de uma transação com as GUCs de contexto setadas via
+ * `set_config(..., is_local => true)` — ou seja, escopo de transação (equivalente
+ * a `SET LOCAL`). Toda leitura/escrita tenant-scoped DEVE passar por aqui: é o
+ * único ponto onde o `tenant_id` chega ao PostgreSQL, e ele nunca vem do cliente.
+ */
+export async function withContext(db, ctx, fn) {
+    if (ctx.tenantId !== undefined && !isUuid(ctx.tenantId)) {
+        throw new TenantContextError(`tenantId inválido no contexto: ${ctx.tenantId}`);
+    }
+    if (ctx.userId !== undefined && !isUuid(ctx.userId)) {
+        throw new TenantContextError(`userId inválido no contexto: ${ctx.userId}`);
+    }
+    if (ctx.clientId !== undefined && !isUuid(ctx.clientId)) {
+        throw new TenantContextError(`clientId inválido no contexto: ${ctx.clientId}`);
+    }
+    const result = await db.begin(async (tx) => {
+        if (ctx.tenantId !== undefined) {
+            await tx `select set_config('app.current_tenant', ${ctx.tenantId}, true)`;
+        }
+        if (ctx.userId !== undefined) {
+            await tx `select set_config('app.current_user', ${ctx.userId}, true)`;
+        }
+        if (ctx.clientId !== undefined) {
+            await tx `select set_config('app.current_client', ${ctx.clientId}, true)`;
+        }
+        return fn(tx);
+    });
+    return result;
+}
+/** Açúcar sintático: contexto apenas de tenant. */
+export function withTenant(db, tenantId, fn) {
+    return withContext(db, { tenantId }, fn);
+}
+//# sourceMappingURL=context.js.map

package/dist/db/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/db/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAoB3D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAM,EACN,GAAc,EACd,EAA0B;IAE1B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,EAAE,CAAA,2CAA2C,GAAG,CAAC,QAAQ,SAAS,CAAC;QAC3E,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,EAAE,CAAA,yCAAyC,GAAG,CAAC,MAAM,SAAS,CAAC;QACvE,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,EAAE,CAAA,2CAA2C,GAAG,CAAC,QAAQ,SAAS,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,CAAC,EAAmB,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAW,CAAC;AACrB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAI,EAAM,EAAE,QAAgB,EAAE,EAA0B;IAChF,OAAO,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC"}

package/dist/db/load-env.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Carregador mínimo de `.env` (sem dependência externa). Procura o arquivo na
+ * raiz do monorepo e popula `process.env` sem sobrescrever variáveis já
+ * definidas (o ambiente real tem prioridade sobre o arquivo). Usado pelos
+ * scripts CLI (migrate/seed) e pela API em desenvolvimento.
+ */
+export declare function loadEnv(fileName?: string): void;
+//# sourceMappingURL=load-env.d.ts.map

package/dist/db/load-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-env.d.ts","sourceRoot":"","sources":["../../src/db/load-env.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,QAAQ,SAAS,GAAG,IAAI,CAa/C"}

package/dist/db/load-env.js

@@ -0,0 +1,44 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+/**
+ * Carregador mínimo de `.env` (sem dependência externa). Procura o arquivo na
+ * raiz do monorepo e popula `process.env` sem sobrescrever variáveis já
+ * definidas (o ambiente real tem prioridade sobre o arquivo). Usado pelos
+ * scripts CLI (migrate/seed) e pela API em desenvolvimento.
+ */
+export function loadEnv(fileName = '.env') {
+    // Sobe diretórios a partir do cwd até achar o arquivo (raiz do monorepo).
+    let dir = process.cwd();
+    for (let i = 0; i < 6; i++) {
+        const candidate = resolve(dir, fileName);
+        if (existsSync(candidate)) {
+            applyEnvFile(candidate);
+            return;
+        }
+        const parent = resolve(dir, '..');
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+}
+function applyEnvFile(path) {
+    const content = readFileSync(path, 'utf8');
+    for (const rawLine of content.split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = line.slice(0, eq).trim();
+        if (key in process.env)
+            continue;
+        let value = line.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        process.env[key] = value;
+    }
+}
+//# sourceMappingURL=load-env.js.map

package/dist/db/load-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-env.js","sourceRoot":"","sources":["../../src/db/load-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,QAAQ,GAAG,MAAM;IACvC,0EAA0E;IAC1E,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG;YAAE,SAAS;QACjC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/db/migrate.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=migrate.d.ts.map

package/dist/db/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":""}

package/dist/db/migrate.js

@@ -0,0 +1,139 @@
+/**
+ * Runner de migrations — fonte única de verdade do schema.
+ *
+ * Aplica arquivos `.sql` numerados em ordem (core + verticais), registrando cada
+ * um em `_migration` com checksum. Roda com o papel OWNER (DATABASE_URL). Antes
+ * das migrations, garante o papel de aplicação `baruk_app` (NOSUPERUSER,
+ * NOBYPASSRLS) e, ao final, concede os privilégios de DML a ele.
+ *
+ * Uso: `pnpm db:migrate`  (ou `tsx src/db/migrate.ts`)
+ */
+import { createHash } from 'node:crypto';
+import { readdirSync, readFileSync, existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createDb } from './client.js';
+import { loadEnv } from './load-env.js';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+function findRepoRoot(start) {
+    let dir = start;
+    for (let i = 0; i < 8; i++) {
+        if (existsSync(join(dir, 'pnpm-workspace.yaml')))
+            return dir;
+        const parent = resolve(dir, '..');
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return start;
+}
+function collectDir(dir) {
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir)
+        .filter((f) => f.endsWith('.sql'))
+        .map((f) => {
+        const path = join(dir, f);
+        const sql = readFileSync(path, 'utf8');
+        return { name: f, path, sql, checksum: createHash('sha256').update(sql).digest('hex') };
+    });
+}
+function collectMigrations() {
+    // Este arquivo vive em packages/core/src/db → as migrations do core em ./migrations.
+    const coreMigrations = join(__dirname, 'migrations');
+    const repoRoot = findRepoRoot(__dirname);
+    const verticalsRoot = join(repoRoot, 'packages', 'verticals');
+    const all = [...collectDir(coreMigrations)];
+    if (existsSync(verticalsRoot)) {
+        for (const vertical of readdirSync(verticalsRoot)) {
+            all.push(...collectDir(join(verticalsRoot, vertical, 'db', 'migrations')));
+        }
+    }
+    // Ordena por nome (prefixos numéricos zero-padded garantem ordem correta).
+    return all.sort((a, b) => a.name.localeCompare(b.name, 'en'));
+}
+/** Valida a senha do papel de app para poder embutir com segurança no DDL. */
+function safePassword(pw) {
+    if (!/^[A-Za-z0-9!@#%^*_\-+=.]{8,}$/.test(pw)) {
+        throw new Error('APP_DB_PASSWORD ausente ou com caracteres não suportados (use 8+ de [A-Za-z0-9!@#%^*_-+=.]).');
+    }
+    return pw;
+}
+async function main() {
+    loadEnv();
+    const ownerUrl = process.env.DATABASE_URL;
+    if (!ownerUrl)
+        throw new Error('DATABASE_URL (papel owner) não definida.');
+    const appPassword = safePassword(process.env.APP_DB_PASSWORD ?? '');
+    const sql = createDb(ownerUrl, { role: 'owner', max: 1 });
+    try {
+        // 1) Papel de aplicação. Roles novas já nascem NOSUPERUSER, NOBYPASSRLS,
+        //    NOCREATEDB, NOCREATEROLE — que é exatamente o que queremos. Definir
+        //    esses atributos EXPLICITAMENTE exige superuser (indisponível em Postgres
+        //    gerenciado como Render/Neon), então só criamos com defaults e setamos
+        //    LOGIN + PASSWORD. A ausência de BYPASSRLS + FORCE RLS garante o isolamento.
+        await sql.unsafe(`
+      DO $$ BEGIN
+        IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'baruk_app') THEN
+          CREATE ROLE baruk_app LOGIN PASSWORD '${appPassword}';
+        END IF;
+      END $$;
+    `);
+        await sql.unsafe(`ALTER ROLE baruk_app WITH LOGIN PASSWORD '${appPassword}';`);
+        // 2) Tabela de controle.
+        await sql.unsafe(`
+      CREATE TABLE IF NOT EXISTS _migration (
+        name       text PRIMARY KEY,
+        checksum   text NOT NULL,
+        applied_at timestamptz NOT NULL DEFAULT now()
+      );
+    `);
+        const applied = new Map();
+        for (const row of await sql `SELECT name, checksum FROM _migration`) {
+            applied.set(row.name, row.checksum);
+        }
+        const migrations = collectMigrations();
+        let count = 0;
+        for (const m of migrations) {
+            const prev = applied.get(m.name);
+            if (prev) {
+                if (prev !== m.checksum) {
+                    throw new Error(`Migration já aplicada foi modificada: ${m.name}. Migrations são imutáveis — crie uma nova.`);
+                }
+                continue;
+            }
+            process.stdout.write(`→ aplicando ${m.name} … `);
+            await sql.begin(async (tx) => {
+                await tx.unsafe(m.sql);
+                await tx `INSERT INTO _migration (name, checksum) VALUES (${m.name}, ${m.checksum})`;
+            });
+            console.log('ok');
+            count++;
+        }
+        // 3) Grants ao papel de app (idempotente; cobre também tabelas de verticais).
+        await sql.unsafe(`
+      GRANT USAGE ON SCHEMA public TO baruk_app;
+      GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO baruk_app;
+      GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO baruk_app;
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public
+        GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO baruk_app;
+      -- Append-only: app não pode alterar/apagar auditoria.
+      REVOKE UPDATE, DELETE ON audit_log FROM baruk_app;
+      -- Segredos de auth: app só lê (seed/owner escreve).
+      REVOKE INSERT, UPDATE, DELETE ON user_credential FROM baruk_app;
+      -- Controle de migrations é privado do owner.
+      REVOKE ALL ON _migration FROM baruk_app;
+    `);
+        console.log(count === 0
+            ? '✓ Nenhuma migration pendente. Schema já atualizado.'
+            : `✓ ${count} migration(s) aplicada(s). Papel baruk_app garantido e privilegiado.`);
+    }
+    finally {
+        await sql.end({ timeout: 5 });
+    }
+}
+main().catch((err) => {
+    console.error('✗ Falha na migração:', err instanceof Error ? err.message : err);
+    process.exit(1);
+});
+//# sourceMappingURL=migrate.js.map

package/dist/db/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAS1D,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,iBAAiB;IACxB,qFAAqF;IACrF,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAE9D,MAAM,GAAG,GAAgB,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAEzD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,EAAU;IAC9B,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,OAAO,EAAE,CAAC;IACV,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAEpE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,yEAAyE;QACzE,yEAAyE;QACzE,8EAA8E;QAC9E,2EAA2E;QAC3E,iFAAiF;QACjF,MAAM,GAAG,CAAC,MAAM,CAAC;;;kDAG6B,WAAW;;;KAGxD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,6CAA6C,WAAW,IAAI,CAAC,CAAC;QAE/E,yBAAyB;QACzB,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;KAMhB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,GAAG,CAAA,uCAAuC,EAAE,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAc,EAAE,GAAG,CAAC,QAAkB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,IAAI,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CACb,yCAAyC,CAAC,CAAC,IAAI,6CAA6C,CAC7F,CAAC;gBACJ,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;YACjD,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC3B,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM,EAAE,CAAA,mDAAmD,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC;YACtF,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,KAAK,EAAE,CAAC;QACV,CAAC;QAED,8EAA8E;QAC9E,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;;;;;;KAYhB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC;YACT,CAAC,CAAC,qDAAqD;YACvD,CAAC,CAAC,KAAK,KAAK,sEAAsE,CACrF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/db/seed.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=seed.d.ts.map

package/dist/db/seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../src/db/seed.ts"],"names":[],"mappings":""}