@boopkit/cap-users 0.1.0

package/capability.json

@@ -0,0 +1,50 @@
+{
+  "name": "users-and-accounts",
+  "description": "Users, identities, properties, and authentication via Prisma",
+  "type": "application",
+  "requires": ["database", "services", "web"],
+  "package": "@boopkit/cap-users",
+  "dependencies": ["bcryptjs", "cookie-parser"],
+  "devDependencies": [],
+  "files": [
+    "prisma/schema/users.prisma",
+    "prisma/schema/accounts.prisma",
+    "src/services/users.service.ts",
+    "src/services/accounts.service.ts",
+    "src/middleware/auth.ts",
+    "src/controllers/auth.ts",
+    "src/routes/auth.ts",
+    "views/signup.hbs",
+    "views/login.hbs",
+    "views/partials/auth-nav.hbs",
+    "styles/auth.css",
+    "reference/user-auth.ref.md"
+  ],
+  "skills": [],
+  "hooks": [
+    { "phase": "imports", "code": "import cookieParser from 'cookie-parser';", "description": "cookie parsing for session tokens" },
+    { "phase": "imports", "code": "import UserService from './services/users.service';", "description": "user service wiring" },
+    { "phase": "imports", "code": "import { ensureVisitor, addAuthContext } from './middleware/auth';", "description": "auth middleware — session resolution and trust context" },
+    { "phase": "imports", "code": "import authRoutes from './routes/auth';", "description": "auth route definitions" },
+    { "phase": "imports", "code": "import AccountService from './services/accounts.service';", "description": "account service wiring" },
+    { "phase": "preRoutes", "order": 14, "code": "app.use(cookieParser());", "description": "parse cookies (required for auth session resolution)" },
+    { "phase": "preRoutes", "order": 15, "code": "app.use(ensureVisitor);", "description": "resolve visitor identity from auth_id cookie" },
+    { "phase": "preRoutes", "order": 16, "code": "app.use(addAuthContext);", "description": "populate res.locals.auth for view templates" },
+    { "phase": "preRoutes", "order": 52, "code": "app.use(authRoutes({ authService: UserService.authService }));", "description": "mount auth routes (signup, login, logout)" }
+  ],
+  "env": [
+    { "name": "SESSION_DURATION", "description": "Session token lifetime in seconds (default: 7 days)", "default": "604800", "required": "runtime" },
+    { "name": "INVITATION_TTL", "description": "Team invitation expiry in milliseconds (default: 7 days)", "default": "604800000", "required": "runtime" }
+  ],
+  "postInstall": {
+    "steps": [
+      "Run database migration to create user and account tables: npm run db:migrate -- --name add-${capabilityName}",
+      "Generate updated Prisma client: npm run db:generate",
+      "Add {{> auth-nav}} to your main.hbs layout — inside <body> before your main content."
+    ],
+    "setupChecks": [
+      { "type": "prisma-migrate", "label": "Run database migrations", "hint": "npm run db:migrate -- --name add-${capabilityName}" },
+      { "type": "prisma-generate", "label": "Generate Prisma client", "hint": "npm run db:generate" }
+    ]
+  }
+}

package/dist/account-management-service.d.ts

@@ -0,0 +1,52 @@
+import type { AccountService } from './account-service.js';
+import type { UserService } from './user-service.js';
+import type { AccountPropertyService } from './account-property-service.js';
+import type { IdentityService } from './identity-service.js';
+import type { BaseAccountInfo, BaseAccountUserInfo, BaseUserInfo, Account, AccountUser, User } from './types.js';
+export declare class AccountManagementError extends Error {
+    constructor(message: string);
+}
+export interface AccountManagementServiceDeps {
+    accountService: AccountService<BaseAccountInfo>;
+    userService: UserService<BaseUserInfo>;
+    accountPropertyService: AccountPropertyService;
+    identityService: IdentityService;
+}
+export interface AccountManagementServiceOptions {
+    onAccountCreated?(account: Account<BaseAccountInfo>, owner: User<BaseUserInfo>): void;
+    onUserAdded?(params: {
+        accountId: number;
+        userId: number;
+        role: string;
+    }): void;
+}
+export interface ProvisionAccountInput {
+    name: string;
+}
+export interface ProvisionAccountResult {
+    account: Account<BaseAccountInfo>;
+    membership: AccountUser;
+}
+export interface TeamMember {
+    userId: number;
+    name?: string;
+    email?: string;
+    role: string;
+    status: string;
+}
+export interface AccountManagementService {
+    validateAccountInput(input: ProvisionAccountInput): void;
+    createAccount(input: ProvisionAccountInput): Promise<Account<BaseAccountInfo>>;
+    linkOwner(accountId: number, userId: number): Promise<AccountUser>;
+    provisionAccount(userId: number, input: ProvisionAccountInput): Promise<ProvisionAccountResult>;
+    addUser(accountId: number, userId: number, role?: BaseAccountUserInfo['role'], status?: BaseAccountUserInfo['status']): Promise<AccountUser>;
+    activateUser(accountId: number, userId: number): Promise<AccountUser>;
+    changeRole(accountId: number, userId: number, newRole: BaseAccountUserInfo['role']): Promise<AccountUser>;
+    removeUser(accountId: number, userId: number): Promise<void>;
+    disableAccount(accountId: number): Promise<Account<BaseAccountInfo>>;
+    getUserAccounts(userId: number): Promise<Account<BaseAccountInfo>[]>;
+    hasRole(accountId: number, userId: number, role: BaseAccountUserInfo['role']): boolean | Promise<boolean>;
+    getTeamMembers(accountId: number): Promise<TeamMember[]>;
+}
+export declare function createAccountManagementService(deps: AccountManagementServiceDeps, options?: AccountManagementServiceOptions): AccountManagementService;
+//# sourceMappingURL=account-management-service.d.ts.map

package/dist/account-management-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-management-service.d.ts","sourceRoot":"","sources":["../src/account-management-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,OAAO,EACP,WAAW,EACX,IAAI,EACL,MAAM,YAAY,CAAC;AAIpB,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAID,MAAM,WAAW,4BAA4B;IAC3C,cAAc,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;IAChD,WAAW,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;IACvC,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,+BAA+B;IAC9C,gBAAgB,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;IACtF,WAAW,CAAC,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACjF;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC,UAAU,EAAE,WAAW,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IAEvC,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACzD,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAC/E,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAGnE,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAGhG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,mBAAmB,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7I,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1G,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG7D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAGrE,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1G,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CAC1D;AAgBD,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,4BAA4B,EAClC,OAAO,CAAC,EAAE,+BAA+B,GACxC,wBAAwB,CAwJ1B"}

package/dist/account-management-service.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountManagementError = void 0;
+exports.createAccountManagementService = createAccountManagementService;
+// ---------- Errors ----------
+class AccountManagementError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AccountManagementError';
+    }
+}
+exports.AccountManagementError = AccountManagementError;
+// ---------- Role hierarchy ----------
+const ROLE_ORDER = ['viewer', 'editor', 'admin', 'owner'];
+function roleLevel(role) {
+    return ROLE_ORDER.indexOf(role);
+}
+// ---------- Validation ----------
+const MAX_ACCOUNT_NAME_LENGTH = 100;
+// ---------- Factory ----------
+function createAccountManagementService(deps, options) {
+    const { accountService, userService, identityService } = deps;
+    // ---- Decomposed steps ----
+    function validateAccountInput(input) {
+        if (!input.name || input.name.trim().length === 0) {
+            throw new AccountManagementError('Account name is required');
+        }
+        if (input.name.length > MAX_ACCOUNT_NAME_LENGTH) {
+            throw new AccountManagementError(`Account name must be ${MAX_ACCOUNT_NAME_LENGTH} characters or fewer`);
+        }
+    }
+    async function createAccount(input) {
+        return accountService.create({ name: input.name.trim(), status: 'enabled' });
+    }
+    async function linkOwner(accountId, userId) {
+        return accountService.addUser(accountId, userId, { role: 'owner', status: 'enabled' });
+    }
+    // ---- Convenience ----
+    async function provisionAccount(userId, input) {
+        validateAccountInput(input);
+        const account = await createAccount(input);
+        const membership = await linkOwner(account.id, userId);
+        const user = await userService.findById(userId);
+        if (user) {
+            options?.onAccountCreated?.(account, user);
+        }
+        return { account, membership };
+    }
+    // ---- Membership management ----
+    async function addUser(accountId, userId, role = 'viewer', status = 'enabled') {
+        const au = await accountService.addUser(accountId, userId, { role, status });
+        options?.onUserAdded?.({ accountId, userId, role });
+        return au;
+    }
+    async function activateUser(accountId, userId) {
+        const users = await accountService.getUsers(accountId);
+        const member = users.find((u) => u.userId === userId);
+        if (!member) {
+            throw new AccountManagementError(`User ${userId} is not a member of account ${accountId}`);
+        }
+        if (member.info.status !== 'pending') {
+            throw new AccountManagementError(`User ${userId} is not in pending status (current: ${member.info.status})`);
+        }
+        return accountService.updateUser(accountId, userId, { role: member.info.role, status: 'enabled' });
+    }
+    async function changeRole(accountId, userId, newRole) {
+        const users = await accountService.getUsers(accountId);
+        const member = users.find((u) => u.userId === userId);
+        if (!member) {
+            throw new AccountManagementError(`User ${userId} is not a member of account ${accountId}`);
+        }
+        return accountService.updateUser(accountId, userId, { role: newRole, status: member.info.status });
+    }
+    async function removeUser(accountId, userId) {
+        const users = await accountService.getUsers(accountId);
+        const member = users.find((u) => u.userId === userId);
+        if (member && member.info.role === 'owner') {
+            const otherOwners = users.filter((u) => u.userId !== userId && u.info.role === 'owner');
+            if (otherOwners.length === 0) {
+                throw new AccountManagementError('Cannot remove the last owner of an account');
+            }
+        }
+        return accountService.removeUser(accountId, userId);
+    }
+    // ---- Account state ----
+    async function disableAccount(accountId) {
+        const account = await accountService.findById(accountId);
+        if (!account) {
+            throw new AccountManagementError(`Account ${accountId} not found`);
+        }
+        return accountService.put(accountId, { ...account.info, status: 'disabled' });
+    }
+    // ---- Queries ----
+    async function getUserAccounts(userId) {
+        return accountService.findAccountsByUser(userId);
+    }
+    async function hasRole(accountId, userId, role) {
+        const userRole = await accountService.getUserRole(accountId, userId);
+        if (!userRole)
+            return false;
+        return roleLevel(userRole) >= roleLevel(role);
+    }
+    async function getTeamMembers(accountId) {
+        const accountUsers = await accountService.getUsers(accountId);
+        const members = [];
+        for (const au of accountUsers) {
+            const user = await userService.findById(au.userId);
+            let email;
+            // Resolve email from identity service
+            const identities = await identityService.findAllByUser(au.userId);
+            const emailIdentity = identities.find((i) => i.domain === 'email');
+            if (emailIdentity) {
+                email = emailIdentity.key;
+            }
+            members.push({
+                userId: au.userId,
+                name: user?.info.name,
+                email,
+                role: au.info.role,
+                status: au.info.status,
+            });
+        }
+        return members;
+    }
+    return {
+        validateAccountInput,
+        createAccount,
+        linkOwner,
+        provisionAccount,
+        addUser,
+        activateUser,
+        changeRole,
+        removeUser,
+        disableAccount,
+        getUserAccounts,
+        hasRole,
+        getTeamMembers,
+    };
+}
+//# sourceMappingURL=account-management-service.js.map

package/dist/account-management-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-management-service.js","sourceRoot":"","sources":["../src/account-management-service.ts"],"names":[],"mappings":";;;AA2FA,wEA2JC;AAzOD,+BAA+B;AAE/B,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAyDD,uCAAuC;AAEvC,MAAM,UAAU,GAAkC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEzF,SAAS,SAAS,CAAC,IAAiC;IAClD,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,mCAAmC;AAEnC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,gCAAgC;AAEhC,SAAgB,8BAA8B,CAC5C,IAAkC,EAClC,OAAyC;IAEzC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAE9D,6BAA6B;IAE7B,SAAS,oBAAoB,CAAC,KAA4B;QACxD,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAChD,MAAM,IAAI,sBAAsB,CAAC,wBAAwB,uBAAuB,sBAAsB,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,KAA4B;QACvD,OAAO,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,SAAiB,EAAE,MAAc;QACxD,OAAO,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,wBAAwB;IAExB,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,KAA4B;QAC1E,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,EAAE,gBAAgB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACjC,CAAC;IAED,kCAAkC;IAElC,KAAK,UAAU,OAAO,CACpB,SAAiB,EACjB,MAAc,EACd,OAAoC,QAAQ,EAC5C,SAAwC,SAAS;QAEjD,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,MAAc;QAC3D,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAsB,CAAC,QAAQ,MAAM,+BAA+B,SAAS,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,sBAAsB,CAAC,QAAQ,MAAM,uCAAuC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,KAAK,UAAU,UAAU,CACvB,SAAiB,EACjB,MAAc,EACd,OAAoC;QAEpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAsB,CAAC,QAAQ,MAAM,+BAA+B,SAAS,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,MAAc;QACzD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACtD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;YACxF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,sBAAsB,CAAC,4CAA4C,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QACD,OAAO,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAED,0BAA0B;IAE1B,KAAK,UAAU,cAAc,CAAC,SAAiB;QAC7C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,sBAAsB,CAAC,WAAW,SAAS,YAAY,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,oBAAoB;IAEpB,KAAK,UAAU,eAAe,CAAC,MAAc;QAC3C,OAAO,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,SAAiB,EACjB,MAAc,EACd,IAAiC;QAEjC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,SAAS,CAAC,QAAuC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,SAAiB;QAC7C,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAiB,EAAE,CAAC;QAEjC,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,KAAyB,CAAC;YAE9B,sCAAsC;YACtC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YAClE,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;YACnE,IAAI,aAAa,EAAE,CAAC;gBAClB,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC;YAC5B,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACrB,KAAK;gBACL,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI;gBAClB,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,oBAAoB;QACpB,aAAa;QACb,SAAS;QACT,gBAAgB;QAChB,OAAO;QACP,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,eAAe;QACf,OAAO;QACP,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/account-property-service.d.ts

@@ -0,0 +1,18 @@
+import { createPropertyService, type PropertyService, type PropertyRecord } from '@boopkit/cap-services';
+/** Options for creating an account property service. */
+export interface AccountPropertyServiceOptions {
+    onCreated?(record: PropertyRecord): void;
+    onUpdated?(record: PropertyRecord): void;
+    onRemoved?(record: PropertyRecord): void;
+}
+/** The service object returned by createAccountPropertyService. */
+export type AccountPropertyService = PropertyService;
+/**
+ * Create a property service pre-configured for account properties.
+ *
+ * Thin wrapper over createPropertyService with:
+ *  - parentIdField set to 'accountId'
+ *  - sensitiveProperties set to ['keys']
+ */
+export declare function createAccountPropertyService(model: Parameters<typeof createPropertyService>[0], options?: AccountPropertyServiceOptions): AccountPropertyService;
+//# sourceMappingURL=account-property-service.d.ts.map

package/dist/account-property-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-property-service.d.ts","sourceRoot":"","sources":["../src/account-property-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAE/B,wDAAwD;AACxD,MAAM,WAAW,6BAA6B;IAC5C,SAAS,CAAC,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC,SAAS,CAAC,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC,SAAS,CAAC,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;CAC1C;AAED,mEAAmE;AACnE,MAAM,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAErD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAClD,OAAO,CAAC,EAAE,6BAA6B,GACtC,sBAAsB,CAMxB"}

package/dist/account-property-service.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccountPropertyService = createAccountPropertyService;
+const cap_services_1 = require("@boopkit/cap-services");
+/**
+ * Create a property service pre-configured for account properties.
+ *
+ * Thin wrapper over createPropertyService with:
+ *  - parentIdField set to 'accountId'
+ *  - sensitiveProperties set to ['keys']
+ */
+function createAccountPropertyService(model, options) {
+    return (0, cap_services_1.createPropertyService)(model, {
+        parentIdField: 'accountId',
+        sensitiveProperties: ['keys'],
+        ...options,
+    });
+}
+//# sourceMappingURL=account-property-service.js.map

package/dist/account-property-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-property-service.js","sourceRoot":"","sources":["../src/account-property-service.ts"],"names":[],"mappings":";;AAuBA,oEASC;AAhCD,wDAI+B;AAY/B;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAC1C,KAAkD,EAClD,OAAuC;IAEvC,OAAO,IAAA,oCAAqB,EAAC,KAAK,EAAE;QAClC,aAAa,EAAE,WAAW;QAC1B,mBAAmB,EAAE,CAAC,MAAM,CAAC;QAC7B,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC"}

package/dist/account-service.d.ts

@@ -0,0 +1,84 @@
+import type { EntityService } from '@boopkit/cap-services';
+import type { BaseAccountInfo, BaseAccountUserInfo, Account, AccountUser } from './types.js';
+/** Lifecycle callbacks for account mutations. */
+export interface AccountServiceOptions<TInfo extends BaseAccountInfo> {
+    onCreated?(account: Account<TInfo>): void;
+    onUpdated?(account: Account<TInfo>): void;
+    onRemoved?(account: Account<TInfo>): void;
+    onUserAdded?(accountUser: AccountUser): void;
+    onUserUpdated?(accountUser: AccountUser): void;
+    onUserRemoved?(accountUser: AccountUser): void;
+}
+/** The service object returned by createAccountService. */
+export interface AccountService<TInfo extends BaseAccountInfo> extends EntityService<TInfo> {
+    findByPublicId(publicId: string): Promise<Account<TInfo> | null>;
+    findByName(name: string): Promise<Account<TInfo> | null>;
+    getUsers(accountId: number): Promise<AccountUser[]>;
+    addUser(accountId: number, userId: number, info?: BaseAccountUserInfo): Promise<AccountUser>;
+    updateUser(accountId: number, userId: number, info: BaseAccountUserInfo): Promise<AccountUser>;
+    removeUser(accountId: number, userId: number): Promise<void>;
+    getUserRole(accountId: number, userId: number): Promise<string | null>;
+    findAccountsByUser(userId: number): Promise<Account<TInfo>[]>;
+}
+/**
+ * Minimal delegate shape for the accounts table.
+ * Extends the entity ModelDelegate with publicId lookups and JSON field queries.
+ */
+interface AccountModelDelegate {
+    create(args: {
+        data: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    findUnique(args: {
+        where: Record<string, unknown>;
+    }): Promise<Record<string, unknown> | null>;
+    findMany(args?: {
+        skip?: number;
+        take?: number;
+        where?: Record<string, unknown>;
+    }): Promise<Record<string, unknown>[]>;
+    update(args: {
+        where: {
+            id: number;
+        };
+        data: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    delete(args: {
+        where: {
+            id: number;
+        };
+    }): Promise<Record<string, unknown>>;
+}
+/**
+ * Minimal delegate shape for the account_users join table.
+ */
+interface AccountUserModelDelegate {
+    create(args: {
+        data: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    findUnique(args: {
+        where: Record<string, unknown>;
+    }): Promise<Record<string, unknown> | null>;
+    findMany(args: {
+        where: Record<string, unknown>;
+    }): Promise<Record<string, unknown>[]>;
+    update(args: {
+        where: {
+            id: number;
+        };
+        data: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    delete(args: {
+        where: {
+            id: number;
+        };
+    }): Promise<Record<string, unknown>>;
+}
+/**
+ * Create a typed account service composing on top of createEntityService.
+ *
+ * Inherits CRUD from entity-service and adds account-specific methods:
+ * findByPublicId, findByName, getUsers, addUser, removeUser, getUserRole.
+ */
+export declare function createAccountService<TInfo extends BaseAccountInfo = BaseAccountInfo>(accountModel: AccountModelDelegate, accountUserModel: AccountUserModelDelegate, options?: AccountServiceOptions<TInfo>): AccountService<TInfo>;
+export {};
+//# sourceMappingURL=account-service.d.ts.map

package/dist/account-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-service.d.ts","sourceRoot":"","sources":["../src/account-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG7F,iDAAiD;AACjD,MAAM,WAAW,qBAAqB,CAAC,KAAK,SAAS,eAAe;IAClE,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC1C,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC1C,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC1C,WAAW,CAAC,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7C,aAAa,CAAC,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,aAAa,CAAC,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc,CAAC,KAAK,SAAS,eAAe,CAAE,SAAQ,aAAa,CAAC,KAAK,CAAC;IACzF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7F,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/F,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;CAC/D;AAED;;;GAGG;AACH,UAAU,oBAAoB;IAC5B,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACvH,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,UAAU,wBAAwB;IAChC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACvF,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzG,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3E;AA+BD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,SAAS,eAAe,GAAG,eAAe,EAClF,YAAY,EAAE,oBAAoB,EAClC,gBAAgB,EAAE,wBAAwB,EAC1C,OAAO,CAAC,EAAE,qBAAqB,CAAC,KAAK,CAAC,GACrC,cAAc,CAAC,KAAK,CAAC,CAgHvB"}

package/dist/account-service.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccountService = createAccountService;
+const cap_services_1 = require("@boopkit/cap-services");
+const types_js_1 = require("./types.js");
+/**
+ * Map a raw delegate row to a typed Account entity.
+ */
+function toAccount(row) {
+    return {
+        id: row.id,
+        publicId: row.publicId,
+        info: row.info,
+        infoSchema: row.infoSchema,
+        revision: row.revision,
+        createdAt: row.createdAt instanceof Date ? row.createdAt : new Date(row.createdAt),
+        updatedAt: row.updatedAt instanceof Date ? row.updatedAt : new Date(row.updatedAt),
+    };
+}
+/**
+ * Map a raw delegate row to a typed AccountUser.
+ */
+function toAccountUser(row) {
+    return {
+        id: row.id,
+        accountId: row.accountId,
+        userId: row.userId,
+        info: row.info,
+        createdAt: row.createdAt instanceof Date ? row.createdAt : new Date(row.createdAt),
+        updatedAt: row.updatedAt instanceof Date ? row.updatedAt : new Date(row.updatedAt),
+    };
+}
+/**
+ * Create a typed account service composing on top of createEntityService.
+ *
+ * Inherits CRUD from entity-service and adds account-specific methods:
+ * findByPublicId, findByName, getUsers, addUser, removeUser, getUserRole.
+ */
+function createAccountService(accountModel, accountUserModel, options) {
+    const base = (0, cap_services_1.createEntityService)(accountModel, {
+        infoSchema: 'account-01',
+        onCreated: options?.onCreated,
+        onUpdated: options?.onUpdated,
+        onRemoved: options?.onRemoved,
+    });
+    return {
+        ...base,
+        async findByPublicId(publicId) {
+            const row = await accountModel.findUnique({ where: { publicId } });
+            return row ? toAccount(row) : null;
+        },
+        async findByName(name) {
+            // Query accounts and find one whose info.name matches.
+            // Uses findMany with JSON field filtering if the delegate supports it,
+            // otherwise falls back to client-side filtering.
+            const rows = await accountModel.findMany();
+            const match = rows.find((row) => {
+                const info = row.info;
+                return info && info.name === name;
+            });
+            return match ? toAccount(match) : null;
+        },
+        async getUsers(accountId) {
+            const rows = await accountUserModel.findMany({ where: { accountId } });
+            return rows.map((row) => toAccountUser(row));
+        },
+        async addUser(accountId, userId, info) {
+            // Check for duplicate
+            const existing = await accountUserModel.findUnique({
+                where: { accountId_userId: { accountId, userId } },
+            });
+            if (existing) {
+                throw new types_js_1.DuplicateAccountUserError(accountId, userId);
+            }
+            const now = new Date();
+            const row = await accountUserModel.create({
+                data: {
+                    accountId,
+                    userId,
+                    info: (info ?? { status: 'enabled', role: 'viewer' }),
+                    createdAt: now,
+                    updatedAt: now,
+                },
+            });
+            const accountUser = toAccountUser(row);
+            options?.onUserAdded?.(accountUser);
+            return accountUser;
+        },
+        async updateUser(accountId, userId, info) {
+            const existing = await accountUserModel.findUnique({
+                where: { accountId_userId: { accountId, userId } },
+            });
+            if (!existing) {
+                throw new Error(`User ${userId} is not a member of account ${accountId}`);
+            }
+            const now = new Date();
+            const row = await accountUserModel.update({
+                where: { id: existing.id },
+                data: { info: info, updatedAt: now },
+            });
+            const accountUser = toAccountUser(row);
+            options?.onUserUpdated?.(accountUser);
+            return accountUser;
+        },
+        async removeUser(accountId, userId) {
+            const existing = await accountUserModel.findUnique({
+                where: { accountId_userId: { accountId, userId } },
+            });
+            if (!existing) {
+                throw new Error(`User ${userId} is not a member of account ${accountId}`);
+            }
+            await accountUserModel.delete({ where: { id: existing.id } });
+            options?.onUserRemoved?.(toAccountUser(existing));
+        },
+        async findAccountsByUser(userId) {
+            const rows = await accountUserModel.findMany({ where: { userId } });
+            const accounts = [];
+            for (const row of rows) {
+                const accountRow = await accountModel.findUnique({ where: { id: row.accountId } });
+                if (accountRow)
+                    accounts.push(toAccount(accountRow));
+            }
+            return accounts;
+        },
+        async getUserRole(accountId, userId) {
+            const existing = await accountUserModel.findUnique({
+                where: { accountId_userId: { accountId, userId } },
+            });
+            if (!existing)
+                return null;
+            const info = existing.info;
+            return info ? info.role : null;
+        },
+    };
+}
+//# sourceMappingURL=account-service.js.map

package/dist/account-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-service.js","sourceRoot":"","sources":["../src/account-service.ts"],"names":[],"mappings":";;AAyFA,oDAoHC;AA7MD,wDAA4D;AAI5D,yCAAuD;AAkDvD;;GAEG;AACH,SAAS,SAAS,CAAgC,GAA4B;IAC5E,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,IAAI,EAAE,GAAG,CAAC,IAAa;QACvB,UAAU,EAAE,GAAG,CAAC,UAAoB;QACpC,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,SAAS,EAAE,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAmB,CAAC;QAC5F,SAAS,EAAE,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAmB,CAAC;KAC7F,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAoC,GAA4B;IACpF,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,SAAS,EAAE,GAAG,CAAC,SAAmB;QAClC,MAAM,EAAE,GAAG,CAAC,MAAgB;QAC5B,IAAI,EAAE,GAAG,CAAC,IAAa;QACvB,SAAS,EAAE,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAmB,CAAC;QAC5F,SAAS,EAAE,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAmB,CAAC;KAC7F,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,YAAkC,EAClC,gBAA0C,EAC1C,OAAsC;IAEtC,MAAM,IAAI,GAAG,IAAA,kCAAmB,EAAQ,YAAmB,EAAE;QAC3D,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,SAAS,EAAE,OAAO,EAAE,SAA0D;KAC/E,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,IAAI;QAEP,KAAK,CAAC,cAAc,CAAC,QAAgB;YACnC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAY;YAC3B,uDAAuD;YACvD,uEAAuE;YACvE,iDAAiD;YACjD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAsC,CAAC;gBACxD,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;YACpC,CAAC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,CAAC,CAAC,SAAS,CAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,SAAiB;YAC9B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;QAED,KAAK,CAAC,OAAO,CACX,SAAiB,EACjB,MAAc,EACd,IAA0B;YAE1B,sBAAsB;YACtB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC;gBACjD,KAAK,EAAE,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;aACnD,CAAC,CAAC;YACH,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,oCAAyB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC;gBACxC,IAAI,EAAE;oBACJ,SAAS;oBACT,MAAM;oBACN,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAY;oBAChE,SAAS,EAAE,GAAG;oBACd,SAAS,EAAE,GAAG;iBACf;aACF,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YACvC,OAAO,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,CAAC;YACpC,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,UAAU,CACd,SAAiB,EACjB,MAAc,EACd,IAAyB;YAEzB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC;gBACjD,KAAK,EAAE,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;aACnD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,+BAA+B,SAAS,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC;gBACxC,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAY,EAAE;gBACpC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAe,EAAE,SAAS,EAAE,GAAG,EAAE;aAChD,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YACvC,OAAO,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC;YACtC,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,MAAc;YAChD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC;gBACjD,KAAK,EAAE,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;aACnD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,+BAA+B,SAAS,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAY,EAAE,EAAE,CAAC,CAAC;YACxE,OAAO,EAAE,aAAa,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,MAAc;YACrC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAqB,EAAE,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,SAAmB,EAAE,EAAE,CAAC,CAAC;gBAC7F,IAAI,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAQ,UAAU,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,MAAc;YACjD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC;gBACjD,KAAK,EAAE,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;aACnD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAsC,CAAC;YAC7D,OAAO,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,IAAe,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth-middleware.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Auth middleware factories for Express.
+ *
+ * Provides three middleware functions:
+ * - `ensureVisitor` — resolves session from auth_id cookie, creates anonymous visitor if missing
+ * - `requireAuth` — gates routes by trust tier, redirects web / 401s API
+ * - `addAuthContext` — populates res.locals.auth for view templates
+ */
+import type { Request, Response, NextFunction } from 'express';
+import type { AuthService } from './auth-service.js';
+import type { IdentityService } from './identity-service.js';
+import type { UserService } from './user-service.js';
+import type { BaseUserInfo, TrustTier } from './types.js';
+/** Dependencies injected into createAuthMiddleware. */
+export interface AuthMiddlewareDeps {
+    authService: AuthService;
+    identityService: IdentityService;
+    userService: UserService<BaseUserInfo>;
+}
+/** Options for createAuthMiddleware. */
+export interface AuthMiddlewareOptions {
+    /** Cookie name for session token. Default: 'auth_id' */
+    cookieName?: string;
+    /** Cookie max-age in milliseconds. Default: 365 days */
+    cookieMaxAge?: number;
+    /** Cookie name for visitor tracking. Default: 'visitor_id' */
+    visitorCookieName?: string;
+    /** Visitor cookie max-age in milliseconds. Default: 10 years */
+    visitorCookieMaxAge?: number;
+    /** Login path for redirects. Default: '/login' */
+    loginPath?: string;
+}
+/** Shape of res.locals.auth populated by addAuthContext. */
+export interface AuthLocals {
+    trustTier: TrustTier | null;
+    userName: string | null;
+    userEmail: string | null;
+    userInitial: string | null;
+}
+/** The middleware functions returned by createAuthMiddleware. */
+export interface AuthMiddleware {
+    ensureVisitor: (req: Request, res: Response, next: NextFunction) => void;
+    requireAuth: (requiredTrust?: TrustTier) => (req: Request, res: Response, next: NextFunction) => void;
+    addAuthContext: (req: Request, res: Response, next: NextFunction) => void;
+}
+/**
+ * Create auth middleware functions wired to the auth, identity, and user services.
+ */
+export declare function createAuthMiddleware(deps: AuthMiddlewareDeps, options?: AuthMiddlewareOptions): AuthMiddleware;
+//# sourceMappingURL=auth-middleware.d.ts.map

package/dist/auth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../src/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAQ,MAAM,YAAY,CAAC;AAIhE,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,WAAW,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;CACxC;AAED,wCAAwC;AACxC,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACzE,WAAW,EAAE,CAAC,aAAa,CAAC,EAAE,SAAS,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACtG,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;CAC3E;AASD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,kBAAkB,EACxB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,cAAc,CAsJhB"}