@boopkit/cap-users 0.1.0

package/dist/identity-service.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createIdentityService = createIdentityService;
+const types_js_1 = require("./types.js");
+function toIdentity(row) {
+    const endedAt = row.endedAt;
+    return {
+        id: row.id,
+        userId: row.userId,
+        domain: row.domain,
+        key: row.key,
+        endedAt: endedAt == null ? null : (endedAt instanceof Date ? endedAt : new Date(endedAt)),
+        createdAt: row.createdAt instanceof Date ? row.createdAt : new Date(row.createdAt),
+        updatedAt: row.updatedAt instanceof Date ? row.updatedAt : new Date(row.updatedAt),
+    };
+}
+/** Compound unique key for (domain, key) lookups. */
+function domainKeyWhere(domain, key) {
+    return { domain_key: { domain, key } };
+}
+/** Normalize key for domain-specific rules (email → lowercase). */
+function normalizeKey(domain, key) {
+    return domain === 'email' ? key.toLowerCase() : key;
+}
+function isPrismaUniqueError(err) {
+    return (typeof err === 'object' &&
+        err !== null &&
+        'code' in err &&
+        err.code === 'P2002');
+}
+/**
+ * Create an identity service for user identity management.
+ *
+ * Not entity-shaped — identities use (domain, key) compound unique
+ * instead of the standard entity pattern.
+ */
+function createIdentityService(model, options) {
+    return {
+        async create(userId, domain, key) {
+            const nKey = normalizeKey(domain, key);
+            try {
+                const row = await model.create({
+                    data: { userId, domain, key: nKey },
+                });
+                const identity = toIdentity(row);
+                options?.onCreated?.(identity);
+                return identity;
+            }
+            catch (err) {
+                if (isPrismaUniqueError(err)) {
+                    throw new types_js_1.DuplicateIdentityError(domain, key);
+                }
+                throw err;
+            }
+        },
+        async findByDomainAndKey(domain, key) {
+            const row = await model.findUnique({ where: domainKeyWhere(domain, normalizeKey(domain, key)) });
+            if (!row)
+                return null;
+            const identity = toIdentity(row);
+            // Active-only: exclude ended identities
+            if (identity.endedAt !== null)
+                return null;
+            return identity;
+        },
+        async findByUserAndDomain(userId, domain) {
+            const row = await model.findFirst({ where: { userId, domain, endedAt: null } });
+            return row ? toIdentity(row) : null;
+        },
+        async findAllByUser(userId, opts) {
+            const where = { userId };
+            if (!opts?.includeEnded) {
+                where.endedAt = null;
+            }
+            const rows = await model.findMany({ where });
+            return rows.map(toIdentity);
+        },
+        async update(domain, key, newUserId) {
+            const row = await model.update({
+                where: domainKeyWhere(domain, normalizeKey(domain, key)),
+                data: { userId: newUserId },
+            });
+            const identity = toIdentity(row);
+            options?.onUpdated?.(identity);
+            return identity;
+        },
+        async endDate(domain, key) {
+            const row = await model.update({
+                where: domainKeyWhere(domain, normalizeKey(domain, key)),
+                data: { endedAt: new Date() },
+            });
+            const identity = toIdentity(row);
+            options?.onEnded?.(identity);
+            return identity;
+        },
+    };
+}
+//# sourceMappingURL=identity-service.js.map

package/dist/identity-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-service.js","sourceRoot":"","sources":["../src/identity-service.ts"],"names":[],"mappings":";;AAwEA,sDAiEC;AAxID,yCAAoD;AAiCpD,SAAS,UAAU,CAAC,GAA4B;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,MAAM,EAAE,GAAG,CAAC,MAAgB;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAgB;QAC5B,GAAG,EAAE,GAAG,CAAC,GAAa;QACtB,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,YAAY,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAiB,CAAC,CAAC;QACnG,SAAS,EAAE,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAmB,CAAC;QAC5F,SAAS,EAAE,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAmB,CAAC;KAC7F,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,SAAS,cAAc,CAAC,MAAc,EAAE,GAAW;IACjD,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,mEAAmE;AACnE,SAAS,YAAY,CAAC,MAAc,EAAE,GAAW;IAC/C,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,MAAM,IAAI,GAAG;QACZ,GAAwB,CAAC,IAAI,KAAK,OAAO,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,KAAuB,EACvB,OAAgC;IAEhC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAAc,EAAE,GAAW;YACtD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;oBAC7B,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE;iBACpC,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;gBACjC,OAAO,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAC/B,OAAO,QAAQ,CAAC;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,iCAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAChD,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,GAAW;YAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YACjC,wCAAwC;YACxC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC3C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,MAAc;YACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAChF,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,IAA2B;YAC7D,MAAM,KAAK,GAA4B,EAAE,MAAM,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;gBACxB,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAW,EAAE,SAAiB;YACzD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBAC7B,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACxD,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;aAC5B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC/B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,GAAW;YACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBAC7B,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACxD,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE;aAC9B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @boopkit/cap-users — User data service factories.
+ *
+ * Provides typed CRUD factories for users, identities, and user properties,
+ * composing on top of @boopkit/cap-services primitives.
+ */
+export { DuplicateIdentityError, DuplicateAccountUserError } from './types.js';
+export type { BaseUserInfo, User, UserIdentity, UserProfile, CredentialEntry, UserCredentials, AuthenticationMethod, UserAuthentication, TrustTier, AuthorizationGrant, UserAuthorization, BaseAccountInfo, BaseAccountUserInfo, Account, AccountUser, } from './types.js';
+export { createUserService } from './user-service.js';
+export type { UserService, UserServiceOptions } from './user-service.js';
+export { createIdentityService } from './identity-service.js';
+export type { IdentityService, IdentityServiceOptions, IdentityQueryOptions } from './identity-service.js';
+export { createUserPropertyService } from './user-property-service.js';
+export type { UserPropertyService, UserPropertyServiceOptions } from './user-property-service.js';
+export { createAuthService, AuthValidationError, AuthError, generateToken, hashToken } from './auth-service.js';
+export type { AuthService, AuthServiceDeps, AuthServiceOptions, AddAuthMethodOptions, SignupInput, SignupResult, LoginResult, VerifyEmailResult, } from './auth-service.js';
+export { createAuthMiddleware } from './auth-middleware.js';
+export type { AuthMiddleware, AuthMiddlewareDeps, AuthMiddlewareOptions, AuthLocals, } from './auth-middleware.js';
+export { createAccountService } from './account-service.js';
+export type { AccountService, AccountServiceOptions } from './account-service.js';
+export { createAccountPropertyService } from './account-property-service.js';
+export type { AccountPropertyService, AccountPropertyServiceOptions } from './account-property-service.js';
+export { createAccountManagementService, AccountManagementError } from './account-management-service.js';
+export type { AccountManagementService, AccountManagementServiceDeps, AccountManagementServiceOptions, ProvisionAccountInput, ProvisionAccountResult, TeamMember, } from './account-management-service.js';
+export { createTeamInvitationService, TeamInvitationError, DEFAULT_INVITATION_TTL_MS, MAX_PENDING_INVITATIONS, MAX_RESENDS, } from './team-invitation-service.js';
+export type { TeamInvitation, TeamInvitationsPropertyInfo, TeamInvitationService, TeamInvitationServiceDeps, TeamInvitationServiceOptions, AccountUserRole, } from './team-invitation-service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,IAAI,EACJ,YAAY,EACZ,WAAW,EACX,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,OAAO,EACP,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE3G,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,YAAY,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAElG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAChH,YAAY,EACV,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,UAAU,GACX,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,YAAY,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE3G,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzG,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,+BAA+B,EAC/B,qBAAqB,EACrB,sBAAsB,EACtB,UAAU,GACX,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,GACZ,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,eAAe,GAChB,MAAM,8BAA8B,CAAC"}

package/dist/index.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * @boopkit/cap-users — User data service factories.
+ *
+ * Provides typed CRUD factories for users, identities, and user properties,
+ * composing on top of @boopkit/cap-services primitives.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RESENDS = exports.MAX_PENDING_INVITATIONS = exports.DEFAULT_INVITATION_TTL_MS = exports.TeamInvitationError = exports.createTeamInvitationService = exports.AccountManagementError = exports.createAccountManagementService = exports.createAccountPropertyService = exports.createAccountService = exports.createAuthMiddleware = exports.hashToken = exports.generateToken = exports.AuthError = exports.AuthValidationError = exports.createAuthService = exports.createUserPropertyService = exports.createIdentityService = exports.createUserService = exports.DuplicateAccountUserError = exports.DuplicateIdentityError = void 0;
+var types_js_1 = require("./types.js");
+Object.defineProperty(exports, "DuplicateIdentityError", { enumerable: true, get: function () { return types_js_1.DuplicateIdentityError; } });
+Object.defineProperty(exports, "DuplicateAccountUserError", { enumerable: true, get: function () { return types_js_1.DuplicateAccountUserError; } });
+var user_service_js_1 = require("./user-service.js");
+Object.defineProperty(exports, "createUserService", { enumerable: true, get: function () { return user_service_js_1.createUserService; } });
+var identity_service_js_1 = require("./identity-service.js");
+Object.defineProperty(exports, "createIdentityService", { enumerable: true, get: function () { return identity_service_js_1.createIdentityService; } });
+var user_property_service_js_1 = require("./user-property-service.js");
+Object.defineProperty(exports, "createUserPropertyService", { enumerable: true, get: function () { return user_property_service_js_1.createUserPropertyService; } });
+var auth_service_js_1 = require("./auth-service.js");
+Object.defineProperty(exports, "createAuthService", { enumerable: true, get: function () { return auth_service_js_1.createAuthService; } });
+Object.defineProperty(exports, "AuthValidationError", { enumerable: true, get: function () { return auth_service_js_1.AuthValidationError; } });
+Object.defineProperty(exports, "AuthError", { enumerable: true, get: function () { return auth_service_js_1.AuthError; } });
+Object.defineProperty(exports, "generateToken", { enumerable: true, get: function () { return auth_service_js_1.generateToken; } });
+Object.defineProperty(exports, "hashToken", { enumerable: true, get: function () { return auth_service_js_1.hashToken; } });
+var auth_middleware_js_1 = require("./auth-middleware.js");
+Object.defineProperty(exports, "createAuthMiddleware", { enumerable: true, get: function () { return auth_middleware_js_1.createAuthMiddleware; } });
+var account_service_js_1 = require("./account-service.js");
+Object.defineProperty(exports, "createAccountService", { enumerable: true, get: function () { return account_service_js_1.createAccountService; } });
+var account_property_service_js_1 = require("./account-property-service.js");
+Object.defineProperty(exports, "createAccountPropertyService", { enumerable: true, get: function () { return account_property_service_js_1.createAccountPropertyService; } });
+var account_management_service_js_1 = require("./account-management-service.js");
+Object.defineProperty(exports, "createAccountManagementService", { enumerable: true, get: function () { return account_management_service_js_1.createAccountManagementService; } });
+Object.defineProperty(exports, "AccountManagementError", { enumerable: true, get: function () { return account_management_service_js_1.AccountManagementError; } });
+var team_invitation_service_js_1 = require("./team-invitation-service.js");
+Object.defineProperty(exports, "createTeamInvitationService", { enumerable: true, get: function () { return team_invitation_service_js_1.createTeamInvitationService; } });
+Object.defineProperty(exports, "TeamInvitationError", { enumerable: true, get: function () { return team_invitation_service_js_1.TeamInvitationError; } });
+Object.defineProperty(exports, "DEFAULT_INVITATION_TTL_MS", { enumerable: true, get: function () { return team_invitation_service_js_1.DEFAULT_INVITATION_TTL_MS; } });
+Object.defineProperty(exports, "MAX_PENDING_INVITATIONS", { enumerable: true, get: function () { return team_invitation_service_js_1.MAX_PENDING_INVITATIONS; } });
+Object.defineProperty(exports, "MAX_RESENDS", { enumerable: true, get: function () { return team_invitation_service_js_1.MAX_RESENDS; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,uCAA+E;AAAtE,kHAAA,sBAAsB,OAAA;AAAE,qHAAA,yBAAyB,OAAA;AAmB1D,qDAAsD;AAA7C,oHAAA,iBAAiB,OAAA;AAG1B,6DAA8D;AAArD,4HAAA,qBAAqB,OAAA;AAG9B,uEAAuE;AAA9D,qIAAA,yBAAyB,OAAA;AAGlC,qDAAgH;AAAvG,oHAAA,iBAAiB,OAAA;AAAE,sHAAA,mBAAmB,OAAA;AAAE,4GAAA,SAAS,OAAA;AAAE,gHAAA,aAAa,OAAA;AAAE,4GAAA,SAAS,OAAA;AAYpF,2DAA4D;AAAnD,0HAAA,oBAAoB,OAAA;AAQ7B,2DAA4D;AAAnD,0HAAA,oBAAoB,OAAA;AAG7B,6EAA6E;AAApE,2IAAA,4BAA4B,OAAA;AAGrC,iFAAyG;AAAhG,+IAAA,8BAA8B,OAAA;AAAE,uIAAA,sBAAsB,OAAA;AAU/D,2EAMsC;AALpC,yIAAA,2BAA2B,OAAA;AAC3B,iIAAA,mBAAmB,OAAA;AACnB,uIAAA,yBAAyB,OAAA;AACzB,qIAAA,uBAAuB,OAAA;AACvB,yHAAA,WAAW,OAAA"}

package/dist/team-invitation-service.d.ts

@@ -0,0 +1,61 @@
+import type { AccountPropertyService } from './account-property-service.js';
+import type { AccountService } from './account-service.js';
+import type { BaseAccountInfo, BaseAccountUserInfo } from './types.js';
+import type { IdentityService } from './identity-service.js';
+export declare const DEFAULT_INVITATION_TTL_MS: number;
+export declare const MAX_PENDING_INVITATIONS = 20;
+export declare const MAX_RESENDS = 3;
+export declare const PRUNE_THRESHOLD = 100;
+export declare const PRUNE_AGE_MS: number;
+export type AccountUserRole = BaseAccountUserInfo['role'];
+export interface TeamInvitation {
+    id: string;
+    token: string;
+    email: string;
+    role: AccountUserRole;
+    status: 'pending' | 'accepted' | 'cancelled' | 'expired';
+    invitedByUserId: number;
+    invitedByName: string;
+    createdAt: string;
+    expiresAt: string;
+    acceptedByUserId?: number;
+    acceptedAt?: string;
+    resendCount: number;
+}
+export interface TeamInvitationsPropertyInfo {
+    invitations: TeamInvitation[];
+}
+export declare class TeamInvitationError extends Error {
+    constructor(message: string);
+}
+export interface TeamInvitationService {
+    getInvitations(accountId: number): Promise<TeamInvitation[]>;
+    getPendingInvitations(accountId: number): Promise<TeamInvitation[]>;
+    createInvitation(accountId: number, email: string, role: AccountUserRole, invitedBy: {
+        userId: number;
+        name: string;
+    }): Promise<TeamInvitation>;
+    cancelInvitation(accountId: number, invitationId: string): Promise<TeamInvitation>;
+    resendInvitation(accountId: number, invitationId: string): Promise<TeamInvitation>;
+    /**
+     * Marks the invitation as accepted but does NOT add the user to the account.
+     * The caller must use `accountManagementService.addUser()` to complete the membership flow.
+     * @see integration test "invite → accept → join flow" for the full pattern
+     */
+    acceptInvitation(accountId: number, token: string, acceptingUserId: number): Promise<TeamInvitation>;
+    findByToken(accountId: number, token: string): Promise<TeamInvitation | null>;
+}
+export interface TeamInvitationServiceDeps {
+    accountPropertyService: AccountPropertyService;
+    accountService: AccountService<BaseAccountInfo>;
+    identityService: IdentityService;
+}
+export interface TeamInvitationServiceOptions {
+    invitationTtl?: number;
+    maxPending?: number;
+    maxResends?: number;
+    pruneThreshold?: number;
+    pruneAgeMs?: number;
+}
+export declare function createTeamInvitationService(deps: TeamInvitationServiceDeps, options?: TeamInvitationServiceOptions): TeamInvitationService;
+//# sourceMappingURL=team-invitation-service.d.ts.map

package/dist/team-invitation-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-invitation-service.d.ts","sourceRoot":"","sources":["../src/team-invitation-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAK7D,eAAO,MAAM,yBAAyB,QAA0B,CAAC;AACjE,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,YAAY,QAA2B,CAAC;AASrD,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IACzD,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B;AAID,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAID,MAAM,WAAW,qBAAqB;IACpC,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC7D,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACpE,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC1C,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF;;;;OAIG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CAC/E;AAID,MAAM,WAAW,yBAAyB;IACxC,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,cAAc,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;IAChD,eAAe,EAAE,eAAe,CAAC;CAClC;AAID,MAAM,WAAW,4BAA4B;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,yBAAyB,EAC/B,OAAO,CAAC,EAAE,4BAA4B,GACrC,qBAAqB,CAmQvB"}

package/dist/team-invitation-service.js

@@ -0,0 +1,237 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TeamInvitationError = exports.PRUNE_AGE_MS = exports.PRUNE_THRESHOLD = exports.MAX_RESENDS = exports.MAX_PENDING_INVITATIONS = exports.DEFAULT_INVITATION_TTL_MS = void 0;
+exports.createTeamInvitationService = createTeamInvitationService;
+const auth_service_js_1 = require("./auth-service.js");
+const cap_services_1 = require("@boopkit/cap-services");
+// ---------- Constants ----------
+exports.DEFAULT_INVITATION_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+exports.MAX_PENDING_INVITATIONS = 20;
+exports.MAX_RESENDS = 3;
+exports.PRUNE_THRESHOLD = 100;
+exports.PRUNE_AGE_MS = 90 * 24 * 60 * 60 * 1000; // 90 days
+const PROPERTY = 'team_invitations';
+const SCHEMA = 'team-invitations-01';
+const MAX_CONCURRENCY_RETRIES = 3;
+const TERMINAL_STATUSES = new Set(['accepted', 'cancelled', 'expired']);
+// ---------- Errors ----------
+class TeamInvitationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TeamInvitationError';
+    }
+}
+exports.TeamInvitationError = TeamInvitationError;
+// ---------- Factory ----------
+function createTeamInvitationService(deps, options) {
+    const { accountPropertyService, accountService, identityService } = deps;
+    const invitationTtl = options?.invitationTtl ?? exports.DEFAULT_INVITATION_TTL_MS;
+    const maxPending = options?.maxPending ?? exports.MAX_PENDING_INVITATIONS;
+    const maxResends = options?.maxResends ?? exports.MAX_RESENDS;
+    const pruneThreshold = options?.pruneThreshold ?? exports.PRUNE_THRESHOLD;
+    const pruneAgeMs = options?.pruneAgeMs ?? exports.PRUNE_AGE_MS;
+    async function loadInvitations(accountId) {
+        const record = await accountPropertyService.get(accountId, PROPERTY);
+        return {
+            invitations: record?.info?.invitations ?? [],
+            revision: record?.revision,
+        };
+    }
+    /**
+     * Remove terminal-status invitations older than `pruneAgeMs` when the array
+     * exceeds `pruneThreshold`. Mutates the array in place for consistency with
+     * `applyLazyExpiry`. Returns true if any entries were removed.
+     */
+    function pruneTerminalInvitations(invitations) {
+        if (invitations.length <= pruneThreshold)
+            return false;
+        const cutoff = new Date(Date.now() - pruneAgeMs).toISOString();
+        const before = invitations.length;
+        for (let i = invitations.length - 1; i >= 0; i--) {
+            const inv = invitations[i];
+            if (TERMINAL_STATUSES.has(inv.status) && inv.createdAt < cutoff) {
+                invitations.splice(i, 1);
+            }
+        }
+        return invitations.length < before;
+    }
+    async function saveInvitations(accountId, invitations, expectedRevision) {
+        pruneTerminalInvitations(invitations);
+        await accountPropertyService.put(accountId, PROPERTY, { invitations }, { infoSchema: SCHEMA, expectedRevision });
+    }
+    /**
+     * Retry a read-modify-write operation on StaleEntityError (optimistic concurrency conflict).
+     */
+    async function withRetry(fn) {
+        for (let attempt = 0; attempt <= MAX_CONCURRENCY_RETRIES; attempt++) {
+            try {
+                return await fn();
+            }
+            catch (err) {
+                if (err instanceof cap_services_1.StaleEntityError && attempt < MAX_CONCURRENCY_RETRIES) {
+                    continue;
+                }
+                throw err;
+            }
+        }
+        // unreachable, but satisfies TypeScript
+        throw new Error('Retry loop exited unexpectedly');
+    }
+    /** Mark overdue pending invitations as expired. Returns true if any changed. */
+    function applyLazyExpiry(invitations) {
+        const now = new Date().toISOString();
+        let changed = false;
+        for (const inv of invitations) {
+            if (inv.status === 'pending' && inv.expiresAt < now) {
+                inv.status = 'expired';
+                changed = true;
+            }
+        }
+        return changed;
+    }
+    async function getInvitations(accountId) {
+        const snapshot = await loadInvitations(accountId);
+        const changed = applyLazyExpiry(snapshot.invitations);
+        if (changed) {
+            // Best-effort expiry flush; ignore conflicts since expiry is idempotent.
+            try {
+                await saveInvitations(accountId, snapshot.invitations, snapshot.revision);
+            }
+            catch (err) {
+                if (!(err instanceof cap_services_1.StaleEntityError))
+                    throw err;
+            }
+        }
+        return snapshot.invitations;
+    }
+    async function getPendingInvitations(accountId) {
+        const invitations = await getInvitations(accountId);
+        return invitations.filter((inv) => inv.status === 'pending');
+    }
+    async function createInvitation(accountId, email, role, invitedBy) {
+        const normalizedEmail = email.toLowerCase().trim();
+        // Check if email already belongs to an account member (outside retry — stable data)
+        const users = await accountService.getUsers(accountId);
+        const memberEmails = await resolveUserEmails(users);
+        if (memberEmails.has(normalizedEmail)) {
+            throw new TeamInvitationError(`User ${normalizedEmail} is already a member of this account`);
+        }
+        return withRetry(async () => {
+            const snapshot = await loadInvitations(accountId);
+            applyLazyExpiry(snapshot.invitations);
+            const pending = snapshot.invitations.filter((inv) => inv.status === 'pending');
+            // Duplicate pending check
+            if (pending.some((inv) => inv.email === normalizedEmail)) {
+                throw new TeamInvitationError(`A pending invitation already exists for ${normalizedEmail}`);
+            }
+            // Max pending check
+            if (pending.length >= maxPending) {
+                throw new TeamInvitationError(`Maximum of ${maxPending} pending invitations reached`);
+            }
+            const now = new Date();
+            const invitation = {
+                id: (0, auth_service_js_1.generateToken)(),
+                token: (0, auth_service_js_1.generateToken)(),
+                email: normalizedEmail,
+                role,
+                status: 'pending',
+                invitedByUserId: invitedBy.userId,
+                invitedByName: invitedBy.name,
+                createdAt: now.toISOString(),
+                expiresAt: new Date(now.getTime() + invitationTtl).toISOString(),
+                resendCount: 0,
+            };
+            snapshot.invitations.push(invitation);
+            await saveInvitations(accountId, snapshot.invitations, snapshot.revision);
+            return invitation;
+        });
+    }
+    async function cancelInvitation(accountId, invitationId) {
+        return withRetry(async () => {
+            const snapshot = await loadInvitations(accountId);
+            applyLazyExpiry(snapshot.invitations);
+            const inv = snapshot.invitations.find((i) => i.id === invitationId);
+            if (!inv)
+                throw new TeamInvitationError(`Invitation ${invitationId} not found`);
+            inv.status = 'cancelled';
+            await saveInvitations(accountId, snapshot.invitations, snapshot.revision);
+            return inv;
+        });
+    }
+    async function resendInvitation(accountId, invitationId) {
+        return withRetry(async () => {
+            const snapshot = await loadInvitations(accountId);
+            applyLazyExpiry(snapshot.invitations);
+            const inv = snapshot.invitations.find((i) => i.id === invitationId);
+            if (!inv)
+                throw new TeamInvitationError(`Invitation ${invitationId} not found`);
+            if (inv.status !== 'pending') {
+                throw new TeamInvitationError('Can only resend pending invitations');
+            }
+            if (inv.resendCount >= maxResends) {
+                throw new TeamInvitationError(`Maximum of ${maxResends} resends reached for this invitation`);
+            }
+            inv.token = (0, auth_service_js_1.generateToken)();
+            inv.expiresAt = new Date(Date.now() + invitationTtl).toISOString();
+            inv.resendCount += 1;
+            await saveInvitations(accountId, snapshot.invitations, snapshot.revision);
+            return inv;
+        });
+    }
+    /**
+     * Marks the invitation as accepted but does NOT add the user to the account.
+     * The caller must use `accountManagementService.addUser()` to complete the membership flow.
+     * @see integration test "invite → accept → join flow" for the full pattern
+     */
+    async function acceptInvitation(accountId, token, acceptingUserId) {
+        return withRetry(async () => {
+            const snapshot = await loadInvitations(accountId);
+            applyLazyExpiry(snapshot.invitations);
+            const now = new Date().toISOString();
+            const inv = snapshot.invitations.find((i) => i.token === token && i.status === 'pending');
+            if (!inv) {
+                throw new TeamInvitationError('Invalid or expired invitation token');
+            }
+            if (inv.expiresAt < now) {
+                inv.status = 'expired';
+                await saveInvitations(accountId, snapshot.invitations, snapshot.revision);
+                throw new TeamInvitationError('Invitation has expired');
+            }
+            inv.status = 'accepted';
+            inv.acceptedByUserId = acceptingUserId;
+            inv.acceptedAt = now;
+            await saveInvitations(accountId, snapshot.invitations, snapshot.revision);
+            return inv;
+        });
+    }
+    async function findByToken(accountId, token) {
+        const all = await getInvitations(accountId);
+        return all.find((i) => i.token === token && i.status === 'pending') ?? null;
+    }
+    /**
+     * Resolve emails for account members by looking up identities in the 'email' domain.
+     * Returns a set of lowercase email addresses.
+     */
+    async function resolveUserEmails(users) {
+        const emails = new Set();
+        for (const u of users) {
+            const identities = await identityService.findAllByUser(u.userId);
+            for (const identity of identities) {
+                if (identity.domain === 'email') {
+                    emails.add(identity.key.toLowerCase());
+                }
+            }
+        }
+        return emails;
+    }
+    return {
+        getInvitations,
+        getPendingInvitations,
+        createInvitation,
+        cancelInvitation,
+        resendInvitation,
+        acceptInvitation,
+        findByToken,
+    };
+}
+//# sourceMappingURL=team-invitation-service.js.map

package/dist/team-invitation-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-invitation-service.js","sourceRoot":"","sources":["../src/team-invitation-service.ts"],"names":[],"mappings":";;;AA8FA,kEAsQC;AApWD,uDAAkD;AAKlD,wDAAyD;AAEzD,kCAAkC;AAErB,QAAA,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAC9D,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAC7B,QAAA,WAAW,GAAG,CAAC,CAAC;AAChB,QAAA,eAAe,GAAG,GAAG,CAAC;AACtB,QAAA,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAEhE,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAyB7F,+BAA+B;AAE/B,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC;AA0CD,gCAAgC;AAEhC,SAAgB,2BAA2B,CACzC,IAA+B,EAC/B,OAAsC;IAEtC,MAAM,EAAE,sBAAsB,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IACzE,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,iCAAyB,CAAC;IAC1E,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,+BAAuB,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,mBAAW,CAAC;IACtD,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,uBAAe,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,oBAAY,CAAC;IAOvD,KAAK,UAAU,eAAe,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAC7C,SAAS,EACT,QAAQ,CACT,CAAC;QACF,OAAO;YACL,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,IAAI,EAAE;YAC5C,QAAQ,EAAE,MAAM,EAAE,QAAQ;SAC3B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,SAAS,wBAAwB,CAAC,WAA6B;QAC7D,IAAI,WAAW,CAAC,MAAM,IAAI,cAAc;YAAE,OAAO,KAAK,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;gBAChE,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,WAA6B,EAC7B,gBAAoC;QAEpC,wBAAwB,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,sBAAsB,CAAC,GAAG,CAC9B,SAAS,EACT,QAAQ,EACR,EAAE,WAAW,EAAE,EACf,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,CACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,SAAS,CAAI,EAAoB;QAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,uBAAuB,EAAE,OAAO,EAAE,EAAE,CAAC;YACpE,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,EAAE,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,+BAAgB,IAAI,OAAO,GAAG,uBAAuB,EAAE,CAAC;oBACzE,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,wCAAwC;QACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,gFAAgF;IAChF,SAAS,eAAe,CAAC,WAA6B;QACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACpD,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,SAAiB;QAC7C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,+BAAgB,CAAC;oBAAE,MAAM,GAAG,CAAC;YACpD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,WAAW,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,qBAAqB,CAAC,SAAiB;QACpD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,SAAiB,EACjB,KAAa,EACb,IAAqB,EACrB,SAA2C;QAE3C,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAEnD,oFAAoF;QACpF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,eAAe,sCAAsC,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;YAE/E,0BAA0B;YAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,eAAe,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,eAAe,EAAE,CAAC,CAAC;YAC9F,CAAC;YAED,oBAAoB;YACpB,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,mBAAmB,CAAC,cAAc,UAAU,8BAA8B,CAAC,CAAC;YACxF,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,UAAU,GAAmB;gBACjC,EAAE,EAAE,IAAA,+BAAa,GAAE;gBACnB,KAAK,EAAE,IAAA,+BAAa,GAAE;gBACtB,KAAK,EAAE,eAAe;gBACtB,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,eAAe,EAAE,SAAS,CAAC,MAAM;gBACjC,aAAa,EAAE,SAAS,CAAC,IAAI;gBAC7B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE;gBAChE,WAAW,EAAE,CAAC;aACf,CAAC;YAEF,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,SAAiB,EAAE,YAAoB;QACrE,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;YACpE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,cAAc,YAAY,YAAY,CAAC,CAAC;YAEhF,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;YACzB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,SAAiB,EAAE,YAAoB;QACrE,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;YACpE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,cAAc,YAAY,YAAY,CAAC,CAAC;YAEhF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,GAAG,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,mBAAmB,CAAC,cAAc,UAAU,sCAAsC,CAAC,CAAC;YAChG,CAAC;YAED,GAAG,CAAC,KAAK,GAAG,IAAA,+BAAa,GAAE,CAAC;YAC5B,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,GAAG,CAAC,WAAW,IAAI,CAAC,CAAC;YACrB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,gBAAgB,CAC7B,SAAiB,EACjB,KAAa,EACb,eAAuB;QAEvB,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;YAE1F,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;gBACvB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC1E,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;YAC1D,CAAC;YAED,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;YACxB,GAAG,CAAC,gBAAgB,GAAG,eAAe,CAAC;YACvC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,SAAiB,EAAE,KAAa;QACzD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;IAC9E,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,iBAAiB,CAC9B,KAAgC;QAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACjE,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,cAAc;QACd,qBAAqB;QACrB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,92 @@
+import type { Entity } from '@boopkit/cap-services';
+/** Extend with project-specific user fields. */
+export interface BaseUserInfo {
+    name?: string;
+    email?: string;
+    type: 'user' | 'service-user';
+}
+/** A stored user wrapping typed info with metadata. */
+export type User<T extends BaseUserInfo = BaseUserInfo> = Entity<T>;
+/** Identity linking a user to an auth mechanism. */
+export interface UserIdentity {
+    id: number;
+    userId: number;
+    domain: string;
+    key: string;
+    endedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** Thrown when creating a duplicate (domain, key) identity. */
+export declare class DuplicateIdentityError extends Error {
+    readonly domain: string;
+    readonly key: string;
+    constructor(domain: string, key: string);
+}
+/** User personal information (property: "profile"). */
+export interface UserProfile {
+    name?: string;
+    email?: {
+        address: string;
+        verified: boolean;
+    };
+}
+/** A single credential entry keyed by strategy (property: "credentials"). */
+export interface CredentialEntry {
+    strategy: string;
+    secret: string;
+}
+/** Auth credentials — strategy-keyed array, never plaintext (property: "credentials"). */
+export type UserCredentials = CredentialEntry[];
+/** A single accepted authentication method (property: "authentication"). */
+export interface AuthenticationMethod {
+    strategy: string;
+    accepted: boolean;
+    refresh_token?: string;
+    access_token?: string;
+    access_token_expires_at?: number;
+    oauth_profile?: unknown;
+}
+/** Current auth state — array of accepted methods (property: "authentication"). */
+export type UserAuthentication = AuthenticationMethod[];
+/** Graduated trust tier for authorization. */
+export type TrustTier = 'recognized' | 'authenticated' | 'verified';
+/** A single per-device/per-key authorization grant. */
+export interface AuthorizationGrant {
+    identity_key: string;
+    strategy: string;
+    trust: TrustTier;
+    granted_at: number;
+    expires_at: number;
+    granted_duration?: number;
+}
+/** Authorization state — array of per-device grants (property: "authorization"). */
+export type UserAuthorization = AuthorizationGrant[];
+/** Base info for an account entity. Extend with project-specific fields. */
+export interface BaseAccountInfo {
+    name: string;
+    status: 'enabled' | 'disabled';
+}
+/** Base info for the account–user join record. */
+export interface BaseAccountUserInfo {
+    status: 'enabled' | 'disabled' | 'pending';
+    role: 'viewer' | 'editor' | 'admin' | 'owner';
+}
+/** A stored account wrapping typed info with metadata. */
+export type Account<T extends BaseAccountInfo = BaseAccountInfo> = Entity<T>;
+/** A join record linking an account to a user. */
+export interface AccountUser<T extends BaseAccountUserInfo = BaseAccountUserInfo> {
+    id: number;
+    accountId: number;
+    userId: number;
+    info: T;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** Thrown when adding a user to an account they're already a member of. */
+export declare class DuplicateAccountUserError extends Error {
+    readonly accountId: number;
+    readonly userId: number;
+    constructor(accountId: number, userId: number);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAIpD,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;CAC/B;AAID,uDAAuD;AACvD,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAIpE,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,+DAA+D;AAC/D,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAET,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;CAMxC;AAID,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CAChD;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,eAAe,EAAE,CAAC;AAEhD,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;AAExD,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,UAAU,CAAC;AAEpE,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,EAAE,CAAC;AAIrD,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;CAChC;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;CAC/C;AAED,0DAA0D;AAC1D,MAAM,MAAM,OAAO,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AAE7E,kDAAkD;AAClD,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,CAAC;IACR,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,2EAA2E;AAC3E,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM9C"}

package/dist/types.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DuplicateAccountUserError = exports.DuplicateIdentityError = void 0;
+/** Thrown when creating a duplicate (domain, key) identity. */
+class DuplicateIdentityError extends Error {
+    constructor(domain, key) {
+        super(`Duplicate identity: ${domain}/${key}`);
+        this.name = 'DuplicateIdentityError';
+        this.domain = domain;
+        this.key = key;
+    }
+}
+exports.DuplicateIdentityError = DuplicateIdentityError;
+/** Thrown when adding a user to an account they're already a member of. */
+class DuplicateAccountUserError extends Error {
+    constructor(accountId, userId) {
+        super(`User ${userId} is already a member of account ${accountId}`);
+        this.name = 'DuplicateAccountUserError';
+        this.accountId = accountId;
+        this.userId = userId;
+    }
+}
+exports.DuplicateAccountUserError = DuplicateAccountUserError;
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AA6BA,+DAA+D;AAC/D,MAAa,sBAAuB,SAAQ,KAAK;IAI/C,YAAY,MAAc,EAAE,GAAW;QACrC,KAAK,CAAC,uBAAuB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;CACF;AAVD,wDAUC;AA2ED,2EAA2E;AAC3E,MAAa,yBAA0B,SAAQ,KAAK;IAIlD,YAAY,SAAiB,EAAE,MAAc;QAC3C,KAAK,CAAC,QAAQ,MAAM,mCAAmC,SAAS,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAVD,8DAUC"}