@carbonbox/domain 0.49.1 → 0.50.0

package/build/carbonbox/stakeholders/shared/domain/exceptions/PermissionAboveRoleCeilingError.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionAboveRoleCeilingError = void 0;
+const CodedRootError_1 = require("../../../../shared/domain/exceptions/CodedRootError");
+const ErrorCode_1 = require("../../../../shared/domain/enums/ErrorCode");
+/**
+ * AIS-D01: a stakeholder of `role` was given permissions outside the role's ceiling
+ * (`RolePermissionCeilingPolicy`). Raised whoever grants them, the host included.
+ */
+class PermissionAboveRoleCeilingError extends CodedRootError_1.CodedRootError {
+    constructor(role, permissionsAboveCeiling) {
+        const technicalMessage = `Permissions outside the ${role} ceiling: ${permissionsAboveCeiling.join(', ')}.`;
+        const context = {
+            role,
+            permissionsAboveCeiling: Array.from(permissionsAboveCeiling),
+            timestamp: new Date().toISOString(),
+        };
+        const suggestions = [
+            `Grant only permissions within the ${role} ceiling`,
+            'Remove the listed permissions from the request',
+            'Raising a role ceiling is a product decision that requires publishing the domain package',
+        ];
+        super(ErrorCode_1.ErrorCode.PERMISSION_ABOVE_ROLE_CEILING, technicalMessage, context, suggestions);
+        this.name = 'PermissionAboveRoleCeilingError';
+    }
+    static create(role, permissionsAboveCeiling) {
+        return new PermissionAboveRoleCeilingError(role, permissionsAboveCeiling);
+    }
+    logError() {
+        return `${this.name}: ${this.technicalMessage}`;
+    }
+}
+exports.PermissionAboveRoleCeilingError = PermissionAboveRoleCeilingError;

package/build/carbonbox/stakeholders/shared/domain/policies/RolePermissionCeilingPolicy.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RolePermissionCeilingPolicy = void 0;
+const StakeholderRole_1 = require("../../../../shared/domain/enums/StakeholderRole");
+const CARBON_CLIENT_PERMISSION_CEILING_1 = require("../constants/CARBON_CLIENT_PERMISSION_CEILING");
+const CARBON_COORDINATOR_PERMISSION_CEILING_1 = require("../constants/CARBON_COORDINATOR_PERMISSION_CEILING");
+const CARBON_MANAGER_PERMISSION_CEILING_1 = require("../constants/CARBON_MANAGER_PERMISSION_CEILING");
+const PermissionAboveRoleCeilingError_1 = require("../exceptions/PermissionAboveRoleCeilingError");
+/**
+ * Pure domain policy with the permission ceiling of each stakeholder role (AIS-D01, D9).
+ *
+ * Why this exists: before the ceiling, any actor able to grant permissions could fabricate power
+ * (a client with host permissions). The ceiling is the most a role can ever hold; the backend adds
+ * the actor-relative rules on top (grantor ⊇ granted, target within the grantor's scope).
+ *
+ * The validated path of `CarbonClientPermissions`, `CarbonCoordinatorPermissions` and
+ * `CarbonManagerPermissions` (`create`) calls `assertWithinCeiling`; `fromPrimitives` does not, so
+ * existing records still load. `CARBON_HOST` has no ceiling.
+ */
+class RolePermissionCeilingPolicy {
+    constructor() {
+        // Static-only — not instantiable.
+    }
+    static hasCeiling(role) {
+        return RolePermissionCeilingPolicy.CEILINGS_BY_ROLE.has(role);
+    }
+    /** The ceiling of the role, or `null` when the role has none (host). */
+    static findCeiling(role) {
+        return RolePermissionCeilingPolicy.CEILINGS_BY_ROLE.get(role) ?? null;
+    }
+    /** The given permissions that fall outside the role's ceiling (empty when the role has none). */
+    static findPermissionsAboveCeiling(role, permissions) {
+        const ceiling = RolePermissionCeilingPolicy.findCeiling(role);
+        if (ceiling === null) {
+            return [];
+        }
+        return permissions.filter((permission) => ceiling.includes(permission) === false);
+    }
+    static isWithinCeiling(role, permissions) {
+        return RolePermissionCeilingPolicy.findPermissionsAboveCeiling(role, permissions).length === 0;
+    }
+    /** Throws `PermissionAboveRoleCeilingError` listing every permission outside the role's ceiling. */
+    static assertWithinCeiling(role, permissions) {
+        const permissionsAboveCeiling = RolePermissionCeilingPolicy.findPermissionsAboveCeiling(role, permissions);
+        if (permissionsAboveCeiling.length > 0) {
+            throw PermissionAboveRoleCeilingError_1.PermissionAboveRoleCeilingError.create(role, permissionsAboveCeiling);
+        }
+    }
+}
+exports.RolePermissionCeilingPolicy = RolePermissionCeilingPolicy;
+RolePermissionCeilingPolicy.CEILINGS_BY_ROLE = new Map([
+    [StakeholderRole_1.StakeholderRole.CARBON_CLIENT, CARBON_CLIENT_PERMISSION_CEILING_1.CARBON_CLIENT_PERMISSION_CEILING],
+    [StakeholderRole_1.StakeholderRole.CARBON_COORDINATOR, CARBON_COORDINATOR_PERMISSION_CEILING_1.CARBON_COORDINATOR_PERMISSION_CEILING],
+    [StakeholderRole_1.StakeholderRole.CARBON_MANAGER, CARBON_MANAGER_PERMISSION_CEILING_1.CARBON_MANAGER_PERMISSION_CEILING],
+]);

package/build/carbonbox/stakeholders/user-invitations/domain/constants/USER_INVITATION_VALIDITY_IN_DAYS.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.USER_INVITATION_VALIDITY_IN_DAYS = void 0;
+/**
+ * Days an invitation stays valid after it is issued (AIS-D04, decision D3).
+ *
+ * The domain does not read the clock: whoever issues the invitation computes
+ * `expiresAt = issuedAt + USER_INVITATION_VALIDITY_IN_DAYS` and `UserInvitation.issue`
+ * rejects an expiry that is not after the issue moment.
+ */
+exports.USER_INVITATION_VALIDITY_IN_DAYS = 7;

package/build/carbonbox/stakeholders/user-invitations/domain/entity/IUserInvitation.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/build/carbonbox/stakeholders/user-invitations/domain/entity/UserInvitation.js

@@ -0,0 +1,229 @@
+"use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _UserInvitation_instances, _UserInvitation_userId, _UserInvitation_email, _UserInvitation_tokenHash, _UserInvitation_issuedAt, _UserInvitation_expiresAt, _UserInvitation_consumedAt, _UserInvitation_revokedAt, _UserInvitation_invitedByStakeholder, _UserInvitation_toProps, _UserInvitation_guardAgainstExpiryNotAfterIssue, _UserInvitation_guardAgainstConsumedAndRevoked;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitation = void 0;
+const AggregateRoot_1 = require("../../../../shared/domain/entities/AggregateRoot");
+const InvalidDateRangeError_1 = require("../../../../shared/domain/exceptions/InvalidDateRangeError");
+const InvalidPropertyValueError_1 = require("../../../../shared/domain/exceptions/InvalidPropertyValueError");
+const UserInvitationId_1 = require("../value-objects/UserInvitationId");
+const UserInvitationUserId_1 = require("../value-objects/UserInvitationUserId");
+const UserInvitationEmail_1 = require("../value-objects/UserInvitationEmail");
+const UserInvitationTokenHash_1 = require("../value-objects/UserInvitationTokenHash");
+const UserInvitationIssuedAt_1 = require("../value-objects/UserInvitationIssuedAt");
+const UserInvitationExpiresAt_1 = require("../value-objects/UserInvitationExpiresAt");
+const UserInvitationConsumedAt_1 = require("../value-objects/UserInvitationConsumedAt");
+const UserInvitationRevokedAt_1 = require("../value-objects/UserInvitationRevokedAt");
+const UserInvitationEvaluatedAt_1 = require("../value-objects/UserInvitationEvaluatedAt");
+const UserInvitationInvitedByStakeholder_1 = require("../value-objects/UserInvitationInvitedByStakeholder");
+const UserInvitationExpiredError_1 = require("../exceptions/UserInvitationExpiredError");
+const UserInvitationAlreadyConsumedError_1 = require("../exceptions/UserInvitationAlreadyConsumedError");
+const UserInvitationRevokedError_1 = require("../exceptions/UserInvitationRevokedError");
+/**
+ * UserInvitation aggregate (AIS-D04, decision D3): a stakeholder created by someone else sets
+ * its own password by accepting a single-use, time-bound invitation. The creator never knows
+ * the password.
+ *
+ * Only the SHA-256 of the token is kept. The domain does not read the clock: issuing, accepting
+ * and revoking receive the current moment (`DD/MM/YYYY HH:mm:ss`). Changes return a new instance.
+ *
+ * Lifecycle: pending → consumed (accepted) | revoked (replaced by a resent invitation). Expiry is
+ * not a stored state: it is evaluated against the moment given (`isExpiredAt`).
+ */
+class UserInvitation extends AggregateRoot_1.AggregateRoot {
+    constructor(props, skipDomainValidation) {
+        const id = skipDomainValidation
+            ? UserInvitationId_1.UserInvitationId.fromPrimitives(props.id).toPrimitives()
+            : UserInvitationId_1.UserInvitationId.create(props.id).toPrimitives();
+        super({ id }, skipDomainValidation);
+        _UserInvitation_instances.add(this);
+        _UserInvitation_userId.set(this, void 0);
+        _UserInvitation_email.set(this, void 0);
+        _UserInvitation_tokenHash.set(this, void 0);
+        _UserInvitation_issuedAt.set(this, void 0);
+        _UserInvitation_expiresAt.set(this, void 0);
+        _UserInvitation_consumedAt.set(this, void 0);
+        _UserInvitation_revokedAt.set(this, void 0);
+        _UserInvitation_invitedByStakeholder.set(this, void 0);
+        if (skipDomainValidation === false) {
+            // Initialize with domain validation
+            __classPrivateFieldSet(this, _UserInvitation_userId, UserInvitationUserId_1.UserInvitationUserId.create(props.userId), "f");
+            __classPrivateFieldSet(this, _UserInvitation_email, UserInvitationEmail_1.UserInvitationEmail.create(props.email), "f");
+            __classPrivateFieldSet(this, _UserInvitation_tokenHash, UserInvitationTokenHash_1.UserInvitationTokenHash.create(props.tokenHash), "f");
+            __classPrivateFieldSet(this, _UserInvitation_issuedAt, UserInvitationIssuedAt_1.UserInvitationIssuedAt.create(props.issuedAt), "f");
+            __classPrivateFieldSet(this, _UserInvitation_expiresAt, UserInvitationExpiresAt_1.UserInvitationExpiresAt.create(props.expiresAt), "f");
+            __classPrivateFieldSet(this, _UserInvitation_consumedAt, UserInvitationConsumedAt_1.UserInvitationConsumedAt.create(props.consumedAt), "f");
+            __classPrivateFieldSet(this, _UserInvitation_revokedAt, UserInvitationRevokedAt_1.UserInvitationRevokedAt.create(props.revokedAt), "f");
+            __classPrivateFieldSet(this, _UserInvitation_invitedByStakeholder, UserInvitationInvitedByStakeholder_1.UserInvitationInvitedByStakeholder.create(props.invitedByStakeholder), "f");
+            __classPrivateFieldGet(this, _UserInvitation_instances, "m", _UserInvitation_guardAgainstExpiryNotAfterIssue).call(this);
+            __classPrivateFieldGet(this, _UserInvitation_instances, "m", _UserInvitation_guardAgainstConsumedAndRevoked).call(this);
+        }
+        else {
+            // Initialize from primitives (no domain validation)
+            __classPrivateFieldSet(this, _UserInvitation_userId, UserInvitationUserId_1.UserInvitationUserId.fromPrimitives(props.userId), "f");
+            __classPrivateFieldSet(this, _UserInvitation_email, UserInvitationEmail_1.UserInvitationEmail.fromPrimitives(props.email), "f");
+            __classPrivateFieldSet(this, _UserInvitation_tokenHash, UserInvitationTokenHash_1.UserInvitationTokenHash.fromPrimitives(props.tokenHash), "f");
+            __classPrivateFieldSet(this, _UserInvitation_issuedAt, UserInvitationIssuedAt_1.UserInvitationIssuedAt.fromPrimitives(props.issuedAt), "f");
+            __classPrivateFieldSet(this, _UserInvitation_expiresAt, UserInvitationExpiresAt_1.UserInvitationExpiresAt.fromPrimitives(props.expiresAt), "f");
+            __classPrivateFieldSet(this, _UserInvitation_consumedAt, UserInvitationConsumedAt_1.UserInvitationConsumedAt.fromPrimitives(props.consumedAt), "f");
+            __classPrivateFieldSet(this, _UserInvitation_revokedAt, UserInvitationRevokedAt_1.UserInvitationRevokedAt.fromPrimitives(props.revokedAt), "f");
+            __classPrivateFieldSet(this, _UserInvitation_invitedByStakeholder, UserInvitationInvitedByStakeholder_1.UserInvitationInvitedByStakeholder.fromPrimitives(props.invitedByStakeholder), "f");
+        }
+    }
+    static create(props) {
+        return new UserInvitation(props, false);
+    }
+    /**
+     * Issues a new pending invitation (neither consumed nor revoked). The caller computes
+     * `expiresAt = issuedAt + USER_INVITATION_VALIDITY_IN_DAYS`; an expiry that is not after the
+     * issue moment is rejected (InvalidDateRangeError).
+     */
+    static issue(props) {
+        return new UserInvitation({
+            id: props.id,
+            userId: props.userId,
+            email: props.email,
+            tokenHash: props.tokenHash,
+            issuedAt: props.issuedAt,
+            expiresAt: props.expiresAt,
+            consumedAt: null,
+            revokedAt: null,
+            invitedByStakeholder: props.invitedByStakeholder,
+        }, false);
+    }
+    static fromPrimitives(primitives) {
+        const props = {
+            id: primitives.id,
+            userId: primitives.userId,
+            email: primitives.email,
+            tokenHash: primitives.tokenHash,
+            issuedAt: primitives.issuedAt,
+            expiresAt: primitives.expiresAt,
+            consumedAt: primitives.consumedAt,
+            revokedAt: primitives.revokedAt,
+            invitedByStakeholder: primitives.invitedByStakeholder,
+        };
+        return new UserInvitation(props, true);
+    }
+    get toPrimitives() {
+        return {
+            id: this.id.toPrimitives(),
+            userId: __classPrivateFieldGet(this, _UserInvitation_userId, "f").toPrimitives(),
+            email: __classPrivateFieldGet(this, _UserInvitation_email, "f").toPrimitives(),
+            tokenHash: __classPrivateFieldGet(this, _UserInvitation_tokenHash, "f").toPrimitives(),
+            issuedAt: __classPrivateFieldGet(this, _UserInvitation_issuedAt, "f").toPrimitives(),
+            expiresAt: __classPrivateFieldGet(this, _UserInvitation_expiresAt, "f").toPrimitives(),
+            consumedAt: __classPrivateFieldGet(this, _UserInvitation_consumedAt, "f").toPrimitives(),
+            revokedAt: __classPrivateFieldGet(this, _UserInvitation_revokedAt, "f").toPrimitives(),
+            invitedByStakeholder: __classPrivateFieldGet(this, _UserInvitation_invitedByStakeholder, "f").toPrimitives(),
+        };
+    }
+    get userId() {
+        return __classPrivateFieldGet(this, _UserInvitation_userId, "f");
+    }
+    get email() {
+        return __classPrivateFieldGet(this, _UserInvitation_email, "f");
+    }
+    get tokenHash() {
+        return __classPrivateFieldGet(this, _UserInvitation_tokenHash, "f");
+    }
+    get issuedAt() {
+        return __classPrivateFieldGet(this, _UserInvitation_issuedAt, "f");
+    }
+    get expiresAt() {
+        return __classPrivateFieldGet(this, _UserInvitation_expiresAt, "f");
+    }
+    get consumedAt() {
+        return __classPrivateFieldGet(this, _UserInvitation_consumedAt, "f");
+    }
+    get revokedAt() {
+        return __classPrivateFieldGet(this, _UserInvitation_revokedAt, "f");
+    }
+    get invitedByStakeholder() {
+        return __classPrivateFieldGet(this, _UserInvitation_invitedByStakeholder, "f");
+    }
+    /**
+     * Whether the invitation is neither consumed nor revoked. Expiry is checked separately with
+     * `isExpiredAt`, since it depends on the moment.
+     */
+    isPending() {
+        return __classPrivateFieldGet(this, _UserInvitation_consumedAt, "f").hasValue() === false && __classPrivateFieldGet(this, _UserInvitation_revokedAt, "f").hasValue() === false;
+    }
+    /**
+     * Whether the validity ended at the given moment (`DD/MM/YYYY HH:mm:ss`).
+     */
+    isExpiredAt(now) {
+        return __classPrivateFieldGet(this, _UserInvitation_expiresAt, "f").isReachedAt(UserInvitationEvaluatedAt_1.UserInvitationEvaluatedAt.create(now));
+    }
+    /**
+     * Returns the invitation accepted at `now`. Checked in this order: revoked
+     * (UserInvitationRevokedError), already consumed (UserInvitationAlreadyConsumedError) and
+     * expired (UserInvitationExpiredError).
+     */
+    consume(now) {
+        const evaluatedAt = UserInvitationEvaluatedAt_1.UserInvitationEvaluatedAt.create(now);
+        if (__classPrivateFieldGet(this, _UserInvitation_revokedAt, "f").hasValue()) {
+            throw UserInvitationRevokedError_1.UserInvitationRevokedError.create();
+        }
+        if (__classPrivateFieldGet(this, _UserInvitation_consumedAt, "f").hasValue()) {
+            throw UserInvitationAlreadyConsumedError_1.UserInvitationAlreadyConsumedError.create();
+        }
+        if (__classPrivateFieldGet(this, _UserInvitation_expiresAt, "f").isReachedAt(evaluatedAt)) {
+            throw UserInvitationExpiredError_1.UserInvitationExpiredError.create();
+        }
+        return UserInvitation.create({
+            ...__classPrivateFieldGet(this, _UserInvitation_instances, "m", _UserInvitation_toProps).call(this),
+            consumedAt: evaluatedAt.toPrimitives(),
+        });
+    }
+    /**
+     * Returns the invitation revoked at `now` (resending replaces the previous invitation).
+     * Revoking an already revoked invitation returns it unchanged; a consumed invitation cannot be
+     * revoked (UserInvitationAlreadyConsumedError).
+     */
+    revoke(now) {
+        const evaluatedAt = UserInvitationEvaluatedAt_1.UserInvitationEvaluatedAt.create(now);
+        if (__classPrivateFieldGet(this, _UserInvitation_consumedAt, "f").hasValue()) {
+            throw UserInvitationAlreadyConsumedError_1.UserInvitationAlreadyConsumedError.create();
+        }
+        if (__classPrivateFieldGet(this, _UserInvitation_revokedAt, "f").hasValue()) {
+            return this;
+        }
+        return UserInvitation.create({
+            ...__classPrivateFieldGet(this, _UserInvitation_instances, "m", _UserInvitation_toProps).call(this),
+            revokedAt: evaluatedAt.toPrimitives(),
+        });
+    }
+}
+exports.UserInvitation = UserInvitation;
+_UserInvitation_userId = new WeakMap(), _UserInvitation_email = new WeakMap(), _UserInvitation_tokenHash = new WeakMap(), _UserInvitation_issuedAt = new WeakMap(), _UserInvitation_expiresAt = new WeakMap(), _UserInvitation_consumedAt = new WeakMap(), _UserInvitation_revokedAt = new WeakMap(), _UserInvitation_invitedByStakeholder = new WeakMap(), _UserInvitation_instances = new WeakSet(), _UserInvitation_toProps = function _UserInvitation_toProps() {
+    return {
+        id: this.id.toPrimitives(),
+        userId: __classPrivateFieldGet(this, _UserInvitation_userId, "f").toPrimitives(),
+        email: __classPrivateFieldGet(this, _UserInvitation_email, "f").toPrimitives(),
+        tokenHash: __classPrivateFieldGet(this, _UserInvitation_tokenHash, "f").toPrimitives(),
+        issuedAt: __classPrivateFieldGet(this, _UserInvitation_issuedAt, "f").toPrimitives(),
+        expiresAt: __classPrivateFieldGet(this, _UserInvitation_expiresAt, "f").toPrimitives(),
+        consumedAt: __classPrivateFieldGet(this, _UserInvitation_consumedAt, "f").toPrimitives(),
+        revokedAt: __classPrivateFieldGet(this, _UserInvitation_revokedAt, "f").toPrimitives(),
+        invitedByStakeholder: __classPrivateFieldGet(this, _UserInvitation_invitedByStakeholder, "f").toPrimitives(),
+    };
+}, _UserInvitation_guardAgainstExpiryNotAfterIssue = function _UserInvitation_guardAgainstExpiryNotAfterIssue() {
+    if (__classPrivateFieldGet(this, _UserInvitation_expiresAt, "f").isAfter(__classPrivateFieldGet(this, _UserInvitation_issuedAt, "f")) === false) {
+        throw InvalidDateRangeError_1.InvalidDateRangeError.create(__classPrivateFieldGet(this, _UserInvitation_issuedAt, "f").toPrimitives(), __classPrivateFieldGet(this, _UserInvitation_expiresAt, "f").toPrimitives());
+    }
+}, _UserInvitation_guardAgainstConsumedAndRevoked = function _UserInvitation_guardAgainstConsumedAndRevoked() {
+    if (__classPrivateFieldGet(this, _UserInvitation_consumedAt, "f").hasValue() && __classPrivateFieldGet(this, _UserInvitation_revokedAt, "f").hasValue()) {
+        throw InvalidPropertyValueError_1.InvalidPropertyValueError.create('revokedAt', 'null when the invitation was consumed', 'a revocation moment');
+    }
+};

package/build/carbonbox/stakeholders/user-invitations/domain/exceptions/UserInvitationAlreadyConsumedError.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationAlreadyConsumedError = void 0;
+const CodedRootError_1 = require("../../../../shared/domain/exceptions/CodedRootError");
+const ErrorCode_1 = require("../../../../shared/domain/enums/ErrorCode");
+/**
+ * The invitation was already accepted; an invitation is single use.
+ * Raised on an anonymous flow: the message and context never identify the invitation, the user
+ * or the email (no account enumeration).
+ */
+class UserInvitationAlreadyConsumedError extends CodedRootError_1.CodedRootError {
+    constructor() {
+        const technicalMessage = 'The invitation was already used and cannot be used again.';
+        const context = {
+            timestamp: new Date().toISOString(),
+        };
+        const suggestions = [
+            'Sign in with the password you set when accepting the invitation',
+            'Use the forgot password option if you do not remember it',
+        ];
+        super(ErrorCode_1.ErrorCode.USER_INVITATION_ALREADY_CONSUMED, technicalMessage, context, suggestions);
+        this.name = 'UserInvitationAlreadyConsumedError';
+    }
+    static create() {
+        return new UserInvitationAlreadyConsumedError();
+    }
+    logError() {
+        return `${this.name}: ${this.technicalMessage}`;
+    }
+}
+exports.UserInvitationAlreadyConsumedError = UserInvitationAlreadyConsumedError;

package/build/carbonbox/stakeholders/user-invitations/domain/exceptions/UserInvitationExpiredError.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationExpiredError = void 0;
+const CodedRootError_1 = require("../../../../shared/domain/exceptions/CodedRootError");
+const ErrorCode_1 = require("../../../../shared/domain/enums/ErrorCode");
+/**
+ * The invitation can no longer be accepted because its validity ended.
+ * Raised on an anonymous flow: the message and context never identify the invitation, the user
+ * or the email (no account enumeration).
+ */
+class UserInvitationExpiredError extends CodedRootError_1.CodedRootError {
+    constructor() {
+        const technicalMessage = 'The invitation has expired and can no longer be accepted.';
+        const context = {
+            timestamp: new Date().toISOString(),
+        };
+        const suggestions = [
+            'Ask the person who invited you to send a new invitation',
+            'Use the most recent invitation email you received',
+        ];
+        super(ErrorCode_1.ErrorCode.USER_INVITATION_EXPIRED, technicalMessage, context, suggestions);
+        this.name = 'UserInvitationExpiredError';
+    }
+    static create() {
+        return new UserInvitationExpiredError();
+    }
+    logError() {
+        return `${this.name}: ${this.technicalMessage}`;
+    }
+}
+exports.UserInvitationExpiredError = UserInvitationExpiredError;

package/build/carbonbox/stakeholders/user-invitations/domain/exceptions/UserInvitationRevokedError.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationRevokedError = void 0;
+const CodedRootError_1 = require("../../../../shared/domain/exceptions/CodedRootError");
+const ErrorCode_1 = require("../../../../shared/domain/enums/ErrorCode");
+/**
+ * The invitation was revoked (for example, replaced by a newer one when it was resent).
+ * Raised on an anonymous flow: the message and context never identify the invitation, the user
+ * or the email (no account enumeration).
+ */
+class UserInvitationRevokedError extends CodedRootError_1.CodedRootError {
+    constructor() {
+        const technicalMessage = 'The invitation is no longer valid.';
+        const context = {
+            timestamp: new Date().toISOString(),
+        };
+        const suggestions = [
+            'Use the most recent invitation email you received',
+            'Ask the person who invited you to send a new invitation',
+        ];
+        super(ErrorCode_1.ErrorCode.USER_INVITATION_REVOKED, technicalMessage, context, suggestions);
+        this.name = 'UserInvitationRevokedError';
+    }
+    static create() {
+        return new UserInvitationRevokedError();
+    }
+    logError() {
+        return `${this.name}: ${this.technicalMessage}`;
+    }
+}
+exports.UserInvitationRevokedError = UserInvitationRevokedError;

package/build/carbonbox/stakeholders/user-invitations/domain/repository/IUserInvitationRepository.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/build/carbonbox/stakeholders/user-invitations/domain/types/UserInvitationIssueProps.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/build/carbonbox/stakeholders/user-invitations/domain/types/UserInvitationPrimitives.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/build/carbonbox/stakeholders/user-invitations/domain/types/UserInvitationProps.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/build/carbonbox/stakeholders/user-invitations/domain/value-objects/UserInvitationConsumedAt.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationConsumedAt = void 0;
+const NullableDateTimeString_1 = require("../../../../shared/domain/value-objects/NullableDateTimeString");
+class UserInvitationConsumedAt extends NullableDateTimeString_1.NullableDateTimeString {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation, UserInvitationConsumedAt.PROPERTY_NAME);
+    }
+    static create(value) {
+        return new UserInvitationConsumedAt(value, false);
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new UserInvitationConsumedAt(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.UserInvitationConsumedAt = UserInvitationConsumedAt;
+UserInvitationConsumedAt.PROPERTY_NAME = 'consumedAt';

package/build/carbonbox/stakeholders/user-invitations/domain/value-objects/UserInvitationEmail.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationEmail = void 0;
+const Email_1 = require("../../../../shared/domain/value-objects/Email");
+class UserInvitationEmail extends Email_1.Email {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation, UserInvitationEmail.PROPERTY_NAME);
+    }
+    static create(value) {
+        Email_1.Email.guardAgainstEmptyValue(value, UserInvitationEmail.PROPERTY_NAME);
+        Email_1.Email.guardAgainstInvalidType(value, UserInvitationEmail.PROPERTY_NAME);
+        Email_1.Email.guardAgainstInvalidEmail(value, UserInvitationEmail.PROPERTY_NAME);
+        return new UserInvitationEmail(value, false);
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new UserInvitationEmail(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.UserInvitationEmail = UserInvitationEmail;
+UserInvitationEmail.PROPERTY_NAME = 'email';

package/build/carbonbox/stakeholders/user-invitations/domain/value-objects/UserInvitationEvaluatedAt.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationEvaluatedAt = void 0;
+const DateTimeString_1 = require("../../../../shared/domain/value-objects/DateTimeString");
+/**
+ * The moment at which an invitation is evaluated (accepted, revoked or checked for expiry).
+ * The domain does not read the clock: the caller passes the current moment and this value
+ * object validates its format.
+ */
+class UserInvitationEvaluatedAt extends DateTimeString_1.DateTimeString {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation, UserInvitationEvaluatedAt.PROPERTY_NAME);
+    }
+    static create(value) {
+        DateTimeString_1.DateTimeString.guardAgainstEmptyValue(value, UserInvitationEvaluatedAt.PROPERTY_NAME);
+        DateTimeString_1.DateTimeString.guardAgainstInvalidType(value, UserInvitationEvaluatedAt.PROPERTY_NAME);
+        DateTimeString_1.DateTimeString.guardAgainstInvalidDateTimeFormat(value);
+        return new UserInvitationEvaluatedAt(value, false);
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new UserInvitationEvaluatedAt(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.UserInvitationEvaluatedAt = UserInvitationEvaluatedAt;
+UserInvitationEvaluatedAt.PROPERTY_NAME = 'now';

package/build/carbonbox/stakeholders/user-invitations/domain/value-objects/UserInvitationExpiresAt.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationExpiresAt = void 0;
+const DateTimeString_1 = require("../../../../shared/domain/value-objects/DateTimeString");
+class UserInvitationExpiresAt extends DateTimeString_1.DateTimeString {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation, UserInvitationExpiresAt.PROPERTY_NAME);
+    }
+    static create(value) {
+        DateTimeString_1.DateTimeString.guardAgainstEmptyValue(value, UserInvitationExpiresAt.PROPERTY_NAME);
+        DateTimeString_1.DateTimeString.guardAgainstInvalidType(value, UserInvitationExpiresAt.PROPERTY_NAME);
+        DateTimeString_1.DateTimeString.guardAgainstInvalidDateTimeFormat(value);
+        return new UserInvitationExpiresAt(value, false);
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new UserInvitationExpiresAt(value, true);
+    }
+    /**
+     * Whether the expiry was reached at the given moment (`DD/MM/YYYY HH:mm:ss`).
+     * The expiry moment itself already counts as expired.
+     */
+    isReachedAt(moment) {
+        return moment.toDate().getTime() >= this.toDate().getTime();
+    }
+    /**
+     * Whether the expiry is strictly after the given moment (`DD/MM/YYYY HH:mm:ss`).
+     */
+    isAfter(moment) {
+        return this.toDate().getTime() > moment.toDate().getTime();
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.UserInvitationExpiresAt = UserInvitationExpiresAt;
+UserInvitationExpiresAt.PROPERTY_NAME = 'expiresAt';

package/build/carbonbox/stakeholders/user-invitations/domain/value-objects/UserInvitationId.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationId = void 0;
+const AggregateId_1 = require("../../../../shared/domain/value-objects/AggregateId");
+const SemanticUuidPrefix_1 = require("../../../../shared/domain/enums/SemanticUuidPrefix");
+const InvalidAggregatePrefixError_1 = require("../../../../shared/domain/exceptions/InvalidAggregatePrefixError");
+/**
+ * Identity of a UserInvitation aggregate (`USR-INV_<id>`).
+ */
+class UserInvitationId extends AggregateId_1.AggregateId {
+    constructor(value, skipDomainValidation) {
+        super(value, skipDomainValidation, UserInvitationId.PROPERTY_NAME);
+    }
+    static create(value) {
+        AggregateId_1.AggregateId.guardAgainstEmptyValue(value, UserInvitationId.PROPERTY_NAME);
+        AggregateId_1.AggregateId.guardAgainstInvalidType(value, UserInvitationId.PROPERTY_NAME);
+        AggregateId_1.AggregateId.guardAgainstInvalidId(value, UserInvitationId.PROPERTY_NAME);
+        // Validate that the prefix is valid for UserInvitation
+        UserInvitationId.guardAgainstInvalidPrefix(value);
+        return new UserInvitationId(value, false);
+    }
+    /**
+     * Validates that the id has the UserInvitation prefix.
+     * The id format was already validated, so the prefix can be extracted safely.
+     */
+    static guardAgainstInvalidPrefix(value) {
+        const prefix = new UserInvitationId(value, true).extractPrefix();
+        if (UserInvitationId.VALID_PREFIXES.includes(prefix) === false) {
+            throw InvalidAggregatePrefixError_1.InvalidAggregatePrefixError.create(value, 'UserInvitation', prefix, UserInvitationId.VALID_PREFIXES, UserInvitationId.PROPERTY_NAME);
+        }
+    }
+    static fromPrimitives(primitive) {
+        const value = primitive;
+        return new UserInvitationId(value, true);
+    }
+    toPrimitives() {
+        return this.value;
+    }
+}
+exports.UserInvitationId = UserInvitationId;
+UserInvitationId.PROPERTY_NAME = 'id';
+UserInvitationId.VALID_PREFIXES = [
+    SemanticUuidPrefix_1.SemanticUuidPrefix.USR_INVITATION,
+];