@endora-commerce/platform 0.100.0

package/dist/kernel/container.js

@@ -0,0 +1,90 @@
+import { asFunction, asValue, createContainer as createAwilixContainer, InjectionMode, } from 'awilix';
+import { forkScopedEm } from '../tenancy/scoped-em.js';
+/** Build a root container. One per process; scopes are children of it. */
+export function createRootContainer() {
+    return createAwilixContainer({
+        injectionMode: InjectionMode.PROXY,
+        strict: true,
+    });
+}
+/**
+ * Register the ORM-derived names.
+ *
+ * `emFactory` keeps today's exact semantics — it is the closure, and every call
+ * forks. `em` is the container-native spelling of the same thing: **transient**,
+ * so each resolution yields its own fork with its own identity map. Neither is
+ * scoped, and that is the invariant the whole request seam rests on: the tenant
+ * filter reads `AsyncLocalStorage` at query-build time (`tenancy/filters.ts`),
+ * which is what makes a bare fork correct.
+ */
+export function registerOrm(container, orm) {
+    container.register({
+        orm: asValue(orm),
+        emFactory: asValue(() => forkScopedEm(orm)),
+        em: asFunction(() => forkScopedEm(orm)).transient(),
+    });
+}
+/**
+ * Register plain values a composition root already owns — the Redis client, the
+ * `requireAdmin` factory, a port implementation a not-yet-converted module
+ * exposes through its handle.
+ *
+ * It exists so a composition root spells the container's vocabulary without
+ * importing `awilix` either. Modules are *forbidden* to import it
+ * (`scripts/check-container-imports.ts`); a root importing it would still be
+ * one more file to touch the day the container is swapped.
+ */
+export function registerValues(container, values) {
+    for (const [name, value] of Object.entries(values)) {
+        container.register({ [name]: asValue(value) });
+    }
+}
+let currentRoot;
+/**
+ * The process-wide root container, created on first use. `enterPlatformScope`
+ * falls back to it so a CLI script or an interval sweep needs no wiring to open
+ * a scope.
+ */
+export function getRootContainer() {
+    currentRoot ??= createRootContainer();
+    return currentRoot;
+}
+/** Install a composed root. Used by the composer, and by tests that build their own. */
+export function setRootContainer(container) {
+    currentRoot = container;
+}
+/**
+ * Dispose the root container and forget it. Runs every registration's
+ * `.disposer(...)` — Redis clients, queue connections, the ORM — so a composed
+ * process tears down through one call instead of a hand-maintained list.
+ */
+export async function disposeRootContainer() {
+    const root = currentRoot;
+    currentRoot = undefined;
+    if (root)
+        await root.dispose();
+}
+/**
+ * Dispose `container` when the process is asked to stop. Returns a detach
+ * function so a test (or a second composition in the same process) does not
+ * leak signal handlers.
+ *
+ * Not installed automatically: importing the kernel must not attach global
+ * signal handlers, or 900 test files would each add a set.
+ */
+export function installShutdownDisposal(container, signals = ['SIGINT', 'SIGTERM']) {
+    let disposed = false;
+    const handler = () => {
+        if (disposed)
+            return;
+        disposed = true;
+        void container.dispose();
+    };
+    for (const signal of signals)
+        process.once(signal, handler);
+    return () => {
+        for (const signal of signals)
+            process.off(signal, handler);
+    };
+}
+//# sourceMappingURL=container.js.map

package/dist/kernel/container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/kernel/container.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,OAAO,EACP,eAAe,IAAI,qBAAqB,EACxC,aAAa,GAEd,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAkDvD,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB;IACjC,OAAO,qBAAqB,CAAe;QACzC,aAAa,EAAE,aAAa,CAAC,KAAK;QAClC,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,SAA0B,EAAE,GAAa;IACnE,SAAS,CAAC,QAAQ,CAAC;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;QACjB,SAAS,EAAE,OAAO,CAAC,GAAkB,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC1D,EAAE,EAAE,UAAU,CAAC,GAAkB,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA0B,EAC1B,MAAyC;IAEzC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,IAAI,WAAwC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,WAAW,KAAK,mBAAmB,EAAE,CAAC;IACtC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,SAA0B;IACzD,WAAW,GAAG,SAAS,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC;IACzB,WAAW,GAAG,SAAS,CAAC;IACxB,IAAI,IAAI;QAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA0B,EAC1B,UAAqC,CAAC,QAAQ,EAAE,SAAS,CAAC;IAE1D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC"}

package/dist/kernel/contribution-sinks.d.ts

@@ -0,0 +1,106 @@
+/**
+ * **A contribution to a registry that was never registered is dropped**
+ * (owner ruling, 2026-09-12; feature 117, A4).
+ *
+ * ## The question this answers, and the one it does not
+ *
+ * The deactivation-consequence ledger (D-44) has four answers and every one of
+ * them is about an owner an **operator switched off** — a module that is
+ * composed, registered, and absent by choice. There is no answer for an owner
+ * an **instance never installed**, which is not a runtime choice but a fact
+ * about the module set the tree was scaffolded with.
+ *
+ * In this repository every module is always composed, so the difference could
+ * not arise. `endora new instance` executed it for the first time: it writes
+ * the modules declaring `activation.nonDeactivatable` closed over
+ * `dependencies` and over **nothing else**, so a `contributes-to` edge — whose
+ * whole purpose is to withhold the `dependencies` claim, since declaring it
+ * would make an optional assistant undeactivatable for as long as a
+ * non-deactivatable module is present — is precisely a promise that the owner
+ * may be missing. A scaffolded instance migrated 118 migrations and then died:
+ *
+ *     ModuleCompositionError: [kernel] module 'catalog' failed in its boot
+ *     hook: Could not resolve 'promptActionToolRegistry'
+ *
+ * ## Why a mechanism rather than a fifth classification
+ *
+ * A fifth kind would add a concept every module author must learn in order to
+ * describe a failure they could not have known about — the module set their
+ * consumer scaffolds with. The mechanism removes the failure instead, so a
+ * module contributes to another module's registry without knowing whether that
+ * registry exists in this composition.
+ *
+ * ## Why it is not either of the two repairs that are refused in writing
+ *
+ *  - **Probing `effectiveState.isPresent` in the hook** is refused by
+ *    `specs/conventions/module-activation.md`: the host filters by contributor
+ *    at enumeration, so a probe would make runtime activation require a
+ *    restart, and a hook mixing work with a contribution must be split before
+ *    either answer applies. This mechanism asks nothing about presence.
+ *  - **Declaring the owner in `dependencies`** makes a module mandatory by
+ *    accident of one hook rather than by a manifest that says so — Principle
+ *    XVII's axis decided in the wrong place.
+ *
+ * ## What keeps it narrow
+ *
+ * The drop is **not** "an unregistered name resolves to something". That would
+ * turn every typo and every genuinely missing dependency into a silent
+ * `undefined`, which is the opposite of what the container is for. It fires on
+ * a conjunction of three facts, all of them derived:
+ *
+ *  1. the reading module's **own manifest** declares this exact name as
+ *     `contributes-to` — so a module gets the drop only for an edge it
+ *     declared, and never for a name it merely happens to read;
+ *  2. **nothing in this composition registers the name** — the owner is not
+ *     here, so there is no table for the descriptor to land in and nobody to
+ *     walk it;
+ *  3. a manifest set has been supplied at all. A process that never established
+ *     one gets today's behaviour — the resolution throws — because answering
+ *     from an empty declaration set would be the silent fall-open this file
+ *     exists to avoid.
+ *
+ * A `contributes-to` edge naming a name **nobody** registers is still a build
+ * failure: `check:port-dependencies` reports it as `unowned-name`. So the
+ * loudness lives where a wiring bug belongs — in CI, against the whole module
+ * set — and what is dropped at runtime is only ever an edge whose owner this
+ * particular instance chose not to install.
+ *
+ * ## The bound, stated rather than discovered
+ *
+ * This covers `contributes-to` and **not** `degrades-without`, and the reason
+ * is the direction of the data rather than the spelling of the kind. A
+ * contribution is a **push**: nothing observes the result, so dropping it is
+ * exactly the declared outcome. A `degrades-without` read is a **pull**: the
+ * consumer wants a value back and its declaration promises a *degrade*, which
+ * is a different branch rather than a silent no-op. Handing it an inert sink
+ * would answer `undefined` from every method, and `paymentAdapterRegistry.get`
+ * returning `undefined` is indistinguishable from "no adapter for this code" —
+ * the fail-open D-179 measured writing a row into a switched-off module's own
+ * table (issue #188). A push can be dropped; a pull cannot.
+ */
+/** One declared contribution: the module that pushes, and the name it pushes into. */
+export interface DeclaredContribution {
+    /** The module whose manifest declares the edge. */
+    readonly moduleId: string;
+    /** The container registration name it contributes to. */
+    readonly name: string;
+}
+/**
+ * Install the deployment's declared contributions. Idempotent;
+ * last-writer-wins, like the gating graph it is installed beside.
+ */
+export declare function provideDeclaredContributions(supplier: () => readonly DeclaredContribution[]): void;
+/**
+ * Forget the declaration set — for a test that needs the un-supplied state
+ * back, which is the state a bare composition is really in.
+ */
+export declare function resetDeclaredContributionsForTesting(): void;
+/**
+ * Does `moduleId`'s own manifest declare `name` as a `contributes-to` edge?
+ *
+ * `false` when no manifest set has been supplied, which is the fail-closed
+ * answer: see {@link declarations}.
+ */
+export declare function isDeclaredContribution(moduleId: string, name: string): boolean;
+export declare const DROPPED_CONTRIBUTION_SINK: unknown;
+//# sourceMappingURL=contribution-sinks.d.ts.map

package/dist/kernel/contribution-sinks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contribution-sinks.d.ts","sourceRoot":"","sources":["../../src/kernel/contribution-sinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAEH,sFAAsF;AACtF,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAqBD;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,SAAS,oBAAoB,EAAE,GAC9C,IAAI,CAGN;AAED;;;GAGG;AACH,wBAAgB,oCAAoC,IAAI,IAAI,CAG3D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAM9E;AAmBD,eAAO,MAAM,yBAAyB,EAAE,OAQtC,CAAC"}

package/dist/kernel/contribution-sinks.js

@@ -0,0 +1,153 @@
+/**
+ * **A contribution to a registry that was never registered is dropped**
+ * (owner ruling, 2026-09-12; feature 117, A4).
+ *
+ * ## The question this answers, and the one it does not
+ *
+ * The deactivation-consequence ledger (D-44) has four answers and every one of
+ * them is about an owner an **operator switched off** — a module that is
+ * composed, registered, and absent by choice. There is no answer for an owner
+ * an **instance never installed**, which is not a runtime choice but a fact
+ * about the module set the tree was scaffolded with.
+ *
+ * In this repository every module is always composed, so the difference could
+ * not arise. `endora new instance` executed it for the first time: it writes
+ * the modules declaring `activation.nonDeactivatable` closed over
+ * `dependencies` and over **nothing else**, so a `contributes-to` edge — whose
+ * whole purpose is to withhold the `dependencies` claim, since declaring it
+ * would make an optional assistant undeactivatable for as long as a
+ * non-deactivatable module is present — is precisely a promise that the owner
+ * may be missing. A scaffolded instance migrated 118 migrations and then died:
+ *
+ *     ModuleCompositionError: [kernel] module 'catalog' failed in its boot
+ *     hook: Could not resolve 'promptActionToolRegistry'
+ *
+ * ## Why a mechanism rather than a fifth classification
+ *
+ * A fifth kind would add a concept every module author must learn in order to
+ * describe a failure they could not have known about — the module set their
+ * consumer scaffolds with. The mechanism removes the failure instead, so a
+ * module contributes to another module's registry without knowing whether that
+ * registry exists in this composition.
+ *
+ * ## Why it is not either of the two repairs that are refused in writing
+ *
+ *  - **Probing `effectiveState.isPresent` in the hook** is refused by
+ *    `specs/conventions/module-activation.md`: the host filters by contributor
+ *    at enumeration, so a probe would make runtime activation require a
+ *    restart, and a hook mixing work with a contribution must be split before
+ *    either answer applies. This mechanism asks nothing about presence.
+ *  - **Declaring the owner in `dependencies`** makes a module mandatory by
+ *    accident of one hook rather than by a manifest that says so — Principle
+ *    XVII's axis decided in the wrong place.
+ *
+ * ## What keeps it narrow
+ *
+ * The drop is **not** "an unregistered name resolves to something". That would
+ * turn every typo and every genuinely missing dependency into a silent
+ * `undefined`, which is the opposite of what the container is for. It fires on
+ * a conjunction of three facts, all of them derived:
+ *
+ *  1. the reading module's **own manifest** declares this exact name as
+ *     `contributes-to` — so a module gets the drop only for an edge it
+ *     declared, and never for a name it merely happens to read;
+ *  2. **nothing in this composition registers the name** — the owner is not
+ *     here, so there is no table for the descriptor to land in and nobody to
+ *     walk it;
+ *  3. a manifest set has been supplied at all. A process that never established
+ *     one gets today's behaviour — the resolution throws — because answering
+ *     from an empty declaration set would be the silent fall-open this file
+ *     exists to avoid.
+ *
+ * A `contributes-to` edge naming a name **nobody** registers is still a build
+ * failure: `check:port-dependencies` reports it as `unowned-name`. So the
+ * loudness lives where a wiring bug belongs — in CI, against the whole module
+ * set — and what is dropped at runtime is only ever an edge whose owner this
+ * particular instance chose not to install.
+ *
+ * ## The bound, stated rather than discovered
+ *
+ * This covers `contributes-to` and **not** `degrades-without`, and the reason
+ * is the direction of the data rather than the spelling of the kind. A
+ * contribution is a **push**: nothing observes the result, so dropping it is
+ * exactly the declared outcome. A `degrades-without` read is a **pull**: the
+ * consumer wants a value back and its declaration promises a *degrade*, which
+ * is a different branch rather than a silent no-op. Handing it an inert sink
+ * would answer `undefined` from every method, and `paymentAdapterRegistry.get`
+ * returning `undefined` is indistinguishable from "no adapter for this code" —
+ * the fail-open D-179 measured writing a row into a switched-off module's own
+ * table (issue #188). A push can be dropped; a pull cannot.
+ */
+/**
+ * The declaration set, supplied by whoever owns the manifests.
+ *
+ * `null` means no manifest set has been established in this process, which is a
+ * real state — a bare fixture composition, a CLI that composes nothing — and is
+ * deliberately **not** the same as an empty one. It fails closed: with no
+ * declarations, nothing is dropped and every unregistered name throws exactly
+ * as it did before this file existed.
+ *
+ * A supplier rather than a snapshot, for the reason `provideDefaultGatingManifests`
+ * is one: the manifest set is established during composition and read after it.
+ */
+let declarations = null;
+/** Memoised per supplier, so a resolution is a set lookup rather than a walk. */
+let index = null;
+const keyOf = (moduleId, name) => `${moduleId}:${name}`;
+/**
+ * Install the deployment's declared contributions. Idempotent;
+ * last-writer-wins, like the gating graph it is installed beside.
+ */
+export function provideDeclaredContributions(supplier) {
+    declarations = supplier;
+    index = null;
+}
+/**
+ * Forget the declaration set — for a test that needs the un-supplied state
+ * back, which is the state a bare composition is really in.
+ */
+export function resetDeclaredContributionsForTesting() {
+    declarations = null;
+    index = null;
+}
+/**
+ * Does `moduleId`'s own manifest declare `name` as a `contributes-to` edge?
+ *
+ * `false` when no manifest set has been supplied, which is the fail-closed
+ * answer: see {@link declarations}.
+ */
+export function isDeclaredContribution(moduleId, name) {
+    if (declarations === null)
+        return false;
+    if (index === null) {
+        index = new Set(declarations().map((edge) => keyOf(edge.moduleId, edge.name)));
+    }
+    return index.has(keyOf(moduleId, name));
+}
+/**
+ * The registry that is not there: every method is a no-op returning
+ * `undefined`.
+ *
+ * A `Proxy` rather than an object with the methods on it, because the platform
+ * cannot know the interface — the registry class belongs to a module, and the
+ * platform may not import one (D-52/D-53). What it does know is the shape of
+ * the *contract*: a `contributes-to` edge is push-only, and all three of the
+ * declarations standing when this landed say so in as many words ("a push, not
+ * a pull: nothing is read back").
+ *
+ * A symbol property answers `undefined` rather than a function, so the runtime
+ * probing the object — `Symbol.toPrimitive`, `then` on an accidental `await` —
+ * sees an ordinary object rather than a thenable that never settles.
+ */
+const NO_OP = () => undefined;
+export const DROPPED_CONTRIBUTION_SINK = new Proxy(Object.create(null), {
+    get(_target, property) {
+        if (typeof property === 'symbol')
+            return undefined;
+        return NO_OP;
+    },
+    has() {
+        return true;
+    },
+});
+//# sourceMappingURL=contribution-sinks.js.map

package/dist/kernel/contribution-sinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contribution-sinks.js","sourceRoot":"","sources":["../../src/kernel/contribution-sinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAUH;;;;;;;;;;;GAWG;AACH,IAAI,YAAY,GAAmD,IAAI,CAAC;AAExE,iFAAiF;AACjF,IAAI,KAAK,GAA+B,IAAI,CAAC;AAE7C,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAU,EAAE,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAEhF;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAA+C;IAE/C,YAAY,GAAG,QAAQ,CAAC;IACxB,KAAK,GAAG,IAAI,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oCAAoC;IAClD,YAAY,GAAG,IAAI,CAAC;IACpB,KAAK,GAAG,IAAI,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,IAAY;IACnE,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,KAAK,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,KAAK,GAAG,GAAc,EAAE,CAAC,SAAS,CAAC;AAEzC,MAAM,CAAC,MAAM,yBAAyB,GAAY,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAW,EAAE;IACzF,GAAG,CAAC,OAAO,EAAE,QAAQ;QACnB,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,GAAG;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}

package/dist/kernel/crypto/password-hasher.d.ts

@@ -0,0 +1,3 @@
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(hash: string, password: string): Promise<boolean>;
+//# sourceMappingURL=password-hasher.d.ts.map

package/dist/kernel/crypto/password-hasher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hasher.d.ts","sourceRoot":"","sources":["../../../src/kernel/crypto/password-hasher.ts"],"names":[],"mappings":"AAgCA,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKpE;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMrF"}

package/dist/kernel/crypto/password-hasher.js

@@ -0,0 +1,44 @@
+import argon2 from 'argon2';
+/**
+ * Thin wrapper around argon2id with OWASP-recommended parameters.
+ * See specs/001-b2b-platform-foundation/research.md R-11.
+ *
+ * - memoryCost: 19 MiB (19456 KiB) — OWASP 2024 recommendation.
+ * - timeCost: 2.
+ * - parallelism: 1.
+ * - argon2id type.
+ *
+ * **Why this lives in the kernel and not in `auth` (feature 075, R-09).**
+ * Five modules and the dev seed hash a password. Every one of them reached
+ * into `auth/services/password-hasher.js` for it, and the obvious remedy —
+ * publish it as a port — is the wrong one: `providePort` wraps a registration
+ * in a gate on the owner's effective state, so an operator switching `auth`
+ * off would make `hashPassword` answer 503 `MODULE_DISABLED`. That is not a
+ * degrade, it is a bug. The test the plan sets is "does switching the owner
+ * off change the answer?", and for a pure function over its argument the
+ * answer is no. So it relocates rather than becoming a port.
+ *
+ * It reads no table, holds no state and touches no request context, which is
+ * what makes the kernel the right home rather than a second module.
+ */
+const HASH_OPTIONS = {
+    type: argon2.argon2id,
+    memoryCost: 19_456,
+    timeCost: 2,
+    parallelism: 1,
+};
+export async function hashPassword(password) {
+    if (password.length < 12) {
+        throw new Error('Password must be at least 12 characters long.');
+    }
+    return argon2.hash(password, HASH_OPTIONS);
+}
+export async function verifyPassword(hash, password) {
+    try {
+        return await argon2.verify(hash, password);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=password-hasher.js.map

package/dist/kernel/crypto/password-hasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hasher.js","sourceRoot":"","sources":["../../../src/kernel/crypto/password-hasher.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,YAAY,GAAmB;IACnC,IAAI,EAAE,MAAM,CAAC,QAAQ;IACrB,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,CAAC;CACf,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,QAAgB;IACjE,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/kernel/i18n/error-envelope-options.d.ts

@@ -0,0 +1,56 @@
+import type { AdminI18nTranslatePort, AdminUserReadPort } from '@endora-commerce/contracts';
+import type { ErrorEnvelopeOptions } from '../../http/error-envelope.js';
+/**
+ * What a composition supplies: the deployment's routing table, and the two
+ * container reads the envelope's injected callbacks are built over.
+ *
+ * The two reads are **thunks**, and that is the contract rather than a style:
+ * each names a gated port, so it resolves per call and a switched-off owner
+ * answers at the call site instead of through a handle the composition is
+ * holding. Capturing either at composition time is the shape D-70 keeps
+ * removing from a composition root.
+ */
+export interface ErrorEnvelopeCompositionInputs {
+    /**
+     * `ErrorCode → {moduleId, key}` for the deployment's own resolved manifest
+     * set — `buildErrorTranslationTargets`' output, which is a composition input
+     * because which modules a deployment resolved is a composition's fact.
+     */
+    readonly errorTranslationTargets: NonNullable<ErrorEnvelopeOptions['errorTranslationTargets']>;
+    /** Owner: `admin_users`. The stored preference of a signed-in admin. */
+    readonly adminUserReadPort: () => AdminUserReadPort;
+    /** Owner: `_i18n`. The lookup, over the merged bundle. */
+    readonly translate: () => AdminI18nTranslatePort;
+}
+/**
+ * The error envelope's options, assembled from what a composition supplies
+ * (`specs/110-instance-repository/` T118).
+ *
+ * **Written here because both composition roots had it, character for
+ * character.** The production root and `backend/test/helpers/test-server.ts`
+ * each carried the same twenty lines — the same language ladder, the same
+ * `translated === \`${moduleId}.${key}\`` test — and
+ * `test/contract/kernel/harness-parity.test.ts` exists precisely because a
+ * difference between two hand-maintained roots is a class of defect the suite
+ * reports green on. Issue #234 is the standing proof: both roots' language
+ * closure read `if (request.actor.kind !== 'admin') return null`, so every
+ * Polish error sentence the platform shipped was unreachable for a buyer, in
+ * production and in every test at once. One declaration cannot drift from
+ * itself.
+ *
+ * The two decisions it owns, and neither is a root's:
+ *
+ *  - **the language ladder** is `createRequestLanguageResolver`'s (D-137), and
+ *    what a root supplies to it is the one rung that reads a module's table;
+ *  - **"the lookup found nothing" is `moduleId.key` coming back**, which is
+ *    `_i18n`'s answer for a key it cannot resolve. Reading it as a miss and
+ *    keeping the raising code's own sentence is the envelope's rule, not the
+ *    deployment's, so it belongs beside the envelope.
+ *
+ * What stays a composition's is the two container reads and the target map,
+ * which is why they arrive as parameters — the platform may not name the module
+ * that registers a container name (D-52/D-53), and which modules a deployment
+ * resolved is a fact only its own root holds.
+ */
+export declare function composeErrorEnvelopeOptions(inputs: ErrorEnvelopeCompositionInputs): ErrorEnvelopeOptions;
+//# sourceMappingURL=error-envelope-options.d.ts.map

package/dist/kernel/i18n/error-envelope-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-envelope-options.d.ts","sourceRoot":"","sources":["../../../src/kernel/i18n/error-envelope-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGzE;;;;;;;;;GASG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,EAAE,WAAW,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC/F,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;IACpD,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,sBAAsB,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,8BAA8B,GACrC,oBAAoB,CActB"}

package/dist/kernel/i18n/error-envelope-options.js

@@ -0,0 +1,46 @@
+import { createRequestLanguageResolver } from './request-language.js';
+/**
+ * The error envelope's options, assembled from what a composition supplies
+ * (`specs/110-instance-repository/` T118).
+ *
+ * **Written here because both composition roots had it, character for
+ * character.** The production root and `backend/test/helpers/test-server.ts`
+ * each carried the same twenty lines — the same language ladder, the same
+ * `translated === \`${moduleId}.${key}\`` test — and
+ * `test/contract/kernel/harness-parity.test.ts` exists precisely because a
+ * difference between two hand-maintained roots is a class of defect the suite
+ * reports green on. Issue #234 is the standing proof: both roots' language
+ * closure read `if (request.actor.kind !== 'admin') return null`, so every
+ * Polish error sentence the platform shipped was unreachable for a buyer, in
+ * production and in every test at once. One declaration cannot drift from
+ * itself.
+ *
+ * The two decisions it owns, and neither is a root's:
+ *
+ *  - **the language ladder** is `createRequestLanguageResolver`'s (D-137), and
+ *    what a root supplies to it is the one rung that reads a module's table;
+ *  - **"the lookup found nothing" is `moduleId.key` coming back**, which is
+ *    `_i18n`'s answer for a key it cannot resolve. Reading it as a miss and
+ *    keeping the raising code's own sentence is the envelope's rule, not the
+ *    deployment's, so it belongs beside the envelope.
+ *
+ * What stays a composition's is the two container reads and the target map,
+ * which is why they arrive as parameters — the platform may not name the module
+ * that registers a container name (D-52/D-53), and which modules a deployment
+ * resolved is a fact only its own root holds.
+ */
+export function composeErrorEnvelopeOptions(inputs) {
+    return {
+        errorTranslationTargets: inputs.errorTranslationTargets,
+        // Issue #234 — the ladder is one kernel function, and the composition keeps
+        // the one rung that reads a module's table (D-137).
+        resolvePreferredLanguage: createRequestLanguageResolver({
+            adminPreferredLanguage: async (adminUserId) => (await inputs.adminUserReadPort().findById(adminUserId))?.preferredLanguage ?? null,
+        }),
+        translateErrorMessage: async ({ moduleId, key, language, originalMessage, params }) => {
+            const translated = await inputs.translate().translate(moduleId, key, language, params);
+            return translated === `${moduleId}.${key}` ? originalMessage : translated;
+        },
+    };
+}
+//# sourceMappingURL=error-envelope-options.js.map

package/dist/kernel/i18n/error-envelope-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-envelope-options.js","sourceRoot":"","sources":["../../../src/kernel/i18n/error-envelope-options.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAyBtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAsC;IAEtC,OAAO;QACL,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,4EAA4E;QAC5E,oDAAoD;QACpD,wBAAwB,EAAE,6BAA6B,CAAC;YACtD,sBAAsB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAC5C,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,iBAAiB,IAAI,IAAI;SACtF,CAAC;QACF,qBAAqB,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE;YACpF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvF,OAAO,UAAU,KAAK,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}