@entifix/business 0.1.0-0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 r10c Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,11 @@
+# @entifix/business
+
+This library was generated with [Nx](https://nx.dev).
+
+## Building
+
+Run `nx build @entifix/business` to build the library.
+
+## Running unit tests
+
+Run `nx test @entifix/business` to execute the unit tests via [Jest](https://jestjs.io).

package/dist/health/health-registry.d.ts

@@ -0,0 +1,87 @@
+import { Context, Effect, Layer } from 'effect';
+/**
+ * What a probe is talking to. Read by `GET /api/$service` to sort the wiring
+ * document into stores, brokers and upstreams; readiness ignores it entirely.
+ */
+export type ProbeKind = 'datastore' | 'broker' | 'upstream';
+/**
+ * One named readiness fact — "can this service still reach Mongo?".
+ *
+ * `check` is fully applied: whoever registers the probe has already closed over
+ * the client handle, so the readiness route can run every probe without knowing
+ * what any of them talk to. It must not fail — a probe that cannot answer
+ * answers `false`; an unhandled defect in a probe would take down the very
+ * endpoint that is supposed to report trouble.
+ */
+export interface HealthProbe {
+    readonly name: string;
+    /**
+     * What sort of thing is on the other end. `datastore` is a Store's backing
+     * engine, `broker` an exchange, `upstream` another service.
+     */
+    readonly kind: ProbeKind;
+    /**
+     * The **logical** names this probe covers — a Store's register name
+     * (`catalog`, `saga`), an exchange (`entifix.events`), a service (`zitadel`).
+     * Never a URI, never a database name: `catalog` is physically
+     * `tenant_<organizationId>`, and a document naming those is an organization
+     * enumerator (ADR 0031).
+     *
+     * It is a list rather than one string because a single connection can back
+     * several Stores: marketplace-admin-service opens one Mongo client for the
+     * `catalog` store and the co-deployed `transaction` slice's `saga` store.
+     * Registering one probe per Store instead would put both names into the
+     * readiness response's `failing` array, which must not change.
+     *
+     * The client package that opens the connection cannot know a Store's register
+     * name, so the composition root passes it in — the one thing about a probe
+     * that is not derivable from the client.
+     */
+    readonly targets: readonly string[];
+    readonly check: Effect.Effect<boolean>;
+}
+/** The outcome of running every registered probe. */
+export interface HealthReport {
+    readonly ready: boolean;
+    /** Names of the probes that answered `false`, in registration order. */
+    readonly failing: readonly string[];
+}
+export interface HealthRegistry {
+    /** Add a probe. Called by an infrastructure layer as it constructs a client. */
+    readonly register: (probe: HealthProbe) => Effect.Effect<void>;
+    /** Run every probe and summarise. Never fails. */
+    readonly report: Effect.Effect<HealthReport>;
+    /**
+     * The registrations themselves, in registration order — what each probe is
+     * for, without running any of them.
+     *
+     * This is what makes the wiring document and readiness generate from **one**
+     * registration rather than from two lists that drift. Deliberately separate
+     * from {@link report}: describing a service must never cost a round trip to
+     * every datastore it has.
+     */
+    readonly probes: Effect.Effect<readonly HealthProbe[]>;
+}
+declare const HealthRegistryTag_base: Context.TagClass<HealthRegistryTag, "HealthRegistryTag", HealthRegistry>;
+/**
+ * DI tag for the readiness registry.
+ *
+ * The point of a registry rather than a hand-written list per service: a
+ * `-service` that gains a datastore gains its readiness probe by merging that
+ * client's probe layer, and nothing in the service's own code has to remember
+ * to describe it. A list in `main.ts` drifts the first time someone adds a
+ * dependency; this cannot, because the probe ships with the client.
+ *
+ * It lives here, in the contract layer, so `entifix-ts-*-client` packages can
+ * register into it without depending on a shell.
+ */
+export declare class HealthRegistryTag extends HealthRegistryTag_base {
+}
+/**
+ * Live registry over a `Ref`. Provide it **once** per service and share the
+ * instance (`Layer.provideMerge`), or the probes register into a registry the
+ * readiness route never reads.
+ */
+export declare const HealthRegistryLayer: Layer.Layer<HealthRegistryTag>;
+export {};
+//# sourceMappingURL=health-registry.d.ts.map

package/dist/health/health-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health-registry.d.ts","sourceRoot":"","sources":["../../src/health/health-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAO,MAAM,QAAQ,CAAC;AAErD;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;CACxC;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAaD,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;CACxD;;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAkB,SAAQ,sBAGpC;CAAG;AAEN;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAgC9D,CAAC"}

package/dist/health/health-registry.js

@@ -0,0 +1,58 @@
+import { Context, Effect, Layer, Ref } from 'effect';
+/**
+ * How long a single probe may take before it counts as failing.
+ *
+ * This is not belt-and-braces. A driver that queues commands while its
+ * connection is down (ioredis with `maxRetriesPerRequest`, for one) leaves the
+ * probe pending instead of rejecting, so without a deadline `/api/health/ready`
+ * *hangs* when a datastore disappears — the one moment it has to answer. A
+ * probe that cannot answer in time is not ready, by definition.
+ */ const PROBE_TIMEOUT = '2 seconds';
+/**
+ * DI tag for the readiness registry.
+ *
+ * The point of a registry rather than a hand-written list per service: a
+ * `-service` that gains a datastore gains its readiness probe by merging that
+ * client's probe layer, and nothing in the service's own code has to remember
+ * to describe it. A list in `main.ts` drifts the first time someone adds a
+ * dependency; this cannot, because the probe ships with the client.
+ *
+ * It lives here, in the contract layer, so `entifix-ts-*-client` packages can
+ * register into it without depending on a shell.
+ */ export class HealthRegistryTag extends Context.Tag('HealthRegistryTag')() {
+}
+/**
+ * Live registry over a `Ref`. Provide it **once** per service and share the
+ * instance (`Layer.provideMerge`), or the probes register into a registry the
+ * readiness route never reads.
+ */ export const HealthRegistryLayer = Layer.effect(HealthRegistryTag, Effect.gen(function*() {
+    const probes = yield* Ref.make([]);
+    return {
+        register: (probe)=>Ref.update(probes, (current)=>[
+                    ...current,
+                    probe
+                ]),
+        probes: Ref.get(probes),
+        report: Effect.gen(function*() {
+            const current = yield* Ref.get(probes);
+            const results = yield* Effect.forEach(current, (probe)=>probe.check.pipe(// A probe that throws is a failing probe, not a broken endpoint.
+                Effect.catchAllDefect(()=>Effect.succeed(false)), Effect.timeoutTo({
+                    duration: PROBE_TIMEOUT,
+                    onTimeout: ()=>false,
+                    onSuccess: (ok)=>ok
+                }), Effect.map((ok)=>({
+                        name: probe.name,
+                        ok
+                    }))), {
+                concurrency: 'unbounded'
+            });
+            const failing = results.filter((r)=>!r.ok).map((r)=>r.name);
+            return {
+                ready: failing.length === 0,
+                failing
+            };
+        })
+    };
+}));
+
+//# sourceMappingURL=health-registry.js.map

package/dist/health/health-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/health/health-registry.ts"],"sourcesContent":["import { Context, Effect, Layer, Ref } from 'effect';\n\n/**\n * What a probe is talking to. Read by `GET /api/$service` to sort the wiring\n * document into stores, brokers and upstreams; readiness ignores it entirely.\n */\nexport type ProbeKind = 'datastore' | 'broker' | 'upstream';\n\n/**\n * One named readiness fact — \"can this service still reach Mongo?\".\n *\n * `check` is fully applied: whoever registers the probe has already closed over\n * the client handle, so the readiness route can run every probe without knowing\n * what any of them talk to. It must not fail — a probe that cannot answer\n * answers `false`; an unhandled defect in a probe would take down the very\n * endpoint that is supposed to report trouble.\n */\nexport interface HealthProbe {\n  readonly name: string;\n  /**\n   * What sort of thing is on the other end. `datastore` is a Store's backing\n   * engine, `broker` an exchange, `upstream` another service.\n   */\n  readonly kind: ProbeKind;\n  /**\n   * The **logical** names this probe covers — a Store's register name\n   * (`catalog`, `saga`), an exchange (`entifix.events`), a service (`zitadel`).\n   * Never a URI, never a database name: `catalog` is physically\n   * `tenant_<organizationId>`, and a document naming those is an organization\n   * enumerator (ADR 0031).\n   *\n   * It is a list rather than one string because a single connection can back\n   * several Stores: marketplace-admin-service opens one Mongo client for the\n   * `catalog` store and the co-deployed `transaction` slice's `saga` store.\n   * Registering one probe per Store instead would put both names into the\n   * readiness response's `failing` array, which must not change.\n   *\n   * The client package that opens the connection cannot know a Store's register\n   * name, so the composition root passes it in — the one thing about a probe\n   * that is not derivable from the client.\n   */\n  readonly targets: readonly string[];\n  readonly check: Effect.Effect<boolean>;\n}\n\n/** The outcome of running every registered probe. */\nexport interface HealthReport {\n  readonly ready: boolean;\n  /** Names of the probes that answered `false`, in registration order. */\n  readonly failing: readonly string[];\n}\n\n/**\n * How long a single probe may take before it counts as failing.\n *\n * This is not belt-and-braces. A driver that queues commands while its\n * connection is down (ioredis with `maxRetriesPerRequest`, for one) leaves the\n * probe pending instead of rejecting, so without a deadline `/api/health/ready`\n * *hangs* when a datastore disappears — the one moment it has to answer. A\n * probe that cannot answer in time is not ready, by definition.\n */\nconst PROBE_TIMEOUT = '2 seconds';\n\nexport interface HealthRegistry {\n  /** Add a probe. Called by an infrastructure layer as it constructs a client. */\n  readonly register: (probe: HealthProbe) => Effect.Effect<void>;\n  /** Run every probe and summarise. Never fails. */\n  readonly report: Effect.Effect<HealthReport>;\n  /**\n   * The registrations themselves, in registration order — what each probe is\n   * for, without running any of them.\n   *\n   * This is what makes the wiring document and readiness generate from **one**\n   * registration rather than from two lists that drift. Deliberately separate\n   * from {@link report}: describing a service must never cost a round trip to\n   * every datastore it has.\n   */\n  readonly probes: Effect.Effect<readonly HealthProbe[]>;\n}\n\n/**\n * DI tag for the readiness registry.\n *\n * The point of a registry rather than a hand-written list per service: a\n * `-service` that gains a datastore gains its readiness probe by merging that\n * client's probe layer, and nothing in the service's own code has to remember\n * to describe it. A list in `main.ts` drifts the first time someone adds a\n * dependency; this cannot, because the probe ships with the client.\n *\n * It lives here, in the contract layer, so `entifix-ts-*-client` packages can\n * register into it without depending on a shell.\n */\nexport class HealthRegistryTag extends Context.Tag('HealthRegistryTag')<\n  HealthRegistryTag,\n  HealthRegistry\n>() {}\n\n/**\n * Live registry over a `Ref`. Provide it **once** per service and share the\n * instance (`Layer.provideMerge`), or the probes register into a registry the\n * readiness route never reads.\n */\nexport const HealthRegistryLayer: Layer.Layer<HealthRegistryTag> = Layer.effect(\n  HealthRegistryTag,\n  Effect.gen(function* () {\n    const probes = yield* Ref.make<readonly HealthProbe[]>([]);\n\n    return {\n      register: probe => Ref.update(probes, current => [...current, probe]),\n\n      probes: Ref.get(probes),\n\n      report: Effect.gen(function* () {\n        const current = yield* Ref.get(probes);\n        const results = yield* Effect.forEach(\n          current,\n          probe =>\n            probe.check.pipe(\n              // A probe that throws is a failing probe, not a broken endpoint.\n              Effect.catchAllDefect(() => Effect.succeed(false)),\n              Effect.timeoutTo({\n                duration: PROBE_TIMEOUT,\n                onTimeout: () => false,\n                onSuccess: (ok: boolean) => ok,\n              }),\n              Effect.map(ok => ({ name: probe.name, ok })),\n            ),\n          { concurrency: 'unbounded' },\n        );\n        const failing = results.filter(r => !r.ok).map(r => r.name);\n        return { ready: failing.length === 0, failing };\n      }),\n    };\n  }),\n);\n"],"names":["Context","Effect","Layer","Ref","PROBE_TIMEOUT","HealthRegistryTag","Tag","HealthRegistryLayer","effect","gen","probes","make","register","probe","update","current","get","report","results","forEach","check","pipe","catchAllDefect","succeed","timeoutTo","duration","onTimeout","onSuccess","ok","map","name","concurrency","failing","filter","r","ready","length"],"mappings":"AAAA,SAASA,OAAO,EAAEC,MAAM,EAAEC,KAAK,EAAEC,GAAG,QAAQ,SAAS;AAoDrD;;;;;;;;CAQC,GACD,MAAMC,gBAAgB;AAmBtB;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,0BAA0BL,QAAQM,GAAG,CAAC;AAG9C;AAEL;;;;CAIC,GACD,OAAO,MAAMC,sBAAsDL,MAAMM,MAAM,CAC7EH,mBACAJ,OAAOQ,GAAG,CAAC;IACT,MAAMC,SAAS,OAAOP,IAAIQ,IAAI,CAAyB,EAAE;IAEzD,OAAO;QACLC,UAAUC,CAAAA,QAASV,IAAIW,MAAM,CAACJ,QAAQK,CAAAA,UAAW;uBAAIA;oBAASF;iBAAM;QAEpEH,QAAQP,IAAIa,GAAG,CAACN;QAEhBO,QAAQhB,OAAOQ,GAAG,CAAC;YACjB,MAAMM,UAAU,OAAOZ,IAAIa,GAAG,CAACN;YAC/B,MAAMQ,UAAU,OAAOjB,OAAOkB,OAAO,CACnCJ,SACAF,CAAAA,QACEA,MAAMO,KAAK,CAACC,IAAI,CACd,iEAAiE;gBACjEpB,OAAOqB,cAAc,CAAC,IAAMrB,OAAOsB,OAAO,CAAC,SAC3CtB,OAAOuB,SAAS,CAAC;oBACfC,UAAUrB;oBACVsB,WAAW,IAAM;oBACjBC,WAAW,CAACC,KAAgBA;gBAC9B,IACA3B,OAAO4B,GAAG,CAACD,CAAAA,KAAO,CAAA;wBAAEE,MAAMjB,MAAMiB,IAAI;wBAAEF;oBAAG,CAAA,KAE7C;gBAAEG,aAAa;YAAY;YAE7B,MAAMC,UAAUd,QAAQe,MAAM,CAACC,CAAAA,IAAK,CAACA,EAAEN,EAAE,EAAEC,GAAG,CAACK,CAAAA,IAAKA,EAAEJ,IAAI;YAC1D,OAAO;gBAAEK,OAAOH,QAAQI,MAAM,KAAK;gBAAGJ;YAAQ;QAChD;IACF;AACF,IACA"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+export * from './health/health-registry.js';
+export * from './repository/config.repository.js';
+export * from './repository/entity.repository.js';
+export * from './repository/entity-link-resolver.repository.js';
+export * from './repository/entity-mixins.repository.js';
+export * from './sessions/one-time-token-store.js';
+export * from './sessions/session-store.js';
+export * from './shutdown/shutdown-registry.js';
+export * from './tenancy/index.js';
+export * from './tokens/token-service.js';
+export * from './use-case/delete/index.js';
+export * from './use-case/get/index.js';
+export * from './use-case/load/index.js';
+export * from './use-case/save/index.js';
+export * from './wiring/wiring-registry.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mCAAmC,CAAC;AAClD,cAAc,mCAAmC,CAAC;AAClD,cAAc,iDAAiD,CAAC;AAChE,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC"}

package/dist/index.js

@@ -0,0 +1,17 @@
+export * from './health/health-registry.js';
+export * from './repository/config.repository.js';
+export * from './repository/entity.repository.js';
+export * from './repository/entity-link-resolver.repository.js';
+export * from './repository/entity-mixins.repository.js';
+export * from './sessions/one-time-token-store.js';
+export * from './sessions/session-store.js';
+export * from './shutdown/shutdown-registry.js';
+export * from './tenancy/index.js';
+export * from './tokens/token-service.js';
+export * from './use-case/delete/index.js';
+export * from './use-case/get/index.js';
+export * from './use-case/load/index.js';
+export * from './use-case/save/index.js';
+export * from './wiring/wiring-registry.js';
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './health/health-registry.js';\nexport * from './repository/config.repository.js';\nexport * from './repository/entity.repository.js';\nexport * from './repository/entity-link-resolver.repository.js';\nexport * from './repository/entity-mixins.repository.js';\nexport * from './sessions/one-time-token-store.js';\nexport * from './sessions/session-store.js';\nexport * from './shutdown/shutdown-registry.js';\nexport * from './tenancy/index.js';\nexport * from './tokens/token-service.js';\nexport * from './use-case/delete/index.js';\nexport * from './use-case/get/index.js';\nexport * from './use-case/load/index.js';\nexport * from './use-case/save/index.js';\nexport * from './wiring/wiring-registry.js';\n"],"names":[],"mappings":"AAAA,cAAc,8BAA8B;AAC5C,cAAc,oCAAoC;AAClD,cAAc,oCAAoC;AAClD,cAAc,kDAAkD;AAChE,cAAc,2CAA2C;AACzD,cAAc,qCAAqC;AACnD,cAAc,8BAA8B;AAC5C,cAAc,kCAAkC;AAChD,cAAc,qBAAqB;AACnC,cAAc,4BAA4B;AAC1C,cAAc,6BAA6B;AAC3C,cAAc,0BAA0B;AACxC,cAAc,2BAA2B;AACzC,cAAc,2BAA2B;AACzC,cAAc,8BAA8B"}

package/dist/repository/config.repository.d.ts

@@ -0,0 +1,7 @@
+import { ConfigurationClient } from '@entifix/core';
+import { Context } from 'effect';
+declare const ConfigurationRepositoryTag_base: Context.TagClass<ConfigurationRepositoryTag, "ConfigurationRepositoryTag", ConfigurationClient>;
+export declare class ConfigurationRepositoryTag extends ConfigurationRepositoryTag_base {
+}
+export {};
+//# sourceMappingURL=config.repository.d.ts.map

package/dist/repository/config.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.repository.d.ts","sourceRoot":"","sources":["../../src/repository/config.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;;AAEjC,qBAAa,0BAA2B,SAAQ,+BAEI;CAAG"}

package/dist/repository/config.repository.js

@@ -0,0 +1,5 @@
+import { Context } from 'effect';
+export class ConfigurationRepositoryTag extends Context.Tag('ConfigurationRepositoryTag')() {
+}
+
+//# sourceMappingURL=config.repository.js.map

package/dist/repository/config.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/repository/config.repository.ts"],"sourcesContent":["import { ConfigurationClient } from '@entifix/core';\nimport { Context } from 'effect';\n\nexport class ConfigurationRepositoryTag extends Context.Tag(\n  'ConfigurationRepositoryTag',\n)<ConfigurationRepositoryTag, ConfigurationClient>() {}\n"],"names":["Context","ConfigurationRepositoryTag","Tag"],"mappings":"AACA,SAASA,OAAO,QAAQ,SAAS;AAEjC,OAAO,MAAMC,mCAAmCD,QAAQE,GAAG,CACzD;AACoD"}

package/dist/repository/entity-link-resolver.repository.d.ts

@@ -0,0 +1,34 @@
+import { type Entity, type EntityConstructor, type EntityLinkResolver } from '@entifix/core';
+import { Context } from 'effect';
+import { ConfigurationRepositoryTag } from './config.repository.js';
+import { EntityRepositoryTag } from './entity.repository.js';
+declare const EntityLinkResolverTag_base: Context.TagClass<EntityLinkResolverTag, "EntityLinkResolverTag", EntityLinkResolver>;
+/**
+ * DI tag for the {@link EntityLinkResolver} an environment provides so entity
+ * links can materialize their targets. The composition root supplies a resolver
+ * backed by the appropriate adapters (REST on the web, Mongo on the backend),
+ * and use-cases that follow links yield this tag rather than depending on any
+ * concrete repository.
+ */
+export declare class EntityLinkResolverTag extends EntityLinkResolverTag_base {
+}
+/** Maps a link target constructor to the repository adapter that loads it. */
+export type EntityLinkRegistration = readonly [
+    EntityConstructor<Entity>,
+    Context.Context<EntityRepositoryTag>
+];
+/**
+ * Assembles an {@link EntityLinkResolverTag} context from repository adapters
+ * that already exist. Each registration's `get` is closed over the
+ * configuration context, so the resulting resolver effects have no outstanding
+ * requirements.
+ *
+ * It lives here, beside the tag, rather than with React's `useEntityLinkResolver`
+ * — which is only a `useMemo` around it — because nothing about it is React.
+ * A server component that imported it from the React package would pull that
+ * package's whole barrel, hooks included, and Next rejects `useState` reaching
+ * a server module. Framework-free code belongs at a framework-free layer.
+ */
+export declare function createEntityLinkResolver(configurationStore: Context.Context<ConfigurationRepositoryTag>, registrations: ReadonlyArray<EntityLinkRegistration>): Context.Context<EntityLinkResolverTag>;
+export {};
+//# sourceMappingURL=entity-link-resolver.repository.d.ts.map

package/dist/repository/entity-link-resolver.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-link-resolver.repository.d.ts","sourceRoot":"","sources":["../../src/repository/entity-link-resolver.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAU,MAAM,QAAQ,CAAC;AAEzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;;AAE7D;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,0BAGxC;CAAG;AAEN,8EAA8E;AAC9E,MAAM,MAAM,sBAAsB,GAAG,SAAS;IAC5C,iBAAiB,CAAC,MAAM,CAAC;IACzB,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC;CACrC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAC/D,aAAa,EAAE,aAAa,CAAC,sBAAsB,CAAC,GACnD,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAiCxC"}

package/dist/repository/entity-link-resolver.repository.js

@@ -0,0 +1,42 @@
+import { EntifixLogicError } from '@entifix/core';
+import { Context, Effect } from 'effect';
+import { EntityRepositoryTag } from './entity.repository.js';
+/**
+ * DI tag for the {@link EntityLinkResolver} an environment provides so entity
+ * links can materialize their targets. The composition root supplies a resolver
+ * backed by the appropriate adapters (REST on the web, Mongo on the backend),
+ * and use-cases that follow links yield this tag rather than depending on any
+ * concrete repository.
+ */ export class EntityLinkResolverTag extends Context.Tag('EntityLinkResolverTag')() {
+}
+/**
+ * Assembles an {@link EntityLinkResolverTag} context from repository adapters
+ * that already exist. Each registration's `get` is closed over the
+ * configuration context, so the resulting resolver effects have no outstanding
+ * requirements.
+ *
+ * It lives here, beside the tag, rather than with React's `useEntityLinkResolver`
+ * — which is only a `useMemo` around it — because nothing about it is React.
+ * A server component that imported it from the React package would pull that
+ * package's whole barrel, hooks included, and Next rejects `useState` reaching
+ * a server module. Framework-free code belongs at a framework-free layer.
+ */ export function createEntityLinkResolver(configurationStore, registrations) {
+    const repositoryByConstructor = new Map(registrations.map(([entityConstructor, repositoryContext])=>[
+            entityConstructor,
+            Context.get(repositoryContext, EntityRepositoryTag)
+        ]));
+    const resolver = {
+        resolve (entityConstructor, id) {
+            const repository = repositoryByConstructor.get(entityConstructor);
+            if (!repository) {
+                return Effect.fail(new EntifixLogicError(`No link resolver registered for entity "${entityConstructor.name}"`, undefined, {
+                    entity: entityConstructor.name
+                }));
+            }
+            return Effect.provide(repository.get(id), configurationStore);
+        }
+    };
+    return Context.make(EntityLinkResolverTag, resolver);
+}
+
+//# sourceMappingURL=entity-link-resolver.repository.js.map

package/dist/repository/entity-link-resolver.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/repository/entity-link-resolver.repository.ts"],"sourcesContent":["import {\n  type EntifixError,\n  EntifixLogicError,\n  type Entity,\n  type EntityConstructor,\n  type EntityLinkResolver,\n} from '@entifix/core';\nimport { Context, Effect } from 'effect';\n\nimport { ConfigurationRepositoryTag } from './config.repository.js';\nimport { EntityRepositoryTag } from './entity.repository.js';\n\n/**\n * DI tag for the {@link EntityLinkResolver} an environment provides so entity\n * links can materialize their targets. The composition root supplies a resolver\n * backed by the appropriate adapters (REST on the web, Mongo on the backend),\n * and use-cases that follow links yield this tag rather than depending on any\n * concrete repository.\n */\nexport class EntityLinkResolverTag extends Context.Tag('EntityLinkResolverTag')<\n  EntityLinkResolverTag,\n  EntityLinkResolver\n>() {}\n\n/** Maps a link target constructor to the repository adapter that loads it. */\nexport type EntityLinkRegistration = readonly [\n  EntityConstructor<Entity>,\n  Context.Context<EntityRepositoryTag>,\n];\n\n/**\n * Assembles an {@link EntityLinkResolverTag} context from repository adapters\n * that already exist. Each registration's `get` is closed over the\n * configuration context, so the resulting resolver effects have no outstanding\n * requirements.\n *\n * It lives here, beside the tag, rather than with React's `useEntityLinkResolver`\n * — which is only a `useMemo` around it — because nothing about it is React.\n * A server component that imported it from the React package would pull that\n * package's whole barrel, hooks included, and Next rejects `useState` reaching\n * a server module. Framework-free code belongs at a framework-free layer.\n */\nexport function createEntityLinkResolver(\n  configurationStore: Context.Context<ConfigurationRepositoryTag>,\n  registrations: ReadonlyArray<EntityLinkRegistration>,\n): Context.Context<EntityLinkResolverTag> {\n  const repositoryByConstructor = new Map(\n    registrations.map(\n      ([entityConstructor, repositoryContext]) =>\n        [\n          entityConstructor,\n          Context.get(repositoryContext, EntityRepositoryTag),\n        ] as const,\n    ),\n  );\n\n  const resolver: EntityLinkResolver = {\n    resolve(entityConstructor, id) {\n      const repository = repositoryByConstructor.get(\n        entityConstructor as EntityConstructor<Entity>,\n      );\n      if (!repository) {\n        return Effect.fail(\n          new EntifixLogicError(\n            `No link resolver registered for entity \"${entityConstructor.name}\"`,\n            undefined,\n            { entity: entityConstructor.name },\n          ),\n        );\n      }\n      return Effect.provide(\n        repository.get(id),\n        configurationStore,\n      ) as Effect.Effect<never, EntifixError>;\n    },\n  };\n\n  return Context.make(EntityLinkResolverTag, resolver);\n}\n"],"names":["EntifixLogicError","Context","Effect","EntityRepositoryTag","EntityLinkResolverTag","Tag","createEntityLinkResolver","configurationStore","registrations","repositoryByConstructor","Map","map","entityConstructor","repositoryContext","get","resolver","resolve","id","repository","fail","name","undefined","entity","provide","make"],"mappings":"AAAA,SAEEA,iBAAiB,QAIZ,gBAAgB;AACvB,SAASC,OAAO,EAAEC,MAAM,QAAQ,SAAS;AAGzC,SAASC,mBAAmB,QAAQ,yBAAyB;AAE7D;;;;;;CAMC,GACD,OAAO,MAAMC,8BAA8BH,QAAQI,GAAG,CAAC;AAGlD;AAQL;;;;;;;;;;;CAWC,GACD,OAAO,SAASC,yBACdC,kBAA+D,EAC/DC,aAAoD;IAEpD,MAAMC,0BAA0B,IAAIC,IAClCF,cAAcG,GAAG,CACf,CAAC,CAACC,mBAAmBC,kBAAkB,GACrC;YACED;YACAX,QAAQa,GAAG,CAACD,mBAAmBV;SAChC;IAIP,MAAMY,WAA+B;QACnCC,SAAQJ,iBAAiB,EAAEK,EAAE;YAC3B,MAAMC,aAAaT,wBAAwBK,GAAG,CAC5CF;YAEF,IAAI,CAACM,YAAY;gBACf,OAAOhB,OAAOiB,IAAI,CAChB,IAAInB,kBACF,CAAC,wCAAwC,EAAEY,kBAAkBQ,IAAI,CAAC,CAAC,CAAC,EACpEC,WACA;oBAAEC,QAAQV,kBAAkBQ,IAAI;gBAAC;YAGvC;YACA,OAAOlB,OAAOqB,OAAO,CACnBL,WAAWJ,GAAG,CAACG,KACfV;QAEJ;IACF;IAEA,OAAON,QAAQuB,IAAI,CAACpB,uBAAuBW;AAC7C"}

package/dist/repository/entity-mixins.repository.d.ts

@@ -0,0 +1,13 @@
+import { Entity, EntityId, EntityLoadRequest } from '@entifix/core';
+import { Context } from 'effect';
+declare const EntityIdTag_base: Context.TagClass<EntityIdTag, "EntityIdTag", EntityId>;
+export declare class EntityIdTag extends EntityIdTag_base {
+}
+declare const EntityLoadRequestTag_base: Context.TagClass<EntityLoadRequestTag, "EntityLoadRequestTag", EntityLoadRequest<Entity>>;
+export declare class EntityLoadRequestTag extends EntityLoadRequestTag_base {
+}
+declare const EntityTag_base: Context.TagClass<EntityTag, "EntityTag", Entity>;
+export declare class EntityTag extends EntityTag_base {
+}
+export {};
+//# sourceMappingURL=entity-mixins.repository.d.ts.map

package/dist/repository/entity-mixins.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-mixins.repository.d.ts","sourceRoot":"","sources":["../../src/repository/entity-mixins.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;;AAEjC,qBAAa,WAAY,SAAQ,gBAG9B;CAAG;;AAEN,qBAAa,oBAAqB,SAAQ,yBAGvC;CAAG;;AAEN,qBAAa,SAAU,SAAQ,cAA6C;CAAG"}

package/dist/repository/entity-mixins.repository.js

@@ -0,0 +1,9 @@
+import { Context } from 'effect';
+export class EntityIdTag extends Context.Tag('EntityIdTag')() {
+}
+export class EntityLoadRequestTag extends Context.Tag('EntityLoadRequestTag')() {
+}
+export class EntityTag extends Context.Tag('EntityTag')() {
+}
+
+//# sourceMappingURL=entity-mixins.repository.js.map

package/dist/repository/entity-mixins.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/repository/entity-mixins.repository.ts"],"sourcesContent":["import { Entity, EntityId, EntityLoadRequest } from '@entifix/core';\nimport { Context } from 'effect';\n\nexport class EntityIdTag extends Context.Tag('EntityIdTag')<\n  EntityIdTag,\n  EntityId\n>() {}\n\nexport class EntityLoadRequestTag extends Context.Tag('EntityLoadRequestTag')<\n  EntityLoadRequestTag,\n  EntityLoadRequest\n>() {}\n\nexport class EntityTag extends Context.Tag('EntityTag')<EntityTag, Entity>() {}\n"],"names":["Context","EntityIdTag","Tag","EntityLoadRequestTag","EntityTag"],"mappings":"AACA,SAASA,OAAO,QAAQ,SAAS;AAEjC,OAAO,MAAMC,oBAAoBD,QAAQE,GAAG,CAAC;AAGxC;AAEL,OAAO,MAAMC,6BAA6BH,QAAQE,GAAG,CAAC;AAGjD;AAEL,OAAO,MAAME,kBAAkBJ,QAAQE,GAAG,CAAC;AAAmC"}

package/dist/repository/entity.repository.d.ts

@@ -0,0 +1,15 @@
+import type { EntifixError, Entity, EntityId, EntityLoadRequest, EntityPage } from '@entifix/core';
+import { Context } from 'effect';
+import { Effect } from 'effect/Effect';
+import { ConfigurationRepositoryTag } from './config.repository.js';
+export interface EntityRepository {
+    get<TEntity extends Entity>(id: EntityId): Effect<TEntity, EntifixError, ConfigurationRepositoryTag>;
+    load<TEntity extends Entity>(request: EntityLoadRequest<TEntity>): Effect<EntityPage<TEntity>, EntifixError, ConfigurationRepositoryTag>;
+    save<TEntity extends Entity>(entity: TEntity): Effect<TEntity, EntifixError, ConfigurationRepositoryTag>;
+    delete<TEntity extends Entity>(entityOrId: EntityId | TEntity): Effect<void, EntifixError, ConfigurationRepositoryTag>;
+}
+declare const EntityRepositoryTag_base: Context.TagClass<EntityRepositoryTag, "EntityRepositoryTag", EntityRepository>;
+export declare class EntityRepositoryTag extends EntityRepositoryTag_base {
+}
+export {};
+//# sourceMappingURL=entity.repository.d.ts.map

package/dist/repository/entity.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity.repository.d.ts","sourceRoot":"","sources":["../../src/repository/entity.repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,iBAAiB,EACjB,UAAU,EACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,OAAO,SAAS,MAAM,EACxB,EAAE,EAAE,QAAQ,GACX,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,0BAA0B,CAAC,CAAC;IAC7D,IAAI,CAAC,OAAO,SAAS,MAAM,EACzB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAClC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,0BAA0B,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,SAAS,MAAM,EACzB,MAAM,EAAE,OAAO,GACd,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,0BAA0B,CAAC,CAAC;IAC7D,MAAM,CAAC,OAAO,SAAS,MAAM,EAC3B,UAAU,EAAE,QAAQ,GAAG,OAAO,GAC7B,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,0BAA0B,CAAC,CAAC;CAC3D;;AAED,qBAAa,mBAAoB,SAAQ,wBAGtC;CAAG"}

package/dist/repository/entity.repository.js

@@ -0,0 +1,5 @@
+import { Context } from 'effect';
+export class EntityRepositoryTag extends Context.Tag('EntityRepositoryTag')() {
+}
+
+//# sourceMappingURL=entity.repository.js.map

package/dist/repository/entity.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/repository/entity.repository.ts"],"sourcesContent":["import type {\n  EntifixError,\n  Entity,\n  EntityId,\n  EntityLoadRequest,\n  EntityPage,\n} from '@entifix/core';\nimport { Context } from 'effect';\nimport { Effect } from 'effect/Effect';\n\nimport { ConfigurationRepositoryTag } from './config.repository.js';\n\nexport interface EntityRepository {\n  get<TEntity extends Entity>(\n    id: EntityId,\n  ): Effect<TEntity, EntifixError, ConfigurationRepositoryTag>;\n  load<TEntity extends Entity>(\n    request: EntityLoadRequest<TEntity>,\n  ): Effect<EntityPage<TEntity>, EntifixError, ConfigurationRepositoryTag>;\n  save<TEntity extends Entity>(\n    entity: TEntity,\n  ): Effect<TEntity, EntifixError, ConfigurationRepositoryTag>;\n  delete<TEntity extends Entity>(\n    entityOrId: EntityId | TEntity,\n  ): Effect<void, EntifixError, ConfigurationRepositoryTag>;\n}\n\nexport class EntityRepositoryTag extends Context.Tag('EntityRepositoryTag')<\n  EntityRepositoryTag,\n  EntityRepository\n>() {}\n"],"names":["Context","EntityRepositoryTag","Tag"],"mappings":"AAOA,SAASA,OAAO,QAAQ,SAAS;AAoBjC,OAAO,MAAMC,4BAA4BD,QAAQE,GAAG,CAAC;AAGhD"}

package/dist/sessions/one-time-token-store.d.ts

@@ -0,0 +1,40 @@
+import type { EntifixError } from '@entifix/core';
+import { Context } from 'effect';
+import { Effect } from 'effect/Effect';
+/**
+ * What a token is for. Namespacing them keeps a token minted for one purpose
+ * from being redeemed as another — a password-reset token must not double as
+ * an email-verification token.
+ */
+export type TokenPurpose = string;
+/**
+ * Short-lived, single-use tokens handed to a user out of band (a link in an
+ * email) and redeemed once.
+ *
+ * The store keeps only a HASH of the token, exactly as it would a password: the
+ * plaintext exists in the response to {@link OneTimeTokenStore.issue} and in the
+ * message sent to the user, and nowhere else. A store dump then yields nothing
+ * an attacker can redeem.
+ */
+export interface OneTimeTokenStore {
+    /**
+     * Mint a token for `subject`, returning the plaintext exactly once.
+     *
+     * The caller must send it onward immediately; there is no way to read it back.
+     */
+    issue(purpose: TokenPurpose, subject: string, ttlSeconds: number): Effect<string, EntifixError>;
+    /**
+     * Redeem a token, returning the subject it was minted for.
+     *
+     * Consuming deletes it, so a link that leaks later — from a browser history, a
+     * mail archive, a proxy log — is already spent. Fails when the token is
+     * unknown, expired, or already used; the caller must not distinguish those.
+     */
+    consume(purpose: TokenPurpose, token: string): Effect<string, EntifixError>;
+}
+declare const OneTimeTokenStoreTag_base: Context.TagClass<OneTimeTokenStoreTag, "OneTimeTokenStoreTag", OneTimeTokenStore>;
+/** DI tag the composition root binds to a concrete {@link OneTimeTokenStore}. */
+export declare class OneTimeTokenStoreTag extends OneTimeTokenStoreTag_base {
+}
+export {};
+//# sourceMappingURL=one-time-token-store.d.ts.map

package/dist/sessions/one-time-token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-token-store.d.ts","sourceRoot":"","sources":["../../src/sessions/one-time-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,CACH,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAChC;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CAC7E;;AAED,iFAAiF;AACjF,qBAAa,oBAAqB,SAAQ,yBAGvC;CAAG"}

package/dist/sessions/one-time-token-store.js

@@ -0,0 +1,5 @@
+import { Context } from 'effect';
+/** DI tag the composition root binds to a concrete {@link OneTimeTokenStore}. */ export class OneTimeTokenStoreTag extends Context.Tag('OneTimeTokenStoreTag')() {
+}
+
+//# sourceMappingURL=one-time-token-store.js.map

package/dist/sessions/one-time-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/sessions/one-time-token-store.ts"],"sourcesContent":["import type { EntifixError } from '@entifix/core';\nimport { Context } from 'effect';\nimport { Effect } from 'effect/Effect';\n\n/**\n * What a token is for. Namespacing them keeps a token minted for one purpose\n * from being redeemed as another — a password-reset token must not double as\n * an email-verification token.\n */\nexport type TokenPurpose = string;\n\n/**\n * Short-lived, single-use tokens handed to a user out of band (a link in an\n * email) and redeemed once.\n *\n * The store keeps only a HASH of the token, exactly as it would a password: the\n * plaintext exists in the response to {@link OneTimeTokenStore.issue} and in the\n * message sent to the user, and nowhere else. A store dump then yields nothing\n * an attacker can redeem.\n */\nexport interface OneTimeTokenStore {\n  /**\n   * Mint a token for `subject`, returning the plaintext exactly once.\n   *\n   * The caller must send it onward immediately; there is no way to read it back.\n   */\n  issue(\n    purpose: TokenPurpose,\n    subject: string,\n    ttlSeconds: number,\n  ): Effect<string, EntifixError>;\n  /**\n   * Redeem a token, returning the subject it was minted for.\n   *\n   * Consuming deletes it, so a link that leaks later — from a browser history, a\n   * mail archive, a proxy log — is already spent. Fails when the token is\n   * unknown, expired, or already used; the caller must not distinguish those.\n   */\n  consume(purpose: TokenPurpose, token: string): Effect<string, EntifixError>;\n}\n\n/** DI tag the composition root binds to a concrete {@link OneTimeTokenStore}. */\nexport class OneTimeTokenStoreTag extends Context.Tag('OneTimeTokenStoreTag')<\n  OneTimeTokenStoreTag,\n  OneTimeTokenStore\n>() {}\n"],"names":["Context","OneTimeTokenStoreTag","Tag"],"mappings":"AACA,SAASA,OAAO,QAAQ,SAAS;AAwCjC,+EAA+E,GAC/E,OAAO,MAAMC,6BAA6BD,QAAQE,GAAG,CAAC;AAGjD"}