@entifix/business 0.1.0-0

package/dist/sessions/session-store.d.ts

@@ -0,0 +1,145 @@
+import type { EntifixError, EntityId } from '@entifix/core';
+import { Context } from 'effect';
+import { Effect } from 'effect/Effect';
+/**
+ * The subject state a session carries. Deliberately structural (no `Principal`
+ * import — that lives in the authn layer above this one) so any domain can
+ * store its authenticated subject here. A resolved `Principal` is assignable to
+ * it as-is.
+ */
+/**
+ * What the session was opened from, for display and for notifying the owner.
+ *
+ * **A label, never an authorization input.** Every field is client-supplied or
+ * client-derived, so a copied cookie copies the device — which is acceptable
+ * precisely because nothing here decides anything. It powers "you are signed in
+ * on these devices" and "a new device signed in"; it never grants or refuses.
+ */
+export interface DeviceContext {
+    /** Opaque, server-minted id carried in a long-lived cookie. */
+    readonly deviceId: string;
+    readonly browser?: string;
+    readonly os?: string;
+    /** `desktop` / `mobile` / `tablet`, as the user-agent reports it. */
+    readonly type?: string;
+    /** Truncated to a /24 — enough for "somewhere else", less PII at rest. */
+    readonly ip?: string;
+}
+export interface SessionData {
+    readonly userId: EntityId;
+    /** Upstream identity subject (e.g. an IdP `sub`, or the canonical user id). */
+    readonly subject: string;
+    readonly roles: readonly string[];
+    readonly attributes: Readonly<Record<string, unknown>>;
+    /**
+     * The organization this session is acting for. It lives here rather than on
+     * the user because a party may belong to several organizations, so switching
+     * is a session operation that re-mints the access token — modelling it on the
+     * user would make someone serving two vendors keep two accounts.
+     *
+     * Absent for a session with no organization: a buyer, or an operator, who
+     * holds no tenant scope by default.
+     */
+    readonly activeOrganizationId?: string;
+    /**
+     * Which population this session belongs to — buyer, vendor staff, or platform
+     * staff. Resolved once when the session opens and carried from there into
+     * every access token minted from it, so no service re-derives it per request.
+     *
+     * A plain string for the same reason `roles` is: the closed set lives in the
+     * business layer above this one.
+     */
+    readonly partyRole?: string;
+    /**
+     * The party behind the account — the `Individual` id, not the account id.
+     *
+     * Resolved once when the session opens, from the only store that holds the
+     * user → party mapping, and carried from here into every access token: a
+     * service scoping a read to *whose records these are* asks about a party, and
+     * has no way to make that hop itself.
+     *
+     * Absent for an account with no party record, and a consumer must read that
+     * as "no party" rather than as "any party".
+     */
+    readonly partyId?: string;
+    /**
+     * The business domains {@link SessionData.activeOrganizationId} is
+     * provisioned for. Resolved once when the session opens and carried from here
+     * into every access token minted from it, so no service re-reads an
+     * entitlement per request — the same arrangement `partyRole` already has.
+     *
+     * Absent for a session with no organization, which is a different statement
+     * from an empty list: the ceiling does not apply rather than denying
+     * everything.
+     */
+    readonly entitlements?: readonly string[];
+    /** Absent for sessions opened by a non-browser caller. */
+    readonly device?: DeviceContext;
+}
+/** A stored session as read back — {@link SessionData} plus lifecycle metadata. */
+export interface SessionRecord extends SessionData {
+    /** The opaque session id this record is keyed by; the revocation handle. */
+    readonly sessionId: string;
+    readonly createdAt: string;
+    /** End of the current sliding window; moves forward on every {@link SessionStore.touch}. */
+    readonly expiresAt: string;
+    /**
+     * The ceiling, stamped at creation and never moved. A sliding window with no
+     * ceiling renews forever, so this is what guarantees every session eventually
+     * ends — including one an attacker is keeping warm.
+     */
+    readonly absoluteExpiresAt: string;
+}
+/** The two durations a session is opened with. */
+export interface SessionLifetimeSeconds {
+    /** Sliding window, renewed on each touch. */
+    readonly idleTtlSeconds: number;
+    /** Ceiling measured from creation; never extended. */
+    readonly absoluteTtlSeconds: number;
+}
+/**
+ * The session persistence seam. An opaque, revocable, TTL-bounded store keyed by
+ * a server-minted session id — the single source of truth every service can
+ * read a live session from, and the handle an admin/logout revokes through.
+ *
+ * Framework- and store-agnostic: a Redis adapter backs it in production, a fake
+ * in tests, and the use-cases that consume {@link SessionStoreTag} never change.
+ */
+export interface SessionStore {
+    /** Persist a new session and return its freshly minted opaque id. */
+    create(data: SessionData, lifetime: SessionLifetimeSeconds): Effect<string, EntifixError>;
+    /** Read a live session, failing if it is unknown, revoked, or expired. */
+    read(sessionId: string): Effect<SessionRecord, EntifixError>;
+    /**
+     * Renew the sliding window, **clamped to the session's own
+     * {@link SessionRecord.absoluteExpiresAt}**. Fails once the ceiling is passed,
+     * which is how a long-lived session finally ends.
+     */
+    touch(sessionId: string, idleTtlSeconds: number): Effect<void, EntifixError>;
+    /**
+     * Every live session a user holds.
+     *
+     * The read side of the index `revokeAllForUser` already walks. Without it
+     * there is no way to show someone where they are signed in, and "sign out
+     * everywhere" is an action with no visible subject.
+     */
+    listForUser(userId: EntityId): Effect<readonly SessionRecord[], EntifixError>;
+    /** Revoke a single session — the next {@link read} fails immediately. */
+    revoke(sessionId: string): Effect<void, EntifixError>;
+    /** Revoke every session for a user (e.g. password change, admin kick). */
+    revokeAllForUser(userId: EntityId): Effect<void, EntifixError>;
+    /**
+     * Revoke every session for a user EXCEPT one.
+     *
+     * What a password change should do: end every other session, but leave the
+     * person who just changed it signed in. `revokeAllForUser` would log them out
+     * of the screen they are standing on.
+     */
+    revokeAllForUserExcept(userId: EntityId, keepSessionId: string): Effect<void, EntifixError>;
+}
+declare const SessionStoreTag_base: Context.TagClass<SessionStoreTag, "SessionStoreTag", SessionStore>;
+/** DI tag the composition root binds to a concrete {@link SessionStore}. */
+export declare class SessionStoreTag extends SessionStoreTag_base {
+}
+export {};
+//# sourceMappingURL=session-store.d.ts.map

package/dist/sessions/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/sessions/session-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC;;;;;GAKG;AACH;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,mFAAmF;AACnF,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC,6CAA6C;IAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,sBAAsB,GAC/B,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAChC,0EAA0E;IAC1E,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC7D;;;;OAIG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC7E;;;;;;OAMG;IACH,WAAW,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC,SAAS,aAAa,EAAE,EAAE,YAAY,CAAC,CAAC;IAC9E,yEAAyE;IACzE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtD,0EAA0E;IAC1E,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC/D;;;;;;OAMG;IACH,sBAAsB,CACpB,MAAM,EAAE,QAAQ,EAChB,aAAa,EAAE,MAAM,GACpB,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;CAC/B;;AAED,4EAA4E;AAC5E,qBAAa,eAAgB,SAAQ,oBAGlC;CAAG"}

package/dist/sessions/session-store.js

@@ -0,0 +1,5 @@
+import { Context } from 'effect';
+/** DI tag the composition root binds to a concrete {@link SessionStore}. */ export class SessionStoreTag extends Context.Tag('SessionStoreTag')() {
+}
+
+//# sourceMappingURL=session-store.js.map

package/dist/sessions/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/sessions/session-store.ts"],"sourcesContent":["import type { EntifixError, EntityId } from '@entifix/core';\nimport { Context } from 'effect';\nimport { Effect } from 'effect/Effect';\n\n/**\n * The subject state a session carries. Deliberately structural (no `Principal`\n * import — that lives in the authn layer above this one) so any domain can\n * store its authenticated subject here. A resolved `Principal` is assignable to\n * it as-is.\n */\n/**\n * What the session was opened from, for display and for notifying the owner.\n *\n * **A label, never an authorization input.** Every field is client-supplied or\n * client-derived, so a copied cookie copies the device — which is acceptable\n * precisely because nothing here decides anything. It powers \"you are signed in\n * on these devices\" and \"a new device signed in\"; it never grants or refuses.\n */\nexport interface DeviceContext {\n  /** Opaque, server-minted id carried in a long-lived cookie. */\n  readonly deviceId: string;\n  readonly browser?: string;\n  readonly os?: string;\n  /** `desktop` / `mobile` / `tablet`, as the user-agent reports it. */\n  readonly type?: string;\n  /** Truncated to a /24 — enough for \"somewhere else\", less PII at rest. */\n  readonly ip?: string;\n}\n\nexport interface SessionData {\n  readonly userId: EntityId;\n  /** Upstream identity subject (e.g. an IdP `sub`, or the canonical user id). */\n  readonly subject: string;\n  readonly roles: readonly string[];\n  readonly attributes: Readonly<Record<string, unknown>>;\n  /**\n   * The organization this session is acting for. It lives here rather than on\n   * the user because a party may belong to several organizations, so switching\n   * is a session operation that re-mints the access token — modelling it on the\n   * user would make someone serving two vendors keep two accounts.\n   *\n   * Absent for a session with no organization: a buyer, or an operator, who\n   * holds no tenant scope by default.\n   */\n  readonly activeOrganizationId?: string;\n  /**\n   * Which population this session belongs to — buyer, vendor staff, or platform\n   * staff. Resolved once when the session opens and carried from there into\n   * every access token minted from it, so no service re-derives it per request.\n   *\n   * A plain string for the same reason `roles` is: the closed set lives in the\n   * business layer above this one.\n   */\n  readonly partyRole?: string;\n  /**\n   * The party behind the account — the `Individual` id, not the account id.\n   *\n   * Resolved once when the session opens, from the only store that holds the\n   * user → party mapping, and carried from here into every access token: a\n   * service scoping a read to *whose records these are* asks about a party, and\n   * has no way to make that hop itself.\n   *\n   * Absent for an account with no party record, and a consumer must read that\n   * as \"no party\" rather than as \"any party\".\n   */\n  readonly partyId?: string;\n  /**\n   * The business domains {@link SessionData.activeOrganizationId} is\n   * provisioned for. Resolved once when the session opens and carried from here\n   * into every access token minted from it, so no service re-reads an\n   * entitlement per request — the same arrangement `partyRole` already has.\n   *\n   * Absent for a session with no organization, which is a different statement\n   * from an empty list: the ceiling does not apply rather than denying\n   * everything.\n   */\n  readonly entitlements?: readonly string[];\n  /** Absent for sessions opened by a non-browser caller. */\n  readonly device?: DeviceContext;\n}\n\n/** A stored session as read back — {@link SessionData} plus lifecycle metadata. */\nexport interface SessionRecord extends SessionData {\n  /** The opaque session id this record is keyed by; the revocation handle. */\n  readonly sessionId: string;\n  readonly createdAt: string;\n  /** End of the current sliding window; moves forward on every {@link SessionStore.touch}. */\n  readonly expiresAt: string;\n  /**\n   * The ceiling, stamped at creation and never moved. A sliding window with no\n   * ceiling renews forever, so this is what guarantees every session eventually\n   * ends — including one an attacker is keeping warm.\n   */\n  readonly absoluteExpiresAt: string;\n}\n\n/** The two durations a session is opened with. */\nexport interface SessionLifetimeSeconds {\n  /** Sliding window, renewed on each touch. */\n  readonly idleTtlSeconds: number;\n  /** Ceiling measured from creation; never extended. */\n  readonly absoluteTtlSeconds: number;\n}\n\n/**\n * The session persistence seam. An opaque, revocable, TTL-bounded store keyed by\n * a server-minted session id — the single source of truth every service can\n * read a live session from, and the handle an admin/logout revokes through.\n *\n * Framework- and store-agnostic: a Redis adapter backs it in production, a fake\n * in tests, and the use-cases that consume {@link SessionStoreTag} never change.\n */\nexport interface SessionStore {\n  /** Persist a new session and return its freshly minted opaque id. */\n  create(\n    data: SessionData,\n    lifetime: SessionLifetimeSeconds,\n  ): Effect<string, EntifixError>;\n  /** Read a live session, failing if it is unknown, revoked, or expired. */\n  read(sessionId: string): Effect<SessionRecord, EntifixError>;\n  /**\n   * Renew the sliding window, **clamped to the session's own\n   * {@link SessionRecord.absoluteExpiresAt}**. Fails once the ceiling is passed,\n   * which is how a long-lived session finally ends.\n   */\n  touch(sessionId: string, idleTtlSeconds: number): Effect<void, EntifixError>;\n  /**\n   * Every live session a user holds.\n   *\n   * The read side of the index `revokeAllForUser` already walks. Without it\n   * there is no way to show someone where they are signed in, and \"sign out\n   * everywhere\" is an action with no visible subject.\n   */\n  listForUser(userId: EntityId): Effect<readonly SessionRecord[], EntifixError>;\n  /** Revoke a single session — the next {@link read} fails immediately. */\n  revoke(sessionId: string): Effect<void, EntifixError>;\n  /** Revoke every session for a user (e.g. password change, admin kick). */\n  revokeAllForUser(userId: EntityId): Effect<void, EntifixError>;\n  /**\n   * Revoke every session for a user EXCEPT one.\n   *\n   * What a password change should do: end every other session, but leave the\n   * person who just changed it signed in. `revokeAllForUser` would log them out\n   * of the screen they are standing on.\n   */\n  revokeAllForUserExcept(\n    userId: EntityId,\n    keepSessionId: string,\n  ): Effect<void, EntifixError>;\n}\n\n/** DI tag the composition root binds to a concrete {@link SessionStore}. */\nexport class SessionStoreTag extends Context.Tag('SessionStoreTag')<\n  SessionStoreTag,\n  SessionStore\n>() {}\n"],"names":["Context","SessionStoreTag","Tag"],"mappings":"AACA,SAASA,OAAO,QAAQ,SAAS;AAsJjC,0EAA0E,GAC1E,OAAO,MAAMC,wBAAwBD,QAAQE,GAAG,CAAC;AAG5C"}

package/dist/shutdown/shutdown-registry.d.ts

@@ -0,0 +1,84 @@
+import { Context, Effect } from 'effect';
+/**
+ * The order a shutdown runs in (ADR 0030).
+ *
+ * **`stop-intake`** stops the process taking new work — cancelling the bus's
+ * consumers, interrupting a polling daemon. **`flush`** carries out what is
+ * already committed but not yet delivered: the outbox relay's final pass. The
+ * two are separate phases rather than one list because they are ordered against
+ * each other and not merely against the connections closing — flushing while
+ * consumers are still folding events would race a drain against fresh work, and
+ * the relay would go on finding entries the handlers keep writing.
+ */
+export declare const SHUTDOWN_PHASES: readonly ["stop-intake", "flush"];
+export type ShutdownPhase = (typeof SHUTDOWN_PHASES)[number];
+/**
+ * One thing to do before this process's connections close.
+ *
+ * `run` is fully applied, exactly like `HealthProbe.check`: whoever
+ * registers the hook has already closed over the connector, the fiber or the
+ * store, so the drain can run every hook without knowing what any of them
+ * touches.
+ */
+export interface ShutdownHook {
+    /** Logged when the hook runs, and when it fails. Never rendered to a caller. */
+    readonly name: string;
+    readonly phase: ShutdownPhase;
+    readonly run: Effect.Effect<void>;
+}
+/**
+ * What a service does on its way out, registered by whoever opened the thing
+ * that needs draining.
+ *
+ * A sibling of `HealthRegistry` and `WiringRegistry`, and for the same reason:
+ * a `-service` that gains a bus gains its consumer drain by merging that
+ * adapter's layer, and nothing in the service's own `main.ts` has to remember
+ * to list it. A hand-written sequence per composition root drifts the first
+ * time someone adds a dependency; this cannot, because the hook ships with the
+ * client that needs it.
+ */
+export interface ShutdownRegistry {
+    /** Add a hook. Called by an adapter layer as it constructs its client. */
+    readonly register: (hook: ShutdownHook) => Effect.Effect<void>;
+    /**
+     * Whether this process has begun terminating.
+     *
+     * Read by `GET /api/health/ready`, which answers `503` from here **before**
+     * it consults any probe: nothing is failing, the process is leaving.
+     */
+    readonly terminating: Effect.Effect<boolean>;
+    /**
+     * Run every hook, phase by phase, in registration order. Never fails.
+     *
+     * Called from a `Layer` finalizer, which is what orders it: the drain layer
+     * is built after the composition root, so it is released before it, and the
+     * connections a hook needs are still open while it runs.
+     */
+    readonly drain: Effect.Effect<void>;
+}
+declare const ShutdownRegistryTag_base: Context.TagClass<ShutdownRegistryTag, "ShutdownRegistryTag", ShutdownRegistry>;
+/**
+ * DI tag for the shutdown registry.
+ *
+ * In the contract layer beside `HealthRegistryTag` so an
+ * `entifix-ts-*-client` package can register a hook without depending on a
+ * shell.
+ */
+export declare class ShutdownRegistryTag extends ShutdownRegistryTag_base {
+}
+/**
+ * Builds the registry and the synchronous latch that flips it.
+ *
+ * Two halves for two callers, the `makeAmqpConnector` shape: the
+ * `registry` goes into the layer graph, while `begin` is called from a
+ * `process.on('SIGTERM')` handler — outside Effect, in the same tick the
+ * runtime starts interrupting — so `/api/health/ready` stops claiming to be
+ * ready the instant the signal lands rather than whenever the finalizers get
+ * around to running.
+ */
+export declare const makeShutdownRegistry: () => {
+    registry: ShutdownRegistry;
+    begin: () => void;
+};
+export {};
+//# sourceMappingURL=shutdown-registry.d.ts.map

package/dist/shutdown/shutdown-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown-registry.d.ts","sourceRoot":"","sources":["../../src/shutdown/shutdown-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,mCAAoC,CAAC;AAEjE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACnC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACrC;;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,wBAGtC;CAAG;AA0BN;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,QAAO;IACtC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,MAAM,IAAI,CAAC;CAsCnB,CAAC"}

package/dist/shutdown/shutdown-registry.js

@@ -0,0 +1,88 @@
+import { Cause, Context, Effect } from 'effect';
+/**
+ * The order a shutdown runs in (ADR 0030).
+ *
+ * **`stop-intake`** stops the process taking new work — cancelling the bus's
+ * consumers, interrupting a polling daemon. **`flush`** carries out what is
+ * already committed but not yet delivered: the outbox relay's final pass. The
+ * two are separate phases rather than one list because they are ordered against
+ * each other and not merely against the connections closing — flushing while
+ * consumers are still folding events would race a drain against fresh work, and
+ * the relay would go on finding entries the handlers keep writing.
+ */ export const SHUTDOWN_PHASES = [
+    'stop-intake',
+    'flush'
+];
+/**
+ * How long one hook may take before the drain moves on without it.
+ *
+ * Not belt-and-braces. Kubernetes sends SIGKILL at the end of
+ * `terminationGracePeriodSeconds` whatever the process is doing, so an
+ * unbounded hook does not buy time — it spends the budget of the hooks behind
+ * it and then loses them entirely. A hook that cannot finish in time has
+ * already failed; the difference is whether the *next* one gets to run.
+ */ const HOOK_TIMEOUT = '10 seconds';
+/**
+ * DI tag for the shutdown registry.
+ *
+ * In the contract layer beside `HealthRegistryTag` so an
+ * `entifix-ts-*-client` package can register a hook without depending on a
+ * shell.
+ */ export class ShutdownRegistryTag extends Context.Tag('ShutdownRegistryTag')() {
+}
+/**
+ * Runs one hook and swallows whatever it does.
+ *
+ * A failure and a timeout are logged the same way on purpose: both mean this
+ * hook did not do its job, both leave the ones behind it still worth running,
+ * and neither is something a terminating process can act on. `Cause.pretty`
+ * keeps them distinguishable in Loki, where someone reading them actually is.
+ */ const runHook = (hook)=>hook.run.pipe(Effect.timeout(HOOK_TIMEOUT), Effect.catchAllCause((cause)=>Effect.logError('shutdown hook did not complete').pipe(// Annotations, not a rendered message: the tooling logger emits these
+        // as structured fields, so which hook stalled a rollout is queryable.
+        Effect.annotateLogs({
+            hook: hook.name,
+            phase: hook.phase,
+            cause: Cause.pretty(cause)
+        }))));
+/**
+ * Builds the registry and the synchronous latch that flips it.
+ *
+ * Two halves for two callers, the `makeAmqpConnector` shape: the
+ * `registry` goes into the layer graph, while `begin` is called from a
+ * `process.on('SIGTERM')` handler — outside Effect, in the same tick the
+ * runtime starts interrupting — so `/api/health/ready` stops claiming to be
+ * ready the instant the signal lands rather than whenever the finalizers get
+ * around to running.
+ */ export const makeShutdownRegistry = ()=>{
+    const hooks = [];
+    let terminating = false;
+    const registry = {
+        register: (hook)=>Effect.sync(()=>{
+                hooks.push(hook);
+            }),
+        terminating: Effect.sync(()=>terminating),
+        drain: Effect.gen(function*() {
+            terminating = true;
+            yield* Effect.logInfo('draining before shutdown').pipe(Effect.annotateLogs({
+                hooks: hooks.length
+            }));
+            for (const phase of SHUTDOWN_PHASES){
+                // Sequential, and in registration order: `stop-intake` before `flush`
+                // is the whole contract, and within a phase a later hook may depend on
+                // an earlier one having stopped.
+                yield* Effect.forEach(hooks.filter((hook)=>hook.phase === phase), runHook, {
+                    discard: true
+                });
+            }
+            yield* Effect.logInfo('drained');
+        })
+    };
+    return {
+        registry,
+        begin: ()=>{
+            terminating = true;
+        }
+    };
+};
+
+//# sourceMappingURL=shutdown-registry.js.map

package/dist/shutdown/shutdown-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/shutdown/shutdown-registry.ts"],"sourcesContent":["import { Cause, Context, Effect } from 'effect';\n\n/**\n * The order a shutdown runs in (ADR 0030).\n *\n * **`stop-intake`** stops the process taking new work — cancelling the bus's\n * consumers, interrupting a polling daemon. **`flush`** carries out what is\n * already committed but not yet delivered: the outbox relay's final pass. The\n * two are separate phases rather than one list because they are ordered against\n * each other and not merely against the connections closing — flushing while\n * consumers are still folding events would race a drain against fresh work, and\n * the relay would go on finding entries the handlers keep writing.\n */\nexport const SHUTDOWN_PHASES = ['stop-intake', 'flush'] as const;\n\nexport type ShutdownPhase = (typeof SHUTDOWN_PHASES)[number];\n\n/**\n * One thing to do before this process's connections close.\n *\n * `run` is fully applied, exactly like `HealthProbe.check`: whoever\n * registers the hook has already closed over the connector, the fiber or the\n * store, so the drain can run every hook without knowing what any of them\n * touches.\n */\nexport interface ShutdownHook {\n  /** Logged when the hook runs, and when it fails. Never rendered to a caller. */\n  readonly name: string;\n  readonly phase: ShutdownPhase;\n  readonly run: Effect.Effect<void>;\n}\n\n/**\n * How long one hook may take before the drain moves on without it.\n *\n * Not belt-and-braces. Kubernetes sends SIGKILL at the end of\n * `terminationGracePeriodSeconds` whatever the process is doing, so an\n * unbounded hook does not buy time — it spends the budget of the hooks behind\n * it and then loses them entirely. A hook that cannot finish in time has\n * already failed; the difference is whether the *next* one gets to run.\n */\nconst HOOK_TIMEOUT = '10 seconds';\n\n/**\n * What a service does on its way out, registered by whoever opened the thing\n * that needs draining.\n *\n * A sibling of `HealthRegistry` and `WiringRegistry`, and for the same reason:\n * a `-service` that gains a bus gains its consumer drain by merging that\n * adapter's layer, and nothing in the service's own `main.ts` has to remember\n * to list it. A hand-written sequence per composition root drifts the first\n * time someone adds a dependency; this cannot, because the hook ships with the\n * client that needs it.\n */\nexport interface ShutdownRegistry {\n  /** Add a hook. Called by an adapter layer as it constructs its client. */\n  readonly register: (hook: ShutdownHook) => Effect.Effect<void>;\n  /**\n   * Whether this process has begun terminating.\n   *\n   * Read by `GET /api/health/ready`, which answers `503` from here **before**\n   * it consults any probe: nothing is failing, the process is leaving.\n   */\n  readonly terminating: Effect.Effect<boolean>;\n  /**\n   * Run every hook, phase by phase, in registration order. Never fails.\n   *\n   * Called from a `Layer` finalizer, which is what orders it: the drain layer\n   * is built after the composition root, so it is released before it, and the\n   * connections a hook needs are still open while it runs.\n   */\n  readonly drain: Effect.Effect<void>;\n}\n\n/**\n * DI tag for the shutdown registry.\n *\n * In the contract layer beside `HealthRegistryTag` so an\n * `entifix-ts-*-client` package can register a hook without depending on a\n * shell.\n */\nexport class ShutdownRegistryTag extends Context.Tag('ShutdownRegistryTag')<\n  ShutdownRegistryTag,\n  ShutdownRegistry\n>() {}\n\n/**\n * Runs one hook and swallows whatever it does.\n *\n * A failure and a timeout are logged the same way on purpose: both mean this\n * hook did not do its job, both leave the ones behind it still worth running,\n * and neither is something a terminating process can act on. `Cause.pretty`\n * keeps them distinguishable in Loki, where someone reading them actually is.\n */\nconst runHook = (hook: ShutdownHook): Effect.Effect<void> =>\n  hook.run.pipe(\n    Effect.timeout(HOOK_TIMEOUT),\n    Effect.catchAllCause(cause =>\n      Effect.logError('shutdown hook did not complete').pipe(\n        // Annotations, not a rendered message: the tooling logger emits these\n        // as structured fields, so which hook stalled a rollout is queryable.\n        Effect.annotateLogs({\n          hook: hook.name,\n          phase: hook.phase,\n          cause: Cause.pretty(cause),\n        }),\n      ),\n    ),\n  );\n\n/**\n * Builds the registry and the synchronous latch that flips it.\n *\n * Two halves for two callers, the `makeAmqpConnector` shape: the\n * `registry` goes into the layer graph, while `begin` is called from a\n * `process.on('SIGTERM')` handler — outside Effect, in the same tick the\n * runtime starts interrupting — so `/api/health/ready` stops claiming to be\n * ready the instant the signal lands rather than whenever the finalizers get\n * around to running.\n */\nexport const makeShutdownRegistry = (): {\n  registry: ShutdownRegistry;\n  begin: () => void;\n} => {\n  const hooks: ShutdownHook[] = [];\n  let terminating = false;\n\n  const registry: ShutdownRegistry = {\n    register: hook =>\n      Effect.sync(() => {\n        hooks.push(hook);\n      }),\n\n    terminating: Effect.sync(() => terminating),\n\n    drain: Effect.gen(function* () {\n      terminating = true;\n      yield* Effect.logInfo('draining before shutdown').pipe(\n        Effect.annotateLogs({ hooks: hooks.length }),\n      );\n      for (const phase of SHUTDOWN_PHASES) {\n        // Sequential, and in registration order: `stop-intake` before `flush`\n        // is the whole contract, and within a phase a later hook may depend on\n        // an earlier one having stopped.\n        yield* Effect.forEach(\n          hooks.filter(hook => hook.phase === phase),\n          runHook,\n          { discard: true },\n        );\n      }\n      yield* Effect.logInfo('drained');\n    }),\n  };\n\n  return {\n    registry,\n    begin: () => {\n      terminating = true;\n    },\n  };\n};\n"],"names":["Cause","Context","Effect","SHUTDOWN_PHASES","HOOK_TIMEOUT","ShutdownRegistryTag","Tag","runHook","hook","run","pipe","timeout","catchAllCause","cause","logError","annotateLogs","name","phase","pretty","makeShutdownRegistry","hooks","terminating","registry","register","sync","push","drain","gen","logInfo","length","forEach","filter","discard","begin"],"mappings":"AAAA,SAASA,KAAK,EAAEC,OAAO,EAAEC,MAAM,QAAQ,SAAS;AAEhD;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,kBAAkB;IAAC;IAAe;CAAQ,CAAU;AAmBjE;;;;;;;;CAQC,GACD,MAAMC,eAAe;AAiCrB;;;;;;CAMC,GACD,OAAO,MAAMC,4BAA4BJ,QAAQK,GAAG,CAAC;AAGhD;AAEL;;;;;;;CAOC,GACD,MAAMC,UAAU,CAACC,OACfA,KAAKC,GAAG,CAACC,IAAI,CACXR,OAAOS,OAAO,CAACP,eACfF,OAAOU,aAAa,CAACC,CAAAA,QACnBX,OAAOY,QAAQ,CAAC,kCAAkCJ,IAAI,CACpD,sEAAsE;QACtE,sEAAsE;QACtER,OAAOa,YAAY,CAAC;YAClBP,MAAMA,KAAKQ,IAAI;YACfC,OAAOT,KAAKS,KAAK;YACjBJ,OAAOb,MAAMkB,MAAM,CAACL;QACtB;AAKR;;;;;;;;;CASC,GACD,OAAO,MAAMM,uBAAuB;IAIlC,MAAMC,QAAwB,EAAE;IAChC,IAAIC,cAAc;IAElB,MAAMC,WAA6B;QACjCC,UAAUf,CAAAA,OACRN,OAAOsB,IAAI,CAAC;gBACVJ,MAAMK,IAAI,CAACjB;YACb;QAEFa,aAAanB,OAAOsB,IAAI,CAAC,IAAMH;QAE/BK,OAAOxB,OAAOyB,GAAG,CAAC;YAChBN,cAAc;YACd,OAAOnB,OAAO0B,OAAO,CAAC,4BAA4BlB,IAAI,CACpDR,OAAOa,YAAY,CAAC;gBAAEK,OAAOA,MAAMS,MAAM;YAAC;YAE5C,KAAK,MAAMZ,SAASd,gBAAiB;gBACnC,sEAAsE;gBACtE,uEAAuE;gBACvE,iCAAiC;gBACjC,OAAOD,OAAO4B,OAAO,CACnBV,MAAMW,MAAM,CAACvB,CAAAA,OAAQA,KAAKS,KAAK,KAAKA,QACpCV,SACA;oBAAEyB,SAAS;gBAAK;YAEpB;YACA,OAAO9B,OAAO0B,OAAO,CAAC;QACxB;IACF;IAEA,OAAO;QACLN;QACAW,OAAO;YACLZ,cAAc;QAChB;IACF;AACF,EAAE"}

package/dist/tenancy/index.d.ts

@@ -0,0 +1,2 @@
+export * from './tenant-database-resolver.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/tenancy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tenancy/index.ts"],"names":[],"mappings":"AAAA,cAAc,+BAA+B,CAAC"}

package/dist/tenancy/index.js

@@ -0,0 +1,3 @@
+export * from './tenant-database-resolver.js';
+
+//# sourceMappingURL=index.js.map

package/dist/tenancy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/tenancy/index.ts"],"sourcesContent":["export * from './tenant-database-resolver.js';\n"],"names":[],"mappings":"AAAA,cAAc,gCAAgC"}

package/dist/tenancy/tenant-database-resolver.d.ts

@@ -0,0 +1,38 @@
+import type { EntifixConnError } from '@entifix/core';
+import { Context, type Effect } from 'effect';
+/**
+ * Resolves the storage handle for one organization.
+ *
+ * The seam the whole tenancy model turns on. Business entities carry no
+ * `organizationId` and no tenant filter, so isolation is *which handle a request
+ * resolves to* — which means no query can leak by omission, because there is no
+ * column to forget.
+ *
+ * Two rules the implementations must keep:
+ *
+ * - **Resolve per request, never per `Layer`.** The connection pool is acquired
+ *   once at boot (`MongoDatabaseLayer`'s `Layer.scoped`); a handle is not a
+ *   connection. Building a `Layer` per request would rebuild the pool per
+ *   request.
+ * - **Derive the storage name from the organization id**, never from a mutable
+ *   attribute such as a slug, so renaming an organization can never strand its
+ *   data.
+ *
+ * `THandle` is the datastore's own handle type (`Db` for Mongo). Keeping it
+ * generic is what lets a Postgres adapter — where the same idea is a schema on
+ * a shared pool rather than a separate database — satisfy the same port without
+ * a call-site change.
+ */
+export interface TenantDatabaseResolver<THandle> {
+    readonly forOrganization: (organizationId: string) => Effect.Effect<THandle, EntifixConnError>;
+}
+declare const TenantDatabaseResolverTag_base: Context.TagClass<TenantDatabaseResolverTag, "TenantDatabaseResolverTag", TenantDatabaseResolver<unknown>>;
+/**
+ * DI tag for the resolver. Declared with an `unknown` handle because the tag is
+ * datastore-agnostic; a service narrows it at the composition root, where it
+ * also knows which driver it provided.
+ */
+export declare class TenantDatabaseResolverTag extends TenantDatabaseResolverTag_base {
+}
+export {};
+//# sourceMappingURL=tenant-database-resolver.d.ts.map

package/dist/tenancy/tenant-database-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-database-resolver.d.ts","sourceRoot":"","sources":["../../src/tenancy/tenant-database-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,sBAAsB,CAAC,OAAO;IAC7C,QAAQ,CAAC,eAAe,EAAE,CACxB,cAAc,EAAE,MAAM,KACnB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;CAC/C;;AAED;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,8BAEgB;CAAG"}

package/dist/tenancy/tenant-database-resolver.js

@@ -0,0 +1,9 @@
+import { Context } from 'effect';
+/**
+ * DI tag for the resolver. Declared with an `unknown` handle because the tag is
+ * datastore-agnostic; a service narrows it at the composition root, where it
+ * also knows which driver it provided.
+ */ export class TenantDatabaseResolverTag extends Context.Tag('TenantDatabaseResolverTag')() {
+}
+
+//# sourceMappingURL=tenant-database-resolver.js.map

package/dist/tenancy/tenant-database-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/tenancy/tenant-database-resolver.ts"],"sourcesContent":["import type { EntifixConnError } from '@entifix/core';\nimport { Context, type Effect } from 'effect';\n\n/**\n * Resolves the storage handle for one organization.\n *\n * The seam the whole tenancy model turns on. Business entities carry no\n * `organizationId` and no tenant filter, so isolation is *which handle a request\n * resolves to* — which means no query can leak by omission, because there is no\n * column to forget.\n *\n * Two rules the implementations must keep:\n *\n * - **Resolve per request, never per `Layer`.** The connection pool is acquired\n *   once at boot (`MongoDatabaseLayer`'s `Layer.scoped`); a handle is not a\n *   connection. Building a `Layer` per request would rebuild the pool per\n *   request.\n * - **Derive the storage name from the organization id**, never from a mutable\n *   attribute such as a slug, so renaming an organization can never strand its\n *   data.\n *\n * `THandle` is the datastore's own handle type (`Db` for Mongo). Keeping it\n * generic is what lets a Postgres adapter — where the same idea is a schema on\n * a shared pool rather than a separate database — satisfy the same port without\n * a call-site change.\n */\nexport interface TenantDatabaseResolver<THandle> {\n  readonly forOrganization: (\n    organizationId: string,\n  ) => Effect.Effect<THandle, EntifixConnError>;\n}\n\n/**\n * DI tag for the resolver. Declared with an `unknown` handle because the tag is\n * datastore-agnostic; a service narrows it at the composition root, where it\n * also knows which driver it provided.\n */\nexport class TenantDatabaseResolverTag extends Context.Tag(\n  'TenantDatabaseResolverTag',\n)<TenantDatabaseResolverTag, TenantDatabaseResolver<unknown>>() {}\n"],"names":["Context","TenantDatabaseResolverTag","Tag"],"mappings":"AACA,SAASA,OAAO,QAAqB,SAAS;AA+B9C;;;;CAIC,GACD,OAAO,MAAMC,kCAAkCD,QAAQE,GAAG,CACxD;AAC+D"}

package/dist/tokens/token-service.d.ts

@@ -0,0 +1,101 @@
+import type { EntifixError, EntityId } from '@entifix/core';
+import { Context } from 'effect';
+import { Effect } from 'effect/Effect';
+/**
+ * The claims a stateless access token carries between the perimeter that mints
+ * it and the services that verify it. Kept small on purpose: everything here is
+ * copied into every request and can only refresh when a new token is minted, so
+ * only authorization-critical, stable subject data belongs in it. Richer or
+ * volatile state stays in the session record and is read on demand.
+ */
+export interface TokenClaims {
+    /** Canonical user id — the value services key their data against. */
+    readonly userId: EntityId;
+    /** Upstream identity subject that authenticated the session. */
+    readonly subject: string;
+    /** The session id the token was minted from; the revocation linkage. */
+    readonly sessionId: string;
+    readonly roles: readonly string[];
+    /**
+     * The organization this session is acting for, and the value every
+     * tenant-plane storage handle is resolved from.
+     *
+     * A property of the **session**, not of the user: a party may hold several
+     * memberships, and switching re-mints the token. Absent for a session with no
+     * organization — a buyer, or an operator, who holds no tenant scope at all.
+     *
+     * Note this is a *routing* key, not an authorization input. Grants still come
+     * from `roles` resolved at the consumer.
+     */
+    readonly activeOrganizationId?: string;
+    /**
+     * Which population the session belongs to — a buyer, a vendor's staff, or
+     * platform staff. Typed as a plain string here because the closed set lives
+     * in the business layer (`PartyRoles` in `business-ts-party-management`),
+     * which this layer may not import; consumers narrow it, exactly as they
+     * already do for `roles`.
+     *
+     * It exists because the alternative was inferring it from an *absent*
+     * `activeOrganizationId`, which cannot tell a buyer from an operator — two
+     * populations whose reach differs enormously. A capability that sensitive
+     * must not be signalled by a missing field.
+     *
+     * Like `activeOrganizationId` this is routing/context, not a grant: what a
+     * principal may do still comes from `roles` resolved at the consumer.
+     */
+    readonly partyRole?: string;
+    /**
+     * The party behind the account — the `Individual` id that domains recording a
+     * party key against, and the value a `ProductOrder.buyerId` holds.
+     *
+     * It is carried because the hop from an account to a party exists in exactly
+     * one store, the one that mints this token. A service scoping a read to the
+     * caller's own records needs the party and cannot derive it from
+     * {@link TokenClaims.userId} without reading another slice's collections.
+     *
+     * Absent for an account with no party record. A consumer must read the
+     * absence as *no party* — scoping to nothing — never as *any party*.
+     *
+     * Like `activeOrganizationId` and `partyRole` this is context, not a grant:
+     * it says whose records these are, never what may be done with them.
+     */
+    readonly partyId?: string;
+    /**
+     * The business domains the acting organization is provisioned for — the
+     * second assignment ceiling (ADR 0007), carried so a server-rendered menu can
+     * shape itself without a lookup on every render.
+     *
+     * Absent for a session with no organization, and that is **not** the same as
+     * an empty list: an operator holds no tenant scope, so the ceiling does not
+     * apply at all, while a member of an organization provisioned for nothing is
+     * entitled to nothing. Consumers therefore decide from
+     * {@link TokenClaims.activeOrganizationId} whether to consult this at all.
+     *
+     * Plain strings for the same reason `roles` is: the domain names live in the
+     * business layer, which this one may not import.
+     *
+     * Like `activeOrganizationId` and `partyRole` this is context, not a grant.
+     */
+    readonly entitlements?: readonly string[];
+    /** Room for a few extra stable claims without a type change. */
+    readonly [key: string]: unknown;
+}
+/**
+ * Signs and verifies short-lived access tokens. The perimeter provides it to
+ * mint a token from a resolved session; every downstream service provides it to
+ * verify one statelessly (no store round trip on the hot path). Vendor-neutral:
+ * a `jose`/HS256 adapter backs it now, an RS256/JWKS one can later without
+ * touching a consumer.
+ */
+export interface TokenService {
+    /** Sign the claims into a compact token that expires after `ttlSeconds`. */
+    sign(claims: TokenClaims, ttlSeconds: number): Effect<string, EntifixError>;
+    /** Verify signature + expiry and return the claims, or fail. */
+    verify(token: string): Effect<TokenClaims, EntifixError>;
+}
+declare const TokenServiceTag_base: Context.TagClass<TokenServiceTag, "TokenServiceTag", TokenService>;
+/** DI tag the composition root binds to a concrete {@link TokenService}. */
+export declare class TokenServiceTag extends TokenServiceTag_base {
+}
+export {};
+//# sourceMappingURL=token-service.d.ts.map

package/dist/tokens/token-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-service.d.ts","sourceRoot":"","sources":["../../src/tokens/token-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,gEAAgE;IAChE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5E,gEAAgE;IAChE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;CAC1D;;AAED,4EAA4E;AAC5E,qBAAa,eAAgB,SAAQ,oBAGlC;CAAG"}

package/dist/tokens/token-service.js

@@ -0,0 +1,5 @@
+import { Context } from 'effect';
+/** DI tag the composition root binds to a concrete {@link TokenService}. */ export class TokenServiceTag extends Context.Tag('TokenServiceTag')() {
+}
+
+//# sourceMappingURL=token-service.js.map

package/dist/tokens/token-service.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/tokens/token-service.ts"],"sourcesContent":["import type { EntifixError, EntityId } from '@entifix/core';\nimport { Context } from 'effect';\nimport { Effect } from 'effect/Effect';\n\n/**\n * The claims a stateless access token carries between the perimeter that mints\n * it and the services that verify it. Kept small on purpose: everything here is\n * copied into every request and can only refresh when a new token is minted, so\n * only authorization-critical, stable subject data belongs in it. Richer or\n * volatile state stays in the session record and is read on demand.\n */\nexport interface TokenClaims {\n  /** Canonical user id — the value services key their data against. */\n  readonly userId: EntityId;\n  /** Upstream identity subject that authenticated the session. */\n  readonly subject: string;\n  /** The session id the token was minted from; the revocation linkage. */\n  readonly sessionId: string;\n  readonly roles: readonly string[];\n  /**\n   * The organization this session is acting for, and the value every\n   * tenant-plane storage handle is resolved from.\n   *\n   * A property of the **session**, not of the user: a party may hold several\n   * memberships, and switching re-mints the token. Absent for a session with no\n   * organization — a buyer, or an operator, who holds no tenant scope at all.\n   *\n   * Note this is a *routing* key, not an authorization input. Grants still come\n   * from `roles` resolved at the consumer.\n   */\n  readonly activeOrganizationId?: string;\n  /**\n   * Which population the session belongs to — a buyer, a vendor's staff, or\n   * platform staff. Typed as a plain string here because the closed set lives\n   * in the business layer (`PartyRoles` in `business-ts-party-management`),\n   * which this layer may not import; consumers narrow it, exactly as they\n   * already do for `roles`.\n   *\n   * It exists because the alternative was inferring it from an *absent*\n   * `activeOrganizationId`, which cannot tell a buyer from an operator — two\n   * populations whose reach differs enormously. A capability that sensitive\n   * must not be signalled by a missing field.\n   *\n   * Like `activeOrganizationId` this is routing/context, not a grant: what a\n   * principal may do still comes from `roles` resolved at the consumer.\n   */\n  readonly partyRole?: string;\n  /**\n   * The party behind the account — the `Individual` id that domains recording a\n   * party key against, and the value a `ProductOrder.buyerId` holds.\n   *\n   * It is carried because the hop from an account to a party exists in exactly\n   * one store, the one that mints this token. A service scoping a read to the\n   * caller's own records needs the party and cannot derive it from\n   * {@link TokenClaims.userId} without reading another slice's collections.\n   *\n   * Absent for an account with no party record. A consumer must read the\n   * absence as *no party* — scoping to nothing — never as *any party*.\n   *\n   * Like `activeOrganizationId` and `partyRole` this is context, not a grant:\n   * it says whose records these are, never what may be done with them.\n   */\n  readonly partyId?: string;\n  /**\n   * The business domains the acting organization is provisioned for — the\n   * second assignment ceiling (ADR 0007), carried so a server-rendered menu can\n   * shape itself without a lookup on every render.\n   *\n   * Absent for a session with no organization, and that is **not** the same as\n   * an empty list: an operator holds no tenant scope, so the ceiling does not\n   * apply at all, while a member of an organization provisioned for nothing is\n   * entitled to nothing. Consumers therefore decide from\n   * {@link TokenClaims.activeOrganizationId} whether to consult this at all.\n   *\n   * Plain strings for the same reason `roles` is: the domain names live in the\n   * business layer, which this one may not import.\n   *\n   * Like `activeOrganizationId` and `partyRole` this is context, not a grant.\n   */\n  readonly entitlements?: readonly string[];\n  /** Room for a few extra stable claims without a type change. */\n  readonly [key: string]: unknown;\n}\n\n/**\n * Signs and verifies short-lived access tokens. The perimeter provides it to\n * mint a token from a resolved session; every downstream service provides it to\n * verify one statelessly (no store round trip on the hot path). Vendor-neutral:\n * a `jose`/HS256 adapter backs it now, an RS256/JWKS one can later without\n * touching a consumer.\n */\nexport interface TokenService {\n  /** Sign the claims into a compact token that expires after `ttlSeconds`. */\n  sign(claims: TokenClaims, ttlSeconds: number): Effect<string, EntifixError>;\n  /** Verify signature + expiry and return the claims, or fail. */\n  verify(token: string): Effect<TokenClaims, EntifixError>;\n}\n\n/** DI tag the composition root binds to a concrete {@link TokenService}. */\nexport class TokenServiceTag extends Context.Tag('TokenServiceTag')<\n  TokenServiceTag,\n  TokenService\n>() {}\n"],"names":["Context","TokenServiceTag","Tag"],"mappings":"AACA,SAASA,OAAO,QAAQ,SAAS;AAiGjC,0EAA0E,GAC1E,OAAO,MAAMC,wBAAwBD,QAAQE,GAAG,CAAC;AAG5C"}

package/dist/use-case/delete/delete.uc.d.ts

@@ -0,0 +1,13 @@
+import { Entity } from '@entifix/core';
+import { Effect } from 'effect';
+import { EntityRepositoryTag } from '../../repository/entity.repository.js';
+import { EntityIdTag } from '../../repository/entity-mixins.repository.js';
+/**
+ * Deletes an entity by id.
+ *
+ * The repository contract also accepts a whole entity, but deleting by id is
+ * the only shape a caller ever has at the point of deletion (a table row, a
+ * route param), so that is what this exposes.
+ */
+export declare function deleteUCFactory<TEntity extends Entity>(): Effect.Effect<void, import("@entifix/core").EntifixError, import("../../index.js").ConfigurationRepositoryTag | EntityRepositoryTag | EntityIdTag>;
+//# sourceMappingURL=delete.uc.d.ts.map

package/dist/use-case/delete/delete.uc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.uc.d.ts","sourceRoot":"","sources":["../../../src/use-case/delete/delete.uc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAC;AAE3E;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,SAAS,MAAM,wJAOrD"}

package/dist/use-case/delete/delete.uc.js

@@ -0,0 +1,18 @@
+import { Effect } from 'effect';
+import { EntityRepositoryTag } from '../../repository/entity.repository.js';
+import { EntityIdTag } from '../../repository/entity-mixins.repository.js';
+/**
+ * Deletes an entity by id.
+ *
+ * The repository contract also accepts a whole entity, but deleting by id is
+ * the only shape a caller ever has at the point of deletion (a table row, a
+ * route param), so that is what this exposes.
+ */ export function deleteUCFactory() {
+    return Effect.gen(function*() {
+        const entityRepository = yield* EntityRepositoryTag;
+        const entityId = yield* EntityIdTag;
+        yield* entityRepository.delete(entityId);
+    });
+}
+
+//# sourceMappingURL=delete.uc.js.map

package/dist/use-case/delete/delete.uc.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/use-case/delete/delete.uc.ts"],"sourcesContent":["import { Entity } from '@entifix/core';\nimport { Effect } from 'effect';\n\nimport { EntityRepositoryTag } from '../../repository/entity.repository.js';\nimport { EntityIdTag } from '../../repository/entity-mixins.repository.js';\n\n/**\n * Deletes an entity by id.\n *\n * The repository contract also accepts a whole entity, but deleting by id is\n * the only shape a caller ever has at the point of deletion (a table row, a\n * route param), so that is what this exposes.\n */\nexport function deleteUCFactory<TEntity extends Entity>() {\n  return Effect.gen(function* () {\n    const entityRepository = yield* EntityRepositoryTag;\n    const entityId = yield* EntityIdTag;\n\n    yield* entityRepository.delete<TEntity>(entityId);\n  });\n}\n"],"names":["Effect","EntityRepositoryTag","EntityIdTag","deleteUCFactory","gen","entityRepository","entityId","delete"],"mappings":"AACA,SAASA,MAAM,QAAQ,SAAS;AAEhC,SAASC,mBAAmB,QAAQ,wCAAwC;AAC5E,SAASC,WAAW,QAAQ,+CAA+C;AAE3E;;;;;;CAMC,GACD,OAAO,SAASC;IACd,OAAOH,OAAOI,GAAG,CAAC;QAChB,MAAMC,mBAAmB,OAAOJ;QAChC,MAAMK,WAAW,OAAOJ;QAExB,OAAOG,iBAAiBE,MAAM,CAAUD;IAC1C;AACF"}

package/dist/use-case/delete/index.d.ts

@@ -0,0 +1,2 @@
+export * from './delete.uc.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/use-case/delete/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/use-case/delete/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC"}

package/dist/use-case/delete/index.js

@@ -0,0 +1,3 @@
+export * from './delete.uc.js';
+
+//# sourceMappingURL=index.js.map