@hilbras/keystone 1.1.0

package/dist/services/domain/authorization.d.ts

@@ -0,0 +1,20 @@
+import type { OrgMembership } from "../../db/schema.js";
+import type { OrganizationRepository, PermissionRepository } from "../../repositories/types.js";
+import { type Result } from "../../lib/result.js";
+export interface PermissionInput {
+    resource: string;
+    action: string;
+}
+export { type PermissionInput as PermissionRequirement };
+export type OrgRole = "owner" | "admin" | "member";
+export declare class AuthorizationDomainService {
+    private readonly organizations;
+    private readonly permissions;
+    constructor(organizations: OrganizationRepository, permissions: PermissionRepository);
+    requirePermission(role: string, resource: string, action: string): Promise<Result<void>>;
+    hasPermission(role: string, resource: string, action: string): Promise<boolean>;
+    hasAnyPermission(role: string, required: PermissionInput[]): Promise<boolean>;
+    requireOrgRole(userId: string, orgId: string, allowedRoles: OrgRole[]): Promise<Result<OrgMembership>>;
+    isOrgMember(userId: string, orgId: string): Promise<OrgMembership | undefined>;
+}
+//# sourceMappingURL=authorization.d.ts.map

package/dist/services/domain/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAChG,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,OAAO,EAAE,KAAK,eAAe,IAAI,qBAAqB,EAAE,CAAC;AACzD,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,qBAAa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,aAAa,EAAE,sBAAsB,EACrC,WAAW,EAAE,oBAAoB;IAG9C,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAQxF,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAWtG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;CAGrF"}

package/dist/services/domain/authorization.js

@@ -0,0 +1,36 @@
+import { ok, err } from "../../lib/result.js";
+export class AuthorizationDomainService {
+    organizations;
+    permissions;
+    constructor(organizations, permissions) {
+        this.organizations = organizations;
+        this.permissions = permissions;
+    }
+    async requirePermission(role, resource, action) {
+        const allowed = await this.permissions.hasPermission(role, resource, action);
+        if (!allowed) {
+            return err({ code: "FORBIDDEN", message: `Missing permission ${resource}:${action}`, statusCode: 403 });
+        }
+        return ok(undefined);
+    }
+    async hasPermission(role, resource, action) {
+        return this.permissions.hasPermission(role, resource, action);
+    }
+    async hasAnyPermission(role, required) {
+        return this.permissions.hasAnyPermission(role, required);
+    }
+    async requireOrgRole(userId, orgId, allowedRoles) {
+        const membership = await this.organizations.findMembership(orgId, userId);
+        if (!membership) {
+            return err({ code: "NOT_MEMBER", message: "Not a member of this organization", statusCode: 403 });
+        }
+        if (!allowedRoles.includes(membership.role)) {
+            return err({ code: "INSUFFICIENT_ROLE", message: "Insufficient organization permissions", statusCode: 403 });
+        }
+        return ok(membership);
+    }
+    async isOrgMember(userId, orgId) {
+        return this.organizations.findMembership(orgId, userId);
+    }
+}
+//# sourceMappingURL=authorization.js.map

package/dist/services/domain/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../src/services/domain/authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAU3D,MAAM,OAAO,0BAA0B;IAElB;IACA;IAFnB,YACmB,aAAqC,EACrC,WAAiC;QADjC,kBAAa,GAAb,aAAa,CAAwB;QACrC,gBAAW,GAAX,WAAW,CAAsB;IACjD,CAAC;IAEJ,KAAK,CAAC,iBAAiB,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,QAAQ,IAAI,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAChE,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,QAA2B;QAC9D,OAAO,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,KAAa,EAAE,YAAuB;QACzE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mCAAmC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAe,CAAC,EAAE,CAAC;YACvD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,uCAAuC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/services/domain/identity.d.ts

@@ -0,0 +1,43 @@
+import type { User } from "../../db/schema.js";
+import type { UserRepository, IdentityRepository } from "../../repositories/types.js";
+import type { TokenSet } from "../tokens.js";
+import { type Result } from "../../lib/result.js";
+export declare class IdentityDomainService {
+    private readonly users;
+    private readonly identities;
+    constructor(users: UserRepository, identities: IdentityRepository);
+    findUser(id: string): Promise<Result<User>>;
+    findUserByEmail(email: string): Promise<Result<User>>;
+    upsertInvitedUser(input: {
+        email: string;
+        name?: string;
+        username?: string;
+    }): Promise<Result<User>>;
+    updateUserProfile(userId: string, updates: Partial<{
+        name: string;
+        username: string;
+        role: string;
+        emailVerified: boolean;
+    }>): Promise<Result<User>>;
+    deactivate(userId: string): Promise<Result<void>>;
+    listOrganizationUsers(orgId: string): Promise<User[]>;
+    touchLastSeen(userId: string): Promise<void>;
+    linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
+    getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{
+        url: string;
+    }>>;
+    completeFederationLogin(provider: string, code: string, redirectUri: string): Promise<Result<{
+        user: User;
+        tokens: {
+            accessToken: string;
+            refreshToken: string;
+        };
+    }>>;
+    issueLocalTokenSet(user: User, opts?: {
+        appId?: string;
+        orgId?: string;
+        clientId?: string;
+        deviceFingerprint?: string;
+    }): Promise<TokenSet>;
+}
+//# sourceMappingURL=identity.d.ts.map

package/dist/services/domain/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/services/domain/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE3D,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,kBAAkB;IAG3C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAM3C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAMrD,iBAAiB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBpG,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,GACzF,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAMlB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKjD,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAIrD,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKlB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAKjH,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IASnF,kBAAkB,CACtB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GACA,OAAO,CAAC,QAAQ,CAAC;CAGrB"}

package/dist/services/domain/identity.js

@@ -0,0 +1,75 @@
+import { createTokenSet } from "../tokens.js";
+import { emit } from "../events/bus.js";
+import { getFederationAuthorizeUrl as getFederationAuthorizeUrlService, completeFederationLogin as completeFederationLoginService } from "../federation.js";
+import { ok, err } from "../../lib/result.js";
+export class IdentityDomainService {
+    users;
+    identities;
+    constructor(users, identities) {
+        this.users = users;
+        this.identities = identities;
+    }
+    async findUser(id) {
+        const user = await this.users.findById(id);
+        if (!user)
+            return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+        return ok(user);
+    }
+    async findUserByEmail(email) {
+        const user = await this.users.findByEmail(email);
+        if (!user)
+            return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+        return ok(user);
+    }
+    async upsertInvitedUser(input) {
+        const existing = await this.users.findByEmail(input.email);
+        if (existing)
+            return ok(existing);
+        const baseUsername = input.username || input.email.split("@")[0];
+        const username = await this.users.ensureUniqueUsername(baseUsername.toLowerCase().trim().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32));
+        const user = await this.users.create({
+            email: input.email,
+            username,
+            name: input.name || username,
+            provider: "password",
+            emailVerified: false,
+        });
+        return ok(user);
+    }
+    async updateUserProfile(userId, updates) {
+        const updated = await this.users.update(userId, updates);
+        if (!updated)
+            return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+        return ok(updated);
+    }
+    async deactivate(userId) {
+        await this.users.deactivate(userId);
+        return ok(undefined);
+    }
+    async listOrganizationUsers(orgId) {
+        return this.users.listByOrg(orgId);
+    }
+    async touchLastSeen(userId) {
+        await this.users.updateLastSeen(userId);
+    }
+    async linkUserIdentity(userId, providerId, providerType, externalSub, email) {
+        await this.identities.link({ userId, providerId, providerType, externalSub, email });
+        return ok(undefined);
+    }
+    async getFederationAuthorizeUrl(provider, state, redirectUri) {
+        const url = await getFederationAuthorizeUrlService(provider, state, redirectUri);
+        return ok({ url });
+    }
+    async completeFederationLogin(provider, code, redirectUri) {
+        const result = await completeFederationLoginService(provider, code, redirectUri);
+        await emit({
+            type: "federation_login",
+            payload: { provider, userId: result.user.id, email: result.user.email },
+        });
+        return ok(result);
+    }
+    async issueLocalTokenSet(user, opts) {
+        return createTokenSet(user, undefined, undefined, opts, opts?.deviceFingerprint);
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/services/domain/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/services/domain/identity.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,yBAAyB,IAAI,gCAAgC,EAAE,uBAAuB,IAAI,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAC5J,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAE3D,MAAM,OAAO,qBAAqB;IAEb;IACA;IAFnB,YACmB,KAAqB,EACrB,UAA8B;QAD9B,UAAK,GAAL,KAAK,CAAgB;QACrB,eAAU,GAAV,UAAU,CAAoB;IAC9C,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9F,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9F,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAA0D;QAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ;YAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;QAElC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACpD,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACrG,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ;YAC5B,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,MAAc,EACd,OAA0F;QAE1F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAAa;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,UAAkB,EAClB,YAAoB,EACpB,WAAmB,EACnB,KAAc;QAEd,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACrF,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB;QAClF,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACjF,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,QAAgB,EAChB,IAAY,EACZ,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACjF,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE;SACxE,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAAU,EACV,IAKC;QAED,OAAO,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACnF,CAAC;CACF"}

package/dist/services/domain/index.d.ts

@@ -0,0 +1,5 @@
+export { AuthenticationDomainService } from "./authentication.js";
+export { AuthorizationDomainService } from "./authorization.js";
+export { IdentityDomainService } from "./identity.js";
+export { OrganizationDomainService } from "./organization.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/services/domain/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/domain/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/services/domain/index.js

@@ -0,0 +1,5 @@
+export { AuthenticationDomainService } from "./authentication.js";
+export { AuthorizationDomainService } from "./authorization.js";
+export { IdentityDomainService } from "./identity.js";
+export { OrganizationDomainService } from "./organization.js";
+//# sourceMappingURL=index.js.map

package/dist/services/domain/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/domain/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/services/domain/organization.d.ts

@@ -0,0 +1,60 @@
+import type { Organization, Application, OrgMembership } from "../../db/schema.js";
+import type { OrganizationRepository, ApplicationRepository, UserRepository } from "../../repositories/types.js";
+import { type Result } from "../../lib/result.js";
+export type OrgRole = "owner" | "admin" | "member";
+export declare class OrganizationDomainService {
+    private readonly organizations;
+    private readonly applications;
+    private readonly users?;
+    constructor(organizations: OrganizationRepository, applications: ApplicationRepository, users?: UserRepository | undefined);
+    createOrganization(input: {
+        name: string;
+        slug?: string;
+        plan?: string;
+    }, userId?: string): Promise<Result<Organization>>;
+    getOrganization(id: string): Promise<Result<Organization>>;
+    listUserOrganizations(userId: string): Promise<Organization[]>;
+    addOrgMembership(input: {
+        orgId: string;
+        userId: string;
+        role: OrgRole;
+    }): Promise<Result<OrgMembership>>;
+    getMembership(orgId: string, userId: string): Promise<Result<OrgMembership>>;
+    updateMembershipRole(orgId: string, userId: string, role: OrgRole): Promise<Result<OrgMembership>>;
+    removeMembership(orgId: string, userId: string): Promise<Result<boolean>>;
+    removeOrgMember(orgId: string, userId: string): Promise<Result<{
+        success: boolean;
+    }>>;
+    deactivateOrgUser(orgId: string, userId: string): Promise<Result<{
+        success: boolean;
+    }>>;
+    listOrgMembers(orgId: string): Promise<{
+        membership: OrgMembership;
+        user: {
+            id: string;
+            email: string;
+            username: string;
+            name: string | null;
+            avatarUrl: string | null;
+        };
+    }[]>;
+    createApplication(input: {
+        orgId: string;
+        name: string;
+        redirectUris?: string[];
+        allowedOrigins?: string[];
+    }): Promise<Result<Application & {
+        clientSecret: string;
+    }>>;
+    listOrganizationApplications(orgId: string): Promise<Application[]>;
+    updateApplication(appId: string, orgId: string, updates: Partial<{
+        name: string;
+        redirectUris: string[];
+        allowedOrigins: string[];
+        allowedIps: string[];
+        blockedIps: string[];
+        isActive: boolean;
+        branding: Record<string, unknown>;
+    }>): Promise<Result<Application>>;
+}
+//# sourceMappingURL=organization.d.ts.map

package/dist/services/domain/organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../src/services/domain/organization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEjH,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,qBAAa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAFN,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,KAAK,CAAC,EAAE,cAAc,YAAA;IAGnC,kBAAkB,CACtB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACrD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAQ1B,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAM1D,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI9D,gBAAgB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAKzG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAM5E,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAM3B,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAIzE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAYrF,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAYvF,cAAc,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;IAI5B,iBAAiB,CAAC,KAAK,EAAE;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMrD,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAInE,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,GACrL,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;CAMhC"}

package/dist/services/domain/organization.js

@@ -0,0 +1,87 @@
+import { emit } from "../events/bus.js";
+import { ok, err } from "../../lib/result.js";
+export class OrganizationDomainService {
+    organizations;
+    applications;
+    users;
+    constructor(organizations, applications, users) {
+        this.organizations = organizations;
+        this.applications = applications;
+        this.users = users;
+    }
+    async createOrganization(input, userId) {
+        const org = await this.organizations.create(input);
+        if (userId) {
+            await this.organizations.addMembership({ orgId: org.id, userId, role: "owner" });
+        }
+        return ok(org);
+    }
+    async getOrganization(id) {
+        const org = await this.organizations.findById(id);
+        if (!org)
+            return err({ code: "ORG_NOT_FOUND", message: "Organization not found", statusCode: 404 });
+        return ok(org);
+    }
+    async listUserOrganizations(userId) {
+        return this.organizations.listByUserId(userId);
+    }
+    async addOrgMembership(input) {
+        const membership = await this.organizations.addMembership(input);
+        return ok(membership);
+    }
+    async getMembership(orgId, userId) {
+        const membership = await this.organizations.findMembership(orgId, userId);
+        if (!membership)
+            return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
+        return ok(membership);
+    }
+    async updateMembershipRole(orgId, userId, role) {
+        const updated = await this.organizations.updateMembershipRole(orgId, userId, role);
+        if (!updated)
+            return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
+        return ok(updated);
+    }
+    async removeMembership(orgId, userId) {
+        return ok(await this.organizations.removeMembership(orgId, userId));
+    }
+    async removeOrgMember(orgId, userId) {
+        const membership = await this.organizations.findMembership(orgId, userId);
+        if (!membership)
+            return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
+        if (membership.role === "owner" && (await this.organizations.countOwners(orgId)) <= 1) {
+            return err({ code: "LAST_OWNER", message: "Cannot remove the last owner", statusCode: 400 });
+        }
+        await this.organizations.removeMembership(orgId, userId);
+        return ok({ success: true });
+    }
+    async deactivateOrgUser(orgId, userId) {
+        const membership = await this.organizations.findMembership(orgId, userId);
+        if (!membership) {
+            return err({ code: "MEMBERSHIP_NOT_FOUND", message: "User is not a member of this organization", statusCode: 404 });
+        }
+        if (this.users) {
+            await this.users.deactivate(userId);
+        }
+        await this.organizations.removeMembership(orgId, userId);
+        return ok({ success: true });
+    }
+    async listOrgMembers(orgId) {
+        return this.organizations.listMembers(orgId);
+    }
+    async createApplication(input) {
+        const app = await this.applications.create(input);
+        await emit({ type: "application_created", payload: { orgId: input.orgId, appId: app.id } });
+        return ok(app);
+    }
+    async listOrganizationApplications(orgId) {
+        return this.applications.listByOrgId(orgId);
+    }
+    async updateApplication(appId, orgId, updates) {
+        const updated = await this.applications.update(appId, orgId, updates);
+        if (!updated)
+            return err({ code: "APP_NOT_FOUND", message: "Application not found", statusCode: 404 });
+        await emit({ type: "application_updated", payload: { orgId, appId: updated.id } });
+        return ok(updated);
+    }
+}
+//# sourceMappingURL=organization.js.map

package/dist/services/domain/organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../../src/services/domain/organization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAI3D,MAAM,OAAO,yBAAyB;IAEjB;IACA;IACA;IAHnB,YACmB,aAAqC,EACrC,YAAmC,EACnC,KAAsB;QAFtB,kBAAa,GAAb,aAAa,CAAwB;QACrC,iBAAY,GAAZ,YAAY,CAAuB;QACnC,UAAK,GAAL,KAAK,CAAiB;IACtC,CAAC;IAEJ,KAAK,CAAC,kBAAkB,CACtB,KAAqD,EACrD,MAAe;QAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAuD;QAC5E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChH,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAa,EACb,MAAc,EACd,IAAa;QAEb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7G,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAEhH,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,8BAA8B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,MAAc;QACnD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,2CAA2C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAKvB;QACC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,KAAa;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,KAAa,EACb,OAAsL;QAEtL,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;CACF"}

package/dist/services/email.d.ts

@@ -0,0 +1,24 @@
+export interface EmailMessage {
+    to: string;
+    subject: string;
+    text: string;
+    html?: string;
+}
+export interface EmailProvider {
+    name?: string;
+    send(message: EmailMessage): Promise<void>;
+}
+export declare const emailProvider: EmailProvider;
+export declare function sendNewDeviceAlert(input: {
+    email: string;
+    ipAddress?: string;
+    userAgent?: string;
+    deviceName?: string;
+}): Promise<void>;
+export declare function sendSuspiciousLoginAlert(input: {
+    email: string;
+    ipAddress?: string;
+    userAgent?: string;
+    reason: string;
+}): Promise<void>;
+//# sourceMappingURL=email.d.ts.map

package/dist/services/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/services/email.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AA8HD,eAAO,MAAM,aAAa,eAAwB,CAAC;AAEnD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB"}

package/dist/services/email.js

@@ -0,0 +1,127 @@
+import { config } from "../config.js";
+import { getPluginEmailProvider } from "./plugins/registry.js";
+class NoOpEmailProvider {
+    async send(message) {
+        console.log("[email] no-op provider would send:", JSON.stringify(message));
+    }
+}
+class ConsoleEmailProvider {
+    async send(message) {
+        console.log("[email] console provider:");
+        console.log(`To: ${message.to}`);
+        console.log(`Subject: ${message.subject}`);
+        console.log(message.text);
+    }
+}
+class SmtpEmailProvider {
+    transporter = null;
+    async send(message) {
+        if (!this.transporter) {
+            const { createTransport } = await import("nodemailer");
+            this.transporter = createTransport({
+                host: config.SMTP_HOST,
+                port: config.SMTP_PORT,
+                secure: config.SMTP_SECURE,
+                auth: config.SMTP_USER && config.SMTP_PASS
+                    ? { user: config.SMTP_USER, pass: config.SMTP_PASS }
+                    : undefined,
+            });
+        }
+        await this.transporter.sendMail({
+            from: config.EMAIL_FROM,
+            to: message.to,
+            subject: message.subject,
+            text: message.text,
+            html: message.html,
+        });
+    }
+}
+class SendGridEmailProvider {
+    async send(message) {
+        if (!config.SENDGRID_API_KEY) {
+            throw new Error("SendGrid provider requires SENDGRID_API_KEY");
+        }
+        const response = await fetch("https://api.sendgrid.com/v3/mail/send", {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${config.SENDGRID_API_KEY}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                personalizations: [{ to: [{ email: message.to }] }],
+                from: { email: config.EMAIL_FROM },
+                subject: message.subject,
+                content: [
+                    { type: "text/plain", value: message.text },
+                    ...(message.html ? [{ type: "text/html", value: message.html }] : []),
+                ],
+            }),
+        });
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`SendGrid request failed: ${response.status} ${body}`);
+        }
+    }
+}
+class MailgunEmailProvider {
+    async send(message) {
+        if (!config.MAILGUN_API_KEY || !config.MAILGUN_DOMAIN) {
+            throw new Error("Mailgun provider requires MAILGUN_API_KEY and MAILGUN_DOMAIN");
+        }
+        const params = new URLSearchParams();
+        params.set("from", config.EMAIL_FROM);
+        params.set("to", message.to);
+        params.set("subject", message.subject);
+        params.set("text", message.text);
+        if (message.html)
+            params.set("html", message.html);
+        const response = await fetch(`https://api.mailgun.net/v3/${config.MAILGUN_DOMAIN}/messages`, {
+            method: "POST",
+            headers: {
+                Authorization: `Basic ${Buffer.from(`api:${config.MAILGUN_API_KEY}`).toString("base64")}`,
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            body: params.toString(),
+        });
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Mailgun request failed: ${response.status} ${body}`);
+        }
+    }
+}
+function createEmailProvider() {
+    const plugin = getPluginEmailProvider();
+    if (plugin)
+        return plugin;
+    const provider = config.EMAIL_PROVIDER || "none";
+    switch (provider) {
+        case "smtp":
+            return new SmtpEmailProvider();
+        case "sendgrid":
+            return new SendGridEmailProvider();
+        case "mailgun":
+            return new MailgunEmailProvider();
+        case "console":
+            return new ConsoleEmailProvider();
+        case "none":
+        default:
+            return new NoOpEmailProvider();
+    }
+}
+export const emailProvider = createEmailProvider();
+export async function sendNewDeviceAlert(input) {
+    await emailProvider.send({
+        to: input.email,
+        subject: "New sign-in from an unrecognized device",
+        text: `A new device was used to sign in to your Hilbras account.\n\nIP: ${input.ipAddress || "unknown"}\nDevice: ${input.deviceName || input.userAgent || "unknown"}\n\nIf this wasn't you, please change your password immediately.`,
+    });
+}
+export async function sendSuspiciousLoginAlert(input) {
+    await emailProvider.send({
+        to: input.email,
+        subject: "Suspicious sign-in activity detected",
+        text: `We detected suspicious sign-in activity on your Hilbras account.\n\nReason: ${input.reason}\nIP: ${input.ipAddress || "unknown"}\nDevice: ${input.userAgent || "unknown"}\n\nIf this wasn't you, please change your password immediately and review your active sessions.`,
+        html: `<p>We detected suspicious sign-in activity on your Hilbras account.</p><ul><li><strong>Reason:</strong> ${input.reason}</li><li><strong>IP:</strong> ${input.ipAddress || "unknown"}</li><li><strong>Device:</strong> ${input.userAgent || "unknown"}</li></ul><p>If this wasn't you, please change your password immediately and review your active sessions.</p>`,
+    });
+}
+//# sourceMappingURL=email.js.map

package/dist/services/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/services/email.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAc/D,MAAM,iBAAiB;IACrB,KAAK,CAAC,IAAI,CAAC,OAAqB;QAC9B,OAAO,CAAC,GAAG,CAAC,oCAAoC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,MAAM,oBAAoB;IACxB,KAAK,CAAC,IAAI,CAAC,OAAqB;QAC9B,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,iBAAiB;IACb,WAAW,GAA4C,IAAI,CAAC;IAEpE,KAAK,CAAC,IAAI,CAAC,OAAqB;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YACvD,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC;gBACjC,IAAI,EAAE,MAAM,CAAC,SAAS;gBACtB,IAAI,EAAE,MAAM,CAAC,SAAS;gBACtB,MAAM,EAAE,MAAM,CAAC,WAAW;gBAC1B,IAAI,EACF,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS;oBAClC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE;oBACpD,CAAC,CAAC,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,UAAU;YACvB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,qBAAqB;IACzB,KAAK,CAAC,IAAI,CAAC,OAAqB;QAC9B,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uCAAuC,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,CAAC,gBAAgB,EAAE;gBAClD,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBACnD,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;gBAClC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE;oBAC3C,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtE;aACF,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF;AAED,MAAM,oBAAoB;IACxB,KAAK,CAAC,IAAI,CAAC,OAAqB;QAC9B,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,8BAA8B,MAAM,CAAC,cAAc,WAAW,EAC9D;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACzF,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF;AAED,SAAS,mBAAmB;IAC1B,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAC;IACxC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC;IACjD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACjC,KAAK,UAAU;YACb,OAAO,IAAI,qBAAqB,EAAE,CAAC;QACrC,KAAK,SAAS;YACZ,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACpC,KAAK,SAAS;YACZ,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC;QACZ;YACE,OAAO,IAAI,iBAAiB,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAKxC;IACC,MAAM,aAAa,CAAC,IAAI,CAAC;QACvB,EAAE,EAAE,KAAK,CAAC,KAAK;QACf,OAAO,EAAE,yCAAyC;QAClD,IAAI,EAAE,oEAAoE,KAAK,CAAC,SAAS,IAAI,SAAS,aAAa,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,IAAI,SAAS,kEAAkE;KACtO,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAK9C;IACC,MAAM,aAAa,CAAC,IAAI,CAAC;QACvB,EAAE,EAAE,KAAK,CAAC,KAAK;QACf,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EAAE,+EAA+E,KAAK,CAAC,MAAM,SAAS,KAAK,CAAC,SAAS,IAAI,SAAS,aAAa,KAAK,CAAC,SAAS,IAAI,SAAS,kGAAkG;QACjR,IAAI,EAAE,2GAA2G,KAAK,CAAC,MAAM,iCAAiC,KAAK,CAAC,SAAS,IAAI,SAAS,qCAAqC,KAAK,CAAC,SAAS,IAAI,SAAS,+GAA+G;KAC3W,CAAC,CAAC;AACL,CAAC"}

package/dist/services/emailVerification.d.ts

@@ -0,0 +1,20 @@
+import { type User } from "../db/schema.js";
+export declare function generateVerificationToken(): {
+    token: string;
+    tokenHash: string;
+};
+export declare function storeVerificationToken(userId: string, tokenHash: string): Promise<{
+    id: string;
+    createdAt: Date;
+    userId: string;
+    expiresAt: Date;
+    tokenHash: string;
+    usedAt: Date | null;
+}>;
+export declare function consumeVerificationToken(token: string): Promise<User | undefined>;
+export declare function sendVerificationEmail(user: {
+    id: string;
+    email: string;
+    name?: string | null;
+}): Promise<void>;
+//# sourceMappingURL=emailVerification.d.ts.map

package/dist/services/emailVerification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailVerification.d.ts","sourceRoot":"","sources":["../../src/services/emailVerification.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkC,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAS5E,wBAAgB,yBAAyB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAGhF;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;;;;;;;GAU7E;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CA2BvF;AAOD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAWpH"}

package/dist/services/emailVerification.js

@@ -0,0 +1,58 @@
+import crypto from "node:crypto";
+import { eq, and, gt, isNull } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { emailVerificationTokens, users } from "../db/schema.js";
+import { emailProvider } from "./email.js";
+const TOKEN_TTL_SECONDS = 24 * 60 * 60; // 24 hours
+function hashToken(token) {
+    return crypto.createHash("sha256").update(token).digest("hex");
+}
+export function generateVerificationToken() {
+    const token = crypto.randomBytes(48).toString("base64url");
+    return { token, tokenHash: hashToken(token) };
+}
+export async function storeVerificationToken(userId, tokenHash) {
+    const [record] = await db
+        .insert(emailVerificationTokens)
+        .values({
+        userId,
+        tokenHash,
+        expiresAt: new Date(Date.now() + TOKEN_TTL_SECONDS * 1000),
+    })
+        .returning();
+    return record;
+}
+export async function consumeVerificationToken(token) {
+    const tokenHash = hashToken(token);
+    const now = new Date();
+    const [record] = await db
+        .select()
+        .from(emailVerificationTokens)
+        .where(and(eq(emailVerificationTokens.tokenHash, tokenHash), gt(emailVerificationTokens.expiresAt, now), isNull(emailVerificationTokens.usedAt)))
+        .limit(1);
+    if (!record)
+        return undefined;
+    await db.update(emailVerificationTokens).set({ usedAt: now }).where(eq(emailVerificationTokens.id, record.id));
+    const [user] = await db
+        .update(users)
+        .set({ emailVerified: true, updatedAt: now })
+        .where(eq(users.id, record.userId))
+        .returning();
+    return user;
+}
+function verificationUrl(token) {
+    const base = process.env.CLIENT_APP_URL || "http://localhost:5173";
+    return `${base}/#verify-email=${encodeURIComponent(token)}`;
+}
+export async function sendVerificationEmail(user) {
+    const { token, tokenHash } = generateVerificationToken();
+    await storeVerificationToken(user.id, tokenHash);
+    const url = verificationUrl(token);
+    await emailProvider.send({
+        to: user.email,
+        subject: "Verify your email address",
+        text: `Hi${user.name ? ` ${user.name}` : ""},\n\nPlease verify your email address by clicking the link below:\n\n${url}\n\nThis link expires in 24 hours.`,
+        html: `<p>Hi${user.name ? ` ${user.name}` : ""},</p><p>Please verify your email address by clicking <a href="${url}">here</a>.</p><p>This link expires in 24 hours.</p>`,
+    });
+}
+//# sourceMappingURL=emailVerification.js.map