@managemint-solutions/sdk 0.9.0 → 0.16.0

package/dist/service-client/index.d.ts

@@ -0,0 +1,72 @@
+import { AuditResource, type AuditActor, type AuditedTable, type AuditedTableOptions, type AuditErrorHandler } from '../audit';
+import type { TypedSupabaseClient } from '../client';
+import { BillingResource } from '../billing';
+import { NotificationsOutboxResource } from '../notifications';
+import { OrganizationsResource, OrganizationSignupResource } from '../organizations';
+import { PermissionsResource } from '../permissions';
+import { UsersResource } from '../users';
+import { WebhookEventsResource } from '../webhook-events';
+export type SupabaseServiceClientConfig = {
+    url: string;
+    /** Service-role key — every query bypasses RLS. */
+    serviceRoleKey: string;
+    /** Where a failed audit insert is reported. Defaults to `console.error`. */
+    onAuditError?: AuditErrorHandler;
+};
+/**
+ * The organization-scoped half of the service client. Everything here is attributed to one
+ * `AuditActor`, so writes land in `audit_logs` the same way a caller's own would — with
+ * `mms_id: null` when the actor is the system (a webhook, a queue worker, provisioning).
+ */
+export declare class SupabaseOrganizationScope {
+    private readonly supabase;
+    readonly actor: AuditActor;
+    readonly audit: AuditResource;
+    readonly billing: BillingResource;
+    readonly organizations: OrganizationsResource;
+    readonly permissions: PermissionsResource;
+    readonly users: UsersResource;
+    constructor(supabase: TypedSupabaseClient, actor: AuditActor, onAuditError?: AuditErrorHandler);
+    /**
+     * An audited table bound to this organization and actor — the shape the api hand-rolls today
+     * as a local `auditedTables(client, organizationId)` factory in billing, provisioning,
+     * subscriptions and both webhook handler services.
+     */
+    table(options: AuditedTableOptions): AuditedTable;
+}
+/**
+ * The client for work that has no caller and no RLS context to run under: inbound webhooks
+ * (Paystack, Resend, the Supabase `send_email` hook), the notification queue worker, unauthenticated
+ * signup, and the writes RLS reserves for the service role outright — the ledger, the outbox, the
+ * webhook event logs, `organizations` INSERT, `permissions` INSERT/DELETE.
+ *
+ * It decodes no JWT, because there is none. Cross-org lookups (find the organization behind a
+ * Paystack customer code) hang off the client itself; anything attributable goes through
+ * `forOrganization`, which supplies the audit actor the resources need.
+ */
+export declare class SupabaseServiceClient {
+    private readonly config;
+    readonly supabase: TypedSupabaseClient;
+    readonly notifications: NotificationsOutboxResource;
+    readonly signup: OrganizationSignupResource;
+    readonly paystackEvents: WebhookEventsResource;
+    readonly resendEvents: WebhookEventsResource;
+    constructor(config: SupabaseServiceClientConfig);
+    /**
+     * Scope to one organization once it is known. `actorMmsId` stays `null` for system work —
+     * `audit_logs.created_by` is nullable precisely so an unattributed write is still recorded.
+     */
+    forOrganization(organizationId: string, actorMmsId?: string | null): SupabaseOrganizationScope;
+    /**
+     * Finds the organization behind an external identifier — a Paystack customer or subscription
+     * code. Deliberately unscoped: a webhook knows only the provider's own id, and which tenant
+     * it belongs to is exactly what this answers.
+     */
+    findOrganizationBy(column: string, value: string): Promise<Record<string, unknown> | null>;
+    /**
+     * A ledger row by id alone. Also unscoped by necessity: a `charge.success` carries the
+     * transaction id in its metadata, and the row is what says which tenant it belongs to.
+     */
+    findTransaction(transactionId: string): Promise<Record<string, unknown> | null>;
+}
+export declare const createSupabaseServiceClient: (config: SupabaseServiceClientConfig) => SupabaseServiceClient;

package/dist/service-client/index.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SupabaseOrganizationScope = void 0;
+const supabase_js_1 = require("@supabase/supabase-js");
+const audit_1 = require("../audit");
+const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
+const billing_1 = require("../billing");
+const notifications_1 = require("../notifications");
+const errors_1 = require("../errors");
+const organizations_1 = require("../organizations");
+const permissions_1 = require("../permissions");
+const users_1 = require("../users");
+const webhook_events_1 = require("../webhook-events");
+/**
+ * The organization-scoped half of the service client. Everything here is attributed to one
+ * `AuditActor`, so writes land in `audit_logs` the same way a caller's own would — with
+ * `mms_id: null` when the actor is the system (a webhook, a queue worker, provisioning).
+ */
+class SupabaseOrganizationScope {
+    supabase;
+    actor;
+    audit;
+    billing;
+    organizations;
+    permissions;
+    users;
+    constructor(supabase, actor, onAuditError) {
+        this.supabase = supabase;
+        this.actor = actor;
+        this.audit = new audit_1.AuditResource(supabase, actor, onAuditError);
+        this.billing = new billing_1.BillingResource(supabase, actor, this.audit);
+        this.organizations = new organizations_1.OrganizationsResource(supabase, actor, this.audit);
+        this.permissions = new permissions_1.PermissionsResource(supabase, actor, this.audit);
+        this.users = new users_1.UsersResource(supabase, actor, this.audit);
+    }
+    /**
+     * An audited table bound to this organization and actor — the shape the api hand-rolls today
+     * as a local `auditedTables(client, organizationId)` factory in billing, provisioning,
+     * subscriptions and both webhook handler services.
+     */
+    table(options) {
+        return (0, audit_1.auditedTable)(this.supabase, this.actor, this.audit, options);
+    }
+}
+exports.SupabaseOrganizationScope = SupabaseOrganizationScope;
+/**
+ * The client for work that has no caller and no RLS context to run under: inbound webhooks
+ * (Paystack, Resend, the Supabase `send_email` hook), the notification queue worker, unauthenticated
+ * signup, and the writes RLS reserves for the service role outright — the ledger, the outbox, the
+ * webhook event logs, `organizations` INSERT, `permissions` INSERT/DELETE.
+ *
+ * It decodes no JWT, because there is none. Cross-org lookups (find the organization behind a
+ * Paystack customer code) hang off the client itself; anything attributable goes through
+ * `forOrganization`, which supplies the audit actor the resources need.
+ */
+class SupabaseServiceClient {
+    config;
+    supabase; // escape hatch for not-yet-migrated queries
+    notifications;
+    signup;
+    paystackEvents;
+    resendEvents;
+    constructor(config) {
+        this.config = config;
+        this.supabase = (0, supabase_js_1.createClient)(config.url, config.serviceRoleKey, {
+            auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },
+        });
+        this.paystackEvents = new webhook_events_1.WebhookEventsResource(this.supabase, 'paystack_webhook_events');
+        this.resendEvents = new webhook_events_1.WebhookEventsResource(this.supabase, 'resend_webhook_events');
+        this.signup = new organizations_1.OrganizationSignupResource(this.supabase, (organizationId) => this.forOrganization(organizationId).audit);
+        // The outbox spans organizations — the row it is about carries its own — so it takes a
+        // factory and scopes per write rather than being built inside one organization's scope.
+        this.notifications = new notifications_1.NotificationsOutboxResource(this.supabase, (organizationId) => this.forOrganization(organizationId).table({
+            table: 'notifications',
+            entityType: enum_1.AuditTrailEntityType.NOTIFICATION,
+        }));
+    }
+    /**
+     * Scope to one organization once it is known. `actorMmsId` stays `null` for system work —
+     * `audit_logs.created_by` is nullable precisely so an unattributed write is still recorded.
+     */
+    forOrganization(organizationId, actorMmsId = null) {
+        return new SupabaseOrganizationScope(this.supabase, { mms_id: actorMmsId, organization_id: organizationId }, this.config.onAuditError);
+    }
+    /**
+     * Finds the organization behind an external identifier — a Paystack customer or subscription
+     * code. Deliberately unscoped: a webhook knows only the provider's own id, and which tenant
+     * it belongs to is exactly what this answers.
+     */
+    async findOrganizationBy(column, value) {
+        const { data, error } = await this.supabase
+            .from('organizations')
+            .select('*')
+            .eq(column, value)
+            .limit(1)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? null);
+    }
+    /**
+     * A ledger row by id alone. Also unscoped by necessity: a `charge.success` carries the
+     * transaction id in its metadata, and the row is what says which tenant it belongs to.
+     */
+    async findTransaction(transactionId) {
+        const { data, error } = await this.supabase
+            .from('billing_transactions')
+            .select('*')
+            .eq('mms_id', transactionId)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? null);
+    }
+}
+exports.SupabaseServiceClient = SupabaseServiceClient;
+const createSupabaseServiceClient = (config) => new SupabaseServiceClient(config);
+exports.createSupabaseServiceClient = createSupabaseServiceClient;
+//# sourceMappingURL=index.js.map

package/dist/service-client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/service-client/index.ts"],"names":[],"mappings":";;;AAAA,uDAAqD;AACrD,oCAOkB;AAClB,0EAAuF;AAEvF,wCAA6C;AAC7C,oDAA+D;AAC/D,sCAA8C;AAC9C,oDAAqF;AACrF,gDAAqD;AACrD,oCAAyC;AACzC,sDAA0D;AAU1D;;;;GAIG;AACH,MAAa,yBAAyB;IAQjB;IACR;IARF,KAAK,CAAgB;IACrB,OAAO,CAAkB;IACzB,aAAa,CAAwB;IACrC,WAAW,CAAsB;IACjC,KAAK,CAAgB;IAE9B,YACmB,QAA6B,EACrC,KAAiB,EAC1B,YAAgC;QAFf,aAAQ,GAAR,QAAQ,CAAqB;QACrC,UAAK,GAAL,KAAK,CAAY;QAG1B,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,aAAa,GAAG,IAAI,qCAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,WAAW,GAAG,IAAI,iCAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAA4B;QAChC,OAAO,IAAA,oBAAY,EAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;CACF;AA3BD,8DA2BC;AAED;;;;;;;;;GASG;AACH,MAAa,qBAAqB;IAOH;IANpB,QAAQ,CAAsB,CAAC,4CAA4C;IAC3E,aAAa,CAA8B;IAC3C,MAAM,CAA6B;IACnC,cAAc,CAAwB;IACtC,YAAY,CAAwB;IAE7C,YAA6B,MAAmC;QAAnC,WAAM,GAAN,MAAM,CAA6B;QAC9D,IAAI,CAAC,QAAQ,GAAG,IAAA,0BAAY,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,EAAE;YAC9D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE;SACpF,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,sCAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;QAC1F,IAAI,CAAC,YAAY,GAAG,IAAI,sCAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,GAAG,IAAI,0CAA0B,CAC1C,IAAI,CAAC,QAAQ,EACb,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,KAAK,CAC/D,CAAC;QACF,uFAAuF;QACvF,wFAAwF;QACxF,IAAI,CAAC,aAAa,GAAG,IAAI,2CAA2B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,EAAE,CACrF,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC;YACzC,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,2BAAoB,CAAC,YAAY;SAC9C,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,cAAsB,EAAE,aAA4B,IAAI;QACtE,OAAO,IAAI,yBAAyB,CAClC,IAAI,CAAC,QAAQ,EACb,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,EACvD,IAAI,CAAC,MAAM,CAAC,YAAY,CACzB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CACtB,MAAc,EACd,KAAa;QAEb,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACjB,KAAK,CAAC,CAAC,CAAC;aACR,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,CAAC,IAAI,IAAI,IAAI,CAAmC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,sBAAsB,CAAC;aAC5B,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC;aAC3B,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,CAAC,IAAI,IAAI,IAAI,CAAmC,CAAC;IAC1D,CAAC;CACF;AAzED,sDAyEC;AAEM,MAAM,2BAA2B,GAAG,CACzC,MAAmC,EACZ,EAAE,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAFjD,QAAA,2BAA2B,+BAEsB"}

package/dist/users/dto.d.ts

@@ -0,0 +1,48 @@
+import type { CreateUserDto as CreateUserDtoType, GetUsersDto as GetUsersDtoType, UpdateUserDto as UpdateUserDtoType, UserIdDto as UserIdDtoType } from '@managemint-solutions/entities/users/dto';
+import { EmergencyContactRelationship, EmploymentType } from '@managemint-solutions/entities/users/enum';
+export declare class UserIdDto implements UserIdDtoType {
+    readonly userId: string;
+}
+export declare class AddUserDto implements CreateUserDtoType {
+    readonly email: string;
+    readonly password: string;
+    readonly name: string;
+    readonly surname: string;
+    readonly phone: string | null;
+    readonly profile_image: string | null;
+    readonly country_code: string;
+    /**
+     * The client's idempotency key for the pro-rata seat charge (principle 1).
+     * Optional: an internally created user - the owner at signup - has no client
+     * request behind it, and one is generated for it.
+     */
+    readonly idempotency_key?: string;
+}
+export declare class GetUsersQueryDto implements Omit<GetUsersDtoType, 'active_in'> {
+    readonly search?: string | null;
+    readonly page: number;
+    readonly page_size: number;
+    readonly active_in?: boolean[] | null;
+}
+export declare class UpdateUserDto implements UpdateUserDtoType {
+    readonly name: string;
+    readonly surname: string;
+    readonly phone: string;
+    readonly country_code: string;
+    readonly employment_type: EmploymentType;
+    readonly birthday?: string | null;
+    readonly start_date?: string | null;
+    readonly end_date?: string | null;
+    readonly job_title?: string | null;
+    readonly manager_id?: string | null;
+    readonly social_facebook?: string | null;
+    readonly social_linkedin?: string | null;
+    readonly social_twitter?: string | null;
+    readonly social_instagram?: string | null;
+    readonly social_github?: string | null;
+    readonly social_website?: string | null;
+    readonly emergency_contact_name?: string | null;
+    readonly emergency_contact_relationship?: EmergencyContactRelationship | null;
+    readonly emergency_contact_phone?: string | null;
+    readonly emergency_contact_email?: string | null;
+}

package/dist/users/dto.js

@@ -0,0 +1,267 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateUserDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UserIdDto = void 0;
+const class_validator_1 = require("class-validator");
+const class_transformer_1 = require("class-transformer");
+const validators_1 = require("../validators");
+const enum_1 = require("@managemint-solutions/entities/users/enum");
+class UserIdDto {
+    userId;
+}
+exports.UserIdDto = UserIdDto;
+__decorate([
+    (0, class_validator_1.IsUUID)('4', { message: 'Invalid user ID format' }),
+    __metadata("design:type", String)
+], UserIdDto.prototype, "userId", void 0);
+class AddUserDto {
+    email;
+    password;
+    name;
+    surname;
+    phone;
+    profile_image;
+    country_code;
+    /**
+     * The client's idempotency key for the pro-rata seat charge (principle 1).
+     * Optional: an internally created user - the owner at signup - has no client
+     * request behind it, and one is generated for it.
+     */
+    idempotency_key;
+}
+exports.AddUserDto = AddUserDto;
+__decorate([
+    (0, class_validator_1.IsEmail)({}, { message: 'Invalid email address' }),
+    __metadata("design:type", String)
+], AddUserDto.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Password is required' }),
+    (0, class_validator_1.MinLength)(8, { message: 'Password must be at least 8 characters' }),
+    (0, class_validator_1.Matches)(/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[!@#$%^&*])/, { message: 'Password must contain at least 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character (!@#$%^&*)' }),
+    __metadata("design:type", String)
+], AddUserDto.prototype, "password", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Name is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Name is required' }),
+    (0, class_validator_1.MaxLength)(50, { message: 'Name cannot be longer than 50 characters' }),
+    __metadata("design:type", String)
+], AddUserDto.prototype, "name", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Surname is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Surname is required' }),
+    (0, class_validator_1.MaxLength)(50, { message: 'Surname cannot be longer than 50 characters' }),
+    __metadata("design:type", String)
+], AddUserDto.prototype, "surname", void 0);
+__decorate([
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsString)({ message: 'Phone number' }),
+    __metadata("design:type", Object)
+], AddUserDto.prototype, "phone", void 0);
+__decorate([
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsString)({ message: 'Profile image URL' }),
+    __metadata("design:type", Object)
+], AddUserDto.prototype, "profile_image", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Country code is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Country code is required' }),
+    __metadata("design:type", String)
+], AddUserDto.prototype, "country_code", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsUUID)('4', { message: 'Invalid idempotency key format' }),
+    __metadata("design:type", String)
+], AddUserDto.prototype, "idempotency_key", void 0);
+// `active_in` arrives as a CSV string and is transformed to booleans, so it is omitted from the
+// implemented contract — the same exception GetClientsDto makes for status_id_in.
+class GetUsersQueryDto {
+    search;
+    page = 1;
+    page_size = 10;
+    // Comma-joined booleans on the wire, e.g. "true,false". Absent = all users.
+    active_in;
+}
+exports.GetUsersQueryDto = GetUsersQueryDto;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsString)({ message: 'Invalid search query' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Search query cannot be empty' }),
+    (0, class_validator_1.MaxLength)(255, { message: 'Search query cannot exceed 255 characters' }),
+    __metadata("design:type", Object)
+], GetUsersQueryDto.prototype, "search", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Transform)(({ value }) => value ? Number(value) : 1, { toClassOnly: true }),
+    (0, class_validator_1.IsNumber)({}, { message: 'Page must be a number' }),
+    (0, class_validator_1.Min)(1, { message: 'Page must be at least 1' }),
+    __metadata("design:type", Number)
+], GetUsersQueryDto.prototype, "page", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Transform)(({ value }) => value ? Number(value) : 10, { toClassOnly: true }),
+    (0, class_validator_1.IsNumber)({}, { message: 'Page size must be a number' }),
+    (0, class_validator_1.Min)(1, { message: 'Page size must be at least 1' }),
+    (0, class_validator_1.Max)(100, { message: 'Page size cannot exceed 100' }),
+    __metadata("design:type", Number)
+], GetUsersQueryDto.prototype, "page_size", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_transformer_1.Transform)(({ value }) => value ? value.split(',').map((entry) => entry.trim() === 'true') : null, { toClassOnly: true }),
+    (0, class_validator_1.IsBoolean)({ each: true, message: 'Active filter values must be booleans' }),
+    __metadata("design:type", Object)
+], GetUsersQueryDto.prototype, "active_in", void 0);
+class UpdateUserDto {
+    name;
+    surname;
+    phone;
+    country_code;
+    employment_type;
+    birthday;
+    start_date;
+    end_date;
+    job_title;
+    manager_id;
+    social_facebook;
+    social_linkedin;
+    social_twitter;
+    social_instagram;
+    social_github;
+    social_website;
+    emergency_contact_name;
+    emergency_contact_relationship;
+    emergency_contact_phone;
+    emergency_contact_email;
+}
+exports.UpdateUserDto = UpdateUserDto;
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Invalid name' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Name is required' }),
+    (0, class_validator_1.MaxLength)(50, { message: 'Name cannot be longer than 50 characters' }),
+    __metadata("design:type", String)
+], UpdateUserDto.prototype, "name", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Invalid surname' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Surname is required' }),
+    (0, class_validator_1.MaxLength)(50, { message: 'Surname cannot be longer than 50 characters' }),
+    __metadata("design:type", String)
+], UpdateUserDto.prototype, "surname", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Invalid phone number' }),
+    __metadata("design:type", String)
+], UpdateUserDto.prototype, "phone", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Country code is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Country code is required' }),
+    __metadata("design:type", String)
+], UpdateUserDto.prototype, "country_code", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEnum)(enum_1.EmploymentType, { message: 'Invalid employment type' }),
+    __metadata("design:type", String)
+], UpdateUserDto.prototype, "employment_type", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsDateString)({}, { message: 'Birthday must be a valid ISO 8601 date string' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "birthday", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsDateString)({}, { message: 'Start date must be a valid ISO 8601 date string' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "start_date", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsDateString)({}, { message: 'End date must be a valid ISO 8601 date string' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "end_date", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsString)({ message: 'Invalid job title' }),
+    (0, class_validator_1.MaxLength)(100, { message: 'Job title cannot be longer than 100 characters' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "job_title", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUUID)('4', { message: 'Invalid manager ID format' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "manager_id", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUrl)({}, { message: 'Invalid Facebook URL' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "social_facebook", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUrl)({}, { message: 'Invalid LinkedIn URL' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "social_linkedin", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUrl)({}, { message: 'Invalid Twitter URL' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "social_twitter", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUrl)({}, { message: 'Invalid Instagram URL' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "social_instagram", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUrl)({}, { message: 'Invalid GitHub URL' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "social_github", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUrl)({}, { message: 'Invalid website URL' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "social_website", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsString)({ message: 'Invalid emergency contact name' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Emergency contact name is required' }),
+    (0, class_validator_1.MaxLength)(50, { message: 'Emergency contact name cannot be longer than 50 characters' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "emergency_contact_name", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsEnum)(enum_1.EmergencyContactRelationship, { message: 'Invalid emergency contact relationship' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Emergency contact relationship is required' }),
+    (0, class_validator_1.MaxLength)(50, { message: 'Emergency contact relationship cannot be longer than 50 characters' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "emergency_contact_relationship", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsString)({ message: 'Invalid emergency contact phone number' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "emergency_contact_phone", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsEmail)({}, { message: 'Invalid emergency contact email address' }),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "emergency_contact_email", void 0);
+//# sourceMappingURL=dto.js.map

package/dist/users/dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dto.js","sourceRoot":"","sources":["../../src/users/dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAOA,qDAeyB;AACzB,yDAA8C;AAC9C,8CAA2C;AAC3C,oEAAyG;AAEzG,MAAa,SAAS;IAEX,MAAM,CAAU;CAC1B;AAHD,8BAGC;AADU;IADR,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;;yCAC1B;AAG3B,MAAa,UAAU;IAEZ,KAAK,CAAU;IAQf,QAAQ,CAAU;IAKlB,IAAI,CAAU;IAKd,OAAO,CAAU;IAIjB,KAAK,CAAiB;IAItB,aAAa,CAAiB;IAI9B,YAAY,CAAU;IAE/B;;;;OAIG;IAGM,eAAe,CAAU;CACnC;AA1CD,gCA0CC;AAxCU;IADR,IAAA,yBAAO,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;;yCAC1B;AAQf;IANR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC7C,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACnE,IAAA,yBAAO,EACN,iDAAiD,EACjD,EAAE,OAAO,EAAE,qHAAqH,EAAE,CACnI;;4CAC0B;AAKlB;IAHR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IACzC,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC7C,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;;wCAChD;AAKd;IAHR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAC5C,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAChD,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;;2CAChD;AAIjB;IAFR,IAAA,uBAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;;yCACP;AAItB;IAFR,IAAA,uBAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;;iDACJ;AAI9B;IAFR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IACjD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;;gDACvB;AAStB;IAFR,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;;mDACzB;AAGpC,gGAAgG;AAChG,kFAAkF;AAClF,MAAa,gBAAgB;IAMlB,MAAM,CAAiB;IAMvB,IAAI,GAAW,CAAC,CAAC;IAOjB,SAAS,GAAW,EAAE,CAAC;IAEhC,4EAA4E;IAKnE,SAAS,CAAoB;CACvC;AA3BD,4CA2BC;AArBU;IALR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC7C,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACzD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;;gDACzC;AAMvB;IAJR,IAAA,4BAAU,GAAE;IACZ,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAA,0BAAQ,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IAClD,IAAA,qBAAG,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;;8CACrB;AAOjB;IALR,IAAA,4BAAU,GAAE;IACZ,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3E,IAAA,0BAAQ,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IACvD,IAAA,qBAAG,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACnD,IAAA,qBAAG,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;;mDACrB;AAOvB;IAJR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAChI,IAAA,2BAAS,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;;mDACtC;AAGxC,MAAa,aAAa;IAIf,IAAI,CAAU;IAKd,OAAO,CAAU;IAGjB,KAAK,CAAU;IAIf,YAAY,CAAU;IAItB,eAAe,CAAkB;IAKjC,QAAQ,CAAiB;IAKzB,UAAU,CAAiB;IAK3B,QAAQ,CAAiB;IAMzB,SAAS,CAAiB;IAK1B,UAAU,CAAiB;IAK3B,eAAe,CAAiB;IAKhC,eAAe,CAAiB;IAKhC,cAAc,CAAiB;IAK/B,gBAAgB,CAAiB;IAKjC,aAAa,CAAiB;IAK9B,cAAc,CAAiB;IAO/B,sBAAsB,CAAiB;IAOvC,8BAA8B,CAAuC;IAKrE,uBAAuB,CAAiB;IAKxC,uBAAuB,CAAiB;CAClD;AArGD,sCAqGC;AAjGU;IAHR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IACrC,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC7C,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;;2CAChD;AAKd;IAHR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACxC,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAChD,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;;8CAChD;AAGjB;IADR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;;4CACtB;AAIf;IAFR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IACjD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;;mDACvB;AAItB;IAFR,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,qBAAc,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;;sDACrB;AAKjC;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,8BAAY,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;;+CAC7C;AAKzB;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,8BAAY,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;;iDAC7C;AAK3B;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,8BAAY,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;;+CAC7C;AAMzB;IAJR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC1C,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;;gDAC3C;AAK1B;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;;iDAClB;AAK3B;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,uBAAK,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;;sDACN;AAKhC;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,uBAAK,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;;sDACN;AAKhC;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,uBAAK,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;;qDACN;AAK/B;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,uBAAK,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;;uDACN;AAKjC;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,uBAAK,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;;oDACN;AAK9B;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,uBAAK,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;;qDACN;AAO/B;IALR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACvD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;IAC/D,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC;;6DACzC;AAOvC;IALR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,mCAA4B,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IAC3F,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;IACvE,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,oEAAoE,EAAE,CAAC;;qEACnB;AAKrE;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;;8DACf;AAKxC;IAHR,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAU,GAAE;IACZ,IAAA,yBAAO,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;;8DACnB"}

package/dist/users/index.d.ts

@@ -0,0 +1,38 @@
+import type { MmsList } from '@managemint-solutions/entities/common';
+import type { UserIdentity, UserSummary } from '@managemint-solutions/entities/users';
+import { type AuditActor, type AuditResource, type AuditRow } from '../audit';
+import type { TypedSupabaseClient } from '../client';
+import type { GetUsersQueryDto } from './dto';
+export * from './dto';
+/** The full users row. The api resolves its manager/created_by/last_updated_by ids into identities. */
+export type UserRow = Record<string, unknown> & {
+    mms_id: string;
+    manager_id: string | null;
+    created_by: string | null;
+    last_updated_by: string | null;
+};
+export declare class UsersResource {
+    private readonly supabase;
+    private readonly auth;
+    private readonly table;
+    constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
+    list(query: GetUsersQueryDto): Promise<MmsList<UserSummary>>;
+    getRow(userId: string): Promise<UserRow>;
+    /**
+     * The public profile behind a `*_by` / `manager_id` column. `user_profiles` is a
+     * `security_invoker = off` view granted to `authenticated`, so this runs on the caller's own
+     * client — it needs no service role.
+     */
+    identityById(userId?: string | null): Promise<UserIdentity | null>;
+    /** Seats in use. Counts rows rather than fetching them. */
+    activeCount(): Promise<number>;
+    isActive(userId: string): Promise<boolean>;
+    update(userId: string, patch: AuditRow): Promise<UserRow>;
+    /** `active` is not an archive flag, so a deactivation is recorded as a plain UPDATE. */
+    setActive(userId: string, active: boolean): Promise<UserRow>;
+    /**
+     * Stamps who created a user. Runs on the service client during signup: the row is written by
+     * the `on_auth_user_created` trigger, so there is nothing to attribute it to until afterwards.
+     */
+    stampCreatedBy(userId: string, createdBy: string | null): Promise<AuditRow>;
+}