@openlup/platform 0.15.0 → 0.17.0

package/dist/identity/adminUserActionPorts.d.ts

@@ -0,0 +1,31 @@
+import type { IdentityAdminActionsPort } from "./adminUserHandlers.js";
+import type { runInviteAdminUserUseCase } from "./inviteAdminUserUseCase.js";
+import type { runRemoveAdminUserUseCase } from "./removeAdminUserUseCase.js";
+export interface AdminUserInviteErrorDetails {
+    identityCode?: string;
+    invitationId?: string;
+    principalId?: string;
+    membershipState?: "active";
+    role?: "admin" | "distributor";
+}
+type AdminUserActionRuntimeEnv = Record<string, string | undefined>;
+type AdminUserInviteRunner = (request: {
+    accessToken: string | null;
+    email: string;
+    role: "admin" | "distributor";
+}, env?: AdminUserActionRuntimeEnv) => ReturnType<typeof runInviteAdminUserUseCase>;
+type AdminUserRemoveRunner = (request: {
+    accessToken: string | null;
+    userId: string;
+}, env?: AdminUserActionRuntimeEnv) => ReturnType<typeof runRemoveAdminUserUseCase>;
+export declare function createAdminUserInvitePort(options: {
+    accessToken: string | null;
+    env?: AdminUserActionRuntimeEnv;
+    runInviteAdminUser: AdminUserInviteRunner;
+}): Pick<IdentityAdminActionsPort, "inviteAdminUser">;
+export declare function createAdminUserRemovePort(options: {
+    accessToken: string | null;
+    env?: AdminUserActionRuntimeEnv;
+    runRemoveAdminUser: AdminUserRemoveRunner;
+}): Pick<IdentityAdminActionsPort, "removeAdminUser">;
+export {};

package/dist/identity/adminUserActionPorts.js

@@ -0,0 +1,51 @@
+import { adminUserInviteResponseSchema } from "./adminContracts.js";
+export function createAdminUserInvitePort(options) {
+    const runInviteAdminUser = options.runInviteAdminUser;
+    return {
+        async inviteAdminUser(request) {
+            const result = await runInviteAdminUser({
+                accessToken: options.accessToken,
+                email: request.email,
+                role: request.role,
+            }, options.env);
+            if (result.status < 200 || result.status >= 300) {
+                const details = {
+                    identityCode: result.body.code,
+                    ...(typeof result.body.invitationId === "string" ? { invitationId: result.body.invitationId } : {}),
+                    ...(result.body.membershipState === "active" && typeof result.body.principalId === "string"
+                        && (result.body.role === "admin" || result.body.role === "distributor")
+                        ? { principalId: result.body.principalId, membershipState: "active", role: result.body.role } : {}),
+                };
+                throw Object.assign(new Error(String(result.body.error ?? `invite_admin_user_http_${result.status}`)), { bffCode: { 400: "BAD_REQUEST", 401: "UNAUTHORIZED", 403: "FORBIDDEN", 409: "CONFLICT" }[result.status] ?? "UPSTREAM_UNAVAILABLE", inviteDetails: details });
+            }
+            if (result.body.error)
+                throw new Error(result.body.error);
+            return adminUserInviteResponseSchema.parse(result.body);
+        },
+    };
+}
+export function createAdminUserRemovePort(options) {
+    const runRemoveAdminUser = options.runRemoveAdminUser;
+    return {
+        async removeAdminUser(request) {
+            const result = await runRemoveAdminUser({
+                accessToken: options.accessToken,
+                userId: request.userId,
+            }, options.env);
+            if (result.status < 200 || result.status >= 300) {
+                throw removePortError(result.status, String(result.body.error ?? `remove_admin_user_http_${result.status}`));
+            }
+            if (result.body.error)
+                throw new Error(result.body.error);
+            if (result.body.revoked !== true) {
+                throw new Error("admin_revoke_admin_user returned an invalid response");
+            }
+            return { revoked: true };
+        },
+    };
+}
+function removePortError(status, message) {
+    const bffCode = { 400: "BAD_REQUEST", 403: "FORBIDDEN", 409: "CONFLICT" }[status]
+        ?? "UPSTREAM_UNAVAILABLE";
+    return Object.assign(new Error(message), { bffCode });
+}

package/dist/identity/adminUserHandlers.d.ts

@@ -0,0 +1,38 @@
+import { type IdentityResponseOptions } from "./response.js";
+import type { HttpRequest, HttpResponse } from "../http/index.js";
+import type { PlatformAdminAuthorizationResult } from "./platformAdminAuth.js";
+import type { OperatorInviteResult } from "./contracts/operatorInvitations.js";
+export interface IdentityAdminActionsPort {
+    inviteAdminUser(request: {
+        email: string;
+        role: "admin" | "distributor";
+    }): Promise<OperatorInviteResult>;
+    removeAdminUser(request: {
+        userId: string;
+    }): Promise<{
+        revoked: true;
+    }>;
+    updateAdminUserRole(request: {
+        userId: string;
+        role: "admin" | "distributor";
+    }): Promise<{
+        userId: string;
+        role: "admin" | "distributor";
+        saved: true;
+    }>;
+}
+export interface AdminUserRoleUpdateDeps extends IdentityResponseOptions {
+    settingsPort: Pick<IdentityAdminActionsPort, "updateAdminUserRole">;
+    authorizeAdmin: (req: HttpRequest) => Promise<PlatformAdminAuthorizationResult>;
+}
+export interface AdminUserInviteDeps extends IdentityResponseOptions {
+    settingsPort: Pick<IdentityAdminActionsPort, "inviteAdminUser">;
+    authorizeAdmin: (req: HttpRequest) => Promise<PlatformAdminAuthorizationResult>;
+}
+export interface AdminUserRemoveDeps extends IdentityResponseOptions {
+    settingsPort: Pick<IdentityAdminActionsPort, "removeAdminUser">;
+    authorizeAdmin: (req: HttpRequest) => Promise<PlatformAdminAuthorizationResult>;
+}
+export declare function createAdminUserRoleUpdateHandler({ settingsPort, authorizeAdmin, responseRequestId, }: AdminUserRoleUpdateDeps): (req: HttpRequest, res: HttpResponse) => Promise<void>;
+export declare function createAdminUserInviteHandler({ settingsPort, authorizeAdmin, responseRequestId, }: AdminUserInviteDeps): (req: HttpRequest, res: HttpResponse) => Promise<void>;
+export declare function createAdminUserRemoveHandler({ settingsPort, authorizeAdmin, responseRequestId, }: AdminUserRemoveDeps): (req: HttpRequest, res: HttpResponse) => Promise<void>;

package/dist/identity/adminUserHandlers.js

@@ -0,0 +1,140 @@
+import { createIdentityResponder } from "./response.js";
+import { adminUserRoleUpdateRequestSchema, adminUserRoleUpdateResponseSchema, adminUserInviteRequestSchema, adminUserInviteResponseSchema, adminUserRemoveRequestSchema, adminUserRemoveResponseSchema } from "./adminContracts.js";
+export function createAdminUserRoleUpdateHandler({ settingsPort, authorizeAdmin, responseRequestId, }) {
+    const { sendBffError, sendBffSuccess, sendMethodNotAllowed } = createIdentityResponder({ responseRequestId });
+    return async function handler(req, res) {
+        if (req.method !== "POST") {
+            sendMethodNotAllowed(res, ["POST"]);
+            return;
+        }
+        let authorization;
+        try {
+            authorization = await authorizeAdmin(req);
+        }
+        catch {
+            sendBffError(res, "UPSTREAM_UNAVAILABLE", "Admin authorization failed");
+            return;
+        }
+        if (authorization.ok === false) {
+            sendBffError(res, authorization.code, authorization.message);
+            return;
+        }
+        const request = adminUserRoleUpdateRequestSchema.safeParse(req.body);
+        if (!request.success) {
+            sendBffError(res, "BAD_REQUEST", "Invalid admin user role update request", {
+                details: request.error.flatten(),
+            });
+            return;
+        }
+        try {
+            const result = await settingsPort.updateAdminUserRole(request.data);
+            const response = adminUserRoleUpdateResponseSchema.safeParse(result);
+            if (!response.success) {
+                sendBffError(res, "INVALID_RESPONSE", "Admin user role update returned invalid response");
+                return;
+            }
+            sendBffSuccess(res, response.data);
+        }
+        catch (error) {
+            const bffCode = error?.bffCode;
+            if (bffCode) {
+                sendBffError(res, bffCode, error.message);
+                return;
+            }
+            sendBffError(res, "UPSTREAM_UNAVAILABLE", "Admin user role update failed");
+        }
+    };
+}
+export function createAdminUserInviteHandler({ settingsPort, authorizeAdmin, responseRequestId, }) {
+    const { sendBffError, sendBffSuccess, sendMethodNotAllowed } = createIdentityResponder({ responseRequestId });
+    return async function handler(req, res) {
+        if (req.method !== "POST") {
+            sendMethodNotAllowed(res, ["POST"]);
+            return;
+        }
+        let authorization;
+        try {
+            authorization = await authorizeAdmin(req);
+        }
+        catch {
+            sendBffError(res, "UPSTREAM_UNAVAILABLE", "Admin authorization failed");
+            return;
+        }
+        if (authorization.ok === false) {
+            sendBffError(res, authorization.code, authorization.message);
+            return;
+        }
+        const request = adminUserInviteRequestSchema.safeParse(req.body);
+        if (!request.success) {
+            sendBffError(res, "BAD_REQUEST", "Invalid admin user invite request", {
+                details: request.error.flatten(),
+            });
+            return;
+        }
+        try {
+            const result = await settingsPort.inviteAdminUser(request.data);
+            const response = adminUserInviteResponseSchema.safeParse(result);
+            if (!response.success) {
+                sendBffError(res, "INVALID_RESPONSE", "Admin user invite returned invalid response");
+                return;
+            }
+            sendBffSuccess(res, response.data);
+        }
+        catch (error) {
+            const failure = error;
+            sendBffError(res, (failure.bffCode ?? "UPSTREAM_UNAVAILABLE"), errorMessage(error, "Admin user invite failed"), failure.inviteDetails ? { details: failure.inviteDetails } : {});
+        }
+    };
+}
+export function createAdminUserRemoveHandler({ settingsPort, authorizeAdmin, responseRequestId, }) {
+    const { sendBffError, sendBffSuccess, sendMethodNotAllowed } = createIdentityResponder({ responseRequestId });
+    return async function handler(req, res) {
+        if (req.method !== "POST") {
+            sendMethodNotAllowed(res, ["POST"]);
+            return;
+        }
+        let authorization;
+        try {
+            authorization = await authorizeAdmin(req);
+        }
+        catch {
+            sendBffError(res, "UPSTREAM_UNAVAILABLE", "Admin authorization failed");
+            return;
+        }
+        if (authorization.ok === false) {
+            sendBffError(res, authorization.code, authorization.message);
+            return;
+        }
+        const request = adminUserRemoveRequestSchema.safeParse(req.body);
+        if (!request.success) {
+            sendBffError(res, "BAD_REQUEST", "Invalid admin user remove request", {
+                details: request.error.flatten(),
+            });
+            return;
+        }
+        try {
+            const result = await settingsPort.removeAdminUser(request.data);
+            const response = adminUserRemoveResponseSchema.safeParse(result);
+            if (!response.success) {
+                sendBffError(res, "INVALID_RESPONSE", "Admin user remove returned invalid response");
+                return;
+            }
+            sendBffSuccess(res, response.data);
+        }
+        catch (error) {
+            sendMutationError(res, error, "Admin user revoke failed", responseRequestId);
+        }
+    };
+}
+function errorMessage(error, fallback) {
+    return error instanceof Error && error.message ? error.message : fallback;
+}
+function sendMutationError(res, error, fallback, responseRequestId) {
+    const { sendBffError } = createIdentityResponder({ responseRequestId });
+    const bffCode = error?.bffCode;
+    if (bffCode) {
+        sendBffError(res, bffCode, errorMessage(error, fallback));
+        return;
+    }
+    sendBffError(res, "UPSTREAM_UNAVAILABLE", errorMessage(error, fallback));
+}

package/dist/identity/authVerifyUrl.d.ts

@@ -0,0 +1,6 @@
+import type { HttpRequest } from "../http/index.js";
+export declare function buildAuthVerifyUrl(authServiceUrl: string, actionType: string, tokenHash: string, redirectTo: string): string;
+/** Only configured HTTP(S) origins authorize the default magic-link destination. */
+export declare function createMagicLinkOriginResolver(configuredOrigins: readonly string[]): (req: HttpRequest) => string | null;
+/** Invalid return targets use the callback's default landing page. */
+export declare function normalizeMagicLinkReturnPath(value: string | undefined, origin: string): string | undefined;

package/dist/identity/authVerifyUrl.js

@@ -0,0 +1,54 @@
+function authVerifyType(actionType) {
+    return actionType === "email_change_current" || actionType === "email_change_new"
+        ? "email_change"
+        : actionType;
+}
+function qpSafeTokenValue(token) {
+    if (token.length === 0)
+        return token;
+    return `%${token.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0")}${encodeURIComponent(token.slice(1))}`;
+}
+export function buildAuthVerifyUrl(authServiceUrl, actionType, tokenHash, redirectTo) {
+    const params = new URLSearchParams({ type: authVerifyType(actionType), redirect_to: redirectTo });
+    return `${authServiceUrl.replace(/\/+$/, "")}/auth/v1/verify?token=${qpSafeTokenValue(tokenHash)}&${params.toString()}`;
+}
+/** Only configured HTTP(S) origins authorize the default magic-link destination. */
+export function createMagicLinkOriginResolver(configuredOrigins) {
+    const origins = configuredOrigins.map(normalizeOrigin);
+    const origin = origins.length > 0 && origins.every((value) => value !== null)
+        ? (origins[0] ?? null)
+        : null;
+    return () => origin;
+}
+function normalizeOrigin(value) {
+    const candidate = value.trim();
+    // URL parsing alone accepts paths, credentials and repaired backslashes.
+    if (!/^https?:\/\/[^/?#\\\s]+\/?$/i.test(candidate))
+        return null;
+    try {
+        const url = new URL(candidate);
+        if (url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+            return null;
+        return url.origin;
+    }
+    catch {
+        return null;
+    }
+}
+/** Invalid return targets use the callback's default landing page. */
+export function normalizeMagicLinkReturnPath(value, origin) {
+    if (!value || !value.startsWith("/") || value.startsWith("//"))
+        return undefined;
+    // Reject encoded separators, controls and nested escapes before any later decoding.
+    if (value.includes("\\") || Array.from(value).some((character) => character.charCodeAt(0) <= 0x20 || character.charCodeAt(0) === 0x7f) || /%(?:2f|5c|0[0-9a-f]|1[0-9a-f]|7f|25)/i.test(value))
+        return undefined;
+    try {
+        const url = new URL(value, origin);
+        if (url.origin !== new URL(origin).origin || url.pathname.startsWith("//"))
+            return undefined;
+        return `${url.pathname}${url.search}${url.hash}`;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/identity/contracts/contracts.d.ts

@@ -0,0 +1,8 @@
+import type { EmailTrustFailureCode } from "./emailTrust.js";
+export declare const AUTH_RECONCILE_CONTRACT_VERSION: "auth.reconcile.v1";
+export interface AuthReconcileResponse {
+    accountId: string;
+    created: boolean;
+    linked: boolean;
+}
+export type AuthReconcileErrorCode = EmailTrustFailureCode | "NO_VERIFIED_EMAIL" | "RESERVED_PRINCIPAL_REFUSED" | "ACCOUNT_LINK_CONFLICT" | "EMAIL_OWNED_BY_OTHER_PRINCIPAL" | "PRINCIPAL_EMAIL_MISMATCH";

package/dist/identity/contracts/contracts.js

@@ -0,0 +1,2 @@
+export const AUTH_RECONCILE_CONTRACT_VERSION = "auth.reconcile.v1";
+// Runtime schemas remain in reference composition until the validator boundary is resolved.

package/dist/identity/contracts/emailTrust.d.ts

@@ -0,0 +1,3 @@
+/** Browser-safe email-association refusal codes. */
+export declare const EMAIL_TRUST_FAILURE_CODES: readonly ["EMAIL_TRUST_ENVELOPE_REFUSED", "EMAIL_TRUST_SETTINGS_UNAVAILABLE"];
+export type EmailTrustFailureCode = typeof EMAIL_TRUST_FAILURE_CODES[number];

package/dist/identity/contracts/emailTrust.js

@@ -0,0 +1,4 @@
+/** Browser-safe email-association refusal codes. */
+export const EMAIL_TRUST_FAILURE_CODES = [
+    "EMAIL_TRUST_ENVELOPE_REFUSED", "EMAIL_TRUST_SETTINGS_UNAVAILABLE",
+];

package/dist/identity/contracts/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./types.js";
+export * from "./ports.js";
+export * from "./providerList.js";
+export * from "./contracts.js";
+export * from "./emailTrust.js";
+export * from "./operatorInvitations.js";
+export * from "./operatorAuth.js";
+export * from "./privacy.js";

package/dist/identity/contracts/index.js

@@ -0,0 +1,8 @@
+export * from "./types.js";
+export * from "./ports.js";
+export * from "./providerList.js";
+export * from "./contracts.js";
+export * from "./emailTrust.js";
+export * from "./operatorInvitations.js";
+export * from "./operatorAuth.js";
+export * from "./privacy.js";

package/dist/identity/contracts/oidc.d.ts

@@ -0,0 +1,3 @@
+/** Credential and dependency refusals; no token or transport details are exposed. */
+export declare const OIDC_FAILURE_CODES: readonly ["OIDC_CONFIGURATION_INVALID", "OIDC_DISCOVERY_UNAVAILABLE", "OIDC_DISCOVERY_INVALID", "OIDC_JWKS_UNAVAILABLE", "OIDC_JWKS_INVALID", "OIDC_JWKS_REFRESH_RATE_LIMITED", "OIDC_JWT_LIBRARY_UNAVAILABLE", "OIDC_TOKEN_INVALID", "OIDC_KID_UNKNOWN", "OIDC_ISSUER_MISMATCH", "OIDC_AUDIENCE_MISMATCH", "OIDC_TOKEN_EXPIRED", "OIDC_TOKEN_NOT_ACTIVE", "OIDC_TOKEN_LIFETIME_INVALID", "OIDC_SUBJECT_INVALID", "OIDC_EMAIL_INVALID", "OIDC_EMAIL_UNVERIFIED", "OIDC_NATIVE_SESSION_REQUIRED"];
+export type OidcFailureCode = typeof OIDC_FAILURE_CODES[number];

package/dist/identity/contracts/oidc.js

@@ -0,0 +1,9 @@
+/** Credential and dependency refusals; no token or transport details are exposed. */
+export const OIDC_FAILURE_CODES = [
+    "OIDC_CONFIGURATION_INVALID", "OIDC_DISCOVERY_UNAVAILABLE", "OIDC_DISCOVERY_INVALID",
+    "OIDC_JWKS_UNAVAILABLE", "OIDC_JWKS_INVALID", "OIDC_JWKS_REFRESH_RATE_LIMITED",
+    "OIDC_JWT_LIBRARY_UNAVAILABLE", "OIDC_TOKEN_INVALID", "OIDC_KID_UNKNOWN",
+    "OIDC_ISSUER_MISMATCH", "OIDC_AUDIENCE_MISMATCH", "OIDC_TOKEN_EXPIRED",
+    "OIDC_TOKEN_NOT_ACTIVE", "OIDC_TOKEN_LIFETIME_INVALID", "OIDC_SUBJECT_INVALID",
+    "OIDC_EMAIL_INVALID", "OIDC_EMAIL_UNVERIFIED", "OIDC_NATIVE_SESSION_REQUIRED",
+];

package/dist/identity/contracts/operatorAuth.d.ts

@@ -0,0 +1,35 @@
+export interface OperatorSession {
+    accessToken: string;
+    expiresAt: string;
+    user: {
+        id: string;
+        email: string;
+    };
+}
+export interface OperatorChallengeRequest {
+    email: string;
+}
+export interface OperatorChallengeVerification {
+    token: string;
+}
+export interface OperatorBrowserAuthPort {
+    getSession(): Promise<OperatorSession | null>;
+    requestChallenge(email: string): Promise<void>;
+    verifyChallenge(token: string): Promise<OperatorSession>;
+    signOut(): Promise<void>;
+    onAuthStateChange(listener: (session: OperatorSession | null) => void): () => void;
+}
+/** Strict parsers keep the contracts entry independent of the server validator. */
+export interface OperatorSchema<T> {
+    parse(value: unknown): T;
+    safeParse(value: unknown): {
+        success: true;
+        data: T;
+    } | {
+        success: false;
+        error: Error;
+    };
+}
+export declare const operatorChallengeRequestSchema: OperatorSchema<OperatorChallengeRequest>;
+export declare const operatorChallengeVerificationSchema: OperatorSchema<OperatorChallengeVerification>;
+export declare const operatorSessionSchema: OperatorSchema<OperatorSession>;

package/dist/identity/contracts/operatorAuth.js

@@ -0,0 +1,53 @@
+function schema(parse) {
+    return { parse, safeParse(value) {
+            try {
+                return { success: true, data: parse(value) };
+            }
+            catch {
+                return { success: false, error: new Error("operator_contract_invalid") };
+            }
+        } };
+}
+function fields(value, keys) {
+    if (!value || typeof value !== "object" || Array.isArray(value)
+        || Object.keys(value).length !== keys.length || !keys.every(key => Object.hasOwn(value, key)))
+        throw new Error("operator_contract_invalid");
+    return value;
+}
+function email(value) {
+    if (typeof value !== "string" || value.length > 320 || !/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/i.test(value))
+        throw new Error("operator_email_invalid");
+    return value;
+}
+export const operatorChallengeRequestSchema = schema(value => {
+    const row = fields(value, ["email"]);
+    if (typeof row.email !== "string")
+        throw new Error("operator_email_invalid");
+    return { email: email(row.email.trim().toLowerCase()) };
+});
+export const operatorChallengeVerificationSchema = schema(value => {
+    const row = fields(value, ["token"]);
+    if (typeof row.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(row.token))
+        throw new Error("operator_token_invalid");
+    return { token: row.token };
+});
+function timestamp(value) {
+    if (typeof value !== "string")
+        return false;
+    const parts = /^(\d{4})-(\d\d)-(\d\d)T(\d\d):(\d\d):(\d\d)(?:\.\d+)?(?:Z|[+-]\d\d:\d\d)$/.exec(value);
+    if (!parts || !Number.isFinite(Date.parse(value)))
+        return false;
+    const [, year, month, day, hour, minute, second] = parts.map(Number);
+    return year >= 1970 && month >= 1 && month <= 12 && day >= 1
+        && day <= new Date(Date.UTC(year, month, 0)).getUTCDate()
+        && hour <= 23 && minute <= 59 && second <= 59;
+}
+export const operatorSessionSchema = schema(value => {
+    const row = fields(value, ["accessToken", "expiresAt", "user"]);
+    const user = fields(row.user, ["id", "email"]);
+    if (typeof row.accessToken !== "string" || !row.accessToken || row.accessToken.length > 8192
+        || !timestamp(row.expiresAt)
+        || typeof user.id !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(user.id))
+        throw new Error("operator_session_invalid");
+    return { accessToken: row.accessToken, expiresAt: row.expiresAt, user: { id: user.id, email: email(user.email) } };
+});

package/dist/identity/contracts/operatorInvitations.d.ts

@@ -0,0 +1,37 @@
+/** Pending invitations confer no authority; only accepted native memberships do. */
+export type OperatorRole = "admin" | "distributor";
+export type OperatorMembershipState = "invited" | "active" | "expired" | "revoked";
+export type OperatorInvitationOutcome = "INVITATION_CREATED" | "ALREADY_INVITED" | "INVITATION_REISSUED";
+export type OperatorInvitationConflict = "MEMBERSHIP_ALREADY_ACTIVE" | "INVITATION_ROLE_CONFLICT" | "IDENTITY_CONFLICT" | "MANAGED_REINVITE_UNSUPPORTED";
+export interface OperatorInvitation {
+    principalId: string;
+    invitationId: string;
+    membershipState: "invited";
+    role: OperatorRole;
+    invitedAt: string;
+    expiresAt: string;
+}
+export interface OperatorInvitationResult extends OperatorInvitation {
+    code: OperatorInvitationOutcome;
+    message?: string;
+}
+export interface OperatorMembershipSnapshot {
+    principalId: string;
+    membershipState: OperatorMembershipState;
+    role: OperatorRole;
+}
+export type OperatorInvitationAcceptance = {
+    code: "ACTIVATED" | "ALREADY_ACTIVE";
+    role: OperatorRole;
+} | {
+    code: "INVITATION_EXPIRED" | "INVITATION_REVOKED" | "NO_INVITATION";
+};
+/** Managed invitations activate membership immediately; no pending attempt is stored. */
+export interface ManagedOperatorMembershipResult {
+    principalId: string;
+    membershipState: "active";
+    role: OperatorRole;
+    code: "MEMBERSHIP_CREATED" | "ALREADY_ACTIVE";
+    message?: string;
+}
+export type OperatorInviteResult = OperatorInvitationResult | ManagedOperatorMembershipResult;

package/dist/identity/contracts/operatorInvitations.js

@@ -0,0 +1 @@
+export {};

package/dist/identity/contracts/ports.d.ts

@@ -0,0 +1,22 @@
+import type { AuthActionResult, AuthSession, AuthStateListener, OAuthProviderKind, Unsubscribe } from "./types.js";
+export interface CustomerAuthPort {
+    getSession(): Promise<AuthSession | null>;
+    onAuthStateChange(listener: AuthStateListener): Unsubscribe;
+    signInWithOtp(input: {
+        email: string;
+        locale: string;
+    }): Promise<AuthActionResult>;
+    verifyOtpCode(input: {
+        email: string;
+        token: string;
+    }): Promise<AuthActionResult>;
+    signInWithOAuth(input: {
+        provider: OAuthProviderKind;
+        redirectTo: string;
+    }): Promise<AuthActionResult>;
+    linkIdentity(input: {
+        provider: OAuthProviderKind;
+        redirectTo: string;
+    }): Promise<AuthActionResult>;
+    signOut(): Promise<void>;
+}

package/dist/identity/contracts/ports.js

@@ -0,0 +1 @@
+export {};

package/dist/identity/contracts/privacy.d.ts

@@ -0,0 +1,62 @@
+import type { OperatorSchema } from "./operatorAuth.js";
+export type PrivacySubjectRef = {
+    kind: "contact";
+    contactId: string;
+} | {
+    kind: "principal";
+    principalId: string;
+};
+export type PrivacyJson = null | boolean | number | string | PrivacyJson[] | {
+    [key: string]: PrivacyJson;
+};
+export interface PersonalDataObligation {
+    owner: string;
+    resource: string;
+    disposition: "erase" | "retain" | "unresolved";
+    reasonCode: string;
+    remote: boolean;
+}
+export interface PersonalDataDocument {
+    contributorId: string;
+    version: string;
+    data: PrivacyJson;
+    coverage: {
+        complete: boolean;
+        included: string[];
+        unavailable: string[];
+    };
+    obligations: PersonalDataObligation[];
+}
+export interface ErasureReceipt {
+    version: "identity.erasure.v1";
+    erasureId: string;
+    completedAt: string;
+    outcome: "ERASED" | "ALREADY_ERASED";
+    obligations: PersonalDataObligation[];
+}
+export interface PrivacyEraseRequest {
+    subject: PrivacySubjectRef;
+    idempotencyKey: string;
+}
+export interface PrivacyExport {
+    format: "personal-data.v1";
+    generatedAt: string;
+    subject: PrivacySubjectRef;
+    documents: PersonalDataDocument[];
+    missingContributors: string[];
+    erasure: ErasureReceipt | null;
+}
+export declare const privacySubjectSchema: OperatorSchema<PrivacySubjectRef>;
+export declare const personalDataObligationSchema: OperatorSchema<PersonalDataObligation>;
+export declare const personalDataDocumentSchema: OperatorSchema<PersonalDataDocument>;
+export declare const erasureReceiptSchema: OperatorSchema<ErasureReceipt>;
+export declare const privacyExportRequestSchema: OperatorSchema<{
+    subject: PrivacySubjectRef;
+}>;
+export declare const privacyEraseRequestSchema: OperatorSchema<PrivacyEraseRequest>;
+export declare const privacyExportResponseSchema: OperatorSchema<PrivacyExport>;
+export declare const privacyEraseResponseSchema: OperatorSchema<ErasureReceipt>;
+declare const refusalCodes: readonly ["PRIVACY_SUBJECT_NOT_FOUND", "PRIVACY_CONTRIBUTOR_DUPLICATE", "PRIVACY_CONTRIBUTOR_MISSING", "PRIVACY_ASSESSMENT_UNAVAILABLE", "PRIVACY_OWNERSHIP_UNDECLARED", "PRIVACY_ACTIVE_SUBSCRIPTION", "PRIVACY_RESUMABLE_SUBSCRIPTION", "PRIVACY_PROTECTED_OPERATOR", "PRIVACY_IDEMPOTENCY_CONFLICT", "PRIVACY_SUBJECT_ERASED", "PRIVACY_STORE_PRIVILEGES_UNSAFE", "MANAGED_PRIVACY_ERASURE_UNAVAILABLE"];
+export type PrivacyRefusalCode = typeof refusalCodes[number];
+export declare const privacyRefusalCodeSchema: OperatorSchema<PrivacyRefusalCode>;
+export {};