@shohaghinfo/aerojs 0.3.0 → 0.4.1

package/AGENTS.md

@@ -707,3 +707,229 @@ When asked to build or modify any feature in an AeroJS project:
    npm run build
    npm test
    ```
+
+---
+
+## 11. Enterprise Capabilities Reference (v0.3.0)
+
+### 11.1 Fluent HTTP Client (`Http`)
+```typescript
+import { Http } from 'aerojs';
+
+const res = await Http.baseUrl('https://api.example.com')
+  .withToken('auth-token')
+  .timeout(5000)
+  .retry(3, 100)
+  .get('/data', { page: 1 });
+
+if (res.successful) {
+  const data = res.json();
+}
+```
+
+### 11.2 SMTP Mail Transport (`Mail`)
+```typescript
+import { Mail } from 'aerojs';
+
+Mail.configure({
+  default: 'smtp',
+  mailers: {
+    smtp: {
+      driver: 'smtp',
+      host: process.env.SMTP_HOST || '127.0.0.1',
+      port: Number(process.env.SMTP_PORT) || 587,
+      auth: { user: process.env.SMTP_USER!, pass: process.env.SMTP_PASS! },
+    },
+  },
+});
+
+await Mail.send((msg) => {
+  msg.to('user@example.com')
+     .subject('Welcome')
+     .html('<h1>Welcome to AeroJS</h1>');
+});
+```
+
+### 11.3 Redis Rate Limiter & Redis Queue
+```typescript
+import { rateLimit, RedisRateLimitStore, RedisClient, Queue } from 'aerojs';
+
+const redis = new RedisClient({ host: '127.0.0.1', port: 6379 });
+
+// Rate Limiter
+app.use(rateLimit({
+  windowMs: 60_000,
+  max: 100,
+  store: new RedisRateLimitStore({ client: redis, prefix: 'rl:api:' }),
+}));
+
+// Queue
+Queue.configure({
+  default: 'redis',
+  connections: {
+    redis: { driver: 'redis', redis },
+  },
+});
+```
+
+### 11.4 OAuth 2.0 Social Login (`OAuth`)
+```typescript
+import { OAuth } from 'aerojs';
+
+router.get('/auth/google', (ctx) => ctx.redirect(OAuth.driver('google').getRedirectUrl()));
+router.get('/auth/google/callback', async (ctx) => {
+  const { user } = await OAuth.driver('google').handleCallback(ctx.query.code as string);
+  ctx.json({ user });
+});
+```
+
+### 11.5 Multi-Channel Notifications (`Notifications`, `Notification`)
+```typescript
+import { Notification, Notifications, MailMessage } from 'aerojs';
+
+class OrderAlertNotification extends Notification {
+  via() { return ['mail', 'database', 'broadcast']; }
+  toMail(u: any) { return new MailMessage().subject('Alert').text('Hello'); }
+  toDatabase(u: any) { return { alert: 'Order Confirmed' }; }
+}
+
+await Notifications.send(user, new OrderAlertNotification());
+```
+
+### 11.6 Tamper-Proof Signed URLs (`UrlSigner`, `validateSignedUrl`)
+```typescript
+import { UrlSigner, validateSignedUrl, Storage } from 'aerojs';
+
+// Generate temporary signed link
+const downloadUrl = await Storage.temporaryUrl('invoices/inv-101.pdf', 900);
+
+// Validate in route
+router.get('/secure/download', validateSignedUrl(), async (ctx) => {
+  ctx.json({ secure: true });
+});
+```
+
+### 11.7 Extended CLI Generators (`aero make:*`)
+```bash
+aero make:job ProcessPayment
+aero make:mail OrderReceipt
+aero make:policy PostPolicy
+aero make:event UserRegistered
+aero make:listener SendWelcomeNotification
+```
+
+---
+
+## 12. Advanced Enterprise Architecture (v0.4.0)
+
+### 12.1 Field-Level AES-256-GCM Encryption (`Crypt`, `@encrypted`)
+Protect sensitive compliance data (SSN, tax records, credentials, confidential notes) transparently at rest:
+
+```typescript
+import { Model, encrypted, Crypt } from 'aerojs';
+
+// Encrypt standalone strings or objects
+const ciphertext = Crypt.encrypt('secret-data');
+const plaintext = Crypt.decrypt(ciphertext);
+
+// Model field-level transparent encryption
+export class AccountRecord extends Model {
+  public static override table = 'accounts';
+  public static override primaryKey = 'id';
+  public static override fillable = ['name', 'ssn', 'private_notes'];
+  
+  // Mark fields for automatic AES-256-GCM encryption
+  public static override encrypted = ['ssn', 'private_notes'];
+
+  // Or use TypeScript property decorator:
+  // @encrypted()
+  // public ssn!: string;
+}
+
+// Automatically encrypted on .save() and decrypted on .find() / .all() / .toJSON()
+const account = await AccountRecord.create({
+  name: 'John Doe',
+  ssn: '123-45-6789',
+  private_notes: 'Confidential client notes',
+});
+```
+
+### 12.2 Database Read Replicas & Master-Slave Routing
+Scale database read throughput across horizontal replica pools with automatic write pinning and master-slave routing:
+
+```typescript
+import { Database, DB } from 'aerojs';
+
+Database.configureReplication({
+  write: { client: 'pg', connection: { host: 'primary.db.internal' } },
+  read: [
+    { client: 'pg', connection: { host: 'replica-1.db.internal' } },
+    { client: 'pg', connection: { host: 'replica-2.db.internal' } },
+  ],
+});
+
+// SELECT queries automatically balance across replicas in round-robin:
+const users = await DB.table('users').where('is_active', true).get();
+
+// INSERT / UPDATE / DELETE automatically target the primary write connection:
+await DB.table('users').insert({ name: 'Alice', email: 'alice@example.com' });
+
+// Read-your-own-writes consistency via .useWriteConnection():
+const freshUser = await DB.table('users').useWriteConnection().where('email', 'alice@example.com').first();
+```
+
+### 12.3 Interactive Queue Horizon Dashboard
+A dark-mode glassmorphic real-time administration dashboard for inspecting background job queues and metrics:
+
+```typescript
+import { app } from './bootstrap.js';
+
+// Mount real-time queue inspector GUI & REST API
+app.useQueueDashboard('/__aero/queue', {
+  auth: (ctx) => ctx.state?.user?.role === 'admin', // Optional authorization guard
+});
+```
+- Web UI: Navigate to `http://localhost:3000/__aero/queue`
+- REST Endpoints:
+  - `GET /__aero/queue/api/metrics` — Active jobs, processed counts, failure rates, queue throughput.
+  - `GET /__aero/queue/api/failed` — Failed job payloads, error messages, and stack traces.
+  - `POST /__aero/queue/api/retry/:id` — Instant dead-letter job retry.
+  - `POST /__aero/queue/api/retry-all` — Batch retry all failed jobs.
+  - `DELETE /__aero/queue/api/purge-all` — Purge failed jobs.
+
+### 12.4 Encrypted Stateless Cookie Session Driver
+Stateless, horizontally scalable user session storage secured via AES-256-GCM authenticated encryption:
+
+```typescript
+import { SessionManager, CookieSessionDriver } from 'aerojs';
+
+const sessionManager = new SessionManager({
+  driver: 'cookie',
+  secret: process.env.APP_KEY, // 32-byte secret key
+  cookie: {
+    name: 'aero_session',
+    httpOnly: true,
+    secure: true,
+    sameSite: 'lax',
+  },
+});
+```
+
+### 12.5 Request Fingerprinting & Anti-Hijack Guard
+Prevent session hijacking and credential replay attacks across network switches or spoofed browsers:
+
+```typescript
+import { fingerprintGuard, RequestFingerprint } from 'aerojs';
+
+// Generate or inspect request fingerprint
+const hash = RequestFingerprint.generate(ctx, { checkIp: false });
+
+// Bind to security middleware stack
+app.use(fingerprintGuard({
+  strict: true,
+  checkIp: false, // Set true for high-security intranets or false for mobile networks
+  onHijackAttempt: (ctx, expected, actual) => {
+    ctx.logger?.warn(`Session hijacking attempt detected: expected ${expected}, got ${actual}`);
+  },
+}));
+```

package/README.md

@@ -1225,10 +1225,10 @@ Mail.configure({
 
 // 2. Dispatch with attachments & HTML
 await Mail.send((msg) => {
-  msg.to('patient@example.com')
-     .from('billing@hospital.org', 'Hospital Billing')
+  msg.to('customer@example.com')
+     .from('billing@example.org', 'Billing Department')
      .subject('Monthly Statement & Invoice')
-     .html('<h1>Hello!</h1><p>Please find your medical invoice attached.</p>')
+     .html('<h1>Hello!</h1><p>Please find your monthly invoice attached.</p>')
      .attach('invoice.pdf', pdfBuffer, 'application/pdf');
 });
 ```
@@ -1306,25 +1306,25 @@ AeroJS ships with a powerful, zero-dependency fluent HTTP client built on native
 import { Http } from '@shohaghinfo/aerojs';
 
 // 1. Fluent API calls
-const response = await Http.baseUrl('https://api.hospital-network.com/v1')
+const response = await Http.baseUrl('https://api.example.com/v1')
   .withToken(process.env.API_KEY!)
   .withQuery({ status: 'active', limit: 50 })
   .timeout(5000)
   .retry(3, 200)
-  .get('/patients');
+  .get('/users');
 
 if (response.successful) {
-  const patients = response.json();
-  console.log('Patients fetched:', patients);
+  const users = response.json();
+  console.log('Users fetched:', users);
 }
 
 // 2. Testing Fakes (Mocking external services)
 Http.fake({
-  '/patients': [{ id: 1, name: 'Alice Smith' }],
+  '/users': [{ id: 1, name: 'Alice Smith' }],
   '/billing': Http.response({ invoiceId: 'INV-101' }, 201),
 });
 
-const res = await Http.post('https://api.hospital-network.com/v1/billing', { amount: 500 });
+const res = await Http.post('https://api.example.com/v1/billing', { amount: 500 });
 expect(res.status).toBe(201);
 
 Http.assertSent((req) => req.url.includes('/billing') && req.method === 'POST');
@@ -1439,6 +1439,146 @@ if (!ctx.hasValidSignature()) {
 
 ---
 
+### 38. Field-Level Database Encryption (`@encrypted()` & `Crypt`)
+
+Ensure HIPAA, GDPR, and PCI-DSS compliance by transparently encrypting sensitive database columns at rest using authenticated **AES-256-GCM** encryption:
+
+```typescript
+import { Model, encrypted, Crypt } from '@shohaghinfo/aerojs';
+
+class AccountRecord extends Model {
+  public static override table = 'accounts';
+  public static override fillable = ['name', 'ssn', 'private_notes'];
+  public static override encrypted = ['ssn', 'private_notes'];
+
+  @encrypted()
+  public ssn!: string;
+}
+
+// 1. Create - Data is stored as aero:enc:<iv>:<tag>:<ciphertext> in the database
+const account = await AccountRecord.create({
+  name: 'Rahim Khan',
+  ssn: '019-99-8888',
+  private_notes: 'Confidential client information',
+});
+
+// 2. Read - Transparently decrypted on fetch
+const loaded = await AccountRecord.find(account.id);
+console.log(loaded.ssn); // '019-99-8888' (Plaintext in app code)
+
+// 3. Arbitrary payload encryption via Crypt facade:
+const cipher = Crypt.encrypt({ account: '123456', balance: 5000 });
+const data = Crypt.decrypt(cipher);
+```
+
+---
+
+### 39. Database Read Replicas & Master-Slave Routing
+
+Route all high-volume read traffic to replica pools with round-robin load distribution while ensuring writes and transactions hit the primary master:
+
+```typescript
+import { Database, DB } from '@shohaghinfo/aerojs';
+
+// Configure replication pool
+Database.configureReplication({
+  write: 'primary_master',
+  read: ['replica_east_1', 'replica_east_2', 'replica_west_1'],
+});
+
+// 1. Automatically queries a read replica (round-robin balanced)
+const users = await DB.table('users').where('active', true).get();
+
+// 2. Force reading from the master node for read-your-own-writes consistency
+const freshUser = await DB.table('users').useWriteConnection().where('id', 1).first();
+
+// 3. Direct write queries always execute on the primary write database
+await DB.table('users').where('id', 1).update({ status: 'verified' });
+```
+
+---
+
+### 40. Interactive Queue Horizon Dashboard (`app.useQueueDashboard`)
+
+A built-in, dark-mode developer control panel for real-time background task monitoring and failure recovery:
+
+```typescript
+import { Aero } from '@shohaghinfo/aerojs';
+
+const app = new Aero();
+
+// Mount the dashboard with optional role-based protection
+app.useQueueDashboard('/__aero/queue', {
+  title: 'AeroJS Queue Horizon',
+  pollInterval: 3, // auto-refresh every 3s
+  auth: (ctx) => ctx.session?.get('user')?.role === 'superadmin',
+});
+```
+
+- **Live GUI (`GET /__aero/queue`)**: Glassmorphic dark UI with live throughput KPI cards, queues status, and dead letter queue inspector.
+- **REST APIs**:
+  - `GET /__aero/queue/api/metrics` — JSON statistics
+  - `GET /__aero/queue/api/failed` — List dead-letter failed jobs with full stack traces
+  - `POST /__aero/queue/api/retry/:id` — Retry single failed task
+  - `DELETE /__aero/queue/api/failed/:id` — Delete failed task
+  - `POST /__aero/queue/api/retry-all` — Batch retry all failed jobs
+  - `DELETE /__aero/queue/api/purge-all` — Purge dead letter queue
+
+---
+
+### 41. Encrypted Stateless Cookie Session Driver (`CookieSessionDriver`)
+
+Store session state entirely on the client within an encrypted, authenticated, and tamper-proof HTTP-only cookie using AES-256-GCM. Ideal for serverless, Edge, and horizontal autoscaling:
+
+```typescript
+import { Aero, sessionPlugin, CookieSessionDriver } from '@shohaghinfo/aerojs';
+
+const app = new Aero();
+
+app.use(sessionPlugin({
+  driver: new CookieSessionDriver(),
+  cookieName: 'aero_session',
+  lifetime: 8 * 3600, // 8-hour shift
+  cookie: { httpOnly: true, secure: true, sameSite: 'lax' },
+}));
+
+app.post('/login', async (ctx) => {
+  await ctx.session.put('user', { id: 1, role: 'physician' });
+  ctx.json({ loggedIn: true });
+});
+```
+
+---
+
+### 42. Client Request Fingerprinting & Anti-Hijacking Guard
+
+Prevent stolen session cookies and session fixation attacks by fingerprinting client browser characteristics (User-Agent, client IP, accept headers):
+
+```typescript
+import { Aero, sessionPlugin, fingerprintGuard, RequestFingerprint } from '@shohaghinfo/aerojs';
+
+const app = new Aero();
+app.use(sessionPlugin());
+
+// Automatically binds and verifies client fingerprint on every session request
+app.use(fingerprintGuard({
+  ip: true,
+  userAgent: true,
+  acceptLanguage: true,
+  onMismatch: (ctx) => {
+    ctx.status(401).json({ error: 'Session hijacked from an unauthorized device' });
+  },
+}));
+
+// Or generate manually for audit logs:
+app.get('/audit', (ctx) => {
+  const fp = RequestFingerprint.generate(ctx);
+  ctx.json({ fingerprint: fp });
+});
+```
+
+---
+
 ## 📊 Comparison Matrix
 
 | Feature | Express | Koa | Fastify | AdonisJS | **AeroJS** |

package/dist/audit/audit-trail.d.ts

@@ -2,12 +2,11 @@
  * @file audit-trail.ts
  * @description Immutable Audit Trail System for AeroJS.
  *
- * Hospital Architecture Section 38:
- * "হাসপাতালের কোনো মেডিকেল ও ফিন্যান্সিয়াল ডাটা ডাটাবেস থেকে কখনো DELETE করা যাবে না।
- * ভুল এন্ট্রি হলে তা STATUS = VOID বা CANCELLED হবে এবং রিভার্সাল এন্ট্রি পড়বে।"
+ * Provides tamper-evident compliance tracking for sensitive database entities.
+ * Ensures auditable state history without destructive data loss.
  *
  * Stores: User ID, Table/Module, Record ID, Action, Old Value, New Value,
- *         IP Address, Timestamp, Cancellation Reason.
+ *         IP Address, Timestamp, Reason.
  */
 export type AuditAction = 'CREATE' | 'UPDATE' | 'VOID' | 'APPROVE' | 'REJECT' | 'PRINT' | 'LOGIN' | 'LOGOUT' | 'LOCK' | 'RESTORE' | 'EXPORT';
 export interface AuditLogEntry {
@@ -80,12 +79,12 @@ export declare class AuditTrailManager {
     log(entry: AuditLogEntry): Promise<void>;
     /**
      * Get full history of changes for a specific record.
-     * Hospital use: "Who changed this invoice? Show all modifications."
+     * Example: "Who modified this transaction? Show all changes."
      */
     getHistory(tableName: string, recordId: string | number): Promise<AuditLogRecord[]>;
     /**
      * Get all activity by a specific user in a time range.
-     * Hospital use: "What did cashier #42 do during the night shift?"
+     * Example: "Show all actions performed by user #42 today."
      */
     getUserActivity(userId: string | number, from?: Date, to?: Date): Promise<AuditLogRecord[]>;
 }

package/dist/audit/audit-trail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-trail.d.ts","sourceRoot":"","sources":["../../src/audit/audit-trail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,SAAS,GACT,QAAQ,GACR,OAAO,GACP,OAAO,GACP,QAAQ,GACR,MAAM,GACN,SAAS,GACT,QAAQ,CAAC;AAEb,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;CACjB;AAID,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACpF,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CAC7F;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,KAAK,CAAS;gBAEV,KAAK,SAAe;IAInB,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAQnF,eAAe,CAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,IAAI,CAAC,EAAE,IAAI,EACX,EAAE,CAAC,EAAE,IAAI,GACR,OAAO,CAAC,cAAc,EAAE,CAAC;CAM7B;AAED;;GAEG;AACH,qBAAa,iBAAkB,YAAW,WAAW;IAC5C,IAAI,EAAE,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,EAAE,CAAM;IACtE,OAAO,CAAC,OAAO,CAAK;IAEP,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAKrD;AAID,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAwC;IAE/C,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAK3C;;;;;;;;;;;;;;;OAeG;IACU,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IASrD;;;OAGG;IACU,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAIhG;;;OAGG;IACU,eAAe,CAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,IAAI,CAAC,EAAE,IAAI,EACX,EAAE,CAAC,EAAE,IAAI,GACR,OAAO,CAAC,cAAc,EAAE,CAAC;CAG7B;AAED,eAAO,MAAM,UAAU,mBAA0B,CAAC;AAIlD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,yBAAyB,qDAAqD,CAAC"}
+{"version":3,"file":"audit-trail.d.ts","sourceRoot":"","sources":["../../src/audit/audit-trail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,SAAS,GACT,QAAQ,GACR,OAAO,GACP,OAAO,GACP,QAAQ,GACR,MAAM,GACN,SAAS,GACT,QAAQ,CAAC;AAEb,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;CACjB;AAID,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACpF,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CAC7F;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,KAAK,CAAS;gBAEV,KAAK,SAAe;IAInB,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAQnF,eAAe,CAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,IAAI,CAAC,EAAE,IAAI,EACX,EAAE,CAAC,EAAE,IAAI,GACR,OAAO,CAAC,cAAc,EAAE,CAAC;CAM7B;AAED;;GAEG;AACH,qBAAa,iBAAkB,YAAW,WAAW;IAC5C,IAAI,EAAE,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,EAAE,CAAM;IACtE,OAAO,CAAC,OAAO,CAAK;IAEP,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAKrD;AAID,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAwC;IAE/C,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAK3C;;;;;;;;;;;;;;;OAeG;IACU,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IASrD;;;OAGG;IACU,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAIhG;;;OAGG;IACU,eAAe,CAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,IAAI,CAAC,EAAE,IAAI,EACX,EAAE,CAAC,EAAE,IAAI,GACR,OAAO,CAAC,cAAc,EAAE,CAAC;CAG7B;AAED,eAAO,MAAM,UAAU,mBAA0B,CAAC;AAIlD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,yBAAyB,qDAAqD,CAAC"}

package/dist/audit/audit-trail.js

@@ -2,12 +2,11 @@
  * @file audit-trail.ts
  * @description Immutable Audit Trail System for AeroJS.
  *
- * Hospital Architecture Section 38:
- * "হাসপাতালের কোনো মেডিকেল ও ফিন্যান্সিয়াল ডাটা ডাটাবেস থেকে কখনো DELETE করা যাবে না।
- * ভুল এন্ট্রি হলে তা STATUS = VOID বা CANCELLED হবে এবং রিভার্সাল এন্ট্রি পড়বে।"
+ * Provides tamper-evident compliance tracking for sensitive database entities.
+ * Ensures auditable state history without destructive data loss.
  *
  * Stores: User ID, Table/Module, Record ID, Action, Old Value, New Value,
- *         IP Address, Timestamp, Cancellation Reason.
+ *         IP Address, Timestamp, Reason.
  */
 import { DB } from '../database/connection.js';
 /**
@@ -107,14 +106,14 @@ export class AuditTrailManager {
     }
     /**
      * Get full history of changes for a specific record.
-     * Hospital use: "Who changed this invoice? Show all modifications."
+     * Example: "Who modified this transaction? Show all changes."
      */
     async getHistory(tableName, recordId) {
         return await this.driver.getHistory(tableName, recordId);
     }
     /**
      * Get all activity by a specific user in a time range.
-     * Hospital use: "What did cashier #42 do during the night shift?"
+     * Example: "Show all actions performed by user #42 today."
      */
     async getUserActivity(userId, from, to) {
         return await this.driver.getUserActivity(userId, from, to);

package/dist/audit/audit-trail.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-trail.js","sourceRoot":"","sources":["../../src/audit/audit-trail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AA8C/C;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IACtB,KAAK,CAAS;IAEtB,YAAY,KAAK,GAAG,YAAY;QAC9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,KAAoB;QACnC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACjE,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACjE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YAChE,UAAU,EAAE,IAAI,IAAI,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,QAAyB;QAClE,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC9B,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC;aAC9B,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;aACpC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC;aAC7B,GAAG,EAAsB,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,eAAe,CAC1B,MAAuB,EACvB,IAAW,EACX,EAAS;QAET,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,IAAI;YAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,EAAE;YAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,GAAG,EAAsB,CAAC;IAC1E,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACrB,IAAI,GAAwD,EAAE,CAAC;IAC9D,OAAO,GAAG,CAAC,CAAC;IAEb,KAAK,CAAC,GAAG,CAAC,KAAoB;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,QAAyB;QAClE,OAAO,IAAI,CAAC,IAAI;aACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;aACnF,OAAO,EAAsB,CAAC;IACnC,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,MAAuB;QAClD,OAAO,IAAI,CAAC,IAAI;aACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;aAClD,OAAO,EAAsB,CAAC;IACnC,CAAC;CACF;AAED,iFAAiF;AAEjF,MAAM,OAAO,iBAAiB;IACpB,MAAM,GAAgB,IAAI,iBAAiB,EAAE,CAAC;IAE/C,SAAS,CAAC,MAAmB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,GAAG,CAAC,KAAoB;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oDAAoD;YACpD,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,QAAyB;QAClE,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAC1B,MAAuB,EACvB,IAAW,EACX,EAAS;QAET,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAElD,iFAAiF;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kDAAkD,CAAC"}
+{"version":3,"file":"audit-trail.js","sourceRoot":"","sources":["../../src/audit/audit-trail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AA8C/C;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IACtB,KAAK,CAAS;IAEtB,YAAY,KAAK,GAAG,YAAY;QAC9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,KAAoB;QACnC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACjE,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACjE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YAChE,UAAU,EAAE,IAAI,IAAI,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,QAAyB;QAClE,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC9B,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC;aAC9B,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;aACpC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC;aAC7B,GAAG,EAAsB,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,eAAe,CAC1B,MAAuB,EACvB,IAAW,EACX,EAAS;QAET,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,IAAI;YAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,EAAE;YAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,GAAG,EAAsB,CAAC;IAC1E,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACrB,IAAI,GAAwD,EAAE,CAAC;IAC9D,OAAO,GAAG,CAAC,CAAC;IAEb,KAAK,CAAC,GAAG,CAAC,KAAoB;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,QAAyB;QAClE,OAAO,IAAI,CAAC,IAAI;aACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;aACnF,OAAO,EAAsB,CAAC;IACnC,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,MAAuB;QAClD,OAAO,IAAI,CAAC,IAAI;aACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;aAClD,OAAO,EAAsB,CAAC;IACnC,CAAC;CACF;AAED,iFAAiF;AAEjF,MAAM,OAAO,iBAAiB;IACpB,MAAM,GAAgB,IAAI,iBAAiB,EAAE,CAAC;IAE/C,SAAS,CAAC,MAAmB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,GAAG,CAAC,KAAoB;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oDAAoD;YACpD,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,QAAyB;QAClE,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAC1B,MAAuB,EACvB,IAAW,EACX,EAAS;QAET,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAElD,iFAAiF;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kDAAkD,CAAC"}

package/dist/auth/auth-manager.d.ts

@@ -2,7 +2,7 @@
  * @file auth-manager.ts
  * @description Central Auth Manager for AeroJS.
  * Manages multiple named guards (session, jwt, api) and exposes ctx.auth.use('guard').
- * Hospital use: ctx.auth.use('session') for cashiers, ctx.auth.use('jwt') for doctors.
+ * Example: ctx.auth.use('session') for web dashboard, ctx.auth.use('jwt') for mobile API.
  */
 import type { AeroContext } from '../core/context.js';
 import type { AuthUser } from './guards/guard.js';
@@ -47,10 +47,10 @@ export declare class Auth {
      * Guards are lazily instantiated per request.
      *
      * @example
-     * // Cashier session auth
+     * // Web session auth
      * await ctx.auth.use('session').authenticate();
      *
-     * // Doctor JWT auth
+     * // Mobile / API JWT auth
      * const user = await ctx.auth.use('jwt').authenticate();
      */
     use(name?: string): any;
@@ -88,8 +88,8 @@ export declare function authPlugin(manager: AuthManager, sessionManager?: Sessio
  * Throws UnauthorizedError if not authenticated.
  *
  * @example
- * router.get('/cashier/dashboard', handler).middleware(auth('session'));
- * router.get('/api/doctor/patients', handler).middleware(auth('jwt'));
+ * router.get('/dashboard', handler).middleware(auth('session'));
+ * router.get('/api/users', handler).middleware(auth('jwt'));
  */
 export declare function auth(guardName?: string): Middleware;
 //# sourceMappingURL=auth-manager.d.ts.map

package/dist/auth/auth-manager.js

@@ -2,7 +2,7 @@
  * @file auth-manager.ts
  * @description Central Auth Manager for AeroJS.
  * Manages multiple named guards (session, jwt, api) and exposes ctx.auth.use('guard').
- * Hospital use: ctx.auth.use('session') for cashiers, ctx.auth.use('jwt') for doctors.
+ * Example: ctx.auth.use('session') for web dashboard, ctx.auth.use('jwt') for mobile API.
  */
 import { SessionGuard } from './guards/session-guard.js';
 import { JwtGuard } from './guards/jwt-guard.js';
@@ -28,10 +28,10 @@ export class Auth {
      * Guards are lazily instantiated per request.
      *
      * @example
-     * // Cashier session auth
+     * // Web session auth
      * await ctx.auth.use('session').authenticate();
      *
-     * // Doctor JWT auth
+     * // Mobile / API JWT auth
      * const user = await ctx.auth.use('jwt').authenticate();
      */
     use(name) {
@@ -115,8 +115,8 @@ export function authPlugin(manager, sessionManager) {
  * Throws UnauthorizedError if not authenticated.
  *
  * @example
- * router.get('/cashier/dashboard', handler).middleware(auth('session'));
- * router.get('/api/doctor/patients', handler).middleware(auth('jwt'));
+ * router.get('/dashboard', handler).middleware(auth('session'));
+ * router.get('/api/users', handler).middleware(auth('jwt'));
  */
 export function auth(guardName) {
     return async (ctx, next) => {

package/dist/auth/bouncer.d.ts

@@ -8,10 +8,10 @@
  * - Policy-based authorization: ctx.bouncer.authorize(DiscountPolicy, 'approve', discount)
  * - Data-scoped checks: enforcing branch-level data isolation
  *
- * Hospital use:
- *   - Section 22: Discount approval matrix (cashier 0%, supervisor 5%, MS 15%, CEO any)
- *   - Section 37: Maker-Checker dual control for refunds, POs, supplier payments
- *   - Section 25: Branch-scoped data access (operator sees only own branch)
+ * Enterprise use:
+ *   - Role-based authorization matrix
+ *   - Maker-Checker dual control for approvals and transactions
+ *   - Branch-scoped or organization-scoped data access
  */
 import type { AuthUser } from '../auth/guards/guard.js';
 import type { Middleware } from '../core/types.js';
@@ -22,7 +22,7 @@ export type PolicyConstructor = new () => PolicyContract;
 export interface PermissionStore {
     /**
      * Returns all roles for a given user ID.
-     * Example: ['cashier', 'ipd_operator']
+     * Example: ['member', 'editor', 'admin']
      */
     getRoles(userId: string | number): Promise<string[]>;
     /**
@@ -72,13 +72,7 @@ export declare class Bouncer {
      */
     cannot(permission: string): Promise<boolean>;
     /**
-     * Hospital-specific: Check discount approval authority.
-     *
-     * Rules (Section 22):
-     *   cashier     → 0%
-     *   supervisor  → up to 5%
-     *   ms          → up to 15%
-     *   director/ceo → unlimited
+     * Enterprise approval check: Check approval authority threshold based on role.
      *
      * @example
      * if (!await ctx.bouncer.canApproveDiscount(12.5)) {
@@ -87,11 +81,10 @@ export declare class Bouncer {
      */
     canApproveDiscount(percent: number): Promise<boolean>;
     /**
-     * Hospital-specific: Check if user belongs to a specific branch.
-     * Enforces Section 25 — branch data scoping.
+     * Enterprise data scoping: Check if user belongs to a specific organizational branch or tenant.
      *
      * @example
-     * await ctx.bouncer.assertBranch(patient.branchId);
+     * await ctx.bouncer.assertBranch(resource.branchId);
      */
     assertBranch(resourceBranchId: string | number): Promise<void>;
     /**

package/dist/auth/bouncer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bouncer.d.ts","sourceRoot":"","sources":["../../src/auth/bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,MAAM,WAAW,cAAc;IAC7B,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAClF;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,cAAc,CAAC;AAIzD,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErD;;;OAGG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5D;AAID,qBAAa,OAAO;IAClB,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,YAAY,CAAyB;IAC7C,OAAO,CAAC,KAAK,CAAC,CAAkB;IAChC,OAAO,CAAC,QAAQ,CAAqC;gBAEzC,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,KAAK,CAAC,EAAE,eAAe;IAK1D;;OAEG;YACW,SAAS;IAUvB;;OAEG;YACW,eAAe;IAU7B;;;;;OAKG;IACU,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM/C;;;;;OAKG;IACU,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAMrD;;;;;OAKG;IACU,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtD;;OAEG;IACU,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIzD;;;;;;;;;;;;;OAaG;IACU,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlE;;;;;;OAMG;IACU,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3E;;;;;;;OAOG;IACU,SAAS,CACpB,WAAW,EAAE,iBAAiB,EAC9B,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,GAAG,EAAE,GACb,OAAO,CAAC,IAAI,CAAC;IAqBhB;;OAEG;IACU,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlD;;OAEG;IACU,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAK1D;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAC,CAAkB;IAEzB,SAAS,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAKvC,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO;CAG/C;AAED,eAAO,MAAM,cAAc,gBAAuB,CAAC;AAEnD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,UAAU,CAOjE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,CAS1D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAOhE"}
+{"version":3,"file":"bouncer.d.ts","sourceRoot":"","sources":["../../src/auth/bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,MAAM,WAAW,cAAc;IAC7B,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAClF;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,cAAc,CAAC;AAIzD,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErD;;;OAGG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5D;AAID,qBAAa,OAAO;IAClB,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,YAAY,CAAyB;IAC7C,OAAO,CAAC,KAAK,CAAC,CAAkB;IAChC,OAAO,CAAC,QAAQ,CAAqC;gBAEzC,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,KAAK,CAAC,EAAE,eAAe;IAK1D;;OAEG;YACW,SAAS;IAUvB;;OAEG;YACW,eAAe;IAU7B;;;;;OAKG;IACU,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM/C;;;;;OAKG;IACU,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAMrD;;;;;OAKG;IACU,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtD;;OAEG;IACU,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIzD;;;;;;;OAOG;IACU,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlE;;;;;OAKG;IACU,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3E;;;;;;;OAOG;IACU,SAAS,CACpB,WAAW,EAAE,iBAAiB,EAC9B,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,GAAG,EAAE,GACb,OAAO,CAAC,IAAI,CAAC;IAqBhB;;OAEG;IACU,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlD;;OAEG;IACU,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAK1D;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAC,CAAkB;IAEzB,SAAS,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAKvC,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO;CAG/C;AAED,eAAO,MAAM,cAAc,gBAAuB,CAAC;AAEnD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,UAAU,CAOjE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,CAS1D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAOhE"}